Quick answer

If an online lending app threatens you, publicly shames you, contacts people who did not agree to guarantee the loan, or misuses your phone data, preserve the evidence and report the conduct to the proper agencies:

Immediate danger or credible threats: Call Unified 911 or go to the nearest police station. You may also report cyber-enabled threats, fraud, or scams to the PNP Anti-Cybercrime Group or NBI Cybercrime Division.
Unfair collection by a lending or financing company: File with the Securities and Exchange Commission (SEC) through SEC iMessage.
Unauthorized access, disclosure, contact-list harvesting, or other misuse of personal data: First notify the lender or its data protection officer in writing. If it does not take appropriate action or respond within 15 calendar days, file a formal complaint with the National Privacy Commission (NPC). The NPC may waive this waiting requirement in serious or patently illegal cases.
A loan issued by a bank, digital bank, non-bank electronic-money issuer, or another BSP-supervised institution: Use the institution’s complaint mechanism first, then escalate an unresolved complaint to the Bangko Sentral ng Pilipinas (BSP).

The government’s March 2026 joint advisory specifically directs the public to report harassment, intimidation, public shaming, threats, fraud, and unlawful use of personal data by online lending platforms. It applies even to entities operating without the required registration or authority. Read the DICT-NPC-SEC Joint Advisory.

Reporting harassment does not automatically cancel a valid loan. A creditor may pursue payment through lawful means, but neither the debt nor a borrower’s consent authorizes threats, humiliation, deception, or disproportionate use of personal data.

What online lenders are prohibited from doing

SEC Memorandum Circular No. 18, Series of 2019 requires lending companies, financing companies, and their collectors to refrain from unfair practices such as:

using or threatening violence or other criminal means to harm a person, reputation, or property;
threatening an action that cannot legally be taken;
using obscenities, insults, or profane language in an abusive manner;
disclosing or publishing borrowers’ names or personal information to shame them;
communicating loan information known, or which should be known, to be false—including failing to say that a debt is disputed when applicable;
using false representations or deceptive means to collect a debt or obtain information;
contacting a borrower before 6:00 a.m. or after 10:00 p.m., subject to the circular’s limited exceptions for accounts more than 15 days past due or the borrower’s recorded consent that those are the only reasonable times; and
contacting people in the borrower’s contact list who were not named as guarantors or co-makers.

The timing exception does not authorize threats, insults, public shaming, deception, or unlawful disclosure. See SEC Memorandum Circular No. 18, Series of 2019.

The Financial Products and Services Consumer Protection Act also protects the rights of financial consumers to fair treatment, data privacy, and timely complaint handling. A financial service provider remains responsible for its employees and agents and may be solidarily liable with an accredited third-party service provider involved in debt collection. Read Republic Act No. 11765.

When collection becomes a privacy violation

The Data Privacy Act does not prevent every use of information connected with a loan. A lender may process information when there is a lawful basis and the processing is necessary, transparent, proportionate, and connected with a legitimate purpose. It may also retain information needed to perform the contract, comply with law, or establish, exercise, or defend legal claims.

However, online lenders may not treat access to your phone as permission to harvest or weaponize everything stored in it. Under NPC Circular No. 20-01, as amended, prohibited or potentially unlawful conduct includes:

requiring unnecessary access to contacts, messages, social-media accounts, photos, files, location, or other phone data;
copying or indiscriminately processing an entire contact list;
using a borrower’s photograph to embarrass or harass the borrower;
accessing a camera or photo gallery beyond a specified and legitimate identity-verification or know-your-customer purpose;
disclosing a debt, balance, photograph, ID, address, or other personal information to friends, relatives, co-workers, employers, or social-media users for shaming or coercion;
using personal data for a purpose materially different from the purpose originally disclosed without another lawful basis;
continuing to retain or process data after it is no longer necessary and no legal ground for retention remains; or
using deceptive interfaces, pre-ticked consent boxes, or designs that make consent easy to give but difficult to withdraw.

An app may have narrowly limited access that allows a borrower to select a character reference or guarantor, or may process proportionate metadata when genuinely necessary for a specified lawful purpose. That is different from copying an entire address book and contacting everyone in it. Read NPC Circular No. 20-01 and NPC Circular No. 2022-02.

Character references are not automatically guarantors

A character reference is ordinarily supplied for identification or verification. A guarantor is someone who has separately and expressly consented to assume responsibility if the borrower defaults. A co-maker is likewise not created merely because the app found someone’s number in the borrower’s phone.

For debt collection through an online lending platform, the 2026 joint advisory states that persons in the contact list other than the borrower’s guarantor must not be contacted. The app must provide separate interfaces for character references and guarantors, and a guarantor must expressly consent to the obligation. A person who never signed, consented, or otherwise legally assumed the obligation should not be treated as liable merely because the borrower listed or stored that person’s number.

