Quick answer

Report abusive collection by an online lending app to the Securities and Exchange Commission (SEC) through SEC iMessage. Report misuse or disclosure of your contacts, photos, IDs, messages, or other personal data to the National Privacy Commission (NPC) using its current Complaint-Affidavit process.

If the collector threatens violence, impersonates an officer, extorts money, publishes intimate or falsified material, or appears to be operating a scam, preserve the evidence and report immediately to the police, NBI, or DICT. Call 911 if anyone is in immediate danger. You may report to more than one agency because unfair collection, privacy violations, and possible crimes involve different legal issues.

Before blocking numbers or uninstalling the app, save screenshots, messages, call logs, payment records, app permissions, and the lender’s identifying details. Reporting harassment does not automatically cancel a valid loan, but a debt does not give a lender permission to threaten, shame, deceive, or misuse personal data.

What conduct may be unlawful?

Under SEC Memorandum Circular No. 18, Series of 2019, unfair collection practices include:

Threatening violence, criminal acts, or harm to a person, reputation, or property.
Threatening action that cannot legally be taken.
Using obscenities, insults, or abusive language that may amount to an offense.
Publishing a borrower’s name or personal information to shame the borrower.
Communicating false loan information, including failing to disclose that a debt is disputed when communicating about it.
Using false representations or deceptive methods to collect a debt or obtain information.
Contacting the borrower before 6:00 a.m. or after 10:00 p.m., subject to the circular’s stated exceptions when the account has been past due for more than 15 days or the borrower expressly agreed—through written, electronic, or recorded consent—that those are the only reasonable times for contact.
Contacting people in the borrower’s contact list who were not named as guarantors or co-makers. The circular treats this as unfair even if the borrower previously gave general access to the contact list.

The time-of-contact exceptions do not authorize threats, public shaming, deceptive statements, or privacy violations.

The March 2026 joint advisory of the DICT, NPC, and SEC reiterates that unnecessary, excessive, or disproportionate processing of personal data is prohibited, whether the online lending platform is recorded with regulators or not.

Contact lists, character references, and guarantors are different

Under NPC Circular No. 2020-01, as amended by NPC Circular No. 2022-02:

An app may not engage in unconstrained or excessive processing of a borrower’s contact list.
Limited access may be used to let the borrower select a character reference or guarantor, or to derive proportionate metadata when necessary for a specified, legitimate purpose.
A character reference is supplied to verify the borrower’s identity and the truth of information given during the loan application. A character reference may not automatically be treated as a guarantor or contacted for debt collection.
A guarantor must separately and expressly consent to assume responsibility if the borrower defaults.
For collection from third parties, the lender may contact a properly consenting guarantor—not unrelated relatives, friends, coworkers, employers, or everyone found in the borrower’s phone.
Camera or gallery access may be permitted for a legitimate purpose such as identity verification, know-your-customer checks, fraud prevention, or payment verification. It should be disabled, or the borrower should be told that it can be revoked, after that purpose is completed.
A borrower’s photograph may not be used to harass or embarrass the borrower.
Personal data may be retained only while necessary for the original purpose, legal claims, legitimate business needs, or a legal retention requirement. It cannot be kept indefinitely for an unspecified future use.

A broad “I agree” button does not make every form of processing lawful. Under the Data Privacy Act of 2012, processing must still be transparent, for a legitimate purpose, and proportionate.

What to do immediately

1. Preserve the evidence

Save the following before deleting anything:

Full screenshots of messages, social-media posts, emails, app notifications, and caller profiles.
The sender’s number, username, profile URL, email address, and displayed name.
Call logs showing dates, times, frequency, and duration.
Audio recordings already lawfully obtained. Do not secretly access someone else’s account or device to obtain evidence.
Screen recordings showing the app, its permissions, privacy notice, loan screen, collector messages, and any public post.
Copies of the loan agreement, disclosure statement, repayment schedule, receipts, transaction references, and account statements.
The app’s exact name, developer, download page, website, privacy policy, and advertised corporate name.
The lender’s SEC registration number and Certificate of Authority number, if displayed.
Messages sent to relatives, coworkers, employers, or other contacts. Ask each recipient to save the original message and prepare a dated account of what happened.
Proof of your written complaint to the lender and proof that it was received.
Evidence of harm, such as workplace notices, medical records, counseling expenses, lost income, account-security alerts, or costs incurred responding to the incident.

