Quick answer

You can report an online lending app to more than one authority because harassment, unfair collection, privacy violations, and criminal threats involve different laws:

Report abusive debt collection by a lending or financing company to the Securities and Exchange Commission (SEC) through iMessage SEC.
Report unauthorized access, use, or disclosure of personal data to the National Privacy Commission (NPC) using its formal complaint process.
Report threats, extortion, impersonation, fraud, or other possible crimes to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT Cyber Hotline.
If the lender is a bank, digital bank, electronic-money issuer, or another BSP-supervised institution, use the provider’s consumer-assistance channel first and then escalate to the Bangko Sentral ng Pilipinas.

Save the evidence before blocking numbers, revoking permissions, deleting messages, or uninstalling the app. Reporting misconduct does not automatically cancel a valid loan, but owing money does not give a lender or collector the right to threaten, shame, deceive, or misuse personal data.

What conduct may be unlawful?

A lender may send lawful payment reminders and pursue legitimate collection remedies. The line is crossed when its methods become abusive, deceptive, disproportionate, or unrelated to collecting the debt through lawful means.

Unfair or abusive collection

The Financial Products and Services Consumer Protection Act, Republic Act No. 11765, gives financial consumers rights to fair treatment, data protection, and timely complaint handling. It expressly prohibits abusive collection or debt-recovery practices. A financial service provider may also be responsible for the acts of its employees, agents, and certain third-party collectors. See the official text of Republic Act No. 11765.

For SEC-regulated lending and financing companies, prohibited conduct under SEC rules includes such practices as:

threatening violence, injury, damage to property, or harm to reputation;
threatening an action that cannot legally be taken;
using insults, obscenities, profane language, or other abusive means;
using false representations or deceptive methods to collect;
falsely claiming to be a lawyer, police officer, court employee, government official, or another person with authority;
representing a message or document as court or government process when it is not;
public shaming or disclosing the borrower’s debt to people who are not legally entitled to receive that information; and
contacting people at unreasonable or inconvenient times, subject to the exceptions in the applicable rules.

The controlling SEC issuance is SEC Memorandum Circular No. 18, series of 2019.

A collector may identify the lender, explain the amount claimed, request payment, offer restructuring, or warn truthfully about lawful remedies. A genuine demand letter is not itself harassment. Whether repeated contact is abusive depends on its frequency, timing, language, recipients, and surrounding circumstances.

Contacting relatives, friends, coworkers, or everyone in your phone

Under the government’s current guidance, contacting people from a borrower’s contact list for debt collection is prohibited unless the person is a guarantor. Merely being listed as a character reference does not make someone a guarantor.

An online lending platform must distinguish between:

a character reference, whose information is supplied only for identification or verification; and
a guarantor, who separately and expressly agreed to assume responsibility if the borrower defaults.

A person does not become liable for your loan simply because you entered their name or number as a reference. The joint DICT-NPC-SEC Public Advisory on Online Lending Platforms dated 18 March 2026 states that lenders may contact only a consenting guarantor for collection purposes—not other people found in the borrower’s contacts.

Privacy violations

The Data Privacy Act of 2012 requires personal-data processing to have a lawful basis and comply with transparency, legitimate purpose, and proportionality. Depending on the facts, a violation may include:

copying or indiscriminately harvesting the borrower’s contact list;
accessing photos, files, messages, location, microphone, or other phone data without a necessary and legitimate purpose;
using data for a materially different purpose from the one properly disclosed;
sending the borrower’s photograph, ID, loan information, or accusations to other people;
posting the borrower’s identity or alleged debt on social media;
creating humiliating images, “wanted” posters, group chats, or public posts;
continuing to hold or use data after it is no longer necessary, unless retention is required by law or reasonably needed for legal claims;
refusing a valid request for access, correction, blocking, erasure, or destruction when the legal requirements for that right are met; or
obtaining supposed consent through misleading interfaces, pre-ticked choices, or a process that makes refusal or withdrawal unfairly difficult.

