Quick answer

Online lending apps may demand payment of a lawful debt, but they may not use threats, humiliation, public shaming, deceptive representations, abusive messages, or unlawful access to personal data. They generally may not contact people found in a borrower’s phone contacts for debt collection unless the person is a guarantor who separately consented to that role.

Report unfair collection practices by a lending or financing company to the Securities and Exchange Commission (SEC). Report unauthorized access, disclosure, or misuse of personal data to the National Privacy Commission (NPC). Threats, extortion, fraud, identity theft, and similar possible crimes should also be reported promptly to the police or cybercrime authorities.

A complaint does not automatically erase a valid loan. Continue disputing or arranging payment through documented, lawful channels while separately challenging the harassment, privacy violation, unauthorized charges, or fraudulent transaction.

Conduct that may violate the law

Depending on the evidence and circumstances, reportable conduct may include:

Threatening violence, arrest, imprisonment, property damage, or another action that the collector cannot legally take
Sending insulting, obscene, degrading, or intimidating messages
Publicly posting or circulating the borrower’s name, photograph, loan information, identification document, or alleged delinquency
Creating group chats to shame the borrower before relatives, coworkers, clients, or acquaintances
Contacting people taken from the borrower’s phone contacts who are neither guarantors nor proper parties to the loan
Falsely representing that the collector is a police officer, lawyer, court employee, or government agent
Sending fabricated warrants, summonses, court orders, or criminal complaints
Disclosing the debt to an employer or another third party merely to embarrass or pressure the borrower
Continuing to use permissions or retain data when these are no longer necessary for a lawful and disclosed purpose
Accessing or processing contacts, photographs, messages, location data, social-media information, or device files beyond what is necessary and proportionate
Using personal data obtained for identity verification for public shaming, harassment, or unrelated collection activity
Pressuring a character reference to pay even though that person never consented to become a guarantor
Threatening a person over a loan that the person never obtained or authorized

The Financial Products and Services Consumer Protection Act recognizes the financial consumer’s rights to fair treatment, data privacy, transparent disclosure, timely complaint handling, and freedom from abusive debt-recovery practices. A regulated provider may also be responsible for the conduct of its employees and collection agents; the law provides solidary liability with accredited third-party service providers for covered acts or omissions.

For lending and financing companies, SEC Memorandum Circular No. 18, series of 2019 specifically prohibits unfair debt-collection practices.

Privacy rules for online lending apps

The Data Privacy Act of 2012 requires personal-data processing to have a lawful basis and to comply with transparency, legitimate purpose, and proportionality. Consent to some processing does not give an online lender unlimited authority over everything stored on a phone.

Under the NPC’s rules for loan-related transactions, as reinforced by the March 18, 2026 joint DICT-NPC-SEC advisory:

Unnecessary application permissions are prohibited.
Unauthorized, excessive, or disproportionate processing of contact lists and other personal data is prohibited.
A lender may not contact people from the borrower’s contact list for collection merely because their details were accessible through the app.
For debt-collection purposes, the lender or collector may contact a guarantor who actually consented to assume that responsibility.
A character reference supplied only for identification or verification is not automatically a guarantor.
Online lending platforms should provide separate processes for selecting character references and consenting guarantors.
Access to a camera or photo gallery may be used for a specified legitimate purpose such as identity verification, but the permission should be turned off once that purpose has been fulfilled.
Personal data should be retained only as long as necessary for the original purpose, the establishment or defense of legal claims, or another period required by law, and must thereafter be securely disposed of.

A privacy notice or pre-ticked consent box does not automatically legalize excessive processing. Consent must be informed, freely given, and specific. Deceptive interfaces that make consent easy to give but difficult to refuse or withdraw may undermine the validity of consent.

What to do immediately

1. Preserve the evidence before blocking or uninstalling the app

Save complete, unedited copies of:

Text messages, chat threads, emails, voice messages, and call logs
Screenshots showing the sender’s number, account name, date, time, and full message
Social-media posts, group chats, comments, and profile links
Threatening images, fabricated legal documents, and collection notices
The app’s name, icon, developer, download page, version, and store listing
The lender’s corporate name, SEC registration details, certificate of authority information, website, email addresses, and payment accounts
Loan agreement, disclosure statement, repayment schedule, receipts, and transaction history
Screenshots or screen recordings of permissions requested by the app
The privacy notice and consent screens displayed when the loan was obtained
Statements from relatives, coworkers, or other third parties who were contacted
Proof of the complaint sent to the lender and its response
Evidence that a supposed “guarantor” never consented to become one

Export conversations where possible. Preserve original files and make a backup. Do not crop away dates, usernames, telephone numbers, URLs, or other details needed to authenticate the evidence.