Keep original files. Back them up to secure storage without editing, cropping, or annotating the originals. You may create redacted copies for ordinary sharing, but retain unredacted versions for authorities.

2. Secure your phone and accounts

After documenting the evidence:

Revoke the app’s access to contacts, SMS, call logs, camera, microphone, photos, files, and location unless an access permission remains genuinely necessary.
Change passwords and PINs that may have been exposed, starting with your primary email and financial accounts.
Enable multi-factor authentication where available.
Review linked devices, account recovery details, and recent logins.
Warn affected contacts not to send money, disclose information, or click links sent by the collector.
Report unauthorized transactions immediately to the bank, e-wallet, or payment provider.
After preserving evidence, uninstall an app obtained from an unofficial source or one suspected of malicious activity. Report the app to the relevant app store.

Do not send additional IDs, selfies, one-time passwords, or account credentials merely because a collector demands them.

3. Send a written demand to the lender

Send the complaint to the lender’s official customer-service channel and Data Protection Officer, if identified in its privacy notice. Include:

Your name and loan or account reference.
A chronological description of the incidents.
The collector’s numbers, names, and accounts.
The personal data accessed, used, or disclosed.
The names of third parties contacted and whether any was actually a guarantor.
Copies of representative evidence.
A statement identifying any amount or transaction you dispute.
Your requested action.

Depending on the facts, you may demand that the company:

Stop threats, insults, public shaming, and contact with non-guarantors.
Remove unlawful posts and stop further disclosure.
Identify the company, collection agency, and personnel responsible.
Explain what personal data it holds, where the data came from, how it was used, and to whom it was disclosed.
Correct inaccurate loan information.
Block, remove, or destroy data shown by substantial proof to be unlawfully obtained, used for an unauthorized purpose, or no longer necessary.
Preserve internal logs, call recordings, account notes, access records, and instructions given to collection agents.
Confirm its response in writing.

An erasure request is not an automatic right to delete every loan record. The company may retain information still required for the contract, regulatory compliance, or the establishment, exercise, or defense of legal claims.

Keep proof of delivery. This written notice is especially important for an NPC complaint.

Where to report

Problem	Primary channel
Threats, shaming, abusive calls, deceptive collection, contact with non-guarantors, or an unlicensed lender	SEC iMessage
Unauthorized or excessive access, use, retention, or disclosure of personal data	National Privacy Commission
Threats, fraud, scams, impersonation, extortion, or other possible cybercrime	NBI, PNP Anti-Cybercrime Group, DICT Cyber Hotline, or the nearest police station
Complaint against a bank, digital bank, or another BSP-supervised institution	Institution’s consumer-assistance unit first, then BSP Consumer Assistance Mechanism
Immediate threat to life, safety, or property	911

Filing an SEC complaint

Use SEC iMessage and select the service for the Financing and Lending Companies Department involving complaints against financing or lending companies. The SEC’s current iMessage guide identifies this as its centralized channel for complaints and ticket tracking.

Your submission should identify the legal company behind the app—not only the app’s brand name—and include:

The completed information or complaint form required by the portal.
A valid government-issued ID.
Your loan documents and payment records.
Screenshots, call logs, recordings, posts, and third-party messages.
The app’s name, website, developer, advertised SEC registration number, and Certificate of Authority number.
A clear description of the relief requested.

If several unrelated companies are involved, prepare a separate complaint and evidence set for each respondent.

A company’s SEC incorporation does not by itself prove that it may operate as a lending company. A lending company needs a valid Certificate of Authority under the Lending Company Regulation Act of 2007. If the operator’s status is unclear, request verification through SEC iMessage.

