Quick answer

Online lending app harassment can be reported to more than one authority:

Report unfair or abusive collection by lending and financing companies to the Securities and Exchange Commission (SEC) through SEC iMessage.
Report unauthorized access, disclosure, public shaming, or misuse of contacts, photos, and other personal data to the National Privacy Commission (NPC).
Report threats of violence, extortion, impersonation, fraud, account compromise, or other possible crimes to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT Cyber Hotline. Call 911 if anyone is in immediate danger.

Preserve the evidence before blocking numbers, revoking permissions, or uninstalling the app. A genuine unpaid loan does not authorize harassment or public shaming. At the same time, reporting misconduct does not automatically cancel a valid debt.

What conduct may be reported?

Philippine law permits creditors to use reasonable and lawful collection methods. It does not permit abusive collection or disproportionate use of personal data. Republic Act No. 11765, the Financial Products and Services Consumer Protection Act, expressly prohibits abusive collection and requires financial service providers to respect client privacy and maintain a free consumer-assistance mechanism. Providers may also be responsible for misconduct committed by their collection agents and accredited third-party service providers. Read Republic Act No. 11765.

Report conduct such as:

Threatening violence, physical harm, property damage, or reputational harm
Threatening arrest, criminal prosecution, or another action the collector cannot legally take
Using obscenities, slurs, insults, or degrading language to abuse the borrower
Falsely claiming to be a police officer, lawyer, court employee, or government official
Sending fabricated warrants, court orders, barangay notices, or other deceptive documents
Posting or threatening to post the borrower’s name, photograph, identification document, loan details, or alleged nonpayment on social media
Giving false loan information to relatives, friends, employers, co-workers, or other third parties
Contacting people harvested from the borrower’s phone, email, or social-media contacts
Using the borrower’s photograph or other personal data to shame or embarrass them
Continuing to process personal data for an undisclosed, unnecessary, or excessive purpose
Calling before 6:00 a.m. or after 10:00 p.m., subject to the exceptions in SEC Memorandum Circular No. 18 for an account more than 15 days past due or documented express consent to those hours

These practices are addressed in SEC Memorandum Circular No. 18, Series of 2019. In March 2026, the SEC, NPC, and DICT again confirmed that harassment, intimidation, public shaming, unnecessary app permissions, and unconstrained access to borrowers’ contact lists are prohibited. Read the 2026 Joint Advisory on Online Lending Platforms.

Character references are not automatically guarantors

A character reference supplies information only for verification of the borrower’s identity and statements. The lender may not automatically treat that person as responsible for the debt.

A guarantor must separately and expressly consent to assume responsibility if the borrower defaults. For debt collection, the lender may contact an actual guarantor. It may not contact unrelated people from the borrower’s contact list. An actual co-maker may have obligations under documents that person signed, but merely appearing in someone’s phone contacts does not make anyone a co-maker or guarantor. These distinctions are set out in NPC Circular No. 2022-02.

Giving app permission is not unlimited consent

Consent to use a camera for identity verification does not necessarily authorize the lender to retain the borrower’s photos indefinitely, create shaming materials, or disclose them to other people. Access must remain necessary, proportionate, and connected to a specified lawful purpose.

Unbridled processing of an entire contact list is prohibited. Limited access may be used to let the borrower select a reference or guarantor, or to derive proportionate metadata for a legitimate purpose, but not to harass contacts or collect from people who are not guarantors. See NPC Circular No. 20-01 and its 2022 amendments.

What may a lender lawfully do?

Depending on the contract and the facts, a legitimate creditor may:

Contact the borrower at reasonable times
Send an accurate statement of account or formal demand
Offer restructuring or another payment arrangement
Contact an actual guarantor or pursue an actual co-maker according to the signed documents
Submit authorized credit information as permitted by law
File an appropriate civil action to recover a valid debt
Retain data that remains necessary to service the loan, comply with law, or establish, exercise, or defend legal claims

The Constitution provides that no person may be imprisoned for debt alone. That protection does not erase the obligation, prevent a civil collection case, or excuse a separate crime if one was actually committed. See Article III, Section 20 of the Constitution.

