Quick answer

If an online lending app is threatening, insulting, publicly shaming, or contacting people who did not agree to answer for your loan, preserve the evidence and report it through the proper channels:

Report unfair collection practices by a lending or financing company to the Securities and Exchange Commission’s Financing and Lending Companies Department (FINLEND) through SEC iMessage.
Report unauthorized, excessive, or disproportionate use or disclosure of personal data to the National Privacy Commission (NPC). Send the notarized Complaints-Assisted Form and supporting evidence to complaints@privacy.gov.ph, or file personally, by registered mail, or by courier under the NPC complaint procedure.
Report credible threats, extortion, impersonation, fraud, hacking, or other possible crimes immediately to law enforcement or the cybercrime channels listed below. Do not wait for an administrative complaint if anyone is in immediate danger.

A complaint does not automatically cancel a valid loan. The lender may still collect through lawful means, but it cannot use abusive collection or unlawful data processing to do so.

Conduct you can report

The Financial Products and Services Consumer Protection Act, or Republic Act No. 11765, prohibits financial service providers from using abusive collection or debt-recovery practices. It also protects financial consumers’ rights to fair treatment, data privacy, and timely complaint handling.

For lending and financing companies, SEC Memorandum Circular No. 18, series of 2019 treats the following as unfair collection practices:

Threatening violence, property damage, reputational harm, or other criminal conduct.
Threatening an action that cannot legally be taken.
Using obscenities, insults, or profane language that abuses the borrower or may amount to an offense.
Publishing or threatening to publish a borrower’s name or personal information to shame the borrower into paying.
Communicating loan information known—or that reasonably should be known—to be false, including failing to disclose that a debt is disputed.
Using false representations or deceptive means to collect a debt or obtain information about a borrower.
Contacting the borrower before 6:00 a.m. or after 10:00 p.m., unless the account is more than 60 days past due, the borrower expressly permitted contact at those hours, or those hours are the only reasonable or convenient opportunity for contact.
Contacting people in the borrower’s contact list who were not named as guarantors or co-makers, even if the borrower previously allowed access to contacts.

Whether a particular message is unlawful depends on its actual wording, context, frequency, recipient, and supporting evidence. A firm but accurate payment demand is not automatically harassment. Threats, deception, humiliation, abusive language, and disclosure to unrelated people are different.

When contact-list use becomes a privacy violation

The Data Privacy Act of 2012 requires personal-data processing to be transparent, for a legitimate purpose, and proportionate. Data must be adequate and relevant, not excessive, and retained only as long as necessary or as otherwise permitted by law.

Under NPC Circular No. 2020-01, as amended by NPC Circular No. 2022-02:

An app may not require unnecessary permissions or process more personal data than necessary.
Access to a camera, gallery, contact list, or other protected resource must be suitable and necessary for a specified, legitimate purpose.
The app should prompt the user to revoke a permission when its purpose has been completed.
Contact-list processing that leads to harassment, collection outside permitted guarantors, or unfair collection is prohibited.
An app may provide a limited interface allowing the borrower to select a character reference or guarantor. Unrestricted copying, saving, or use of the entire contact list is prohibited.
A borrower’s photograph may not be used to embarrass or harass the borrower.
A character reference is for verifying the borrower’s identity and information. A reference is not automatically a guarantor and should not be pressured to pay.
A guarantor must have separately and expressly consented to assume responsibility if the borrower defaults.
For debt collection involving people selected from a contact list, the NPC rules permit contact with the guarantor—not unrelated relatives, friends, co-workers, customers, or social-media contacts.

The DICT, NPC, and SEC reiterated these rules in their 18 March 2026 Joint Advisory on Online Lending Platforms, including platforms operated without proper recording or authorization.

A genuine co-borrower or co-maker who signed the loan documents may have a separate legal obligation. Check the actual agreement before assuming that someone was merely a reference.

Preserve evidence before blocking or uninstalling the app

Save evidence before changing permissions, blocking numbers, deleting messages, or uninstalling the app. Keep an untouched master copy and a backup.