Consent to reasonable identity verification or loan processing is not unlimited permission to shame a borrower or message everyone in the borrower’s phone. However, withdrawal of consent does not necessarily require deletion of every record: the company may retain data needed to comply with law, administer an existing contract, document transactions, or establish or defend legal claims.

What to do immediately

1. Protect yourself if there is an urgent threat

If a message contains a credible threat of immediate physical harm, someone is approaching your home or workplace, or you believe you are in danger, contact 911 or the nearest police station. Do not meet a threatening collector alone.

Tell a trusted person what is happening. If the sender knows your home or work address, inform household members, building security, or workplace security without circulating more personal information than necessary.

Do not pay money to a new personal account merely because someone threatens arrest, exposure, or violence. Verify payment instructions through the lender’s official channel.

2. Preserve evidence before changing the phone

Keep the original device and messages where possible. Save:

screenshots showing the complete message, sender, date, and time;
screen recordings that show the conversation in sequence;
call logs, voicemail, recorded messages, and the numbers used;
the app’s name, icon, developer, app-store page, download link, and version;
the privacy notice, loan agreement, disclosure statement, repayment schedule, and collection policy;
proof of amounts received and payments made;
receipts, bank or e-wallet records, reference numbers, and account details used for collection;
screenshots of every permission requested or granted;
posts, group chats, edited photographs, or messages sent to your contacts;
statements or screenshots from relatives, coworkers, or references who were contacted;
emails or written complaints sent to the company and its replies;
the collector’s name, agency, claimed position, and the lender represented; and
the corporate name shown in the contract, not only the app’s brand name.

Keep unedited originals. Back them up to secure storage and make a chronological incident log. Note which contact received what information and when. Avoid cropping away dates, usernames, URLs, or phone numbers that may help authenticate the evidence.

If a post may disappear, save its URL and capture the account name, profile, date, comments, and surrounding page. Do not retaliate by publicly posting the collector’s private information.

3. Limit further access

After preserving the evidence:

review the app’s permissions and revoke access that is no longer necessary;
change passwords for email, banking, e-wallet, and social-media accounts if compromise is possible;
enable multifactor authentication;
review logged-in devices and active sessions;
warn contacts not to click links, send money, or provide information to the collector;
use the platform’s reporting tools against abusive accounts or posts; and
block abusive numbers if doing so will not interfere with evidence preservation or a safety plan.

Revoking phone permissions does not erase data the operator already copied. A written privacy request and, when necessary, an NPC complaint may still be needed.

Send the company a written complaint

Use the lender’s official email address, in-app support facility, or consumer-assistance channel. Address the message to its consumer-assistance unit and data protection officer, if identified.

State only verifiable facts:

Your name and loan or account reference.
The dates, numbers, accounts, and names involved.
The exact conduct complained of.
The personal data accessed, used, or disclosed.
The people or platforms to which it was disclosed.
The harm or risk caused.
The action you want the company to take.

You may request that it:

stop abusive communications and contact you only through a specified lawful channel;
stop contacting non-guarantors;
remove public posts and instruct recipients or agents to stop further disclosure;
identify the company and collection agency responsible;
explain the source, purpose, lawful basis, recipients, and retention period for your data;
provide access to the personal data it holds, subject to lawful limitations;
correct inaccurate information;
block, erase, or destroy unlawfully obtained or unnecessary data where legally required;
preserve relevant records for the investigation; and
provide a written resolution and an accurate statement of account.

Keep proof of delivery. This written step is particularly important for an NPC complaint because the current NPC complaint form asks whether you first notified the respondent in writing. If you did not, you must explain why—for example, an urgent safety risk, inability to identify or contact the operator, or another circumstance making prior notice impracticable. Whether that explanation is sufficient is for the NPC to determine.

Do not sign an admission, waiver, restructuring agreement, or settlement you do not understand. If you dispute the debt or amount, say exactly what is disputed while keeping the harassment complaint separate.

Report unfair collection to the SEC

The SEC generally regulates lending companies and financing companies, including their reported online lending platforms. Submit the complaint to the SEC Financing and Lending Companies Department through:

SEC iMessage portal
Hotline: 1-4732 (1-4SEC)

Identify both the app and the corporate lender. Attach the loan documents, screenshots, payment records, communications, and your written complaint to the company. Explain whether the collector contacted non-guarantors, disclosed the debt, made threats, impersonated authorities, or used abusive language.

