Quick answer

If an online lending app is threatening, insulting, publicly shaming you, messaging your contacts, or misusing your photos or personal data:

Preserve the evidence before blocking or uninstalling the app.
Revoke unnecessary app permissions after documenting them.
Send the lender and its data protection officer a written complaint.
Report unfair collection practices to the SEC through SEC iMessage.
File a privacy complaint with the National Privacy Commission (NPC) if the lender fails to act appropriately or does not respond within 15 calendar days. The NPC may waive this prior-notice requirement in serious or urgent cases.
Report credible threats, fraud, impersonation, extortion, or other possible crimes promptly to the PNP, NBI, or DICT.

You may complain even if the loan is overdue. A lender may make truthful, lawful demands and pursue available legal remedies, but it may not use harassment, public shaming, fabricated cases, or unlawful processing of personal data. Reporting misconduct does not automatically cancel a valid debt, interest, or other lawful obligation.

What lenders and collectors are not allowed to do

The Financial Products and Services Consumer Protection Act prohibits abusive collection or debt-recovery practices. For lending and financing companies, SEC Memorandum Circular No. 18, Series of 2019 treats the following as unfair collection practices:

Using or threatening violence or other criminal means against a person, reputation, or property
Threatening action that cannot legally be taken
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense
Disclosing or publishing borrowers’ names or personal information to shame them, except where disclosure is specifically allowed by law
Communicating false loan information, including failing to say that a debt is disputed when required
Using false representations or deceptive means to collect a debt or obtain information
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., unless the account is more than 15 days past due or the borrower expressly agreed that those are the only convenient times
Contacting people in the borrower’s contact list who were not named as guarantors or co-makers, even if the borrower supposedly consented to contact access

A collector does not automatically escape responsibility by saying it is a separate collection agency. The SEC rules cover a lending or financing company’s third-party service providers, while the Data Privacy Act keeps the personal-information controller accountable for data processed on its behalf.

When contact access becomes a privacy violation

The Data Privacy Act of 2012 requires personal data to be processed transparently, for a legitimate purpose, and only to a proportionate extent. Consent is not a blank cheque: processing must still be lawful, fair, relevant, and not excessive.

Under NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02, an online lending app may access data or device permissions only when suitable, necessary, and not excessive for a specified lawful purpose.

The current joint DICT-NPC-SEC advisory on online lending platforms makes these distinctions:

An app may use a separate interface to let you select a character reference or guarantor.
A character reference is for identification or verification, not debt collection.
A guarantor must have expressly consented to assume responsibility for the loan and may be contacted about the obligation.
For debt collection, the lender may not contact other people harvested from your phonebook.
An app may derive proportionate contact-list metadata when necessary for a specified legitimate purpose, but unconstrained, excessive, or harassment-related processing is prohibited.
Camera or gallery access may be allowed for identity verification, know-your-customer checks, payment verification, or a similar legitimate purpose. Access should end—or the app should prompt you to revoke it—after that purpose is completed.
A borrower’s photograph may not be used for harassment or embarrassment.
Deceptive designs, such as pre-ticked consent boxes or interfaces that make consent easy but withdrawal difficult, may undermine the validity of consent.

A genuine co-borrower, co-maker, or other person independently liable under signed documents is different from someone merely found in a contact list. Whether that person is legally liable depends on the actual agreement and evidence—not the label assigned by the app.

Preserve these records before blocking or uninstalling

Keep the original files whenever possible. Cropped screenshots without dates, sender details, or surrounding context may be difficult to authenticate.

Preserve:

Screenshots showing the complete message, sender’s number or account, date, and time
Screen recordings scrolling through the complete message thread, profile, post, or app page
Call logs and contemporaneous notes stating what was said, when, and by whom
URLs, account names, profile identifiers, group names, and post timestamps
Messages sent to relatives, co-workers, employers, or other contacts
Statements or affidavits from recipients, together with their own original screenshots
The app’s store listing, developer name, version, privacy notice, and requested permissions
Screenshots of your phone’s permission settings before and after revocation
Loan agreement, disclosure statement, repayment schedule, statements of account, receipts, and payment confirmations
Advertised terms, interest, fees, penalties, and due dates
The lender’s corporate name, SEC registration number, Certificate of Authority number, office address, website, and customer-service or privacy contact
Names or aliases used by collectors and the numbers, accounts, or email addresses they used
Proof of every written complaint and the lender’s response
Evidence of harm, such as workplace notices, lost income, medical records, or expenses, if relevant to the relief claimed

Keep an untouched copy in secure cloud storage or another device. Do not edit message text, alter timestamps, or annotate the only original copy.