Preserve:

Full screenshots of texts, chats, social-media messages, posts, and emails, showing the sender, recipient, date, time, and surrounding conversation.
Call logs showing numbers, dates, times, duration, and frequency.
Voicemails left by collectors.
Links, usernames, account IDs, group names, and profile pages used for public shaming.
Screenshots or screen recordings of the app’s permissions, privacy notice, consent screens, collection notices, and app-store listing.
The loan agreement, disclosure statement, repayment schedule, receipts, payment confirmations, and account statement.
The app’s trade name and the legal name of the lending or financing company, if shown.
Its SEC registration number and Certificate of Authority number, if available.
The names or aliases of collectors and any collection agency they identified.
Statements or screenshots from relatives, friends, employers, or other people contacted about the debt.
Your written complaint to the company and proof that it was delivered.
The company’s reply, ticket number, or failure to respond.
A dated chronology explaining what happened and who received each disclosure.

Ask affected contacts to keep the original messages on their own devices. Their signed affidavits may strengthen an NPC complaint.

Do not secretly record a private telephone conversation without specific legal advice or the consent required by law. The Anti-Wiretapping Act generally prohibits secretly recording a private communication without authorization from all parties, and the Supreme Court has applied it even when the person recording participated in the conversation in Ramirez v. Court of Appeals.

Send the company a written demand

Send the complaint to the lender’s consumer-assistance unit, official support address, and data protection officer if identified in its privacy notice. Keep proof of transmission and receipt.

A concise notice may state:

I am reporting collection and personal-data processing connected with account [reference number]. On [dates], your company or collection agent [describe the exact calls, messages, disclosures, threats, or contact-list use]. The recipients included [identify them and explain whether they were references, guarantors, or unrelated contacts].

I demand that you stop abusive collection and all unauthorized contact with third parties; preserve all relevant records; identify the lending company, collection agency, and persons responsible; identify the personal data collected, its source, purpose, and recipients; correct any false information; and block or delete data that was unlawfully obtained, used for an unauthorized purpose, or is no longer lawfully necessary, subject to legitimate retention required by law.

Please acknowledge this notice and provide your written action within 15 calendar days.

This notice helps establish the NPC’s usual exhaustion requirement. It does not prevent an immediate SEC or police report, and it does not require you to negotiate directly with someone making credible threats.

File the SEC complaint

Use SEC iMessage and direct the ticket to FINLEND for unfair collection by a lending company, financing company, online lending platform, or its collection agent.

Include:

Your name and reliable contact details.
The app name and the lender’s full corporate name, if known.
SEC registration and Certificate of Authority details, if available.
Your loan or account reference, amount borrowed, due date, and disputed amount, if relevant.
A chronological account of the collection conduct.
The phone numbers, accounts, names, and agencies used by the collectors.
Copies of the messages, posts, call logs, loan documents, and complaints already sent to the company.
The identities of third parties contacted and whether they ever agreed to be guarantors or co-makers.
A clear request for investigation and appropriate regulatory action.

If the app conceals the legal lender or appears unlicensed, say so and attach the privacy notice, app-store page, website, advertisements, payment instructions, and any company details you found. The SEC’s 2026 advisory also lists 1-4732 (1-4SEC) as its hotline.

The SEC may impose regulatory sanctions where supported by the evidence and applicable rules. Possible measures include fines, cease-and-desist orders, suspension, or cancellation of the provider’s authority to operate. Outcomes depend on the investigation; filing a complaint does not guarantee a particular sanction or financial award.

File the NPC privacy complaint

Use the NPC’s current Complaints-Assisted Form. The NPC accepts a completed, notarized form or a properly verified complaint with evidence and witness affidavits:

By email to complaints@privacy.gov.ph;
Personally at an NPC office;
By registered mail; or
By courier.

Follow the current filing instructions and 2021 Rules of Procedure, as amended. Electronic filings should comply with the NPC’s signature and PDF requirements.

The 15-day exhaustion rule

Before the NPC ordinarily gives a complaint due course, you must show that:

You informed the lender, collection agency, or other responsible entity of the privacy violation in writing; and
It failed to take timely and appropriate action or did not respond within 15 calendar days after receiving the notice.

Attach the notice and delivery proof. The 15 days are an exhaustion period, not a reason to delay an SEC, police, or emergency report.