Ask the SEC to verify whether the company is registered and has authority to operate as a lending or financing company. Corporate registration alone does not necessarily establish authority to conduct a lending business, and an app-store listing is not proof of SEC authorization.

If the provider is supervised by the BSP rather than the SEC, use its internal consumer-assistance mechanism and then follow the BSP consumer-assistance process. Complaints involving cooperatives or other specially regulated providers may fall under a different financial regulator.

File a privacy complaint with the NPC

Use the NPC’s current Complaint-Affidavit form and filing instructions. As of the source-check date, the NPC instructs complainants to:

Download and complete the prescribed form.
Attach all supporting evidence.
Include a valid government-issued ID.
Have the complaint-affidavit notarized.
Submit it in person, by courier, or by scanned email using the address shown on the official filing page and current form.
Check the applicable NPC schedule of fees and charges.

The March 2026 form requires the respondent’s information, the personal data processed, the alleged violations, a chronological narrative, the relief requested, supporting evidence, verification, and certification against forum shopping. Failure to attach evidence can result in outright dismissal.

Describe the privacy issue precisely. Instead of writing only “the app harassed me,” state, for example:

what personal data was collected;
what permission or notice was presented;
what purpose was disclosed;
why the collection or later use was unauthorized, excessive, or disproportionate;
what was sent or posted;
who received it;
whether those recipients were guarantors;
what request you made to the company; and
how the company responded.

If the same issues are already pending before a court, tribunal, or another quasi-judicial agency, disclose that fact in the certification. If a same or similar action is filed later, comply with the complaint form’s requirement to notify the NPC within five calendar days after learning of it.

NPC proceedings can result in administrative remedies. Possible criminal prosecution under the Data Privacy Act is not automatic: criminal liability and penalties require the proper proceedings and proof of the specific statutory offense.

Report threats, fraud, or cybercrime

The March 2026 joint government advisory lists these channels for other harassment, threats, fraud, or scams:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; telephone (632) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; telephone (632) 8723-0401 local 7491

For immediate danger, call 911 or go to the nearest police station.

Bring or attach the original messages, screenshots, URLs, payment instructions, account details, phone numbers, and identification information used by the sender. Describe exactly what was threatened or demanded. Do not label conduct as extortion, libel, identity theft, or another crime unless you can first state the underlying facts; investigators and prosecutors determine the appropriate offense.

A collector’s unsupported claim that you will be immediately arrested for ordinary nonpayment should be documented. The Philippine Constitution prohibits imprisonment for debt, but this does not prevent civil collection or prosecution for a genuinely separate crime supported by evidence. A lender cannot lawfully manufacture criminal liability simply to frighten a borrower into paying.

If you are not the borrower

You may still complain if the app collected, used, or disclosed your own personal data or repeatedly contacted you.

Tell the collector in writing that:

you are not the borrower;
you did not consent to be a guarantor, if that is true;
you do not accept liability for the loan;
it must stop using your details for collection; and
it should identify where it obtained your information.

Preserve the messages and submit your own complaint when your data or rights were affected. Do not share the borrower’s address, employer, whereabouts, or other information merely to stop the calls.

Reporting does not erase a legitimate debt

Privacy and collection violations should be addressed independently from the loan balance. A borrower should request:

the signed or electronically accepted agreement;
the amount actually released;
an itemized statement of principal, interest, fees, penalties, and payments;
the disclosure statement;
the lender’s full corporate identity and authority to operate; and
official payment instructions.

Pay only through a verified channel and keep receipts. Do not assume that misconduct automatically makes the entire loan void. Conversely, do not accept a collector’s assertion that an unpaid balance excuses threats or public disclosure.

If charges appear unexplained, the amount differs from the contract, or the interest and penalties appear grossly excessive, obtain individualized legal advice. The validity or reduction of charges depends on the contract, disclosures, governing regulations, and particular facts.

