Quick answer

If an online lending app threatens, insults, publicly shames, deceives, or contacts people in your phonebook to pressure you to pay, preserve the evidence and report the conduct to the proper agency:

SEC: unfair collection by a lending or financing company.
National Privacy Commission (NPC): unauthorized, excessive, or harmful use or disclosure of personal data.
PNP, NBI, or DICT: threats, fraud, scams, impersonation, hacking, or other possible crimes.
BSP: complaints involving a bank, e-money issuer, pawnshop, or another BSP-supervised institution, after first complaining to that institution.

You may report both collection harassment and a privacy violation arising from the same incident. A valid unpaid loan does not authorize harassment or misuse of personal data. Conversely, filing a complaint does not automatically erase a legitimate debt, interest, or lawful collection remedy.

What conduct may violate the rules?

Financing and lending companies—and collectors acting for them—may use reasonable, lawful means to collect a debt. They must act in good faith and treat borrowers fairly.

SEC rules identify the following as unfair collection practices:

Using or threatening violence or other criminal means to harm a person, reputation, or property.
Threatening an action that cannot legally be taken.
Using obscenities, insults, or profane language that amounts to abuse or a criminal offense.
Publishing or disclosing borrowers’ names or personal information to shame them, except where disclosure is lawfully permitted.
Communicating false loan information, including failing to say that a debt is disputed when applicable.
Using false representations or deceptive means to collect a debt or obtain information.
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., unless the account is more than 15 days past due or the borrower expressly agreed, through written, electronic, or recorded means, that those are the only reasonable or convenient times.
Contacting people in the borrower’s contact list other than properly named guarantors or co-makers—even if the borrower supposedly consented.

These restrictions appear in SEC Memorandum Circular No. 18, series of 2019, as reproduced and applied in an official SEC cease-and-desist order. The broader Financial Products and Services Consumer Protection Act also prohibits abusive collection or debt-recovery practices and requires financial service providers to respect client privacy.

Privacy violations involving contacts, photos, and app permissions

Under NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02, an online lender must not demand unnecessary permissions or process data in an unconstrained, excessive, or disproportionate way.

Important distinctions include:

An app may obtain limited access that allows you to select a character reference or guarantor, or may derive proportional contact-list metadata when necessary for a specified legitimate purpose. It cannot freely copy and use everyone in your phonebook for collection.
For debt collection, the lender may contact a person who actually consented to be a guarantor. It may not contact unrelated phonebook entries.
A character reference is not automatically a guarantor. A character reference is for verifying the borrower’s identity or information. The lender must tell the person how the details were obtained and allow the person to request removal as a reference.
Character references must not be contacted for debt collection, marketing, cross-selling, or unrelated product offers.
A guarantor must have separately and expressly consented to assume the obligation. Merely appearing in someone’s contacts—or being named without consent—does not make a person a guarantor.
Camera or photo-gallery access may be allowed for a specified purpose such as identity verification, but it must stop when that purpose has been fulfilled. A borrower’s photo must not be altered, posted, or circulated to humiliate the borrower.
Data may be retained only while necessary for its stated purpose, a legal requirement, or the establishment, exercise, or defense of legal claims. Erasure is therefore not absolute while a valid account or legal claim remains.

The DICT, NPC, and SEC reaffirmed these rules, including the prohibition against contacting phonebook entries who are not guarantors, in their March 18, 2026 joint advisory on online lending platforms.

What to do immediately

1. Protect yourself if there is an urgent threat

Call 911 if there is a credible threat of immediate violence, someone is approaching your home or workplace, or a crime is in progress. The government’s Unified 911 system connects callers to police, fire, medical, and rescue services.

Do not meet a threatening collector alone. Tell a trusted family member, building administrator, employer security office, or barangay or police station when needed for safety.

