Quick answer

Online lenders may collect a valid debt, but they may not threaten, insult, deceive, publicly shame, or misuse your personal data. Accessing or harvesting your phone contacts for debt collection or harassment is prohibited. So is contacting people from your contact list other than named guarantors or co-makers, even if you previously allowed the app to access your contacts.

Report the conduct through the channel that matches the violation:

Problem	Where to report
Harassment or unfair collection by a lending or financing company	Securities and Exchange Commission (SEC)
Contact harvesting, doxxing, unauthorized disclosure, or other misuse of personal data	National Privacy Commission (NPC)
Loan offered by a bank, digital bank, e-wallet provider, or another BSP-supervised institution	Provider first, then Bangko Sentral ng Pilipinas (BSP)
Threats of violence, extortion, impersonation, fake documents, account hacking, or immediate danger	Police, PNP Anti-Cybercrime Group, NBI Cybercrime Division, or CICC

One incident may properly be reported to more than one agency because each has a different mandate. Disclose related cases when a complaint form requires it.

Reporting harassment does not automatically cancel a valid loan, erase the balance, or prevent lawful collection or a civil case. It requires the creditor to collect through lawful and respectful means.

What collection practices are prohibited?

Under SEC Memorandum Circular No. 18, Series of 2019, SEC-regulated lending companies, financing companies, and their collection providers must act in good faith and use only reasonable, legally permissible collection methods.

Prohibited conduct includes:

Using or threatening violence or other criminal means against a person, reputation, or property.
Threatening action that cannot legally be taken.
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense.
Publishing or disclosing the names or other personal information of borrowers allegedly refusing to pay, except where disclosure is legally permitted.
Giving—or threatening to give—false loan information to another person, including failing to say that a debt is disputed.
Using false representations or deceptive means to collect or obtain information about a borrower.
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., subject to an important exception: the circular allows such contact when the account has been past due for more than 15 days or when the borrower has expressly agreed, through written, electronic, or recorded means, that those hours are the only reasonable or convenient time for contact.
Contacting people in the borrower’s phone contact list who were not named as guarantors or co-makers. The circular treats this as unfair collection notwithstanding the borrower’s consent.

The hours exception does not permit threats, insults, deception, public shaming, or privacy violations.

A lender may make disclosures for legitimate purposes recognized by law, such as disclosures authorized by the borrower, required by a court or authorized government agency, or necessary for properly engaged collection agencies, counsel, credit-information entities, or service providers. These exceptions do not authorize mass messaging, social-media shaming, or unnecessary disclosure to relatives, coworkers, employers, and unrelated contacts.

When does collection become a privacy violation?

The Data Privacy Act of 2012 requires personal-data processing to be transparent, for a legitimate purpose, and proportionate to that purpose.

More specifically, NPC Circular No. 2020-01 provides that online lending apps must not require unnecessary permissions. It expressly prohibits:

Accessing contact lists or email lists for debt collection or harassment.
Harvesting social-media contacts.
Copying or saving contacts for those purposes.
Using a borrower’s photograph to harass or embarrass the borrower.

An app may request camera or gallery access when genuinely necessary for identity verification or fraud prevention. Once that purpose is completed, it should disable the permission by default or prompt the borrower to disable it. Character references or co-makers should be entered through a separate interface rather than taken from the borrower’s entire contact list.

These privacy requirements apply even to a person or entity acting as a lender without the required SEC authority. Being unregistered does not place an operator outside NPC jurisdiction.

Clicking “Allow” when installing an app is not a blanket license to harvest contacts, shame a borrower, or disclose loan details indiscriminately. Consent must also be valid, informed, specific, and connected to a legitimate purpose; some practices are expressly prohibited notwithstanding consent.

The lender remains responsible for its collectors

A lender cannot avoid responsibility merely by saying that an outside collection agency, call center, lawyer, or individual collector sent the messages.

SEC Memorandum Circular No. 18 makes the financing or lending company ultimately responsible for collection practices performed by its third-party service providers. The Financial Products and Services Consumer Protection Act also prohibits abusive collection and makes a regulated financial service provider responsible for its representatives, with solidary liability for qualifying third-party service providers.

