Quick answer

Online lending app harassment can be reported to more than one authority because different agencies handle different violations:

Report abusive collection practices by an SEC-regulated lending or financing company to the Securities and Exchange Commission (SEC).
Report unauthorized access, use, or disclosure of contacts, photos, messages, or other personal data to the National Privacy Commission (NPC).
If the lender is a bank, digital bank, e-money issuer, or another BSP-supervised institution, complain first to the provider and then escalate an unresolved complaint to the Bangko Sentral ng Pilipinas (BSP).
Report threats of violence, extortion, impersonation, account hacking, or other possible crimes promptly to the Philippine National Police or National Bureau of Investigation. Call 911 if anyone is in immediate danger.

Harassment does not erase a legitimate loan, but owing money does not give a lender or collector the right to threaten, shame, deceive, or misuse personal data. Preserve the evidence before blocking numbers, deleting the app, changing permissions, or closing accounts.

What conduct may be reported?

Debt collectors may make lawful, proportionate efforts to collect an unpaid account. The fact that a borrower received a payment reminder does not by itself establish harassment or a privacy violation.

A complaint may be warranted when collectors engage in conduct such as:

threatening violence, arrest, imprisonment, public humiliation, or another consequence they have no lawful authority to impose;
using insults, obscene language, repeated intimidation, or deceptive representations;
pretending to be a court, police officer, lawyer, government employee, or another person;
posting or threatening to post the borrower’s name, photograph, identification, loan details, or alleged delinquency online;
sending humiliating messages to an employer, co-worker, relative, friend, or social-media contact;
contacting people taken from the borrower’s phonebook for collection when they were not the borrower’s chosen guarantors;
falsely telling third parties that they are co-makers, guarantors, or responsible for paying the loan;
editing a borrower’s photograph into a “wanted,” criminal, fraudulent, or sexually degrading image;
accessing contacts, photos, camera, location, messages, or files beyond what is necessary and lawfully disclosed;
continuing to use app permissions after the purpose for which access was obtained has ended; or
disclosing personal information without a lawful basis or for a purpose inconsistent with the stated loan transaction.

SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair debt-collection practices by covered financing and lending companies. The Financial Products and Services Consumer Protection Act, or Republic Act No. 11765, separately requires fair and respectful treatment, prohibits abusive collection or debt-recovery practices, and protects client data. It also makes covered providers responsible for acts or omissions of their employees and agents and, in specified circumstances, jointly liable with accredited third-party service providers. See the official text of Republic Act No. 11765.

What privacy rules apply to lending apps?

The Data Privacy Act requires personal-data processing to have a lawful basis and to be transparent, proportionate, and limited to a legitimate purpose. Agreeing to a privacy policy or granting a phone permission is not a blanket authorization to harass the borrower or expose the debt to everyone in the borrower’s contacts.

Under the NPC’s rules for loan-related transactions:

an app should request access only when the data is suitable, necessary, and not excessive for a legitimate purpose;
consent should be requested when the information is actually needed, with an appropriate notice explaining how it will be used;
unrestricted or excessive processing of contact lists is prohibited;
contact-list processing that leads to harassment, collects from persons other than borrower-provided guarantors, or produces unfair collection practices is prohibited;
an app may provide an interface allowing the borrower to select a character reference or guarantor, but access must be limited to what is necessary for that selection; and
a borrower’s photograph must not be used to harass or embarrass the borrower in collecting a delinquent loan.

The current provisions are found in NPC Circular No. 2022-02, which amended NPC Circular No. 2020-01.

A lender may still process information when another lawful basis applies—for example, information genuinely necessary to administer or enforce a contract. Whether a particular use was lawful depends on the information involved, the declared purpose, the notices shown, the permissions granted, who received the information, and what the collector actually did.

