Quick answer

You can report online lending app harassment through more than one government channel:

Report unfair or abusive debt collection to the Securities and Exchange Commission (SEC) if the lender is a lending or financing company.
File a privacy complaint with the National Privacy Commission (NPC) if the app accessed, copied, used, or disclosed your contacts, photos, messages, location, government-ID details, or other personal data improperly.
Report threats, extortion, impersonation, account hacking, or other possible crimes immediately to law enforcement.
If the lender is a bank, e-wallet issuer, or another BSP-supervised financial institution, first complain to the institution and then escalate an unresolved complaint to the Bangko Sentral ng Pilipinas (BSP).

These remedies may be pursued at the same time when the conduct falls within several agencies’ jurisdictions. Harassment or a privacy violation does not automatically erase a valid loan, but a genuine debt does not authorize threats, public shaming, deception, or unlawful use of personal data.

What conduct should be reported?

Debt collectors may make lawful, reasonable efforts to collect an amount that is actually due. They must nevertheless act in good faith and respect privacy and consumer-protection rules.

Conduct that may justify a complaint includes:

threatening violence, arrest, imprisonment, physical harm, or other consequences that the collector has no lawful authority to impose;
using insults, obscenities, humiliating language, or repeated communications intended to frighten or abuse;
pretending to be a police officer, lawyer, court employee, government agency, or another person;
falsely claiming that a criminal case, warrant, court order, or barangay proceeding already exists;
posting or threatening to post the borrower’s name, photograph, ID, loan details, or alleged delinquency on social media;
sending “shame” messages to relatives, friends, co-workers, employers, clients, or other third parties;
contacting people taken from the borrower’s phonebook or social-media network to pressure or embarrass the borrower;
creating group chats that expose the loan to people who are not proper parties to it;
using edited photographs, fake wanted posters, funeral images, sexualized material, or defamatory captions;
accessing device data that is unnecessary for the loan transaction;
continuing to use personal data for an incompatible purpose after the stated purpose has ended;
refusing to identify the lending or financing company, collection agency, or account involved;
demanding payment through a suspicious personal account without providing a verifiable statement of account; or
continuing abusive collection even after receiving a written demand to stop the unlawful conduct.

The SEC’s rules apply not only to covered lending and financing companies but also to third-party collection providers acting for them. A company generally cannot avoid responsibility merely by outsourcing collection.

What privacy rules apply to lending apps?

The Data Privacy Act of 2012 requires personal-data processing to have a lawful basis and a declared, specific purpose. The data collected must be adequate, relevant, suitable, necessary, and not excessive for that purpose. Borrowers also have rights to information, access, correction, objection in appropriate cases, erasure or blocking when legally available, damages, and the filing of an NPC complaint.

The more specific rules are found in NPC Circular No. 20-01 on loan-related transactions, as amended by NPC Circular No. 2022-02.

Among the important protections:

A lending app may not obtain unrestricted access to a borrower’s entire phone contact list for debt collection or harassment.
If the borrower needs to select a character reference or guarantor from the phone, access must be limited to what is necessary for that selection. The app should provide a separate interface for the borrower’s chosen references or guarantors.
Consent requests and privacy notices must be understandable and presented when the particular information is needed. A broad permission screen does not give the lender unlimited authority to use data for any purpose.
A character reference’s information cannot be used indiscriminately for marketing, cross-selling, unrelated sharing, or collection pressure.
A character reference is not automatically liable for the debt. Liability depends on whether the person actually entered into an enforceable undertaking, such as a guaranty or co-maker agreement.
A guarantor’s data may be processed to the extent necessary for a genuine guaranty, subject to applicable law and the terms of the agreement.
Loan data should not be retained indefinitely merely because it might later be useful. Retention must have a lawful and necessary purpose, including legitimate recordkeeping or the establishment, exercise, or defense of legal claims.

Consent is not the only possible lawful basis for processing, and withdrawing consent does not always require immediate deletion. A lender may retain information needed to perform the loan contract, comply with law, maintain required records, or pursue or defend a legal claim. It still may not use that information to harass or publicly shame anyone.

Act quickly if there is an immediate threat

Call 911 or contact the nearest police station if a collector threatens imminent violence, says someone is coming to your home or workplace to harm you, attempts to enter your property, or appears to be carrying out a threat.