Which agency should receive the report?

Problem	Where to report
Harassment or unfair collection by a lending or financing company or its collector	SEC iMessage, selecting the service for financing and lending concerns
Unauthorized access, disclosure, contact-list harvesting, debt shaming, or other misuse of personal data	National Privacy Commission
Credible threat of violence or an immediate safety emergency	Unified 911 or the nearest police station
Cyber-enabled threat, fraud, scam, impersonation, or similar suspected crime	PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT Cyber Hotline
Complaint against a bank, digital bank, non-bank electronic-money issuer, pawnshop, payment-system operator, or other BSP-supervised institution	Institution’s internal complaint mechanism, then BSP Consumer Assistance
A cooperative acting as the lender	Cooperative Development Authority, while any personal-data violation may still be reported to the NPC

One incident may fall within more than one agency’s jurisdiction. For example, a message threatening violence while displaying your ID to co-workers may support an SEC report, an NPC privacy complaint, and a law-enforcement report. Keep the reference number for every filing and disclose related proceedings when a formal complaint requires that information.

What to do immediately

1. Address any safety risk first

If the sender threatens to visit, injure, abduct, expose, or otherwise harm you or another person, do not arrange a private meeting. Call Unified 911, notify people at your home or workplace, and go to the nearest police station if necessary. The nationwide Unified 911 hotline connects callers with police, fire, medical, and rescue services. See the DILG’s Unified 911 guidance.

Do not wait for the lender’s 15-day privacy response period before seeking emergency or police assistance.

2. Preserve evidence before blocking or uninstalling the app

Save the material in its original form where possible. Useful evidence includes:

complete screenshots showing the message, sender, date, and time—not only the insulting sentence;
the full message thread, emails, voice notes, and social-media posts;
call logs and a written note of what was said, when, and by whom;
the exact URL, account name, profile identifier, and date of any public post;
screenshots taken by relatives, colleagues, or other people whom the collector contacted;
a screen recording of the app’s name, developer, privacy notice, requested permissions, account page, and loan details;
the loan contract, disclosure statement, repayment schedule, receipts, proof of disbursement, and account statement;
the collector’s claimed name, company, phone number, email address, and payment instructions;
proof that you disputed the balance or asked the lender to stop the conduct;
the lender’s replies and support-ticket numbers; and
a dated chronology of every incident.

Ask affected contacts to retain the original messages on their own devices. Their affidavits may later help establish what was disclosed to them.

Secretly recording a private telephone conversation can raise issues under the Anti-Wiretapping Act. Preserve call logs, voicemails, voice messages voluntarily sent to you, and contemporaneous notes; obtain legal advice before making a covert recording.

3. Secure your phone and accounts

After preserving the evidence:

review and revoke unnecessary permissions for contacts, storage, location, camera, microphone, and social media;
change important passwords using a trusted device, especially email, banking, e-wallet, and social-media passwords;
enable multi-factor authentication;
check for unfamiliar logged-in devices or account-recovery details;
warn contacts not to open links, send money, or provide information to collectors; and
uninstall the app only after recording the evidence and information needed to identify its operator.

Revoking permission or uninstalling an app prevents some future access but does not automatically delete information already copied to the lender’s systems.

Send a written complaint to the lender or its data protection officer

For an eventual NPC complaint, you normally must prove that you informed the company or concerned entity in writing and gave it an opportunity to act. Send the notice to the lender’s official customer-service and data-protection contacts shown in the app, privacy notice, contract, or company website.

Your written notice should:

identify the loan account without publicly exposing unnecessary information;
give the dates, numbers, accounts, and names involved;
describe exactly what information was accessed or disclosed and who received it;
state that you dispute the harassment or unlawful processing, even if you do not dispute the underlying debt;
demand that the lender stop contacting non-guarantors and stop further publication or disclosure;
ask it to identify the source, purpose, legal basis, recipients, retention period, and categories of personal data being processed;
request correction, restriction, blocking, or deletion of data for which no lawful basis remains;
require it to preserve collection logs, access records, recordings lawfully held by the company, instructions to collectors, and disclosures relevant to the complaint; and
request a written response and ticket number.

A concise notice may say:

I am formally reporting harassment and unauthorized processing of my personal data in connection with account [reference]. On [dates], your collector contacted or disclosed my loan information to [persons/accounts] and sent the attached messages. Please immediately stop further disclosure and contact with persons who are not genuine, consenting guarantors; preserve all relevant records; identify the data processed, its source, legal basis, purpose, and recipients; and provide your written corrective action within 15 calendar days.