2. Secure the phone and affected accounts

After preserving evidence:

Revoke unnecessary permissions for contacts, storage, photos, camera, microphone, location, and call logs.
Change passwords for affected email, financial, and social-media accounts.
Enable multifactor authentication.
Review bank and e-wallet transactions for unauthorized activity.
Inform affected contacts that messages about the loan may have been sent without authority.
Report impersonation posts or accounts to the relevant platform.
Do not install remote-access software or send one-time passwords to anyone claiming to “help settle” the loan.

If the app appears malicious, obtain technical assistance before deleting it when device logs may be important evidence.

3. Send a written complaint to the provider

Use the provider’s official consumer-assistance channel. State:

Your name and loan or account reference
The dates and description of the conduct
The names, numbers, or accounts used by the collectors
Which personal data was accessed, used, or disclosed
Which third parties were contacted
The harm or risk caused
The specific relief requested

Possible requests include stopping third-party contact, identifying the collector, preserving records, correcting inaccurate data, investigating unauthorized access, deleting data that no longer has a lawful retention basis, and providing a written resolution.

Do not admit an amount you genuinely dispute. If the debt is valid, you may state that you are willing to communicate about payment through lawful and respectful channels.

Where to report the violation

SEC: unfair collection by lending or financing companies

For an online lending platform operated by or on behalf of a lending or financing company, submit the complaint to the SEC Financing and Lending Companies Department through the SEC iMessage portal.

The government’s March 2026 advisory also identifies the SEC hotline as 1-4732 (1-4SEC). Attach the evidence, identify the legal company behind the app if known, and explain whether relatives, coworkers, character references, or other contacts were approached.

Before borrowing or paying, check whether the company is registered and has the necessary authority to operate. Corporate registration alone does not necessarily mean that a company is authorized to conduct a lending or financing business. The SEC maintains information on lending and financing companies, relevant issuances, and regulatory status.

NPC: unauthorized processing or disclosure of personal data

A formal privacy complaint may be filed with the NPC by the affected data subject or by an authorized representative. Under the 2021 NPC Rules of Procedure, the complainant generally must first:

Inform the lender, app operator, collector, or other responsible entity in writing about the privacy violation; and
Show that the entity failed to take timely or appropriate action, or did not respond within 15 calendar days after receiving the written notice.

The NPC may waive this prior-notice requirement for good cause or a serious violation—for example, where immediate action is needed to prevent grave and irreparable harm, no adequate remedy is available from the respondent, or the conduct is patently illegal.

Use the NPC’s current complaint instructions and complaint-assisted form. A formal complaint should generally be verified or made through the notarized complaint-assisted form and supported by documentary evidence, witness affidavits when available, correspondence with the respondent, the relief requested, and a certification against forum shopping. Follow the NPC page’s current filing and fee instructions rather than relying on an unofficial social-media address.

A person whose information was taken from another person’s phone may file a privacy complaint concerning the processing of that person’s own data even if the person was not the borrower.

BSP or CDA: when the provider is under another regulator

The proper financial regulator depends on the institution:

Complaints against banks, digital banks, e-money issuers, and other BSP-supervised institutions should ordinarily be raised first through the institution’s consumer-assistance mechanism and then, if unresolved, through the BSP Consumer Assistance Mechanism.
Complaints involving a credit cooperative may fall within the jurisdiction of the Cooperative Development Authority.
Some schemes use an app name different from the regulated company. Identify the entity named in the loan agreement, disclosure statement, privacy notice, payment instructions, and app-store listing.

A privacy complaint may still be brought to the NPC even when a separate financial regulator handles the collection or consumer-protection issue.

Police and cybercrime authorities: threats, fraud, and immediate danger

Report credible threats of violence, extortion, identity theft, fraudulent loans, account takeover, fabricated official documents, or other possible crimes without waiting for the SEC or NPC process to finish.

The March 2026 government advisory lists:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (632) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph; onlinecims.ocs@gmail.com; (632) 8723-0401 local 7491

For an immediate threat to life or safety, call 911 or go to the nearest police station. Bring the device and copies of the evidence, but keep your own backup. The precise criminal offense and the proper venue depend on the words used, surrounding acts, identity of the sender, and available proof.

If the loan is disputed or fraudulent

Tell the lender in writing that you dispute the transaction or amount. Ask for:

The executed loan agreement and disclosure statement
The date and method of disbursement
The destination bank or e-wallet account
A complete computation of principal, interest, fees, penalties, and payments
Identity-verification and application records
The company’s authority to operate and the identity of the collection agency
Preservation of device, access, call, message, and transaction logs

Do not pay through a newly supplied personal account without independently verifying that it belongs to the legitimate creditor. Do not send additional identification documents to an unverified collector.