Common mistakes to avoid

Deleting the app or messages too soon. Capture the evidence first.
Reporting only the app’s trade name. Find the corporate lender and any collection agency named in the contract or privacy notice.
Submitting cropped screenshots without dates or sender information.
Making broad accusations without identifying the exact words, disclosure, recipient, date, and data involved.
Failing to complain to the company in writing or failing to explain why prior notice was unsafe or impossible.
Assuming a character reference is automatically a guarantor.
Paying a collector’s personal bank or e-wallet account without verification.
Posting IDs, contracts, phone numbers, or private conversations publicly while asking for help.
Retaliating with threats or harassment.
Ignoring genuine court papers. Verify them directly with the named court and obtain legal help; do not rely on the collector’s explanation.
Confusing a regulator’s complaint process with emergency protection. Contact police immediately when there is a credible threat.

When legal help is urgent

Consult a Philippine lawyer promptly if:

there is a credible threat to life, safety, property, employment, or family;
intimate images, fabricated sexual content, IDs, or sensitive records were posted or threatened with release;
the collector is impersonating police, lawyers, courts, or government agencies;
your account, SIM, e-wallet, or identity may have been taken over;
many people received your personal data;
you suffered job loss, financial loss, medical harm, or another loss you may need to prove;
you received a subpoena, summons, warrant, or document that may be genuine;
you are considering damages, an injunction, criminal charges, or a settlement;
the company cannot be identified or appears to operate from outside the Philippines; or
the same dispute is already before more than one agency or court.

Those unable to afford private counsel may ask the Public Attorney’s Office about eligibility for legal assistance. Availability and representation depend on PAO rules and the facts of the matter.

Frequently asked questions

Can a lending app message everyone in my contacts?

No. Current joint DICT-NPC-SEC guidance prohibits contacting people in the borrower’s contact list for collection unless they are guarantors. Contact-list processing must also be necessary, proportionate, and tied to a specified legitimate purpose.

Can the lender contact my character reference?

A character reference may be used for identification or verification consistent with the disclosed lawful purpose. A reference who did not separately consent to guarantee the loan should not be treated as liable or contacted for debt collection.

Is repeated calling automatically harassment?

Not necessarily. Legitimate reminders are allowed. Frequency, timing, content, recipients, deception, insults, threats, and refusal to respect reasonable communication arrangements determine whether conduct may be abusive.

Can I revoke the app’s permissions?

Yes, you can revoke unnecessary device permissions. Preserve evidence first. Revocation stops future device access through that permission but may not delete information already obtained.

Can I demand that all my data be deleted immediately?

You may request blocking, erasure, or destruction of data that was unlawfully obtained, used for unauthorized purposes, or is no longer necessary. The lender may lawfully retain some records for an existing contract, regulatory duties, transaction documentation, or legal claims. The answer depends on the data and purpose involved.

Should I stop paying because the collector violated my privacy?

A complaint does not automatically extinguish a valid debt. Request an accurate statement of account, dispute questionable charges in writing, and use only verified payment channels. Seek legal advice before withholding payment based solely on the collection misconduct.

Can I be arrested simply because I did not pay an online loan?

The Constitution prohibits imprisonment for debt. Ordinary nonpayment is generally addressed through civil remedies. A separate offense—if one is genuinely alleged—requires its own facts, evidence, and lawful process. A collector cannot order your arrest or truthfully guarantee that police will arrest you merely for an unpaid balance.

May I file with both the SEC and NPC?

Yes, when the facts involve both unfair collection and misuse of personal data. You may also report possible crimes to law enforcement. Clearly disclose related proceedings whenever an agency’s forms or rules require it.

What if the app has disappeared from the app store?

Preserve the download link, screenshots, contract, payment accounts, messages, and corporate details. The disappearance of an app does not prevent a complaint, although identifying the responsible company may require investigation.

Official references

This article provides general Philippine legal information, not legal advice or a prediction of any complaint’s outcome. The proper agency, remedies, deadlines, and liability may depend on the lender’s regulatory status, the documents, and the specific communications involved. Official sources and procedures were checked as of 2 September 2026.