Do not ignore genuine court papers. Verify suspicious documents directly with the court branch or government office named in them rather than using the collector’s phone number.

What to do immediately

1. Protect yourself and preserve the evidence

Before deleting anything:

Take screenshots showing the full message, sender or account name, phone number, date, and time.
Export or preserve complete chat threads and emails, not only the most offensive sentence.
Save voicemails, call logs, social-media posts, profile URLs, notification history, and app-store listing details.
Screen-capture the app’s permissions and privacy notice.
Save the loan agreement, disclosure statement, promissory note, repayment schedule, receipts, and proof of all payments.
Ask contacted relatives, friends, and co-workers to preserve the messages they received and provide their own screenshots.
Record the app name, developer, corporate lender, collection agency, payment account, phone numbers, email addresses, and names used by collectors.
Keep the original files. Store a backup in a secure account or device and make a chronological incident list.

Do not secretly record a private telephone conversation without legal advice. The Anti-Wiretapping Act generally requires authorization from all parties to a private communication, and unlawfully obtained recordings may be inadmissible. Preserve call logs and voicemails left by the collector instead. Read Republic Act No. 4200.

If you suspect the app compromised your accounts, change passwords from a trusted device, enable multi-factor authentication, review financial transactions, and notify the affected bank or e-wallet provider immediately.

2. Identify the company behind the app

The app’s brand may differ from the lender’s legal name. Look for the corporate name and regulator in:

The loan agreement and disclosure statement
The app’s privacy notice and terms
Collection messages and receipts
The app-store developer page
SEC registration or Certificate of Authority details displayed in the app or advertisements

Include both the app name and the legal company name in every complaint. If the company is unknown, provide all facts that can help trace it: URLs, developer names, screenshots, payment-account details, phone numbers, and email addresses.

3. Send a written complaint to the lender

Use the lender’s consumer-assistance unit and data-protection contact shown in its contract, privacy notice, website, or app. Keep proof of sending and receipt.

State:

Your name, account or loan reference, and the app involved
The exact acts complained of, with dates and sender details
Which information was accessed, used, or disclosed
Who was contacted and what was communicated
Whether you dispute the amount, specific charges, or the collector’s identity
The action you want taken

You may request that the company:

Stop contacting people who are not guarantors
Stop public disclosure, threats, insults, or deceptive representations
Restrict unnecessary processing and revoke unnecessary app permissions
Correct inaccurate information
Identify the company and collector handling the account
Preserve collection logs and relevant records
Provide an itemized statement of account
Give a written response through its consumer-assistance mechanism

If the loan is valid but you cannot presently pay, you may separately propose a realistic restructuring arrangement. Do not send money to a newly supplied personal account until the lender confirms through an official channel that the collector and payment instructions are authorized.

How to file an SEC complaint

The SEC is the main regulator for lending companies, financing companies, their online lending platforms, and their collection agents.

Go to SEC iMessage.
Select the service for complaints involving financing and lending companies.
Identify the app, legal company, and collection agency, if known.
Describe the events chronologically.
Attach the agreement, disclosure statement, receipts, payment history, screenshots, call logs, app permissions, and correspondence with the company.
Save the ticket or reference number and monitor the portal for requests or replies.

The SEC’s official complaint guidance also provides a complaint form and emphasizes submitting complete evidence, a valid government-issued ID, and one complaint form per respondent company.

The SEC may investigate, require a response, commence an administrative action, impose fines, suspend or revoke authority to operate, or take other enforcement measures warranted by the evidence. The SEC cannot simply rewrite a private contract, declare it void, or cancel the borrower’s debt through an ordinary regulatory complaint.

How to file an NPC privacy complaint

File with the NPC when the app or collector improperly accessed, retained, used, or disclosed personal data—including contacts, photographs, IDs, addresses, employment information, or loan details.

