Quick answer

Online lending apps and their collectors may demand payment through lawful, proportionate means, but they may not threaten violence, publicly shame you, impersonate government officials, disclose your debt to unrelated persons, or misuse your photographs, messages, social-media information, or phone contacts.

Report the conduct according to the violation:

Unfair collection by a lending or financing company: Securities and Exchange Commission (SEC)
Unauthorized collection, disclosure, or misuse of personal data: National Privacy Commission (NPC)
Threats, extortion, fraud, impersonation, or other possible crimes: Philippine National Police Anti-Cybercrime Group (PNP-ACG), National Bureau of Investigation Cybercrime Division (NBI-CCD), or the appropriate police station
Conduct by a bank, e-wallet issuer, or other BSP-supervised institution: complain first to the institution, then elevate the matter through the Bangko Sentral ng Pilipinas consumer-assistance mechanism when appropriate

These remedies may be pursued together when the same conduct involves regulatory, privacy, and criminal violations. Filing a complaint, however, does not automatically cancel a legitimate loan. Continue disputing or paying only through verified, documented channels, as the circumstances require.

What collectors are prohibited from doing

Under the SEC rules against unfair debt-collection practices, the Data Privacy Act of 2012, and NPC rules for loan-related data, a collector may not use collection methods that unlawfully injure a borrower’s safety, dignity, reputation, or privacy.

Potential violations include:

threatening physical harm, arrest, imprisonment, deportation, job loss, property damage, or another consequence the collector cannot lawfully impose;
using obscene, insulting, degrading, or intimidating language;
repeatedly contacting a person at unreasonable times or with a frequency intended to harass;
pretending to be a police officer, lawyer, court employee, government agency, or other person;
sending fabricated warrants, summonses, court orders, demand letters, or government notices;
publishing the borrower’s photograph, identification document, loan details, or supposed delinquency on social media;
editing a borrower’s photograph into a “wanted,” “scammer,” or similarly humiliating image;
contacting people harvested from the borrower’s phone or social-media accounts who were not validly identified as guarantors;
telling an employer, colleague, relative, neighbor, or unrelated third person about the debt merely to shame or pressure the borrower;
using a character reference as if that person were automatically liable for the loan; or
retaining or using personal data beyond a lawful, necessary, and proportionate purpose.

A legitimate demand for payment is not harassment merely because it is unwelcome. The facts that usually matter are the collector’s language, frequency, timing, identity, recipients, threats, disclosures, and use of personal data.

Phone contacts, character references, and guarantors are different

The government’s March 18, 2026 joint advisory on online lending platforms distinguishes ordinary contacts, character references, and guarantors.

A lending app may not indiscriminately harvest and use a borrower’s contact list for collection. It should use a separate interface through which the borrower selects specific references or guarantors.

A character reference is ordinarily supplied for identification or verification. Being named as a reference does not, by itself, make that person responsible for the debt.

A guarantor must have expressly consented to assume responsibility for the obligation. For collection purposes, the 2026 advisory states that persons in the borrower’s contact list other than the borrower’s guarantors must not be contacted. Merely appearing in someone’s phonebook—or being identified as a relative, friend, or co-worker—does not create liability for the loan.

Consent does not authorize unlimited access or public shaming

Tapping “Allow” or accepting an app’s terms does not give the lender unlimited authority over a person’s data. Personal-data processing must still have a lawful basis and comply with transparency, legitimate purpose, and proportionality.

Under NPC Circular No. 20-01, as subsequently amended:

app permissions must be suitable, necessary, and not excessive;
camera or gallery access may be used for legitimate identity-verification or fraud-prevention purposes, but a borrower’s photograph may never be used to harass or embarrass the borrower;
unrestricted harvesting or saving of phone or social-media contacts for collection or harassment is prohibited;
permissions should be disabled, or the borrower prompted to disable them, once their legitimate purpose has been achieved; and
the lender remains accountable for personal data handled by its collection agency or other service provider.

Consent obtained through deception, vague notices, bundled permissions, or interfaces designed to make refusal or withdrawal unnecessarily difficult may not provide a valid basis for the challenged processing.

What to do immediately

1. Preserve evidence before blocking or uninstalling anything

Save the evidence in its original form as far as possible:

screenshots showing the full message, sender, number, account name, date, and time;
screen recordings showing the complete conversation or social-media post;
original SMS messages, emails, voice messages, and call logs;
URLs, usernames, profile identifiers, and copies of public posts;
the app’s name, developer, download page, privacy notice, terms, and permission requests;
collection notices, loan agreements, disclosure statements, repayment schedules, receipts, and transaction records;
proof of the amount actually received and every payment made;
names and statements of relatives, colleagues, or other people contacted;
copies of altered photographs, fabricated legal documents, or threats;
the lender’s corporate name, SEC registration details, certificate of authority information, office address, and customer-service or data-protection contact; and
your written complaint to the company and proof that it was delivered.

