Quick answer

Yes. Online lending app harassment and misuse of personal data may be reported separately—or at the same time—to:

The lender’s consumer-assistance unit or Data Protection Officer;
The Securities and Exchange Commission (SEC) for complaints against lending and financing companies and their collection agents;
The National Privacy Commission (NPC) for unlawful access, use, disclosure, retention, or sharing of personal data;
The Bangko Sentral ng Pilipinas (BSP) if the provider is a BSP-supervised bank, e-money issuer, or other financial institution; and
The police or National Bureau of Investigation (NBI) when there are threats of violence, extortion, impersonation, account intrusion, fake legal documents, or other possible crimes.

You may complain even if the loan is valid or unpaid. A lender may lawfully demand payment and pursue proper legal remedies, but it may not use abusive collection tactics or personal data to shame, threaten, deceive, or pressure you through unrelated contacts. Reporting misconduct does not automatically cancel a legitimate debt, interest, or court case.

If anyone is threatening immediate physical harm, knows your location, is on the way to your home or workplace, or is demanding payment through violence or extortion, contact 911 or the nearest police station immediately.

What conduct may violate the law?

Under the Financial Products and Services Consumer Protection Act, financial consumers have rights to fair treatment, data protection, and timely handling of complaints. Financial service providers may not employ abusive collection or debt-recovery practices. They are also responsible for their employees and agents and may be solidarily liable with accredited third-party service providers involved in collection.

For SEC-regulated lending and financing companies, prohibited practices under SEC Memorandum Circular No. 18, Series of 2019 include:

Using or threatening violence or other criminal means against a person, reputation, or property;
Threatening action that cannot legally be taken;
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense;
Publishing or disclosing borrowers’ names and personal information to shame them, subject to narrow lawful disclosures;
Communicating loan information known—or which should be known—to be false, including failing to say that a debt is disputed when disclosure is otherwise allowed;
Using false representations or deceptive means to collect or obtain information;
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., unless the account is more than 15 days past due or the borrower expressly agreed that those are the only reasonable times for contact; and
Contacting people in the borrower’s contact list other than named guarantors or co-makers, notwithstanding the borrower’s consent.

The SEC’s rules do not prohibit every reminder, demand letter, collection call, or lawsuit. A collector may identify the creditor, state the amount claimed, ask for payment, propose restructuring, contact an expressly bound guarantor, and pursue lawful court remedies. The line is crossed when collection becomes abusive, deceptive, unnecessarily public, or disproportionate.

Privacy rules that specifically apply to lending apps

The Data Privacy Act requires personal data processing to have a lawful basis and to comply with transparency, legitimate purpose, and proportionality. Data subjects also have rights to information, access, correction, objection, blocking or erasure in proper cases, damages, and the filing of a complaint. See the Data Privacy Act of 2012.

The more specific rules are found in NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02. They apply to lending and financing companies, persons acting as lenders whether or not they have SEC authority, and their data processors or service providers.

Among other requirements:

An app may request access to protected phone resources only when suitable, necessary, and not excessive for a legitimate purpose.
Processing through an app permission should begin only when the data is actually needed.
When access is no longer necessary and no other lawful basis applies, the app should turn the permission off or tell the user it may be revoked.
A borrower’s photograph must not be used to harass or embarrass the borrower.
Unconstrained or disproportionate processing of contact lists—including processing that leads to harassment, unfair collection, or debt collection from people other than guarantors—is prohibited.
Access to a contact list must be limited to the minimum needed to let the borrower choose a character reference or guarantor.
A character reference may be contacted only to verify the borrower’s identity and the truthfulness of information supplied for the loan. The reference must be told why they were contacted and how their details were obtained, and must be offered an option to have those details removed.
A character reference is not automatically a guarantor.
A guarantor must separately and expressly consent to that role. For debt collection, the lender may not simply message other people in the borrower’s phone book.

Permission granted during installation is not unlimited permission to copy contacts, create shaming messages, publish photographs, or disclose a debt to family members, colleagues, clients, or social-media contacts.

What to do immediately

1. Preserve evidence before blocking or uninstalling the app

Keep the original device and make unedited copies of:

Full screenshots showing the sender, number or account, date, time, and entire message;
Chat exports, emails and email headers, call logs, voicemails, and notification history;
Posts, comments, group messages, profile URLs, and the date and time each was visible;
Messages received by relatives, co-workers, employers, clients, or other contacts;
The app-store page, developer name, privacy notice, permissions requested, and app version;
Your loan application, disclosure statement, contract, repayment schedule, statements of account, receipts, and proof of payments;
The names and account details of payees to whom loan proceeds or repayments were transferred;
Your written complaints to the lender and its replies or acknowledgment numbers; and
Evidence of harm, such as an employer’s notice, medical documents, lost-client correspondence, or witness affidavits.