Be careful with recordings. Secretly recording a private spoken conversation can raise issues under the Anti-Wiretapping Act. Unless you have consent or case-specific legal advice, rely on call logs, written messages, witness accounts, and detailed notes rather than secretly recording calls.

Secure your phone and accounts

After preserving evidence:

Revoke the app’s access to contacts, camera, photos, microphone, location, SMS, call logs, and storage unless a permission remains genuinely necessary.
Review your Google, Apple, social-media, and email accounts for unfamiliar devices or sessions.
Change passwords if you suspect unauthorized access, and enable multi-factor authentication.
Update your phone and run its built-in security scan.
Remove unknown device-administrator, accessibility, VPN, or profile permissions.
Tell affected contacts not to pay, click links, disclose information, or argue with collectors.
Verify payment instructions through the lender’s official channel. Do not send money to an unfamiliar personal account merely because of a threat.
Uninstall the app only after preserving the agreement, privacy notice, permissions, account details, and messages. Uninstalling does not erase data already stored by the lender or cancel the loan.

Send a written complaint to the lender first

For an NPC complaint, the general rule is that you must first inform the lender, its data protection officer, or the concerned data processor in writing and allow it to address the violation.

Send the notice through the privacy or customer-assistance address in the app, privacy notice, loan agreement, or official website. If possible, also send it by a trackable method. Keep the sent message, delivery confirmation, ticket number, and response.

A concise notice may say:

I am formally reporting unfair collection and possible unauthorized or excessive processing of personal data. On [dates], persons using [numbers/accounts] contacted [identify recipients] and disclosed or used [identify data]. Attached are the relevant records.

Please stop unlawful third-party contact and disclosure; preserve all collection and data-processing records; identify the legal entity, collector, and data protection officer involved; state the source, purpose, recipients, and retention period of the affected data; correct any inaccurate account information; and erase, block, or restrict data that no longer has a lawful basis for processing. Please respond in writing.

If you dispute the amount, state exactly what is disputed and why. Request an itemized statement showing the principal, interest, fees, penalties, payments, and outstanding balance. Avoid admitting facts or amounts you genuinely dispute.

The lender’s lack of a response after 15 calendar days from receiving your written notice, or its failure to take timely and appropriate action, can satisfy the NPC’s exhaustion requirement. If the response is inadequate, preserve it and explain why.

Report unfair collection to the SEC

The SEC generally regulates lending and financing companies and their online lending platforms.

Go to SEC iMessage and open a new ticket.
Sign in through eSECURE.
Select “Complaints on Financing and Lending Companies” under the Financing and Lending Companies Department.
Identify both the app’s brand name and the legal company operating it. Include the store developer, payment recipient, website, phone numbers, and other identifiers if the legal name is unclear.
Provide a chronological account: who contacted whom, what was said or disclosed, and the date and channel of every incident.
Attach the strongest evidence, including the agreement, payment history, complete screenshots, recipients’ evidence, app permissions, and your prior written complaint.
State the action requested, such as investigation of unfair collection practices, verification of authority to operate, and appropriate regulatory action.
Save the ticket number and monitor the ticket for requests or replies.

The SEC’s current iMessage user guide confirms that iMessage is its official platform for complaints and allows users to upload files, reply, and track tickets. The March 2026 joint advisory also lists the SEC FINLEND hotline as 1-4732 (1-4SEC).

A company’s ordinary SEC registration is not, by itself, proof that it may operate a lending business. A lending or financing company must have the appropriate Certificate of Authority. If the app conceals its operator or appears unlicensed, say so expressly and attach the available identifying evidence.

File a formal privacy complaint with the NPC

Use the NPC process when the app or its collector harvested contacts, disclosed loan information, used your photograph for shaming, retained data without justification, ignored your data-subject rights, or otherwise processed data unlawfully.