2. Preserve evidence before blocking or uninstalling

Save the evidence in at least two secure locations. Keep:

Full screenshots of texts, chats, social-media posts, emails, and in-app notices, showing the date, time, sender, number, username, and URL.
Call logs, voicemail files, and the dates, times, duration, and substance of calls.
The app’s name, developer, download page, version, privacy notice, terms, consent screens, and requested permissions.
The lender’s corporate name, SEC registration number, Certificate of Authority number, office address, collection agency, and official contact details, if displayed.
Your application, loan agreement, disclosure statement, account statement, repayment schedule, receipts, and payment history.
Copies of altered photos, public-shaming posts, group messages, or messages sent to relatives, co-workers, clients, or employers.
Screenshots and short written statements from third parties whom the collector contacted. Ask them to preserve the original messages and sender details.
Your written complaint to the lender and its acknowledgment, ticket number, and response.

Do not crop away identifying details. For disappearing posts, save the URL and timestamp before requesting removal.

Be careful with audio recording. The Anti-Wiretapping Law generally prohibits secretly recording a private communication without authorization from all parties. Preserve existing messages and call logs, but obtain legal advice before secretly recording a call.

3. Restrict further access

After preserving evidence:

Revoke the app’s access to contacts, photos, camera, microphone, SMS, files, and location unless a permission remains genuinely necessary.
Remove the app after saving the agreement, account details, payment instructions, privacy notice, and evidence you may need.
Block abusive numbers and accounts.
Change reused passwords and review the security of your email, social-media, e-wallet, and banking accounts.
Warn affected contacts that they may receive misleading messages. Ask them not to argue with the collector, click links, or send money.
Report public-shaming posts to the platform after saving evidence and request removal for harassment or disclosure of personal information.

Revoking permissions or uninstalling the app does not cancel the loan.

Send a written complaint to the lender first

Use the lender’s consumer-assistance channel and data protection officer contact, if available. Written notice is especially important because an NPC complaint ordinarily requires proof that you first informed the company and gave it an opportunity to respond.

Include:

Your name and account or loan reference number.
The app’s name and the lender’s corporate identity.
A dated, chronological description of what happened.
The phone numbers, accounts, collectors, or agencies involved.
The people contacted and what information was disclosed.
Why the debt or amount is disputed, if applicable.
Copies of representative evidence.
The specific action you want.

You may demand, as applicable:

Immediate cessation of threats, insults, public shaming, and third-party collection messages.
Confirmation that the account is marked as disputed.
Identification of the lender, collection agency, responsible personnel, and data protection officer.
Disclosure of what personal data was collected, its source, purpose, lawful basis, recipients, and retention period.
Correction of inaccurate data.
Removal of a character reference who requests removal.
Blocking or deletion of data that was unlawfully obtained, used for an unauthorized purpose, or is no longer necessary, subject to lawful retention obligations.
Preservation of relevant records for investigation.
A correct account statement and verified official payment channel.

Keep proof of delivery. Under the current amended NPC Rules of Procedure, the company generally has 15 calendar days from receipt of your written notice to respond or take timely and appropriate action before an NPC complaint is pursued. The NPC may waive this requirement for good cause or a serious violation, including grave and irreparable harm, lack of an adequate remedy, or patently illegal conduct.

Where to report

Problem	Proper channel
Unfair collection by a lending or financing company	SEC Financing and Lending Companies Department
Misuse, unauthorized disclosure, or excessive processing of personal data	National Privacy Commission
Threats, fraud, scams, impersonation, hacking, or other possible crimes	PNP Anti-Cybercrime Group, NBI Cybercrime Division, DICT Cyber Hotline, or the nearest police station
Conduct by a bank, e-money issuer, pawnshop, payment-system operator, or another BSP-supervised institution	Institution’s consumer-assistance channel first, then BSP
Immediate danger or crime in progress	911

Filing with one agency does not necessarily replace filing with another. Each body addresses a different part of the conduct.

How to file an SEC complaint

For harassment or unfair collection by an SEC-regulated lending or financing company:

Go to the SEC’s official iMessage ticketing system.
Create an account or sign in.
Select the Financing and Lending Companies Department and the service for Complaints on Financing and Lending Companies.
Identify both the app and the company operating it. Include the SEC registration and Certificate of Authority numbers if known.
Upload a clear chronology, the loan documents, your written complaint to the lender, its response, and evidence of the abusive collection.
Save the electronic ticket number and monitor the ticket for SEC requests.

The SEC identifies iMessage as its central platform for public complaints and requests in its official iMessage user guide. The March 2026 joint advisory also lists the SEC hotline 1-4732 (1-4SEC).