For conduct committed through texts, messaging apps, email, social media, or other computer systems, you may also approach:

the PNP Anti-Cybercrime Group through its official contact and reporting channels; or
the NBI Cybercrime Division through the official NBI website.

Possible criminal liability depends on the exact words, acts, intent, identity of the sender, and evidence. Depending on the facts, investigators or prosecutors may consider offenses under the Revised Penal Code, the Data Privacy Act, or the Cybercrime Prevention Act of 2012. Do not assume that every rude or persistent message automatically establishes a particular crime.

If the sender threatens suicide, sexual violence, kidnapping, injury to a child, or the release of intimate material, treat the situation as urgent and seek police and legal assistance immediately.

Preserve evidence before blocking or uninstalling the app

Save evidence first. Some information may disappear when an account is deleted, a conversation is unsent, or the app is removed.

Preserve:

full screenshots showing the sender’s number, account name, date, and time;
screen recordings that show the complete conversation and account profile;
original text messages, emails, voice messages, call logs, and voicemail;
URLs and screenshots of social-media posts, group chats, comments, and profile pages;
the app’s name, developer, download page, version, permissions, privacy notice, and terms;
screenshots of the permissions shown in your phone settings;
the loan agreement, disclosure statement, promissory note, payment schedule, and statement of account;
receipts, transfer confirmations, reference numbers, and payment instructions;
names and numbers used by collectors;
messages received by your relatives, employer, co-workers, or other contacts;
affidavits or written accounts from people who received disclosure or harassment;
your written complaint to the lender or its data protection officer and proof of delivery;
the lender’s response, if any; and
records showing the practical harm caused, such as medical expenses, lost work, employment consequences, or account-security costs.

Keep unedited originals. Store copies in a secure location outside the affected phone. When taking screenshots, avoid cropping out dates, account identifiers, or surrounding messages that establish context.

Ask affected contacts to preserve their own copies. Do not ask them to fabricate, embellish, or coordinate their accounts.

Identify the company behind the app

The app’s brand name may differ from the registered company’s name. Look for the legal entity in:

the loan contract or disclosure statement;
the app’s privacy notice and terms;
payment instructions and receipts;
collection messages;
the app-store developer page; and
the lender’s website.

A lending company must be registered and must have SEC authority to operate as a lending company. The SEC maintains official information and lists through its Lending and Financing Companies portal.

Record both the app name and every possible corporate name. If the company cannot be identified, preserve the app-store link, payment-account details, phone numbers, email addresses, websites, and social-media profiles. Tell the SEC and law-enforcement agency that the operator’s legal identity is uncertain rather than guessing.

Send a written demand to the lender and its data protection officer

For an NPC complaint, you ordinarily must first give the company a written opportunity to address the privacy violation. Send a concise notice to the lender’s official customer-service address and data protection officer, if listed.

Include:

your name and enough account information to locate the loan;
the dates and description of the conduct;
the phone numbers or accounts used by collectors;
the personal data accessed or disclosed;
the names or categories of third parties contacted;
copies of representative evidence;
the action you want, such as stopping third-party disclosure, restricting unlawful processing, correcting inaccurate information, preserving relevant records, and explaining the lawful basis and source of the data; and
a request for a written response.

Do not send passwords, one-time PINs, full card details, or unnecessary copies of sensitive documents. Redact information that the company does not need to investigate your complaint.

Keep the sent email, courier receipt, delivery confirmation, or support-ticket number. Under the NPC’s current complaint guidance, the usual exhaustion requirement is satisfied when the respondent fails to take timely or appropriate action or gives no response within 15 calendar days after receiving the written notice. The NPC may treat serious or urgent circumstances differently, but a complainant should not assume an exception will automatically apply.

A useful demand is factual and specific. Avoid insults, threats, or statements that could distract from the evidence.

File an SEC complaint for unfair debt collection

The SEC regulates lending and financing companies under the Lending Company Regulation Act, the Financing Company Act, and related regulations. SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair debt-collection practices.

Use the SEC’s official complaint instructions and form. The SEC currently instructs complainants to:

complete the complaint form accurately;
submit one complaint form for each respondent company;
attach a copy of a valid government-issued ID; and
attach supporting evidence, including relevant loan and payment documents.

Complaints concerning lending companies may also be directed to the SEC Financial and Lending Company Division at flcd_complaints@sec.gov.ph or through the SEC’s iMessage portal. Check the official complaint page before filing because addresses, forms, and submission arrangements may change.