Preserve evidence before taking action

Create a separate evidence folder and keep the original files whenever possible. Save:

screenshots and screen recordings showing the full message, sender, date, and time;
original SMS, emails, chat threads, voice messages, call logs, and social-media posts;
URLs, profile names, account identifiers, phone numbers, email addresses, and payment-account details;
the app’s name, developer, store listing, version, privacy policy, and requested permissions;
screenshots of current phone permissions and any prompts requesting access to contacts, photos, camera, location, or storage;
the loan agreement, disclosure statement, promissory note, repayment schedule, receipts, and account statement;
proof of the amount actually received and all amounts already paid;
communications with the lender’s customer-service, privacy, or complaints unit;
messages sent to relatives, co-workers, employers, references, or other third parties;
written statements from recipients describing what they received and when;
proof connecting the app’s trade name to the corporate lender or financing company; and
a chronological incident log listing every call, threat, disclosure, payment demand, and report made.

Ask affected contacts not to delete messages. They should preserve the original thread and sender information, not merely forward a cropped screenshot.

Do not publicly repost unredacted threats if doing so would expose your own ID, account number, address, contact list, or other sensitive information. Provide complete copies privately to the proper authority.

Secure your phone and accounts

After preserving evidence:

Review the app’s permissions and disable access that is no longer necessary, particularly contacts, photos, camera, microphone, location, and storage.
Check whether the app has accessibility, device-administrator, notification-access, or “display over other apps” privileges, and revoke unnecessary access.
Change passwords for affected email, social-media, cloud-storage, and financial accounts. Use unique passwords and enable multifactor authentication.
Check account sessions and sign out unknown devices.
Tell contacts that they may receive unauthorized collection messages and should not provide personal information, verification codes, or money.
Report abusive messages or impersonating accounts to the relevant app store, messaging service, or social-media platform.
Do not install another APK, screen-sharing tool, or “verification” app sent by a collector.
Do not send an OTP, PIN, password, selfie with ID, or additional contact list merely to stop the harassment.

Uninstalling the lending app does not necessarily erase data already copied to the lender’s systems. If appropriate, make a written request concerning access, correction, objection, deletion, or blocking. Some information may lawfully be retained for an outstanding contract, recordkeeping duty, legal claim, or another authorized purpose, so deletion is not automatic in every case.

Send a written notice to the lender

Write to the company—not only to the collector’s personal number. Use the lender’s official consumer-assistance and privacy contacts shown in the contract, disclosure statement, app, website, or privacy notice.

Your notice should identify:

your full name and account or application number;
the app and corporate lender involved;
the phone numbers, accounts, or collector names used;
the specific conduct complained of;
dates and recipients of any disclosures;
the data or app permissions involved;
the action requested; and
a reasonable deadline for a written response.

You may request that the company:

stop abusive or unauthorized collection activity;
preserve relevant call recordings, messages, access logs, account notes, and instructions given to collectors;
identify the company and collection agency responsible;
explain the source, purpose, lawful basis, recipients, and retention of the personal data used;
correct inaccurate information;
restrict or delete data when legally required; and
communicate only through a specified lawful channel.

Keep proof that the notice was delivered. For an NPC complaint, this step is especially important: the general rule requires the complainant to notify the respondent in writing and allow it to act. Ordinarily, the complaint should show that the respondent failed to take timely or appropriate action or did not respond within 15 calendar days after receiving the notice. The NPC may waive exhaustion requirements in circumstances allowed by its rules, but a complainant should not assume that an exception applies.

How to complain to the SEC

Use the SEC route for unfair collection practices by lending and financing companies, operation without proper authority, disclosure failures, or related regulatory violations.

The SEC’s official instructions require:

a completely and accurately filled-out complaint form;
one complaint form for each respondent company;
a copy of a valid government-issued ID; and
supporting evidence, such as the loan disclosure statement, agreement, repayment schedule, receipts, messages, and screenshots.

The SEC currently identifies flcd_complaints@sec.gov.ph as the Financial and Lending Company Division’s email for lending complaints. Its official lending and financing company complaint page contains the complaint form and filing instructions. SEC concerns may also be submitted through the SEC iMessage portal.

For email filing, follow the SEC’s stated subject format:

COMPLETE NAME_RESPONDENT COMPANY_SUBJECT OF COMPLAINT

Identify the registered company, not only the app’s brand name, if that information is available. Attach evidence connecting the two.