Complete the prior-notice requirement

Under the current NPC Rules, a complainant must ordinarily:

Inform the lender, collection agency, or other responsible entity in writing about the privacy violation; and
Show that the entity failed to take timely or appropriate action, or did not respond within 15 calendar days after receiving the written notice.

The NPC may waive this requirement for good cause or a serious violation, including situations involving grave and irreparable harm, no adequate remedy from the respondent, or conduct that is patently illegal. If public shaming, threats, or disclosure is continuing, file promptly and explain why immediate NPC intervention is necessary. Read the 2021 NPC Rules of Procedure and the 2024 amendments.

Prepare and submit the complaint

Use the latest form linked from the NPC’s official filing page. As of the source-check date, the current Complaint-Affidavit is dated 1 March 2026.

The complaint should:

Identify the complainant and respondent
List the personal data involved
Explain the prior written notice—or why it was unsafe or impracticable
Narrate the facts clearly and chronologically
Identify the possible privacy violations
List and attach the evidence
State the relief requested
Include verification and certification against forum shopping
Be properly signed and notarized
Include a valid government-issued ID

The NPC accepts complaints personally, by registered mail, by courier, or by authorized electronic-mail filing as stated on its filing page. The NPC’s posted fee schedule lists a ₱500 basic complaint filing fee, plus applicable legal-research and damages-related fees. Qualified indigent complainants and other exempt parties may request exemption with the required documents. See the NPC schedule of fees.

The current 2021 NPC Rules do not contain the former six-month/30-day administrative filing rule found in the repealed 2016 procedure. Nevertheless, file promptly: electronic evidence can disappear, and separate civil, consumer-protection, or criminal claims have their own prescriptive periods.

When to report to law enforcement

Use law-enforcement channels in addition to the SEC or NPC when the evidence indicates possible threats, extortion, impersonation, fraud, hacking, identity misuse, or another crime. Administrative complaints do not replace a criminal investigation.

The March 2026 joint government advisory identifies these channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph; (02) 8723-0401 local 7491

Bring the original device if requested, along with printed and digital copies of the messages, transaction records, URLs, sender details, and identification of witnesses. Ask for the complaint, blotter, or reference number.

For a threat of immediate violence or a crime in progress, call the free, 24-hour Unified 911 emergency hotline. See the official DILG 911 guidance.

Whether particular conduct constitutes grave threats, coercion, cyber libel, identity theft, fraud, or another offense depends on its exact words, context, intent, sender, and supporting evidence. Avoid assigning a criminal label in the complaint unless you can accurately describe the facts supporting it.

What if the loan provider is supervised by the BSP?

Some digital credit products are issued by banks or other Bangko Sentral-supervised institutions rather than SEC-regulated lending companies.

First complain through the institution’s Financial Consumer Protection Assistance Mechanism or official customer-service channel. If the response is unsatisfactory, escalate through the BSP Online Buddy on the BSP website or submit the BSP Complaint/Inquiry/Reply form with proof of your prior complaint. The BSP’s current complaint instructions explain the process.

The NPC may still receive a separate complaint concerning misuse of personal data.

Evidence checklist

A strong complaint ordinarily includes:

Loan agreement, disclosure statement, and repayment schedule
Proof of disbursement and every payment
Itemized statement or disputed computation
App name, developer, URL, legal lender, and collection agency
Privacy notice, consent screen, and screenshots of permissions
Complete messages with dates, times, and sender details
Call logs and preserved voicemails
Screenshots and URLs of public posts
Messages received by contacts, preferably preserved by the recipients themselves
Written complaint sent to the lender, delivery proof, and its response
A dated incident chronology
Witness affidavits when necessary
Valid identification and the correctly completed agency form

Redact unrelated account credentials, one-time passwords, PINs, and personal data of uninvolved people from working copies. Preserve unredacted originals securely in case the investigating authority requires them.