Under the Financial Products and Services Consumer Protection Act, a provider must have a free consumer-assistance mechanism. For an alleged disputed amount or unauthorized transaction, the law requires the provider, pending its final investigation report, to suspend interest, fees, and charges or provide a similar reasonable accommodation.

What a complaint can—and cannot—do

Regulators may investigate, require corrective action, impose administrative sanctions, or refer matters for appropriate proceedings. Available relief depends on jurisdiction, the evidence, and the violation proved.

However:

Filing a complaint does not by itself cancel the principal loan.
Harassment does not prevent a creditor from using lawful collection or court procedures.
Nonpayment of an ordinary loan is not, by itself, a reason for a private collector to arrest a borrower.
A collection message is not a summons, subpoena, warrant, or court judgment.
Deleting the app does not necessarily delete information already copied to the provider’s systems.
Payment does not automatically extinguish a privacy complaint based on earlier unlawful processing or disclosure.
A borrower cannot defeat lawful record-retention duties simply by withdrawing consent; some information may still be retained when another lawful basis applies.

Common mistakes to avoid

Deleting messages or uninstalling the app before saving evidence
Posting full identification cards, loan documents, or unredacted screenshots publicly
Responding with threats, insults, or defamatory accusations
Paying a collector through an unverified personal account
Reporting only the app’s brand name without identifying the corporate operator
Naming every employee as an offender without evidence of participation
Treating a character reference as legally liable merely because the app contacted that person
Filing an NPC complaint without first sending written notice to the respondent, unless facts support a waiver
Assuming that a police blotter, SEC complaint, and NPC complaint are interchangeable
Ignoring a genuine summons or official notice because collectors previously sent fabricated documents

Verify court papers directly with the court named in the document. Do not rely on the collector’s telephone number or link.

When legal help is urgent

Consult a lawyer promptly when:

There is a credible threat of violence, stalking, or a visit to your home or workplace
Intimate images, children’s information, government IDs, medical information, or financial credentials were exposed
The app obtained access to many contacts or published the debt widely
A loan was created through identity theft
Money was taken from a bank or e-wallet without authority
You received authentic court, prosecutor, police, SEC, BSP, CDA, or NPC documents
The company is demanding a large amount based on unclear or rapidly increasing charges
You need an urgent NPC temporary ban on further personal-data processing
Several victims appear to be affected by the same operator
Evidence may soon disappear or the responsible company cannot be identified

Frequently asked questions

Can an online lender contact my relatives or coworkers?

Not merely because their numbers appeared in your contact list. For debt collection, current NPC guidance prohibits contacting persons from that list other than a guarantor who separately consented to the obligation. A character reference is not automatically a guarantor.

Can the lender post my photograph and debt on social media?

Public disclosure intended to shame or pressure a borrower may constitute unfair collection and unlawful personal-data processing. Preserve the post, URL, date, account details, audience, shares, and comments before requesting removal.

Is it legal for an app to access my contacts?

Access is not automatically lawful simply because the user clicked “allow.” The purpose, necessity, proportionality, notice, and lawful basis matter. Unbridled processing of an entire contact list and its use for harassment or collection from non-guarantors is prohibited.

Should I report to the SEC or NPC?

Report unfair collection by a lending or financing company to the SEC. Report unlawful processing or disclosure of personal data to the NPC. When both occurred, complaints may be filed with both agencies. Possible crimes should be separately reported to law-enforcement or cybercrime authorities.

Must I wait 15 days before going to the NPC?

Ordinarily, you must first notify the responsible entity in writing and allow it to act; lack of a response within 15 calendar days may satisfy the exhaustion requirement. The NPC may waive this requirement for good cause or serious and urgent violations.

Can collectors have me arrested for failing to pay?

Ordinary inability or failure to pay a civil debt does not, by itself, authorize a private collector to arrest anyone. Criminal liability may arise only when facts independently establish an offense, and arrest or prosecution must follow lawful procedures. Do not ignore genuine official documents.

Does paying the loan waive my complaint?

Not necessarily. Payment may settle the debt but does not automatically legalize earlier harassment, unauthorized disclosure, or excessive processing. Review any quitclaim or settlement carefully before signing.

What if I never borrowed from the app?

Immediately dispute the loan, secure your accounts, request the application and disbursement records, and report suspected identity theft or fraud. Also preserve credit reports, e-wallet records, SIM information, and all collection messages.

This article provides general legal information, not legal advice for a particular case. Liability, remedies, jurisdiction, and filing requirements depend on the evidence and the identity of the lender or app operator. Official sources and procedures were checked as of August 24, 2026.