According to the SEC’s published procedure, it evaluates the filing and may furnish the respondent with a copy. The company is ordinarily given 10 days from receipt to answer or comment. The SEC may seek a reply, close a resolved matter, endorse issues to another agency, or commence administrative proceedings when sufficient grounds exist.

The SEC cannot simply cancel the debt, change the payment terms, declare the agreement void, or settle the borrower’s obligation through this complaint process. Those issues may require negotiation, mediation, or court action.

How to complain to the National Privacy Commission

Use the NPC route when the complaint concerns unauthorized or excessive access, use, collection, retention, or disclosure of personal data.

The NPC’s current Complaint-Affidavit form should be completed fully and accurately. It incorporates verification and certification against forum shopping and must ordinarily be notarized. Attach:

evidence of the privacy violation;
witness affidavits, when available;
the privacy notice or permission screens;
proof of your written notice to the respondent;
the respondent’s reply, or proof that 15 calendar days passed without a response; and
documents identifying the responsible lender, app operator, collection agency, or other entity.

Failure to attach supporting evidence can result in outright dismissal. Use the latest form available on the NPC forms page and review the NPC complaint mechanics before filing.

The NPC lists these filing methods, subject to its current procedural requirements:

personal filing;
registered mail;
courier; or
email when authorized by the Commission.

The NPC currently directs complaints to complaints@privacy.gov.ph. Its 2025 form lists the NPC at 25th–27th Floors, The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Quezon City 1103. Confirm the address and filing requirements on the official NPC complaint page immediately before sending a physical filing.

Electronic documents should comply with the NPC’s prescribed format and signing requirements. Do not assume that an ordinary unsigned email containing screenshots is already a formal complaint.

If the provider is regulated by the BSP

Some loan apps are operated by banks, digital banks, e-money issuers, or other BSP-supervised financial institutions rather than SEC-regulated lending companies.

First submit the complaint to the institution’s own Financial Consumer Protection Assistance Mechanism or official customer-service channel. Preserve its ticket number, acknowledgment, and final response.

If the issue remains unresolved, escalate it through the BSP Online Buddy or other BSP consumer-assistance channels. The BSP lists consumeraffairs@bsp.gov.ph for consumer complaints. Include:

your complaint to the institution;
its response, if any;
the account and transaction details;
a concise chronology; and
supporting documents.

The BSP generally handles complaints against BSP-supervised institutions. It is not the usual regulator for an ordinary SEC-licensed lending company merely because payments passed through a bank or e-wallet.

When to report the matter to law enforcement

Go beyond an administrative complaint when the conduct may be criminal—for example:

a credible threat to kill, injure, abduct, or sexually assault someone;
extortion or a demand for money accompanied by a threat to expose private information;
account takeover, hacking, identity theft, or unauthorized financial transactions;
impersonation of police, courts, lawyers, or government officials;
fabricated warrants, summonses, or criminal charges;
stalking or attempts to enter the borrower’s home or workplace;
publication of intimate images or sexually degrading material; or
coordinated harassment that creates an immediate safety risk.

Call 911 for immediate danger. Otherwise, bring your evidence and identification to the appropriate PNP unit or the NBI. The NBI maintains an online complaint page and lists its Cybercrime Division at ccd@nbi.gov.ph on the official NBI divisions directory.

An administrative complaint to the SEC or NPC does not automatically replace a criminal complaint. Likewise, filing with law enforcement does not necessarily address licensing, consumer-protection, or data-governance violations.

Do you still have to pay the loan?

Harassment or a privacy violation does not automatically cancel a valid principal obligation. Dispute unlawful collection conduct separately from the account balance.

Ask the lender for:

the loan agreement and disclosure statement;
an itemized statement of principal, interest, penalties, fees, and payments;
the lender’s registered corporate name and authority to operate;
the identity and authority of any collection agency; and
an official payment channel and receipt.

Do not send money to a collector’s personal account merely because of a threat. Verify payment instructions through the lender’s official channel. If the balance, charges, or validity of the agreement is disputed, obtain legal advice before signing a restructuring agreement, waiver, acknowledgment, or settlement.