Common mistakes to avoid

Deleting the app immediately. Preserve the agreement, permissions, messages, and account details first.
Naming only the app. Identify the corporate lender, developer, and collection agency whenever possible.
Submitting cropped or edited screenshots. Preserve context, timestamps, sender details, URLs, and original files.
Secretly recording calls. Philippine anti-wiretapping rules can create a separate problem.
Posting the evidence publicly. This may expose your own or another person’s data and complicate the dispute.
Assuming a character reference must pay. Liability requires an actual legal undertaking, not mere inclusion in a contact list.
Skipping written notice before an NPC complaint. Send it and preserve proof, unless serious circumstances justify asking the NPC to waive the requirement.
Assuming an unregistered app makes every obligation disappear. Registration violations and the enforceability of a particular loan are separate legal questions.
Paying an unverified collector. Confirm the collector and destination account with the lender’s official channel.
Ignoring genuine legal papers. Verify them independently and obtain legal help before the response deadline.

When legal help is urgent

Consult a lawyer or the Public Attorney’s Office promptly when:

A threat is specific, credible, or directed at your family or workplace
Intimate images, IDs, medical information, or other highly sensitive data were disclosed
A public shaming post remains online or is spreading
Your phone, email, bank account, or e-wallet appears compromised
Multiple lenders or collection agencies are involved
You suffered job loss, financial loss, or serious reputational harm
You received a summons, subpoena, court order, or notice of formal proceedings
You want damages, an injunction, or emergency relief
You are unsure whether a document makes someone a guarantor or co-maker
A filing or prescriptive period may be approaching

Claims under Republic Act No. 11765 generally prescribe five years from consummation of the financial transaction, or five years from discovery of deceit or nondisclosure of material facts, but in any event after ten years from the violation. Privacy, civil, and criminal remedies may follow different periods, so do not delay based solely on that rule.

Frequently asked questions

Can a collector call my family, friends, or employer?

Not merely because their details appeared in your phone. Contacting people from the borrower’s contact list for collection is prohibited unless the person is an actual guarantor as recognized under the applicable rules. A character reference is not automatically a guarantor.

Is it harassment if the collector repeatedly asks me to pay?

Not every reminder is unlawful. Frequency, timing, language, threats, deception, third-party disclosure, and the surrounding circumstances matter. A collector may request payment lawfully but may not abuse, shame, deceive, or threaten the borrower.

Can the lender post my name and photograph because I missed payment?

Public shaming and the use of a borrower’s photograph or personal information to embarrass them are prohibited collection and data-processing practices.

Can I revoke the app’s permissions?

Yes. Preserve evidence first, then turn off unnecessary access to contacts, photos, camera, location, storage, microphone, SMS, and other data. Revocation does not erase copies the company already obtained, so separately demand restriction or deletion where legally appropriate.

Can I demand deletion of all my data?

You may request deletion or removal, particularly when the data is no longer necessary or was processed unlawfully. The right is not absolute: the company may retain data required by law, needed to service an existing account, or necessary to establish, exercise, or defend legal claims. Ask for a written explanation of any refusal.

What if I already paid the loan?

Submit proof of full settlement and demand that collection stop. You may also ask the company to correct its records and delete or securely dispose of data that is no longer lawfully necessary. Continued collection or disclosure after confirmed settlement should be documented and reported.

Can I complain even if I am not the borrower?

Yes, if your own personal data was improperly processed or you personally received threats or abusive communications. An affected contact may file an NPC complaint concerning their data and report possible crimes directly to law enforcement.

Will filing a complaint erase my debt?

No. The complaint addresses the collection conduct, consumer-protection violation, or misuse of data. The validity, amount, and enforceability of the debt remain separate questions.

Can I be arrested simply for failing to pay an online loan?

A person cannot be imprisoned for debt alone. A collector cannot lawfully manufacture an arrest warrant. Separate criminal conduct, if properly charged and proved, is different. Verify any claimed warrant or case directly with the named court or law-enforcement office.

Official references

This article provides general legal information, not advice for a specific case. Rights, liability, jurisdiction, and available remedies depend on the loan documents, communications, parties, and evidence. Consult a Philippine lawyer for advice on your circumstances. Laws, procedures, and official channels were checked against primary government sources on 6 August 2026.