The SEC may investigate regulatory violations and impose administrative sanctions, but its official guidance states that it cannot, through the complaint process alone:

Rewrite the loan’s payment terms.
Cancel or settle the debt.
Declare the loan contract void.
Judicially declare an interest rate void for being excessive.

Those issues may require negotiation or court proceedings.

Filing an NPC complaint

The general 15-day rule

Under the 2021 NPC Rules of Procedure, as amended in 2024, an NPC complaint generally will not be given due course unless you show that:

You informed the lender, its data processor, or the concerned entity in writing about the privacy violation; and
It failed to take timely and appropriate action, or failed to respond within 15 calendar days after receiving your notice.

The NPC may waive this requirement for proven good cause or a serious violation, including circumstances involving grave and irreparable harm, no plain and adequate remedy from the respondent, or conduct that is patently illegal. Explain and document the urgency if you request a waiver. Do not wait 15 days before contacting police or emergency services when safety is at risk.

Use the current Complaint-Affidavit

The NPC implemented a new Complaint-Affidavit effective July 1, 2025. Use the current bilingual Complaint-Affidavit and questionnaire, not an older form circulating online.

The complaint must generally:

Be written, signed, verified, and notarized.
Identify you and the respondent, or provide facts that may lead to the respondent’s identity.
State the material facts chronologically.
Identify the privacy provisions or conduct involved.
Specify the relief requested.
Attach your written correspondence with the respondent and its response, if any.
Attach documentary evidence and witness affidavits, when available.
Include the required certification against forum shopping.

A representative ordinarily needs a special power of attorney. Different proof rules apply when a parent or guardian files for a minor or an incompetent person.

Submit the notarized complaint:

In person at an NPC office;
By courier; or
As a scanned copy by email to complaints@privacy.gov.ph.

The NPC currently lists its main office at 25th–27th Floors, The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Barangay Paligsahan, Quezon City. Check the NPC website immediately before a physical filing for any operational notice or address change.

Do not use the NPC’s Data Breach Notification Management System as a substitute for an individual complaint. That system is primarily for personal information controllers and processors submitting required breach notifications.

Filing fees

Under NPC Circular No. 2023-01, the basic complaint filing fee is ₱500, plus the applicable legal research fee and any additional fee based on a claim for damages. The schedule lists:

An additional ₱150 for damages not exceeding ₱20,000.
An additional ₱500 for damages above ₱20,000 up to ₱100,000.
An additional ₱500 for each succeeding ₱100,000, or fraction thereof.

Indigent litigants may obtain an exemption if they satisfy both income and property requirements and submit the prescribed supporting documents. The schedule uses a family gross-income ceiling of twice the applicable monthly minimum wage and a real-property ceiling of ₱300,000 based on the current tax declaration. Check the NPC payment page or filing desk before paying because payment instructions may change.

Reporting threats, scams, and possible cybercrime

The March 2026 joint government advisory lists these reporting contacts:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph; (02) 8723-0401 local 7491
NBI online complaint: nbi.gov.ph/online-complaint

Bring or submit original evidence where requested. Explain any immediate risk, ongoing publication, threatened visit, demand for money, or attempt to impersonate a police officer, lawyer, court, or government agency.

A rude or repeated message is not automatically a particular criminal offense. Possible liability depends on the words used, intent, manner of publication, personal data involved, and other facts. Law enforcement and prosecutors must determine the appropriate offense, while courts determine criminal guilt.

What can happen after a complaint?

The SEC may seek an explanation from the company, investigate its authority and collection practices, and pursue administrative sanctions. These may include fines, suspension, or revocation of authority, depending on the applicable rule and proven violation.

The NPC may dismiss a complaint that is incomplete, unsupported, outside its jurisdiction, or filed without first giving the respondent an opportunity to act when no waiver is justified. If the complaint proceeds, the respondent may be required to file a verified comment, and the case may involve preliminary proceedings, mediation, investigation, and adjudication.