Include both the collector’s identity and the principal lender in your complaint whenever they can be identified.

What to do immediately

1. Protect yourself

If there is a credible threat of physical harm, an attempt to locate you, or someone is already at your home or workplace acting violently, call 911 or seek help from the nearest police station. Tell trusted household members or workplace security about the threat.

Do not meet a threatening collector alone.

2. Preserve the evidence before blocking or uninstalling

Save:

Full screenshots showing the message, sender, date, and time.
The complete conversation, not only the most offensive line.
Text messages, emails, social-media posts, voicemails, and call logs.
URLs and screenshots of public posts before requesting their removal.
The app’s store page, developer name, privacy notice, permissions, and version.
The loan agreement, disclosure statement, promissory note, payment schedule, statement of account, receipts, and proof of disbursement.
Payment instructions, account names, wallet numbers, QR codes, and receipts.
Messages sent to relatives, coworkers, employers, or other contacts.
Written statements from contacted persons describing what was disclosed.
Earlier complaints to the lender and the lender’s replies.
Any fake summons, warrant, police notice, demand letter, or purported court document.

Back up the evidence in at least two secure locations. Keep original files when possible; forwarding or repeatedly editing them may remove useful metadata.

Do not secretly record a private telephone or in-person conversation without obtaining legal advice and the other participants’ authorization. The Supreme Court has held that even a participant may violate the Anti-Wiretapping Act by secretly recording a private conversation without authorization from all parties. See Ramirez v. Court of Appeals and Republic Act No. 4200. Instead, preserve voicemails and make a contemporaneous written note of the date, time, number, collector’s name, and words used.

3. Secure your phone and accounts

After preserving evidence:

Revoke the app’s access to contacts, camera, microphone, photos, files, and location unless an access permission remains genuinely necessary.
Change passwords for your email, social media, mobile wallet, and other accounts if compromise is possible.
Turn on multifactor authentication.
Review active sessions and log out unfamiliar devices.
Warn contacts not to open links, send money, disclose OTPs, or respond to anyone claiming to collect on your behalf.
Uninstall the app only after saving necessary documents and confirming how you can access your account and make legitimate payments through an official channel.

Revoking a phone permission will not necessarily delete information already copied to the lender’s servers. Address that separately in your written privacy request.

4. Identify the legal company behind the app

The app’s brand name may differ from the lender’s corporate name. Check:

The loan contract and disclosure statement.
The privacy notice and terms of service.
The app-store developer details.
Disbursement and payment receipts.
Collection messages and demand letters.
The name of the recipient of earlier payments.

Ask the SEC to confirm the company’s authority if its status is unclear. Do not assume that an app is legitimate merely because it appears in an app store or uses a familiar payment service.

Send a written complaint to the lender first

Send the lender’s customer-assistance unit and data protection officer a dated written complaint through a verifiable channel. Preserve proof of delivery.

State:

Your name and loan or account reference, using only information necessary to identify the account.
The app, lender, and collection agency involved.
A chronological account of what happened.
The phone numbers, accounts, or collector names involved.
Which contacts received messages and what information was disclosed.
The conduct you want stopped.
Whether you dispute the amount, fees, payment posting, or identity of the creditor.
Your request for the identity and authority of the collection provider.
Your request for the lawful basis, source, purpose, recipients, and retention period for your personal data.
Your request to stop unauthorized processing and securely delete unlawfully harvested data.
Your request to preserve relevant collection logs, access records, call records, messages, and data-sharing records for the investigation.
A request for a written response.

A request to erase data is not absolute. A lender may retain information that it must keep under law or that remains necessary for a legitimate, properly documented purpose. It should not retain or use unlawfully harvested contacts or keep data indefinitely for an unspecified future use.

This written notice is particularly important for an NPC complaint. Under the 2021 NPC Rules, a complainant generally must first give the respondent an opportunity to address the privacy violation.

