Quick answer

If an online lending app threatens, insults, publicly shames, impersonates authorities, contacts people who did not guarantee the loan, or misuses your contacts, photos, or other personal data, preserve the evidence and report the conduct to the proper agency:

Securities and Exchange Commission (SEC): unfair debt collection by lending and financing companies, including unregistered operators. File through SEC iMessage under the Financing and Lending Companies Department (FINLEND).
National Privacy Commission (NPC): unauthorized, excessive, or harmful collection, use, retention, or disclosure of personal data. Follow the NPC formal complaint procedure.
PNP, NBI, or DICT: threats, extortion, fraud, impersonation, identity theft, account intrusion, or other possible cybercrime. For immediate danger, call the nationwide Unified 911 emergency hotline.
Bangko Sentral ng Pilipinas (BSP): if the lender is a bank, e-money issuer, pawnshop, or another BSP-supervised institution rather than an SEC-regulated lending or financing company.

You may use more than one channel because unfair collection, privacy misuse, and possible crimes are different issues. The government’s March 2026 joint DICT-NPC-SEC advisory expressly directs the public to report abusive conduct.

Reporting harassment does not automatically cancel a valid loan. Continue to address any legitimate balance through a verified official payment channel, or dispute the amount in writing. The Constitution prohibits imprisonment for debt alone, but separate conduct such as fraud may present a different legal issue. See Article III, Section 20 of the Constitution.

What conduct may be reported

Unfair debt collection

SEC rules prohibit collection methods such as:

Threatening violence, property damage, reputational harm, or other criminal acts.
Threatening arrest, prosecution, seizure, or another action the collector cannot lawfully take.
Using obscenities, degrading insults, or abusive language that may itself amount to an offense.
Publicly posting or circulating a borrower’s name, photograph, loan status, identification document, or other personal information outside a lawful disclosure.
Sending false loan information, including omitting that the alleged debt is disputed.
Pretending to be

Quick answer

If an online lending app threatens, insults, publicly shames, impersonates authorities, contacts people who are not valid guarantors, or misuses your contacts, photos, messages, or other personal data, preserve the evidence and report the conduct to the proper agency:

Securities and Exchange Commission (SEC): unfair debt collection by lending or financing companies, including unregistered operators. File through the SEC iMessage Portal under the Financing and Lending Companies Department.
National Privacy Commission (NPC): unauthorized, excessive, or harmful collection, use, storage, or disclosure of personal data. Follow the NPC’s formal complaint procedure.
PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT Cyber Hotline: threats, extortion, fraud, impersonation, identity theft, account intrusion, or other possible crimes.
Bangko Sentral ng Pilipinas (BSP): if the lender is a bank, e-money issuer, or another BSP-supervised institution.

Harassment can be unlawful even when the debt is real or overdue. Reporting it does not automatically cancel a valid loan, however. Continue addressing the debt through a verified official channel, or dispute the balance in writing if it is wrong. The Constitution prohibits imprisonment for debt alone, although independently fraudulent or criminal conduct is a different matter. See Article III, Section 20 of the Constitution.

What online lenders are not allowed to do

Unfair debt collection

SEC rules prohibit financing and lending companies—and collectors acting for them—from using practices such as:

Threatening violence, property damage, reputational harm, or another criminal act.
Threatening an action that cannot legally be taken, such as automatic arrest merely for an unpaid debt.
Using obscenities, insults, or abusive language amounting to an offense.
Publishing or circulating a borrower’s name, photo, loan information, or other personal details to shame the borrower, except for a disclosure specifically permitted by law.
Giving third parties false loan information or failing to disclose that a debt is disputed.
Pretending to be a court, police officer, lawyer, government agency, or another person.
Using deception to collect a debt or obtain information about the borrower.
Contacting people from the borrower’s phone, email, or social-media contact list who are not parties legally responsible for the loan.
Contacting a borrower before 6:00 a.m. or after 10:00 p.m. The SEC rule contains exceptions where the account is more than 15 days past due or the borrower expressly agreed that those hours are the only reasonable times for contact. Even then, threats, deception, public shaming, and other abusive practices remain prohibited.

These rules are summarized in an official SEC cease-and-desist order applying Memorandum Circular No. 18, series of 2019.