An online platform operated by a lending or financing company should conspicuously disclose its corporate name, SEC registration number, Certificate of Authority number, and an advisory to review the disclosure statement. Missing or suspicious information should be included in the complaint. You may also request verification of the company’s Certificate of Authority through SEC iMessage.

How to file a privacy complaint with the NPC

Before filing

Unless an exception is justified, first send the lender or concerned company a written privacy complaint and allow 15 calendar days from receipt for a response or appropriate action.

Prepare the formal complaint

The NPC’s current process requires a written, signed, verified complaint. The official Complaints-Assisted Form should be completed and notarized. Attach:

Your contact and service details.
The respondent’s identity and contact details, if known.
A chronological statement of material facts.
The DPA or NPC rights allegedly violated.
The relief you are requesting.
Copies of your correspondence with the respondent.
Documentary evidence and witness affidavits, if available.
A certification against forum shopping.
Proof of authority if a representative is filing for you.

If the company behind the app is unknown, describe all facts that may help identify it: app-store page, developer name, website, payment accounts, phone numbers, email addresses, loan documents, and messages.

Submit and pay the applicable fee

Follow the NPC’s current formal complaint instructions and form. A notarized complaint may be submitted in person, by courier, or as a scanned copy by email to complaints@privacy.gov.ph. Keep the signed original because the NPC may require conventional filing.

As of July 31, 2026, NPC Circular No. 2023-01 lists:

A ₱500 filing fee for complaints.
A legal-research fee of 1% of the filing fee, but not less than ₱10.
Additional filing fees when damages are claimed.
Exemptions for qualifying indigent complainants, subject to documentary requirements.
Possible waiver by the NPC for good cause under its procedural rules.

Check the NPC page for payment instructions rather than sending money to an unofficial account.

Urgent privacy relief

A complainant may ask for a temporary ban on the respondent’s processing of personal data before the NPC decision becomes final. This is not automatic. The motion must establish the facts supporting urgent relief, the parties must be heard, and a bond may be required. Because the request has technical and procedural requirements, urgent legal assistance is advisable when contact harvesting, public shaming, identity misuse, or other harmful processing is continuing.

File promptly. The current NPC Rules also recognize statutory prescriptive periods for penal DPA violations; the applicable period and starting date can depend on the offense and facts.

Reporting threats, fraud, or other possible crimes

Report credible threats, extortion-like demands, impersonation, unauthorized account access, fraudulent payment instructions, or similar conduct to law enforcement. The March 2026 government advisory lists:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; (02) 8723-0401 local 7491

Bring or attach your identification, chronology, original devices when requested, copies of messages and loan records, account or payment details, and information identifying the sender. Let investigators or prosecutors determine the proper offense; the exact charge depends on the words used, intent, manner of publication, identity of the sender, and other evidence.

When the BSP is the proper financial regulator

Some digital loans are issued by banks, non-bank electronic-money issuers, pawnshops, payment-system operators, or other BSP-supervised institutions rather than SEC-regulated lending companies.

First complain through the institution’s own financial consumer protection assistance mechanism and save its reference number. If unresolved, elevate the matter through the BSP Consumer Assistance Mechanism:

BSP Online Buddy on the BSP website.
consumeraffairs@bsp.gov.ph
(02) 5306-2584
Mail, walk-in filing, or the nearest BSP regional office or branch.

Attach your complaint to the institution, its response, supporting documents, and the relief requested. Privacy violations may still be separately reported to the NPC.

What lawful collection may still look like

A complaint should separate unlawful conduct from legitimate collection. Depending on the contract and facts, a lender may generally:

Send a civil demand for the correct amount.
Contact the borrower at reasonable times and through lawful channels.
Contact a genuine guarantor or co-maker according to the agreement and applicable law.
Report credit data through legally authorized channels.
Offer restructuring or settlement.
File a proper civil collection case.

A collector must not falsely present a private demand as a court order, invent a warrant, pretend to be a police officer or lawyer, or threaten a legal action that cannot be taken. Genuine court papers come through lawful court processes and should not be ignored.