Keep an incident log in chronological order. Record what happened, who was contacted, what information was disclosed, and how you learned of it. Back up the files without editing, cropping, or adding annotations to the originals.

Be careful with secret call recording. The Anti-Wiretapping Act generally prohibits secretly recording a private communication without authorization from all parties. Save written messages and voicemails, write a contemporaneous account of calls, or ask for permission before recording. Obtain legal advice before relying on a secretly recorded conversation.

2. Secure your phone and accounts

After preserving evidence:

Review and revoke unnecessary permissions for contacts, photos, camera, microphone, location, SMS, storage, and social media;
Change passwords for your email, social-media, banking, and e-wallet accounts, especially if passwords were reused;
Enable multi-factor authentication;
Remove unknown device sessions and connected apps;
Contact your bank or e-wallet immediately if there are unauthorized transactions; and
Run the device’s security scan and install operating-system updates.

Uninstalling the app may stop further access from the device, but it does not erase information already copied to the lender’s systems. Send a separate data-rights request to the company or its Data Protection Officer.

3. Send a written complaint to the lender

Address the complaint to the lender’s consumer-assistance unit and Data Protection Officer. Use the corporate operator’s name—not only the app’s brand name—if you can identify it from the contract, privacy notice, app-store listing, payment records, or disclosure statement.

State:

Your name and loan or account reference, with sensitive numbers partly masked where possible;
A dated summary of the harassment or disclosure;
The phone numbers, collector names, accounts, or third-party agencies involved;
Which contacts received messages and what personal data was disclosed;
Whether you dispute the debt, amount, fees, payment posting, or identity of the borrower;
The specific action requested; and
A reasonable channel and time for lawful communication with you.

You may request that the company:

Stop abusive and third-party collection communications;
Preserve relevant records, call logs, access logs, and instructions given to collectors;
Identify the corporate lender and collection agency;
Correct an inaccurate balance or mark the debt as disputed;
Explain the source, purpose, recipients, and retention period of your personal data;
Remove you as a character reference if you are not the borrower or guarantor;
Restrict or erase data no longer lawfully needed;
Confirm the action taken; and
Communicate only through a specified email address or other reasonable channel.

Erasure is not absolute. A provider may retain information when required by law, reasonably needed to administer a valid loan, or necessary for legal claims. Withdrawal of consent also does not invalidate processing that has another lawful basis.

Where to report the conduct

Situation	Primary route
SEC-regulated lending or financing company, online lending platform, or its collector	Lender’s consumer-assistance mechanism, then SEC
Unlawful access, contact harvesting, shaming, disclosure, or refusal to honor privacy rights	Lender or Data Protection Officer, then NPC
Bank, e-wallet issuer, or other BSP-supervised provider	Provider’s consumer-assistance mechanism, then BSP
Cooperative lender	Cooperative’s assistance mechanism, then Cooperative Development Authority
Threats, extortion, impersonation, hacking, fake warrants, or immediate danger	Police, NBI, or another appropriate law-enforcement office
Harassing post or message on an app or social network	Report to the platform in addition to—not instead of—the proper regulator

More than one route may apply. For example, sending your photograph and alleged debt to your co-workers may support both an SEC collection complaint and an NPC privacy complaint. A threat to physically harm you may also require a criminal complaint.

How to file an SEC complaint

For a lending or financing company, first use the provider’s free consumer-assistance mechanism. The Financial Products and Services Consumer Protection Act requires financial service providers to maintain such a mechanism and permits dissatisfied consumers to escalate concerns to the appropriate regulator.

The SEC now receives public complaints through its iMessage SEC-Wide Ticketing System. According to the SEC iMessage user guide:

Open a new ticket and sign in through an eSECURE account.
Search for and select “Complaints on Financing and Lending Companies.”
Complete the form and attach the supporting documents.
Save the ticket number and monitor the ticket for SEC requests or replies.

Include, if available:

The app and corporate lender’s names;
SEC registration and Certificate of Authority details;
App-store and website links;
Your contract, disclosure statement, and statement of account;
Proof of your complaint to the lender;
Screenshots and witness statements;
The collector’s numbers, names, and agency;
A clear explanation of the relief or regulatory action requested; and
Information showing that the app may be unlicensed or operating under another company’s identity.