Privacy violations involving contacts, photos, and other data

An online lender may process only data that is suitable, necessary, and proportionate to a lawful purpose. Current NPC rules provide that:

Unnecessary app permissions and excessive personal-data processing are prohibited.
Access to a camera or photo gallery may be allowed for identity verification, know-your-customer checks, fraud prevention, or payment verification, but only when needed. Access should be turned off or revocable after that purpose is completed.
A borrower’s photo cannot be used to embarrass or pressure the borrower.
An app may provide limited contact-list access so the borrower can select a reference or guarantor, or may derive proportionate metadata for a legitimate purpose. It cannot indiscriminately copy, store, or use the entire contact list.
Contact-list processing that leads to harassment, unfair collection, or collection from people other than valid guarantors is prohibited.
A character reference is for checking the borrower’s identity or the truth of application information. A reference is not automatically a guarantor and should not be pursued for payment.
A guarantor must separately consent to becoming responsible for the debt. A genuine co-maker or other borrower named in valid loan documents may be contacted in that person’s own capacity; a random contact cannot simply be relabeled a guarantor or co-maker.
Personal data may be retained only while necessary for the original purpose, legal claims, or a legal retention requirement. It must later be securely disposed of.

These standards appear in NPC Circular No. 20-01, its 2022 amendments, and the March 2026 joint DICT-NPC-SEC advisory.

Giving an app permission does not authorize unlimited processing or harassment. On the other hand, withdrawing consent does not necessarily require deletion of records the lender still lawfully needs to service the loan, comply with law, or establish or defend a legal claim.

Preserve evidence before blocking or uninstalling the app

Do this as soon as possible:

Capture the app’s identity. Save the app name, icon, store listing, download link, developer name, corporate name, privacy policy, app version, SEC registration number, and Certificate of Authority number displayed in the app or advertisement.
Save complete communications. Keep original texts, emails, chat threads, direct messages, call logs, voicemails, collection notices, and social-media posts. Screenshots should show the sender’s number or account, date and time, full message, and surrounding conversation.
Ask contacted people to preserve their copies. A relative, co-worker, employer, or friend should retain the actual message on their device. Record whether that person was ever named as a character reference, guarantor, co-maker, or borrower.
Document the connection to the lender. Save messages in which the sender names the app, quotes your loan details, provides the lender’s payment channel, or otherwise shows that the collector acts for the lender.
Capture permissions and data use. Take screenshots or a screen recording of the app’s permissions, privacy notice, consent screens, and any prompts requiring access to contacts, camera, photos, location, storage, microphone, or social-media accounts.
Preserve loan records. Keep the loan agreement, disclosure statement, repayment schedule, receipts, payment confirmations, account ledger, and any written dispute about the amount.
Make a chronology. List each incident by date, time, sender, recipient, exact conduct, data disclosed, and action you took.
Keep originals unchanged. Back them up securely, but do not crop, annotate, or overwrite the only copy. Keep the original device where practicable.

Screenshots without context may be insufficient. In an NPC lending case, the complainant failed to establish who sent the messages, who received them, and whether the recipients were nominated references. The NPC emphasized authentication and supporting affidavits from recipients with personal knowledge. See GJJ v. Creditable Lending Corporation.

Do not secretly record a private phone conversation without legal advice. The Anti-Wiretapping Act generally requires authorization from all parties, even when the person recording is part of the conversation. Preserve voicemails and make contemporaneous written notes instead. See Republic Act No. 4200 and Ramirez v. Court of Appeals.

Secure your phone and accounts

After preserving the evidence:

Revoke unnecessary contacts, camera, photo, location, microphone, storage, and social-media permissions in the phone’s settings.
Change passwords for your email, social media, cloud storage, and financial accounts if the app may have obtained access.
Enable multi-factor authentication.
Review logged-in devices and remove sessions you do not recognize.
Never give a collector an OTP, PIN, password, or remote-control access to your device.
Warn affected contacts not to click links, send money, disclose information, or respond to threats.
Block abusive numbers or accounts after saving the evidence.
Uninstall the app if needed for safety, but first save your agreement, account information, receipts, privacy notice, and the app’s identifying details.
Make payments only through a channel you have independently verified with the lender. Do not send money to an unfamiliar personal account merely because a threatening message demands it.

Send the lender a written complaint and privacy notice

Write to the lender’s customer-service channel and data protection officer, if identified in its privacy notice. Email is useful because it creates proof of delivery. Keep the sent message, attachments, acknowledgment, ticket number, and response.