The Constitution provides that no person may be imprisoned merely for debt. This does not immunize a person from prosecution for a separate criminal act supported by evidence, and it does not prevent a civil collection case. See Article III, Section 20 of the 1987 Constitution.

Common mistakes to avoid

Deleting the app or messages too early. Preserve agreements, privacy notices, permissions, payment history, and harassment evidence first.
Relying only on telephone complaints. Send written notice and keep proof of receipt.
Naming only the app. Identify the corporate operator, collector, developer, payment recipient, and numbers used as far as possible.
Posting everything publicly. This may expose your identification, contacts, loan data, and authentication details. Submit complete evidence privately to the authorities.
Secretly recording calls without legal advice. Philippine anti-wiretapping rules can apply even when the recorder participated in the private conversation.
Paying a personal account sent by an unknown collector. Verify the lender and official payment channel and demand a receipt.
Assuming harassment cancels the debt. Dispute abusive conduct separately from the accuracy and enforceability of the account.
Ignoring real court or agency documents. Verify them directly with the named court or agency and obtain legal help immediately.
Waiting until evidence disappears. Save temporary posts, disappearing chats, app pages, and call details as soon as possible.

When legal help is urgent

Consult a Philippine lawyer, the Public Attorney’s Office if you qualify, or a recognized legal-aid organization promptly when:

There are credible threats to life, physical safety, children, or property.
Intimate images, altered photographs, identification documents, or home and workplace details are being circulated.
The app appears to control or compromise your phone, email, social media, bank, or e-wallet accounts.
A complaint involves many affected contacts or continuing large-scale data processing.
You need a temporary ban, damages, an injunction, or a criminal complaint.
A collector has appeared at your home or workplace and refuses to leave.
You received genuine court summons, a subpoena, or an official agency order.
You signed as guarantor, co-maker, or co-borrower and dispute your consent or liability.
Significant time has passed and a filing deadline or prescriptive period may be involved.

Frequently asked questions

Can I complain even if I really owe the money?

Yes. A lender may lawfully collect a valid debt but may not use prohibited harassment, deception, public shaming, or unlawful data processing. Continue addressing the account separately and request an accurate statement or restructuring if needed.

Can the app message everyone in my contacts because I accepted its terms?

No. A blanket consent does not authorize unbridled processing or unfair collection. For debt collection, current NPC rules allow contact with an actual, consenting guarantor—not unrelated phonebook entries.

I was only listed as a character reference. Can the lender demand payment from me?

Being a character reference does not automatically make you a guarantor. A guarantor must separately and expressly consent to undertake the obligation. A character reference may request removal and should not be contacted for collection.

Can I complain if I am not the borrower?

Yes, if your own personal data was obtained, used, or disclosed improperly, you may complain as an affected data subject. Preserve the messages, state that you did not consent to be a guarantor, request removal where applicable, and identify how the collector obtained or used your information.

Should I pay immediately to stop the harassment?

Do not send money to an unverified personal account or unfamiliar payment link. Verify the lender, ask for an account statement, use only an official payment channel, and obtain a receipt. Report threats or unlawful collection regardless of whether you decide to pay or negotiate.

Does an SEC or NPC complaint stop collection automatically?

No. A complaint does not automatically suspend a valid debt or all collection activity. It may lead to investigation or regulatory relief. A temporary privacy-processing ban must be specifically requested and granted by the NPC.

What if the app has no company name or license information?

Preserve the app page, developer identity, URLs, phone numbers, payment accounts, privacy notice, and messages. Report the missing disclosures and suspected unauthorized operation to the SEC through iMessage.

Can a collector have me arrested simply for failing to repay a loan?

A person cannot be imprisoned merely for debt. A separate criminal allegation requires its own legal basis, evidence, and lawful process. Threats of automatic arrest or an invented warrant should be preserved and reported.

How long should I wait before filing with the NPC?

Ordinarily, give the company written notice and 15 calendar days from receipt to respond or take appropriate action. The NPC may waive this step for good cause or serious, urgent harm. File promptly rather than relying on informal or outdated deadline information.

Official references

This article provides general legal information, not legal advice or a prediction of the outcome of any complaint. Rights, liability, jurisdiction, and available remedies depend on the loan documents, communications, parties, and evidence. Official sources and procedures were checked as of July 31, 2026.