If you cannot identify the operator, provide all available leads: app developer, website domain, privacy-policy entity, receiving bank or e-wallet account, text-message sender, customer-service email, and advertised address. Lending businesses generally require a valid SEC authority under the Lending Company Regulation Act.

An app-store report may help remove a harmful app, but it is not a substitute for an SEC, NPC, or criminal complaint.

How to file a National Privacy Commission complaint

Give the company a written opportunity to act

Under the 2021 NPC Rules of Procedure, as amended, a complaint ordinarily will not be given due course unless:

You informed the personal information controller, processor, or concerned entity of the violation in writing; and
It failed to take timely or appropriate action, or did not respond within 15 calendar days after receiving your written notice.

Attach proof of delivery, such as an email acknowledgment, courier receipt, or ticket confirmation.

The NPC may waive this requirement for properly established good cause or a serious violation involving risk of harm—for example, grave and irreparable damage that only NPC action can prevent, lack of an adequate remedy from the respondent, or patently illegal conduct. Explain and support the urgency instead of simply omitting the prior written notice.

Prepare the formal complaint

Use the NPC’s current Complaint-Affidavit or Complaints-Assisted Form. The complaint should be complete, signed, verified, and notarized. It should identify the complainant and respondent, narrate the material facts, state the relief requested, and include:

Correspondence with the respondent;
Documentary evidence;
Witness affidavits, when available; and
A sworn certification against forum shopping disclosing any related case or complaint.

If you later learn that the same or a similar action has been filed elsewhere, the current rules require the NPC to be informed within five calendar days.

The NPC’s formal filing guidance allows submission in person, by courier, or by emailing a scanned notarized complaint and supporting documents to complaints@privacy.gov.ph. Current contact details and the Quezon City address are posted on the NPC contact page.

The current basic filing fee is ₱500, with additional charges for damages claims and certain applications. Indigent complainants and other qualified cases may be exempt or granted a waiver under the rules. Confirm the assessment and payment instructions through the NPC’s official fee schedule before paying.

Within 30 calendar days from receipt, the investigating officer may give the complaint due course or dismiss it without prejudice. Common grounds for outright dismissal include an incomplete complaint, failure to give the respondent an opportunity to act without justification, insufficient evidence, a matter outside the Data Privacy Act, or parties who cannot be traced despite diligent efforts.

If harmful processing is continuing, ask a lawyer whether an application for a temporary ban on processing is appropriate. That remedy has additional procedural and bond requirements and is not automatically granted.

When to involve the police or NBI

Seek immediate law-enforcement help when the messages involve:

A credible threat of physical harm, kidnapping, property damage, or an unlawful home or workplace visit;
Extortion or a demand to pay a person or account unrelated to the verified lender;
Fake arrest warrants, court orders, subpoenas, government notices, or impersonation of police, lawyers, courts, or public officials;
Hacking, account takeover, identity theft, or unauthorized financial transactions;
Publication or threatened publication of intimate images;
Doxxing that creates an immediate safety risk; or
Continued mass disclosure despite urgent written demands to stop.

The NBI provides an official online complaint page and investigative assistance through its Cybercrime Division and regional centers. The Department of Justice Office of Cybercrime also receives cybercrime complaints and referrals.

Bring your identification, device, incident log, original messages, exported files, transaction records, witness information, and copies of complaints already sent to the lender or platforms. Do not alter the device or retaliate against the sender.

What if the lender is BSP-supervised?

Some digital loans are issued by banks or other BSP-supervised institutions rather than ordinary SEC-regulated lending companies. Check the contract, disclosure statement, privacy notice, and advertising for the named regulator.

For a BSP-supervised provider:

Report the matter first to the institution’s Financial Consumer Protection Assistance Mechanism.
If dissatisfied, elevate it through the BSP Consumer Assistance Mechanism using the channels in the BSP’s current complaint guide.

A separate NPC complaint remains available when personal data was misused.

Deadlines and monetary thresholds

Act promptly even when a long prescriptive period appears available. Messages may be deleted, accounts may disappear, and electronic records may be overwritten.

For claims under the Financial Products and Services Consumer Protection Act, the statutory rule is generally five years from consummation of the financial transaction, or five years from discovery of deceit or nondisclosure of material facts, with a ten-year maximum from the violation. Its application to a particular claim depends on the facts.

The SEC and BSP may adjudicate certain disputes that are purely civil and seek only payment or reimbursement of money not exceeding ₱10 million. That ceiling concerns the special adjudicatory remedy; it does not prevent a regulator from receiving information about misconduct or exercising its supervisory and enforcement powers.