State:

Your name and account or loan reference number, without sending unnecessary sensitive information.
The app and corporate operator involved.
The dates, numbers, accounts, and collectors involved.
The exact threats, abusive statements, third-party contacts, or disclosures.
Which personal data was accessed, used, stored, or disclosed.
Whether the debt or amount is disputed.
Which recipients were not guarantors, co-makers, or other borrowers.
The relief you want—for example, stop contacting third parties, stop the abusive collector, correct the account, identify the source and recipients of disclosed data, restrict unlawful processing, and confirm remedial action.
A request that the lender preserve relevant records, including collector instructions, call logs, messages, access logs, app-permission records, consent records, and the identity of collection agencies or service providers.
A reasonable written-response deadline.

For an eventual NPC complaint, expressly identify the conduct as a claimed privacy violation and keep proof that the lender received your notice.

Report unfair collection to the SEC

For a lending or financing company, submit a complaint through the SEC iMessage Portal and route it to the Financing and Lending Companies Department (FINLEND). The March 2026 joint advisory also lists the SEC hotline 1-4732 (1-4SEC).

Attach or describe:

Your chronology.
Screenshots, messages, call logs, and posts.
The actual messages received by third parties.
The app-store page and developer details.
The lender’s corporate name, SEC registration number, and Certificate of Authority number, if available.
The loan agreement, disclosure statement, and payment records.
Your written complaint to the lender and its response.
An explanation of how each sender is connected to the lender or collector.

Use Check with SEC to verify the corporate name and authority claimed by the operator. Report the app even if it appears unregistered or hides its operator. Include every identifying detail you have.

The NPC’s 15-day exhaustion rule discussed below applies to an NPC privacy complaint; it is not a reason to delay an urgent SEC or police report.

File a privacy complaint with the NPC

First notify the respondent and allow 15 calendar days

As a general rule, the NPC will not give a complaint due course unless you prove that:

You informed the lender, app operator, collector, or other concerned entity in writing of the privacy violation or personal-data breach; and
It failed to take timely or appropriate action, or did not respond within 15 calendar days after receiving your notice.

The NPC may waive these requirements for proven good cause or a serious violation involving a risk of harm—for example, grave and irreparable harm requiring NPC action, lack of a plain and adequate remedy from the respondent, or patently illegal conduct. If you need a waiver, state the facts and attach proof rather than merely describing the case as urgent. These requirements are in the 2021 NPC Rules of Procedure, as amended.

Do not wait 15 days before contacting police, emergency services, the SEC, or another appropriate authority when there is an immediate threat.

Complete the current complaint form

Use the NPC’s current Complaint-Affidavit form dated March 1, 2026. Follow its instructions carefully. The complaint generally must be written, signed, verified, and notarized.

Include:

Your contact information and a valid government-issued ID.
The respondent’s legal name and address, if known.
A chronological narration of the facts.
The specific personal data processed or disclosed.
Copies of your written notice to the respondent, proof of receipt, and its response.
Documentary evidence and relevant witness affidavits.
The relief requested.
The required verification and certification against forum shopping.
An explanation and proof if you are asking the NPC to waive prior notice or the 15-day period.

Failure to attach supporting evidence can lead to outright dismissal.

Pay the applicable fee or request an exemption

The fee schedule currently linked by the NPC lists:

A ₱500 base filing fee for a complaint.
A legal research fee equal to 1% of the filing fee, but not less than ₱10.
Additional filing fees when damages are claimed.
Separate fees and bonds for special applications such as a temporary ban on processing.

An indigent litigant may qualify for exemption by showing both that the litigant’s and immediate family’s gross income does not exceed twice the applicable monthly minimum wage and that the litigant owns no real property with a fair market value above ₱300,000, together with the required certificates and affidavits. Check the current NPC schedule of fees and obtain official payment instructions before paying.

Submit the complaint

The NPC filing page permits filing personally, by courier, or by scanning the completed notarized complaint and emailing it to complaints@privacy.gov.ph. Follow the page’s current PDF and electronic-signature instructions.

The NPC can order compliance, impose administrative fines, award indemnity where legally supported, permanently ban processing, or recommend prosecution to the Department of Justice. The outcome depends on the evidence and the particular violation.

Report threats, fraud, or other possible crimes

Contact law enforcement promptly when messages involve:

A credible threat of violence, abduction, stalking, or property damage.
Extortion or a demand backed by threats to publish private information.
Impersonation of police officers, courts, lawyers, or government agencies.
Identity theft, a loan you did not obtain, or use of a stolen ID.
Unauthorized access to your phone, accounts, email, or social media.
Fabricated arrest warrants, summonses, cases, or government documents.
Sexual threats, intimate images, or threats involving a child.
Fraudulent payment links or demands to transfer money to an unknown person.