1. Complete the current complaint form

Download the current NPC Complaint-Affidavit and questionnaire. Complete it accurately and have it notarized.

The complaint should include:

Your identity and contact details
The respondent’s legal name and service details, if known
If the respondent is unknown, the circumstances and identifiers that may lead to its identification
The personal data processed
A clear chronological narration
The specific conduct complained of
All correspondence showing prior written notice
Documentary evidence and witness affidavits, where available
The relief requested
A verification and certification against forum shopping
A valid government-issued ID

The NPC warns that a complaint may be dismissed without prejudice if it is deficient in form, unsupported, unrelated to a privacy violation, or filed without giving the respondent an opportunity to act when no valid exception is shown.

2. Observe the prior-notice rule—or explain why it should be waived

Under the 2021 NPC Rules of Procedure, as amended, show that you notified the lender in writing and that it failed to act appropriately or did not respond within 15 calendar days.

The NPC may waive this requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm, the absence of a plain and adequate remedy, or conduct that is patently illegal. If you seek a waiver, state the urgent facts and attach proof; do not simply skip the requirement without explanation.

3. Submit the complaint

The NPC’s formal complaint page permits submission:

In person
By registered mail
By courier
By email to complaints@privacy.gov.ph

The current NPC address shown on its 2026 form is:

National Privacy Commission 25th–27th Floors, The Upper Class Tower Quezon Avenue corner Scout Reyes Street Quezon City 1103

For email filing, send a clear PDF of the notarized complaint and readable attachments. Illegible, erroneous, or malfunctioning electronic submissions are not treated as filed. Check the NPC filing page before dispatch because agency addresses and electronic-filing instructions can change.

4. Pay the applicable fee

The current NPC schedule of fees lists:

₱500 filing fee
A legal research fee equal to 1% of the filing fee, but not less than ₱10
Additional fees when damages are claimed

Indigent complainants may be exempt if their gross family income does not exceed twice the applicable monthly minimum wage and they do not own real property with a fair market value above ₱300,000. The schedule requires supporting documents, including a barangay certificate of indigency and the specified affidavits and tax declaration, if any. The NPC may also waive fees on motion for good cause under its procedural rules.

Pay only through an official NPC cashier or authorized payment channel and follow the payment instructions issued for the complaint.

5. Know the initial timelines

After receipt, the NPC should assign or raffle the complaint to an investigating officer within five calendar days. Within 30 calendar days from receipt, the investigating officer may give the complaint due course or dismiss it without prejudice on procedural or evidentiary grounds.

If given due course, the respondent is ordinarily required to submit a verified comment within 15 calendar days from receiving the order. These are procedural periods, not a promise that the entire case will be decided within 30 days.

If you later learn of another case or claim involving the same or similar issues, the certification against forum shopping requires disclosure to the NPC within five calendar days. Related reports to different agencies may address different violations, but they must not be concealed from the NPC.

When a temporary privacy ban may be considered

A formal complaint does not automatically stop data processing immediately. A complainant may move for a temporary ban on processing while the case is pending when necessary to preserve or protect data-subject rights.

This is a separate procedure involving proof of entitlement, a summary hearing, service on the respondent, and generally a bond unless exempted. Filing the motion suspends the main complaint proceedings until the application is resolved. Seek legal assistance before using this remedy, especially if the lender is continuing mass disclosures or publication that may cause grave or irreparable harm.

Report threats, fraud, or possible crimes separately

The SEC and NPC administrative processes do not replace a police or criminal complaint. Report the matter promptly when there are credible threats of physical harm, blackmail, extortion, impersonation of police or court officers, fraudulent payment instructions, account takeover, identity misuse, or continued publication of damaging material.

The March 2026 DICT-NPC-SEC advisory lists:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; (02) 8723-0401 local 7491

If physical harm appears imminent, contact local police or emergency services immediately. Preserve the device and original evidence; investigators may request a sworn complaint, identification, the original files, or access to the device for proper extraction. Describe the facts without conclusively assigning criminal charges—the investigators and prosecutors must determine which offenses, if any, are supported.

If the lender is supervised by the BSP

Some digital loans are issued by banks or other Bangko Sentral-supervised institutions rather than SEC-regulated lending companies.