How to report the lender to the SEC

For lending and financing companies and their online lending platforms, file through the SEC iMessage portal. The SEC’s current iMessage user guide, listing services as of February 5, 2026, identifies iMessage as the SEC’s official ticketing platform and says it replaces informal complaint channels such as ordinary email and Google Forms.

The general process is:

Register or sign in through eSECURE.
Open a new iMessage ticket.
Select Financing and Lending Companies Department.
Choose Complaints on Financing and Lending Companies under the Legal and Enforcement Division.
Identify the lender’s corporate name and the app.
Describe each incident chronologically.
Upload your supporting documents and identification as required.
Save the ticket number and monitor the portal for requests or replies.

If several companies are involved, distinguish the acts attributed to each. Do not publish your identification document, loan details, or evidence in a public social-media comment.

The SEC can investigate regulatory violations and impose appropriate sanctions. It does not automatically rewrite your contract, settle the account, or cancel a valid obligation simply because harassment occurred.

Under SEC Memorandum Circular No. 18, the stated administrative penalties are:

Violation level	Lending company	Financing company
First offense	₱25,000	₱50,000
Second offense	₱50,000	₱100,000
Third offense	Depending on the facts and gravity: a fine of at least twice the second-offense fine but not more than ₱1 million, a 60-day suspension of lending or financing activities, or revocation of the certificate of authority	Same range of possible sanctions

Other sanctions under later or additional laws may also apply. The penalty imposed in a particular case depends on the evidence, the regulated entity involved, and the SEC’s findings; it is not automatically paid to the complainant as compensation.

How to file a privacy complaint with the NPC

Under the 2021 NPC Rules of Procedure, a privacy complaint ordinarily requires proof that:

You informed the lender, collector, personal-information controller, processor, or other concerned entity in writing; and
It failed to take timely or appropriate action, or did not respond within 15 calendar days after receiving your notice.

The NPC may waive these requirements for good cause or a serious violation, including circumstances involving grave and irreparable harm, the absence of a plain and adequate remedy, or patently illegal conduct. Explain and prove why a waiver is necessary instead of simply omitting the prior written notice.

Use the NPC’s complaint-assisted form and filing guidance. A formal filing generally consists of a completed and notarized complaint-assisted form or a verified complaint, together with:

A clear statement of facts and the relief requested.
Copies of supporting documents.
Witness affidavits, if any.
Your correspondence with the respondent and proof of receipt.
The respondent’s reply, if any.
A certification against forum shopping.
Information identifying the respondent or, if its identity is unknown, facts that may lead to its identification.

Complaints may be filed personally, by registered mail, by courier, or by electronic mail when authorized by the NPC. Electronic documents should be digitally signed and in PDF format when practicable. Confirm the currently authorized address or email through the NPC contact directory before sending. The NPC’s listed office is at the 25th–27th Floors, The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Quezon City.

The rules require payment of the applicable filing fee unless the complainant qualifies as indigent, the NPC grants a waiver for good cause, or another stated exemption applies. Ask the NPC to confirm the current amount and payment instructions.

If the unlawful processing is ongoing and creates grave or irreparable harm, obtain legal advice about requesting a temporary ban on processing. Such relief has additional procedural and bond requirements.

If the lender is regulated by the BSP

Some digital loans are offered by banks, digital banks, e-money issuers, or other BSP-supervised institutions rather than SEC-regulated lending companies.

First submit the complaint through the provider’s Financial Consumer Protection Assistance Mechanism or official customer-service channel. If the response is unsatisfactory or the provider does not act within a reasonable period, elevate the matter through the BSP Consumer Assistance Mechanism.

The BSP currently directs consumers to its BOB chatbot on the BSP website or official Facebook page. If BOB is inaccessible, the BSP’s current complaint guidance provides for submitting its Complaint/Inquiry/Reply form with proof that the complaint was first raised with the institution.

The BSP does not handle complaints against ordinary lending and financing companies merely because they transfer funds through a bank or e-wallet. Those complaints generally belong with the SEC.