Keep proof of delivery. If the app offers only an in-app ticket, screenshot the completed submission and ticket number. A demand for deletion does not require the lender to erase information it must lawfully retain for the loan, regulatory compliance, or legal claims, but it must not use retained data for unrelated harassment or shaming.

How to file an SEC complaint

Use the SEC’s official iMessage portal. The portal generates an electronic ticket that can be tracked. The March 2026 government advisory also lists the SEC hotline 1-4732 (1-4SEC) for unfair debt-collection concerns.

Provide:

your name and reliable contact details;
the app’s brand name and the lender’s exact corporate name, if known;
the names or identifying details of collectors and collection agencies;
the loan or transaction reference;
a short chronological statement of facts;
copies of the messages, posts, call logs, contract, disclosure statement, receipts, and other evidence;
details of people contacted and whether any of them actually consented to be a guarantor; and
the action requested, such as investigation of unfair collection or unauthorized lending operations.

If you know only the app name, attach evidence that may identify its operator: the app-store developer page, privacy notice, website, payment account, loan agreement, disclosure statement, text-message footer, email domain, or disbursement record. Do not delay a serious report merely because the operator concealed its corporate identity.

A corporation’s SEC registration alone does not authorize it to lend. Lending and financing companies require the applicable Certificate of Authority, and an online lending platform must be properly recorded. Report suspected unauthorized operations along with the harassment.

An SEC complaint does not itself rewrite the loan, declare the agreement void, or erase the balance. Continue to request an accurate statement of account and discuss lawful payment arrangements separately if the debt is valid.

How to file a formal NPC complaint

The 15-calendar-day rule

Under the 2021 NPC Rules of Procedure, as amended in 2024, the NPC normally will not give a complaint due course unless you establish that:

you informed the lender, processor, or concerned entity of the privacy violation in writing; and
it failed to take timely and appropriate action or did not respond within 15 calendar days from receipt.

The NPC may waive these requirements for good cause or a serious violation, including grave and irreparable harm, lack of a speedy or adequate remedy from the respondent, or conduct that is patently illegal. Explain and prove why immediate NPC action is necessary if you rely on an exception.

Formal requirements

Use the NPC’s Complaints-Assisted Form or prepare a verified complaint. A formal filing should include:

the identities and contact information of the complainant and respondent, or facts that may lead to an unknown respondent’s identification;
a clear narration of material facts;
the legal and factual basis of the privacy complaint;
the relief requested;
all correspondence with the respondent and proof of its action or inaction;
documentary evidence and witness affidavits, if any;
a valid government-issued ID and authority documents if a representative is filing; and
a sworn certification against forum shopping, including the status of any related case or claim.

If you later learn that the same or a similar action has been filed elsewhere, the NPC rules require you to report that fact within five calendar days. An incomplete complaint, failure to give the respondent an opportunity to address it without adequate justification, insufficient evidence, or inability to identify or trace the parties despite diligence may result in dismissal without prejudice.

Filing channel and fee

The NPC’s 2025 Citizen’s Charter authorizes online submission of the notarized form or complaint-affidavit and supporting evidence to complaints@privacy.gov.ph. In-person filing is available at the Complaints and Investigation Division, 25th Floor, The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Quezon City 1103. Check the NPC complaint page before filing in case its forms or channels have changed.

The basic NPC complaint filing fee is ₱500. If damages are claimed, the published additional fee is:

₱150 for a claim not exceeding ₱20,000;
₱500 for a claim over ₱20,000 but not exceeding ₱100,000; and
₱500 for every succeeding ₱100,000 or fraction thereof.

Qualified indigent complainants are exempt upon submission of the required proof. Applications for a temporary ban or other special relief may involve additional fees, a bond, and a hearing. See the NPC Schedule of Fees and Charges.

If disclosure is continuing and likely to cause grave harm, ask the NPC or a lawyer whether a motion for a temporary ban on processing is appropriate. It is a formal remedy, not an automatic consequence of sending an ordinary complaint.

Reporting threats, fraud, or scams

The 2026 joint advisory lists these channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; (02) 8723-0401 local 7491

Report promptly if the conduct involves a credible threat, extortion, impersonation of police or court personnel, fake warrants or subpoenas, account takeover, fraudulent payment instructions, or malicious publication. The precise criminal offense and proper venue depend on the words used, the evidence, the sender’s identity, and where the acts occurred. Bring the original device and copies of the evidence if investigators request them.

Nonpayment of a debt by itself is not grounds for imprisonment: Article III, Section 20 of the Constitution states that no person shall be imprisoned for debt. This does not protect independently criminal conduct such as fraud proven under the applicable law. See the 1987 Constitution.

If the lender is regulated by the BSP

Banks, digital banks, non-bank electronic-money issuers, money-service businesses, pawnshops, and other BSP-supervised financial institutions follow a different regulatory route.