First use the institution’s free Financial Consumer Protection Assistance Mechanism. If it fails to act or you are dissatisfied, escalate through the BSP Consumer Assistance Mechanism, preferably through the BSP Online Buddy. If BOB is unavailable, the BSP’s current instructions allow a completed complaint form to be emailed to consumeraffairs@bsp.gov.ph, with proof that you first complained to the supervised institution.

This BSP route does not prevent a separate NPC complaint concerning unlawful personal-data processing.

Common mistakes that weaken a complaint

Deleting the app or messages before preserving evidence
Submitting cropped screenshots that omit the sender, date, time, or context
Naming only the app brand and omitting the legal company, developer, payment recipient, and collector
Filing an NPC complaint without prior written notice and without facts supporting a waiver
Making broad claims such as “they harassed me” without identifying the exact words, recipients, dates, and channels
Secretly recording calls without considering the Anti-Wiretapping Act
Publicly posting unredacted IDs, loan documents, phone numbers, or other sensitive evidence
Paying through an unfamiliar personal account because a collector threatened immediate arrest
Assuming that deleting the app deletes server-side data
Assuming an SEC or NPC complaint automatically cancels the loan
Ignoring genuine court papers because earlier collection messages were fake
Omitting related proceedings from the NPC certification against forum shopping

When legal help is urgent

Consult a Philippine lawyer promptly when:

A credible threat of violence or serious reputational harm is ongoing
Your identity, government ID, bank account, or online account has been misused
Private or intimate material is being threatened or distributed
The app continues mass disclosure despite written notice
You want a temporary ban, injunction, damages, or another urgent court remedy
Multiple victims may need a coordinated complaint
You receive an authentic summons, subpoena, complaint, or demand from a court, prosecutor, or government agency
The amount, interest, fees, guaranty, or identity of the true lender is materially disputed

A genuine court summons should be verified directly with the court named in the document. Do not rely on a collector’s phone number for verification, and do not ignore a verified deadline.

Frequently asked questions

Can I complain even if I really owe the money?

Yes. The debt and the collection method are separate issues. A valid obligation does not authorize threats, insults, public shaming, or unlawful data processing. Continue addressing any legitimate balance through documented, official channels.

Can the app contact my family, friends, or employer?

It may not harvest your phonebook and contact unrelated people for debt collection or shaming. Under the 2026 joint advisory, a character reference is for identification or verification, while only a guarantor who expressly consented to the obligation may be contacted for collection. A genuine co-borrower or co-maker may have separate contractual liability depending on the signed documents.

Does tapping “Allow Contacts” authorize the lender to message everyone?

No. Contact access must still be necessary, proportionate, and connected to a legitimate disclosed purpose. Unbridled contact-list processing is prohibited, and borrower consent does not make contact-list harassment lawful.

Can a lender have me arrested simply because I did not pay?

The 1987 Constitution states that no person shall be imprisoned for debt. This does not immunize separate criminal conduct, such as independently proven fraud or another offense. A collector may not invent a criminal case or impersonate an authority merely to force payment.

Can I demand deletion of all my data?

You may exercise applicable rights to access, correction, objection, erasure, or blocking. However, immediate deletion is not absolute. The lender may retain data still necessary to administer a valid loan, comply with law, or establish, exercise, or defend legal claims. It must not retain identifiable data indefinitely for an undefined future use.

Will the SEC or NPC erase my debt?

No. These agencies address regulatory, consumer-protection, and privacy violations. The validity and amount of the loan remain subject to the contract, applicable law, payments, and evidence.

Do I need a lawyer to file?

Not ordinarily. Both the SEC and NPC provide direct complaint channels. Legal help becomes important when urgent protective relief, substantial damages, disputed liability, complex evidence, or parallel court and administrative proceedings are involved.

What if I cannot identify the company behind the app?

Preserve the app name, store page, developer, website, privacy notice, receiving bank or e-wallet account, collector numbers, email addresses, URLs, and advertisements. State in the complaint that the legal operator is unknown and explain every fact that may lead to its identification.

Official sources

Disclaimer

This article provides general Philippine legal information, not legal advice or a prediction of any complaint’s outcome. Rights, liability, and available remedies depend on the loan documents, communications, data actually processed, identities of the parties, and other evidence. Official sources and procedures were checked as of 31 July 2026.