Do not crop away identifying information unless you retain an uncropped original. Back up the files to another device or secure storage. Ask third-party recipients to preserve their own copies and write a short account of when and how they received the communication.

2. Secure your phone and accounts

After preserving evidence:

revoke unnecessary permissions for contacts, storage, photos, camera, microphone, location, and SMS;
review accessibility, device-administrator, notification-access, and screen-overlay permissions;
change passwords for email, social media, banking, and e-wallet accounts if compromise is suspected;
enable multi-factor authentication;
remove unknown apps or configuration profiles;
warn contacts not to respond, pay, click links, or disclose verification codes;
report abusive accounts or posts to the platform; and
consider having the device checked if the app behaves like malware.

Uninstalling the app does not necessarily erase data already copied to the lender’s systems.

3. Send a written demand to the lender

Address the complaint to the company, its customer-service unit, and—if identified—its data protection officer. State:

your name and account or loan reference;
the exact conduct complained of;
the numbers, accounts, collectors, or agencies involved;
which data were accessed, disclosed, or misused;
who received the disclosure;
the dates and times of the incidents;
the action demanded; and
a reasonable deadline for an urgent response.

Depending on the facts, request that the company:

stop the harassment and third-party contact;
preserve relevant call recordings, system logs, collector assignments, and disclosure records;
identify the company and collection agency responsible;
disclose the source, recipients, purpose, and manner of processing your data;
correct inaccurate information;
block, remove, or securely dispose of data unlawfully obtained or no longer necessary;
remove public posts or altered photographs;
communicate only through a specified lawful channel; and
provide a written accounting of the debt.

Keep proof of delivery. This written notice is particularly important for an NPC complaint.

How to complain to the SEC

The SEC regulates lending companies and financing companies, including their reported online lending platforms. Its complaint process covers unfair collection and violations of laws and regulations within its jurisdiction.

The government’s current joint advisory directs complaints about unfair collection to the SEC Financing and Lending Companies Department through iMessage SEC or hotline 1-4732 (1-4SEC). Check the SEC’s current filing instructions before submission because channels and documentary requirements may change.

Prepare:

one complaint for each respondent company;
the company’s legal name and the app or platform name;
a clear chronological narration;
copies of the loan and disclosure documents;
screenshots, messages, call logs, posts, and witness information;
payment records and a computation of the disputed balance, if relevant; and
a copy of a valid government-issued ID.

The SEC’s published complaint guidance for lending and financing companies warns that incomplete complaints or complaints unsupported by evidence may be dismissed. It also explains that an SEC regulatory complaint does not, by itself, cancel the loan, rewrite its terms, or conclusively declare the contract void.

Before borrowing or reporting, check whether the operator appears in the SEC’s current lists of registered lending or financing companies and whether it is authorized to operate the platform. An app-store listing is not proof of SEC authority.

How to file a privacy complaint with the NPC

Use the NPC process when the conduct involves unauthorized access, collection, retention, disclosure, publication, or other misuse of personal data.

Written notice generally comes first

Under the 2021 NPC Rules of Procedure, a complainant generally must first:

inform the lender, collection agency, or other concerned entity in writing of the privacy violation or personal-data breach; and
show that it failed to take timely or appropriate action, or gave no response within 15 calendar days from receipt.

The NPC may waive this exhaustion requirement for good cause or a serious violation—for example, where urgent NPC action is needed to prevent grave and irreparable harm, no adequate remedy is available from the respondent, or the conduct is patently illegal. If relying on an exception, explain and prove why it applies.

Formal requirements

A formal NPC complaint generally must be:

written, signed, and verified;
filed by the affected data subject or an authorized representative;
supported by a special power of attorney when a representative files;
directed against an identified respondent, or accompanied by facts that can lead to identification;
supported by a factual narrative and documentary or testimonial evidence;
accompanied by correspondence showing the prior written notice and the respondent’s action or inaction;
specific about the relief requested; and
accompanied by the required certification against forum shopping.

A filing fee may apply unless an exemption or waiver is available. Review the NPC’s current File a Complaint page and prescribed forms before filing. Failure to meet the requirements can result in dismissal without prejudice.

Affected contacts may file their own complaints because they are data subjects in relation to their names, numbers, messages, or other information. A borrower cannot automatically pursue another adult’s personal privacy claim without proper authority.

When to report to cybercrime or law-enforcement authorities

Go beyond the regulatory complaint when the messages or conduct may constitute a crime, such as:

a credible threat of violence or physical injury;
extortion or a demand for money accompanied by unlawful threats;
fraudulent payment instructions;
identity theft or unauthorized account access;
impersonation of police, courts, lawyers, or government agencies;
fabricated warrants or criminal cases;
publication of defamatory accusations through a computer system;
stalking, sexual threats, or dissemination of intimate material; or
continued harassment creating an immediate safety risk.

The 2026 government advisory lists these channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; telephone (632) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph; telephone (632) 8723-0401 local 7491

Verify current contact details on the agencies’ official websites before sending sensitive records. For immediate danger, contact the nearest police station or emergency services. Bring the original device and an organized copy of the evidence when asked.