The Constitution prohibits imprisonment for nonpayment of debt alone. That principle does not shield separate fraudulent or criminal conduct, and whether a particular case involves more than unpaid debt depends on the evidence. A collector cannot lawfully guarantee arrest or conviction through a text message.

Common mistakes to avoid

Deleting the app or messages before preserving evidence.
Filing only against the app name without identifying the corporate operator.
Sending cropped screenshots that omit the sender, date, time, or surrounding conversation.
Treating an inquiry or social-media post as a formal administrative complaint.
Failing to notify the lender in writing before filing with the NPC, without establishing grounds for waiver.
Omitting the notarization, verification, certification against forum shopping, or attachments required for an NPC complaint.
Combining several unrelated lenders in one SEC complaint form.
Paying through an unverified personal bank or e-wallet account.
Threatening collectors in return or publishing their unverified personal information.
Assuming that revoking permissions deletes data already collected.
Ignoring official notices because earlier messages were abusive. Authenticate any supposed court document directly with the named court or through counsel.
Expecting the SEC or NPC complaint process by itself to cancel the loan or determine every claim for damages.

When legal help is urgent

Consult a lawyer or the Public Attorney’s Office promptly when:

there is a credible threat to safety;
intimate images, IDs, medical information, or other highly sensitive data have been published;
money or an account was taken through hacking or impersonation;
you receive an authentic summons, subpoena, warrant, or court pleading;
the respondent is unknown, overseas, or hiding behind multiple entities;
several agencies or court proceedings involve the same facts;
you are being asked to sign a waiver or settlement;
substantial damages or business and employment losses have occurred; or
a deadline in an official order or notice is approaching.

A lawyer can assess possible criminal, civil, administrative, and privacy remedies based on the exact messages, contract, data flows, and identity of the parties.

Frequently asked questions

Can a lending app contact everyone in my phonebook?

Not for unrestricted debt collection. NPC rules prohibit unbridled contact-list processing, including processing that leads to harassment or collection from persons other than borrower-provided guarantors. Limited access may be permitted so the borrower can select a character reference or guarantor, subject to necessity and proportionality.

Can a lender contact my guarantor or reference?

Contact is not automatically unlawful, but its purpose, content, frequency, and data disclosed must remain lawful and proportionate. Naming someone as a character reference does not automatically make that person liable for the debt. Liability as a guarantor or co-maker depends on a valid legal undertaking and its terms.

Does clicking “Allow Contacts” mean the lender may message all my contacts?

No. Device permission does not remove the requirements of lawful purpose, transparency, necessity, and proportionality, and it does not authorize harassment or indiscriminate disclosure.

May collectors tell my employer or family that I owe money?

Disclosure to third parties can raise both unfair-collection and data-privacy issues, particularly when it is used to shame the borrower or demand payment from someone who is not legally responsible. The result depends on who was contacted, why, what was disclosed, and whether a lawful basis existed.

Should I block the collectors?

Preserve the complete evidence first. You may then block abusive accounts for safety, but keep at least one controlled written channel open with the company if you need statements, dispute resolution, or proof of notice. You do not need to accept threats to maintain a dispute.

Can I file with both the SEC and NPC?

Yes, when the facts involve both unfair collection and misuse of personal data. Describe each agency’s issue clearly and disclose other pending proceedings when a form or rule requires it. An NPC filing must contain the required certification against forum shopping.

Is a police blotter enough?

A blotter may document an incident, but it is not necessarily a complete criminal complaint or an SEC/NPC complaint. Ask the receiving office what affidavits, device evidence, and follow-up steps are required.

How quickly should I report?

Preserve evidence and send written notice promptly. Immediate threats should be reported without waiting 15 days. Different remedies have different limitation periods, and delay can make digital evidence and respondent identification harder. Republic Act No. 11765 generally provides a five-year period for claims under that Act, subject to its discovery rule and ten-year outer limit, but other laws and proceedings may use different periods.

Official resources

This article provides general legal information, not legal advice or a prediction of how any complaint will be resolved. Procedures and conclusions may depend on the lender’s regulator, the contract, the personal data involved, and the available evidence. Official sources and procedures were checked on 2 September 2026; confirm filing forms, addresses, and channels directly with the relevant agency before submitting.