The Data Privacy Act separately penalizes offenses such as unauthorized processing, processing for unauthorized purposes, malicious disclosure, and unauthorized disclosure. The applicable offense and penalty depend on the type of data, lawful basis, purpose, intent, and responsible persons. An abusive collection message does not automatically prove every element of a DPA crime.

Common mistakes to avoid

Deleting messages or uninstalling the app before preserving evidence.
Submitting only cropped screenshots that omit the sender, date, URL, or surrounding conversation.
Naming only the app instead of identifying the corporate operator and collection agency.
Filing an NPC complaint without first sending a written notice or explaining why the 15-day requirement should be waived.
Using an obsolete NPC complaint form.
Failing to notarize the NPC Complaint-Affidavit or include the certification against forum shopping.
Sending original evidence to the respondent without keeping secure copies.
Paying a collector through a personal account or unverified payment link.
Assuming that blocking a number preserves the messages; some devices or apps may hide or delete the thread.
Posting your own unredacted IDs, loan agreement, phone number, or account details while seeking help online.
Assuming that a complaint automatically suspends payment obligations or stops interest and penalties.
Ignoring genuine court papers. Verify them directly with the named court rather than through the collector’s phone number.

When legal help is urgent

Seek assistance from a lawyer, the Public Attorney’s Office if eligible, or an appropriate legal-aid organization promptly when:

There is a credible threat of violence, stalking, or a physical visit.
Intimate images, altered photographs, IDs, or sensitive records have been published or threatened.
The collector claims to have filed a criminal case, obtained a warrant, or issued court papers.
You received an actual summons, subpoena, complaint, or demand from a court or government agency.
Your identity or financial account has been used without permission.
You want damages, an injunction, or other court relief.
Several lenders or collection agencies are coordinating harassment.
Your employer, customers, or professional reputation are being targeted.
A deadline stated in a genuine legal document is approaching.

Frequently asked questions

Can a lending app contact my family, friends, coworkers, or employer?

Not for debt collection merely because their information appeared in your contact list. A character reference may be contacted for identity or application verification, but is not automatically a guarantor. A person may be contacted about the debt as a guarantor or co-maker only if that person actually and separately agreed to assume the obligation.

Does giving the app permission to access contacts allow it to message everyone?

No. Permission does not authorize unconstrained or disproportionate processing, harassment, public shaming, or collection from people who are not guarantors. The app’s access and use must remain necessary, legitimate, and proportionate.

Does reporting the harassment erase my loan?

No. The validity and amount of the loan are separate from the legality of the collection methods. Continue to address any undisputed obligation through verified official channels while disputing inaccurate charges in writing.

Can I be jailed simply because I cannot pay a loan?

The 1987 Constitution states that no person may be imprisoned for debt. This does not immunize a person from prosecution for a separate alleged crime, such as independently proven fraud. A private collector cannot issue an arrest warrant or decide criminal guilt.

What if I never borrowed and was contacted only because I was listed as a reference?

Tell the lender in writing that you did not consent to be a guarantor, request the source of your information, demand that collection calls stop, and ask for removal of your data as a character reference. Preserve the messages and consider an NPC complaint if the data continues to be misused.

Should I block the collector?

Preserve the evidence first. You may then block abusive accounts or numbers, but retain a safe channel—such as email—for official written communications about the account. Blocking one number does not prevent you from filing a complaint.

Do I need a lawyer to report the app?

A lawyer is not generally required to submit an SEC ticket or begin an NPC complaint, although the NPC Complaint-Affidavit must be properly completed, verified, and notarized. Legal help is advisable for criminal allegations, claims for substantial damages, urgent court relief, or complicated disputes about the loan documents.

This article provides general Philippine legal information, not advice for a specific case. Legal rights and the correct forum depend on the lender’s regulatory status, the loan documents, the data involved, and the exact communications. Official sources and procedures were checked as of August 6, 2026.