The precise offense depends on the words used, how they were communicated, who received them, the collector’s intent, and the surrounding circumstances. Not every rude message constitutes a criminal offense, while a single specific and credible threat may require urgent action.

If the lender is supervised by another regulator

Confirm who actually extended the credit:

Lending and financing companies generally fall under the SEC.
Banks, digital banks, and many other BSP-supervised financial institutions fall under the BSP.
Cooperatives may fall under the Cooperative Development Authority, depending on the activity.
Privacy violations remain within the NPC’s mandate regardless of which financial regulator supervises the lender.

The Financial Products and Services Consumer Protection Act requires regulated financial service providers to maintain consumer-protection and redress mechanisms and gives the appropriate financial regulator enforcement powers. Begin with the provider’s internal complaint mechanism when required, but report urgent threats or crimes immediately.

What happens to the loan while a complaint is pending?

A regulatory, privacy, or criminal complaint does not automatically erase the principal, stop contractual charges, or prevent lawful collection. Separate the two issues:

Is there a valid obligation, and what amount is legally due?
Did the lender or collector use an unlawful method?

A borrower may owe a valid debt while still having a strong complaint for harassment or misuse of data. Conversely, paying the debt does not necessarily waive an existing privacy or harassment complaint.

Request a written statement showing:

the principal actually released;
interest and its contractual basis;
service, processing, late, and other fees;
payments and the dates credited; and
the current balance.

Do not send payment to a personal account or a newly supplied channel until the lender confirms it through an independently verified official contact. Preserve proof of every payment.

Common mistakes to avoid

Deleting the app or messages before preserving evidence.
Submitting screenshots without dates, sender details, or surrounding conversation.
Naming only the app when the legal company operating it can be identified.
Filing an NPC complaint without first giving written notice or explaining why the requirement should be waived.
Assuming a character reference is a guarantor.
Paying a collector’s personal account without verifying authority.
Posting IDs, contracts, phone numbers, and unredacted evidence publicly.
Threatening or insulting collectors in return. This may complicate the evidence and create separate issues.
Assuming a complaint automatically cancels the debt.
Ignoring formal legal papers. A genuine summons or subpoena should be verified directly with the named court or agency and addressed promptly.

When legal help is urgent

Consult a lawyer promptly when:

threats involve violence, sexual harm, kidnapping, or harm to children;
intimate images, identification documents, or sensitive records were published;
the collector contacted an employer or large group and caused measurable reputational or economic loss;
money was taken through unauthorized transactions;
the company appears fictitious or cannot be identified;
you received an authentic summons, subpoena, or court pleading;
multiple agencies or companies are involved;
you intend to claim damages or seek urgent injunctive relief; or
prescription periods may be approaching.

A lawyer can help identify the proper respondents, preserve electronic evidence, distinguish regulatory from criminal claims, and avoid inconsistent allegations across different proceedings.

Frequently asked questions

Can a lending app contact everyone in my phone?

No. Unrestricted harvesting and use of contact lists for debt collection or harassment is prohibited. Under the 2026 joint advisory, collection contact may not be directed to persons on the borrower’s contact list other than guarantors who actually consented to that role.

Can the collector call my employer or relatives?

A collector cannot disclose the debt to unrelated persons merely to embarrass or pressure you. Whether a particular communication was permissible depends on the recipient’s actual role, the information disclosed, its purpose, and whether the contact was necessary and proportionate.

Does accepting the app’s permissions make everything lawful?

No. Permissions and consent do not excuse excessive, deceptive, unnecessary, or incompatible processing. The lender must still comply with the Data Privacy Act and NPC rules.

Can a reference be forced to pay?

Not merely because the person was listed as a character reference. Liability as a guarantor requires a legally sufficient undertaking and consent; the relevant documents must be examined.

Must I wait 15 days before going to the NPC?

Ordinarily, you must first notify the respondent in writing and allow it to act. A complaint may proceed after an inadequate response or no response within 15 calendar days from receipt. The NPC may waive this requirement for proven good cause or a serious and urgent violation.

Can I report the same incident to the SEC, NPC, and police?

Yes, when distinct aspects fall within their respective mandates. Disclose related pending cases where the applicable form or certification requires it, and keep your factual account consistent.

Will reporting erase my loan?

No. The legality of the collection conduct and the existence or amount of the debt are separate questions.

What if I never borrowed from the app?

Preserve the messages and obtain any available account details. State clearly that you deny applying for or receiving the loan. Possible identity theft, fraud, or erroneous data processing should be reported promptly to the company, the NPC, and law-enforcement authorities as the evidence warrants.

Official references

This article provides general legal information, not advice for a particular case. Outcomes depend on the loan documents, communications, parties, evidence, and applicable regulator. Official procedures and contact channels should be rechecked before filing. Law and official guidance checked as of August 25, 2026.