When to involve law enforcement

Contact law enforcement promptly if the conduct includes:

A credible threat of physical injury, kidnapping, property damage, or violence.
Extortion or a demand for payment to prevent publication of private material.
Hacking, account takeover, SIM-related fraud, or identity theft.
Impersonation of police officers, judges, court staff, lawyers, or government agencies.
Fabricated warrants, summonses, or criminal charges.
Posting altered, sexualized, or degrading images.
Persistent stalking or attempts to locate you or your family.
Unauthorized financial transactions.

Possible criminal liability depends on the exact words, conduct, evidence, intent, and persons involved. Do not label the incident as a particular crime unless advised; give investigators the complete facts.

You may approach:

The nearest police station or PNP Anti-Cybercrime Group.
The NBI online complaint service or NBI Cybercrime Division.
The Cybercrime Investigation and Coordinating Center.

A threat of immediate arrest for the mere failure to pay an ordinary debt is misleading. Article III, Section 20 of the 1987 Constitution prohibits imprisonment for debt. This does not shield separate criminal conduct such as fraud or a violation involving a check, when the legal elements are actually present. Verify any purported case directly with the named court or agency and do not ignore genuine legal papers.

Common mistakes that weaken a complaint

Deleting the app or messages before preserving evidence.
Reporting only the app’s marketing name and omitting the corporate lender.
Submitting cropped screenshots that hide the sender, date, or surrounding conversation.
Making only a telephone complaint and keeping no proof.
Filing an NPC complaint without first sending written notice or explaining why the requirement should be waived.
Omitting the certification against forum shopping or failing to disclose related proceedings.
Secretly recording private calls without considering the Anti-Wiretapping Act.
Posting your identification, loan documents, or screenshots containing other people’s data publicly.
Retaliating by publishing the collector’s private information.
Paying a collector’s personal account without verifying written authority and an official payment channel.
Assuming that harassment automatically voids the debt.
Ignoring a real summons because earlier collectors sent fake ones.

Frequently asked questions

Can a lender contact my relatives, friends, or coworkers?

It may contact a person properly named as a guarantor or co-maker, and limited processing may be permissible for a voluntarily supplied character reference. It may not harvest and contact the rest of your phone list. Even when contact is otherwise lawful, the lender may not threaten, shame, lie, or disclose more loan information than the lawful purpose requires.

What if I clicked “Allow contacts” when installing the app?

That does not authorize contact harvesting for collection or harassment. NPC Circular No. 2020-01 prohibits accessing, copying, or saving contact lists for those purposes, while SEC Memorandum Circular No. 18 prohibits contacting listed persons other than named guarantors or co-makers notwithstanding borrower consent.

Can I complain even if the loan is overdue?

Yes. Delinquency permits lawful collection, not threats, insults, deception, public shaming, or unauthorized data processing.

Can someone who is not the borrower complain?

Yes, if that person’s own contact information or other personal data was unlawfully obtained, used, or disclosed. The contacted person should preserve the message, notify the lender in writing, and may pursue an NPC complaint as the affected data subject. Their evidence can also support the borrower’s SEC complaint.

What if the app or lender is unregistered?

Report it to the SEC and preserve the app-store page, payment accounts, websites, numbers, and all corporate names used. The NPC’s loan-processing rules apply to entities acting as lenders even without SEC authority. Do not assume, without legal review of the documents, that lack of registration automatically cancels every obligation.

Will the NPC order the lender to delete everything?

Not necessarily. The NPC may address unlawful processing, but a lender may retain data required by law or genuinely necessary for a continuing lawful purpose. Focus the request on unlawfully harvested contacts, excessive permissions, improper disclosures, inaccurate data, and information no longer supported by a lawful purpose.

Should I stop paying while the complaint is pending?

A harassment or privacy complaint does not itself suspend the loan. Request an updated statement of account, dispute incorrect amounts in writing, and use only a verified official payment channel. Obtain individual legal advice before withholding payment when the amount, creditor, contract, or enforceability is disputed.

Official sources

This article provides general Philippine legal information, not legal advice for a particular case. Procedures and outcomes depend on the lender’s regulatory status, the loan documents, the evidence, and the specific conduct involved. Official sources and filing channels were checked on August 18, 2026.