In the complaint, separate each alleged violation:

identify the company and app;
give a dated chronology;
quote or attach the abusive messages;
identify third parties contacted and what they were told;
explain any false representation or threat;
attach the contract, disclosure statement, and proof of payments; and
state the remedy requested.

If the lender appears unregistered or the app is not among the operator’s reported platforms, say so and attach the evidence supporting that concern.

File an NPC complaint for misuse or disclosure of personal data

The NPC accepts complaints from people personally affected by a privacy violation or personal-data breach. A borrower’s contact may also have an independent complaint if that contact’s own personal data was collected, used, or disclosed unlawfully.

Follow the NPC’s current formal complaint procedure and complaint mechanics. The NPC currently requires a filled-out and notarized Complaints-Assisted Form or another properly verified complaint, together with supporting evidence and relevant witness affidavits.

The complaint should establish:

who processed or disclosed the data;
what personal data was involved;
how and when it was collected, accessed, used, retained, or disclosed;
why the processing was unauthorized, excessive, disproportionate, misleading, insecure, or incompatible with the stated purpose;
who received the disclosure;
the harm or risk caused;
what you asked the company to do;
proof that the company received your written complaint; and
its response, or proof that 15 calendar days passed without an appropriate response.

The NPC presently permits filing personally, by registered mail, by courier, or by authorized electronic mail. Its complaint page identifies complaints@privacy.gov.ph for complaints. Electronic filing requirements, notarization, copy requirements, and fees should be checked on the official page before submission. The NPC publishes its forms on its official forms page.

Do not delay while trying to negotiate indefinitely. Procedural time limits and the treatment of continuing or repeated violations can depend on the applicable rules and facts. File promptly once the required written notice period has passed, or consult the NPC or a lawyer if the violation is ongoing, serious, or urgent.

If the app belongs to a bank or another BSP-supervised institution

The BSP handles complaints involving institutions under its supervision, including banks, certain non-bank financial institutions, electronic-money issuers, and operators of payment systems.

First use the institution’s own Financial Consumer Protection Assistance Mechanism or official customer-service channel. If the complaint remains unresolved, escalate it through the BSP’s Consumer Assistance Mechanism.

The BSP accepts complaints through its Online Buddy or through its Complaints, Inquiries and Requests form sent to consumeraffairs@bsp.gov.ph. Attach:

the complaint previously sent to the institution;
the institution’s reply, if any;
a concise account of the unresolved issue;
the resolution requested; and
supporting documents.

Do not use the BSP route merely because payment passed through a bank or e-wallet. The proper regulator generally depends on the institution that actually extended or serviced the loan.

Secure your phone and accounts

After preserving evidence:

Review the app’s permissions and revoke access to contacts, camera, microphone, photos, files, location, and other functions that are no longer needed.
Remove device-administrator, accessibility, screen-overlay, or notification access if the app was granted those privileges without a continuing need.
Change passwords for email, social media, and financial accounts if compromise is possible.
Enable multi-factor authentication.
Contact your mobile provider if you suspect SIM misuse or takeover.
Warn affected contacts briefly that messages may be unauthorized and that they should not send money or personal information.
Report impersonating or abusive accounts to the relevant platform.
Run the phone’s security checks and install operating-system updates.
Uninstall the app after evidence and essential account information have been preserved, if doing so will not prevent access to records you still need.

Revoking permission or uninstalling the app does not by itself delete information already copied to the lender’s systems. Address server-side data through a written privacy request.

Continue handling any legitimate loan separately

Do not send payment solely because a collector threatens arrest, exposure, or immediate police action. Verify:

the registered company’s identity;
the loan account number;
the principal, interest, fees, penalties, and payments credited;
whether the person contacting you is authorized;
the official payment channel; and
whether the requested amount matches the contract and statement of account.

Request a written accounting when the amount is disputed. Pay only through a verified company channel and keep the receipt.

The Constitution prohibits imprisonment for nonpayment of debt. This does not prevent civil collection, enforcement of valid security, or prosecution for a separate offense supported by evidence. A collector’s unsupported claim that ordinary nonpayment automatically results in arrest or imprisonment should be preserved and reported.

A harassment complaint and the loan dispute are separate. Continue communicating in writing about a valid balance, proposed restructuring, or a disputed computation without surrendering your privacy rights.