Privacy, civil, administrative, and criminal actions may have different prescriptive periods. Do not assume that an SEC ticket preserves every other legal claim. Obtain legal advice promptly where damages are substantial, a complaint is being filed in court, or a deadline may be close.

Common mistakes to avoid

Deleting everything before reporting. Preserve the app details and messages first.
Naming only the app. Identify the corporate lender, collection agency, developer, and payment recipient where possible.
Posting unredacted evidence publicly. This can further expose your ID, address, phone numbers, loan records, and innocent contacts.
Assuming consent allows public shaming. App permissions and broad terms do not override privacy and consumer-protection law.
Assuming a complaint cancels the loan. Continue disputing incorrect charges and proposing lawful payment arrangements where appropriate.
Paying an unverified collector. Confirm payment instructions through the lender’s official channel.
Giving a regulator your OTP, password, PIN, or complete card credentials. These are not needed to process a complaint.
Ignoring a real court document. Verify it directly with the named court or government office and obtain legal help. Do not rely on the collector’s phone number for verification.
Secretly recording every call. Philippine anti-wiretapping law may apply.
Filing with only one agency when several issues exist. Collection abuse, privacy misuse, and criminal threats involve different powers and remedies.

When legal help is urgent

Consult a lawyer promptly when:

A real summons, subpoena, or court pleading has been served;
The lender obtained or threatened attachment, foreclosure, repossession, or garnishment;
Your identity was used to obtain a loan you did not apply for;
The disclosure caused job loss, substantial financial damage, or serious reputational harm;
The app is still distributing your data to many people;
You need a temporary ban, injunction, damages, or preservation order;
Several victims want to file a coordinated complaint; or
Law enforcement asks you to execute an affidavit or surrender a device for examination.

Qualified applicants may approach the Public Attorney’s Office or the Integrated Bar of the Philippines National Center for Legal Aid.

Frequently asked questions

Can I report harassment even if I admit owing the money?

Yes. The duty to pay a valid debt and the right to be free from abuse are separate. A complaint does not excuse nonpayment, but nonpayment does not authorize threats, deception, public shaming, or unlawful data processing.

Can an online lender have me arrested for an unpaid loan?

Not for debt alone. Article III, Section 20 of the 1987 Constitution prohibits imprisonment for debt. Separate acts—such as proven fraud or another statutory offense—are different and require proper legal process. A collector cannot create an arrest warrant or criminal case merely by sending a threatening text.

May collectors contact my family, employer, or co-workers?

They may not use ordinary contacts to shame you or pressure them into collecting your debt. Different considerations may apply if a person expressly became a guarantor or co-maker, if a narrowly tailored communication is legally necessary, or if disclosure is required by a court or government authority. Merely being a relative, colleague, employer, or character reference does not make someone liable for your loan.

Is a character reference required to pay?

No. A character reference is not automatically a guarantor. A guarantor must expressly agree to undertake the obligation. The lender must also obtain the guarantor’s separate consent.

Can I demand deletion of all my data immediately?

You may request deletion or blocking when processing is unlawful, excessive, outdated, or no longer necessary. The lender may retain records required by law or reasonably needed for a valid contract, regulatory compliance, fraud prevention, or legal claims. Ask it to identify the lawful basis and retention period for any refusal.

What if I never borrowed from the app?

State clearly that the debt and identity are disputed. Ask the company to stop collection, preserve its application and verification records, correct its data, and investigate identity theft. Report unauthorized financial transactions immediately to the affected bank or e-wallet. Consider complaints to the SEC, NPC, and law enforcement.

What if the app is unlicensed or based overseas?

Report it anyway. NPC loan-processing rules cover persons acting as lenders whether or not they have SEC authority, and Philippine regulators may act on conduct or data processing within their jurisdiction. Provide technical and financial leads such as the developer, domain, privacy-policy entity, payee accounts, phone numbers, and platform listing.

Will an SEC or NPC complaint award damages automatically?

No. Liability, sanctions, damages, and criminal responsibility require the appropriate proceedings and evidence. Regulators may investigate, order corrective action, impose administrative sanctions within their authority, or refer possible offenses. Court or adjudicatory relief may require a separate properly filed action.

This article provides general Philippine legal information, not advice for a particular loan, complaint, or court case. Outcomes depend on the contract, communications, identity of the provider, evidence, and applicable regulator. Laws, procedures, official channels, fees, and cited guidance were checked against primary and official sources as of 6 August 2026.