For immediate danger, call the nationwide Unified 911 emergency hotline. For cyber-related complaints, the government’s March 2026 advisory lists:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph; (02) 8723-0401 local 7491

Bring your ID, original device, evidence backups, printed chronology, loan records, and names of witnesses. Ask for an incident, complaint, or reference number. A regulator’s administrative investigation does not replace a police or prosecutorial complaint when the conduct may be criminal.

If the lender is supervised by the BSP

If the app is operated by a bank, non-bank e-money issuer, pawnshop, money-service business, payment-system operator, or another BSP-supervised institution, first complain through that institution’s Financial Consumer Protection Assistance Mechanism.

If its action is unsatisfactory, escalate through the BSP Online Buddy (BOB) on the BSP website. If you cannot use BOB, submit the BSP complaint form and evidence to consumeraffairs@bsp.gov.ph. See the BSP’s current complaint guide.

A lender’s name, license, and actual regulator matter. An app associated with an SEC-regulated lending company is ordinarily reported to the SEC, while a loan offered directly by a BSP-supervised institution follows the BSP route. Privacy violations may still be reported separately to the NPC.

Common mistakes to avoid

Deleting the app, messages, or account before preserving evidence.
Submitting cropped screenshots that hide the sender, date, time, or conversation context.
Relying only on forwarded screenshots instead of obtaining the recipient’s original message and statement.
Naming only the app brand and not identifying the corporate operator or collection agency.
Failing to show how an anonymous number is connected to the lender.
Filing with the NPC without first giving written notice and waiting 15 calendar days, unless a waiver is properly supported.
Assuming a complaint automatically cancels the loan or pauses interest and charges.
Sending an ID, selfie, OTP, or other sensitive data to an unverified collector.
Paying a threatening sender without independently confirming the account with the lender.
Secretly recording private calls without considering the Anti-Wiretapping Act.
Exaggerating events or submitting altered evidence. State only what you can personally prove.

When legal help is urgent

Consult a lawyer promptly if there is continuing mass disclosure, workplace harassment, threats against children or family members, identity theft, an unauthorized loan, intimate-image threats, a police or court document you cannot verify, significant financial loss, or a need for an emergency order restricting data processing.

If private counsel is not affordable, ask the Public Attorney’s Office about eligibility or contact the Integrated Bar of the Philippines National Center for Legal Aid.

Frequently asked questions

Can a lending app contact my family, friends, or employer?

Not merely because their numbers appeared in your phone. Current NPC rules prohibit debt collection from contact-list members other than valid guarantors. A character reference is for identity or application verification and is not automatically liable for the debt. An actual co-maker or other borrower under valid loan documents is different.

What if I clicked “Allow contacts”?

That does not authorize indiscriminate copying, public shaming, harassment, or collection from unrelated contacts. Processing must still be lawful, transparent, necessary, and proportionate.

Can collectors contact me about a real overdue loan?

Yes. A lender may make lawful, proportionate collection efforts and may process data reasonably necessary to enforce the loan. It cannot use threats, deception, abusive language, public exposure, or prohibited third-party contacts.

Should I stop paying after filing a complaint?

A complaint about collection conduct does not by itself extinguish or suspend a valid debt. Pay only through a verified channel, keep receipts, and dispute incorrect charges or balances in writing.

Can I be arrested simply for not paying an online loan?

No person may be imprisoned for debt alone. A lender may pursue lawful civil remedies. Liability for a separately alleged crime depends on facts beyond simple inability or failure to pay, and a collector cannot truthfully claim that arrest is automatic.

Must I wait 15 days before reporting?

The 15-calendar-day period ordinarily applies to the prior-notice requirement for a formal NPC complaint. It does not prevent an immediate SEC report, police complaint, cybercrime report, or emergency call. The NPC can also waive the requirement in properly proven serious cases.

What if I never applied for the loan?

Treat it as possible identity theft or fraud. Do not acknowledge the debt merely to stop the messages. Preserve the evidence, demand the application and identity-verification records in writing, secure your accounts, and report promptly to the lender, NPC, SEC or BSP as applicable, and law enforcement.

Can a contacted friend file a complaint too?

Possibly. A friend or relative whose own personal data was collected, used, or disclosed may be an affected data subject and may have a separate privacy complaint. That person should preserve the original communication and document how the lender obtained and used the data.

This article provides general Philippine legal information, not legal advice for a particular case. Rights, jurisdiction, and remedies depend on the loan documents, identity of the operator, evidence, and specific communications. Official sources and filing procedures were checked as of July 30, 2026.