Common mistakes to avoid

Deleting messages too soon. Preserve originals before blocking accounts.
Reporting only the app’s brand name. Include the legal company, collector, developer, numbers, and payment accounts.
Submitting a narrative without attachments. Agencies need evidence connecting the company to the conduct.
Sending one SEC form against several companies. Follow the SEC instruction to use one complaint form per respondent.
Skipping the written notice required for an NPC complaint. Notify the company and preserve proof of receipt unless an applicable exception is established.
Assuming app permission equals unlimited consent. Explain why the particular access or disclosure exceeded the stated purpose.
Claiming every collection call is illegal. Identify the threat, deception, excessive access, third-party disclosure, or other specific misconduct.
Ignoring a real loan because collection was abusive. Challenge the misconduct and address the account separately.
Paying an unidentified collector’s personal account. Verify authority and obtain a written statement first.
Posting IDs and unredacted evidence publicly. Send sensitive evidence securely to the proper agency.
Threatening or harassing the collector in return. Keep your communications factual and professional.

When legal help is urgent

Consult a Philippine lawyer promptly if:

a court summons, subpoena, warrant, or formal demand has actually been served;
intimate images, medical information, government-ID data, or information about a child has been exposed;
the harassment has caused job loss, serious reputational harm, financial loss, or a medical emergency;
a collector has visited or threatened to enter your home or workplace;
you are being asked to sign a settlement, waiver, acknowledgment, or new promissory note;
the lender has filed a civil or criminal complaint;
your identity or financial accounts may have been compromised;
the operator is unidentified or appears to be outside the Philippines; or
you need damages, an injunction, or another court remedy beyond an agency complaint.

The Public Attorney’s Office may assist qualified indigent applicants, subject to its governing rules and assessment. Its official information is available through the PAO website.

FAQ

Can a lender contact my family, friends, or employer?

A lender cannot indiscriminately harvest and contact people from your phonebook to shame or pressure you. Communication with a genuine guarantor, co-maker, or properly selected character reference may be permissible only within the lawful and necessary purpose applicable to that person. It does not authorize public disclosure or harassment.

Can a character reference be forced to pay?

Not merely because the person was listed as a reference. Payment liability depends on an actual, valid contractual undertaking, such as a guaranty or co-maker agreement—not the label “reference” alone.

Does granting contact permission make text blasting lawful?

No. Device permission is not unlimited authority. Processing must still have a lawful basis, follow the disclosed purpose, and be necessary and proportionate. Broad disclosure of a borrower’s debt to unrelated contacts may violate privacy and collection rules.

Can I demand deletion of all my data?

You may request erasure or blocking when the legal conditions are met, but the right is not absolute. The company may retain data required by law, needed to perform or document the loan, or necessary for legal claims. Ask it to identify what will be retained, the legal basis, the purpose, and the retention period.

Should I file with both the SEC and NPC?

Often, yes. The SEC addresses regulated lending and collection conduct; the NPC addresses personal-data processing and privacy rights. Police or cybercrime authorities may also be appropriate where threats or other possible crimes are involved.

Can I complain even if I already paid the loan?

Yes. Payment does not erase a completed privacy violation or abusive collection act. Preserve the payment record and the evidence of what occurred.

Can a person contacted about someone else’s loan complain?

Yes, if that person’s own data was improperly collected or used, or if they personally received threats or harassment. Their complaint should focus on what happened to them and include their own evidence.

Will filing a complaint cancel the debt?

Not automatically. An agency may investigate misconduct and impose available remedies or sanctions, but the validity and amount of the loan remain separate questions.

What if the app or company uses several names?

List every known name and attach evidence connecting them: contracts, privacy notices, app-store pages, websites, phone numbers, email domains, payment accounts, and collection messages. Do not state that separate entities are the same company unless the documents support it.

What if the company does not answer my privacy complaint?

Keep proof that it received the written notice. If there is no timely or appropriate action—or no response within 15 calendar days—follow the NPC’s formal filing requirements and submit the complaint promptly.

Official sources

This article provides general legal information, not legal advice or a prediction of any complaint’s outcome. Rights, jurisdiction, and remedies depend on the messages, contracts, permissions, company identity, and other evidence in each case. Official sources and filing information were checked on 27 August 2026; confirm the latest agency forms and channels before filing.