First use the institution’s Financial Consumer Protection Assistance Mechanism. If its handling remains unsatisfactory, escalate the complaint through the BSP Online Buddy on the BSP website, or submit the BSP Complaint, Inquiry and Request Form to consumeraffairs@bsp.gov.ph with proof of your prior complaint and supporting documents. See the BSP’s current consumer-assistance channels.

A privacy complaint against the same institution may still fall within NPC jurisdiction.

Common mistakes that weaken a complaint

Deleting the app or messages too early. Preserve evidence and identifying information first.
Submitting only cropped screenshots. Include the sender, date, time, surrounding conversation, URL, and account identifier.
Naming only the app brand. Look for the corporate operator, collection agency, developer, payment recipient, and lender shown in the contract.
Filing with the NPC without the written 15-day notice. Attach the notice and proof of receipt, or clearly establish why the NPC should waive the requirement.
Omitting the certification against forum shopping or related cases. Formal NPC complaints can be dismissed for procedural defects.
Posting IDs and loan records publicly. Give evidence through official channels and redact irrelevant account, family, or contact information.
Paying a collector’s personal account without verification. Confirm payment instructions through the lender’s official channel and obtain a receipt.
Assuming a complaint suspends the loan automatically. Keep the harassment complaint separate from a request for an accurate balance or payment arrangement.
Secretly recording calls without legal advice. Preserve call logs, received voice messages, and detailed notes instead.
Blocking every number before saving evidence. Save what is needed, then block abusive accounts where appropriate.

When legal help is urgent

Consult the Public Attorney’s Office, the Integrated Bar of the Philippines legal-aid program, or private counsel promptly if:

the collector made a credible threat of physical harm;
intimate images, IDs, medical information, or information about children were exposed;
the lender continues mass disclosure after receiving written notice;
you received an authentic summons, subpoena, court order, or prosecutor’s notice;
money was taken from an account without authority;
the app or collector appears to have assumed control of your phone, SIM, email, or financial account;
you need a temporary ban, injunction, damages, or another urgent formal remedy;
multiple proceedings have been filed and the certification against forum shopping requires careful treatment; or
you are close to a procedural deadline.

Do not ignore genuine court papers. Verify them directly with the issuing court or agency using independently obtained contact information rather than a number supplied by the collector.

Frequently asked questions

Can an online lender contact my family, friends, or employer?

Not to shame you or pressure them to pay merely because their numbers appeared in your contact list. Debt-collection contact through an online lending platform is limited to a genuine guarantor who expressly consented. A person who actually signed as co-maker may have a separate contractual obligation. Limited disclosure may also be lawful when required by a court or authorized agency, or to properly engaged service providers for a legitimate and proportionate purpose—but that does not permit public humiliation.

Is a character reference responsible for my loan?

Not merely because the person was named as a reference. A guarantor must separately and expressly consent to assume the obligation. Liability ultimately depends on the documents the person knowingly signed and the applicable law.

Does uninstalling the app erase my data?

No. It may stop some future access, but information already copied may remain on the operator’s systems. Revoke permissions, preserve evidence, and send a written request addressing continued processing and retention.

Can I report an unregistered or unidentified lender?

Yes. Report suspected unauthorized lending and the available identifying evidence to the SEC. NPC loan-data rules also cover persons acting as lenders or financing companies even without the required SEC authority.

Will filing a complaint cancel my debt?

No. Harassment or a privacy violation does not automatically extinguish a valid principal obligation. It may expose the company, responsible officers, or collectors to administrative, civil, or criminal consequences, depending on the evidence and proceedings.

Is there a deadline for filing?

Report ongoing threats and disclosures immediately. The NPC’s important pre-filing period is the lender’s 15-calendar-day opportunity to respond to your written privacy complaint, unless the NPC waives it. A claim under Republic Act No. 11765 generally prescribes five years from consummation of the financial transaction or discovery of deceit or material nondisclosure, subject to the law’s ten-year outer limit. Privacy, civil, and criminal claims may follow different prescriptive periods, so do not assume that this five-year rule governs every remedy.

What can the agencies order?

Depending on jurisdiction and proof, regulators may require corrective action, impose fines or other administrative sanctions, suspend or revoke authority, order or recommend restrictions on personal-data processing, award indemnity within the NPC’s authority, or refer possible crimes for prosecution. Law-enforcement agencies investigate suspected criminal conduct. No particular result is guaranteed merely because a report was filed.

Official references

This article provides general Philippine legal information, not individualized legal advice. Outcomes depend on the loan documents, identities of the parties, evidence, regulator, and specific conduct. Official laws, procedures, fees, channels, and guidance were checked as of 1 August 2026.