The NPC may waive prior exhaustion for good cause or serious violations, including circumstances involving grave and irreparable harm, no plain and adequate remedy from the respondent, or patently illegal conduct. Explain and document the urgency rather than simply omitting the prior notice.

Form, attachments, and fee

The complaint should identify the complainant and respondent, narrate the material facts, state the requested relief, attach correspondence and evidence, and include the required verification and certification against forum shopping. If the respondent’s legal identity is unknown, provide the app name, numbers, URLs, payment accounts, and other facts that may lead to identification.

The current NPC Schedule of Fees and Charges lists a ₱500 filing fee for complaints. Additional fees may apply to claims for damages, motions, or special applications. Qualified indigent complainants may seek exemption by submitting the prescribed proof. The Complaints-Assisted Form also instructs complainants to use one form per respondent.

The NPC may issue compliance orders, impose administrative fines, order a ban on processing, award indemnity where legally supported, or recommend prosecution to the Department of Justice. Criminal guilt and statutory imprisonment are determined through the proper criminal process, not merely by filing an NPC complaint.

Report threats, fraud, or other possible crimes

Administrative complaints do not replace emergency or criminal reporting. According to the 2026 Joint Advisory, reports involving threats, harassment, fraud, or scams may also be sent to:

DICT Cyber Hotline: 1326 or 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph or (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph, onlinecims.ocs@gmail.com, or (02) 8723-0401 local 7491

Call 911 for a credible and immediate threat to life, safety, or property. You may also report at the nearest police station. Bring the original device if requested, but first maintain a secure backup and ask for a complaint or incident reference number.

Do not assume that every offensive message constitutes a particular crime. Possible criminal liability depends on the exact words, surrounding acts, identities involved, intent, and admissible evidence.

Protect your accounts and contacts

After preserving evidence:

Revoke unnecessary contacts, camera, gallery, microphone, location, SMS, and storage permissions.
Change the passwords of your email, social-media, mobile-wallet, and banking accounts if the app or collector may have obtained access.
Enable multi-factor authentication.
Warn affected contacts not to send money, disclose information, click links, or provide one-time passwords.
Tell contacts to preserve messages rather than arguing with collectors.
Report impersonation or abusive accounts to the relevant platform, but retain copies before the platform removes them.
Do not send additional IDs or selfies to an unverified collector.
Verify payment instructions through the lender’s official consumer-assistance channel. Do not pay into an employee’s or collector’s personal account merely because of a threat.
Continue keeping records of lawful payments and any genuine dispute over the balance.

Common mistakes to avoid

Deleting or uninstalling the app before capturing its permissions, notices, and company details.
Submitting cropped screenshots that omit the sender, date, time, or context.
Naming only the app’s brand when the loan agreement identifies a different legal company.
Filing an NPC complaint without proof of the written notice and 15-day opportunity to respond, unless a waiver is properly justified.
Describing conduct only as “harassment” without quoting or attaching the actual messages.
Claiming that every friend or relative contacted was a guarantor without checking whether that person expressly consented.
Secretly recording private calls without considering the Anti-Wiretapping Act.
Posting the collector’s unredacted IDs, phone numbers, or personal data publicly. Provide evidence to the authorities instead.
Assuming that a privacy or SEC complaint erases the debt.
Ignoring a real summons, subpoena, court order, or regulator’s notice because earlier collector messages were false.

When legal help is urgent

Consult a Philippine lawyer promptly if:

A credible threat of violence, stalking, property damage, or extortion is continuing.
Your IDs, photographs, address, employer information, or financial credentials were publicly exposed.
A collector impersonated a court, police officer, prosecutor, lawyer, or government agency.
You received an authentic summons, subpoena, warrant, or formal court pleading.
The app used your identity to open another account or make unauthorized transactions.
A large balance, disputed payment, forged agreement, or allegedly fraudulent transaction is involved.
You want damages, an urgent temporary ban on data processing, or other court relief.
Several borrowers or contacts were affected and the evidence needs coordinated preservation.

Frequently asked questions

Does reporting harassment cancel the loan?

No. It addresses the manner of collection or use of personal data. A valid unpaid obligation may still be collected through lawful demands, negotiation, or court proceedings.

Can a lending app have me arrested simply because I did not pay?

A collector cannot issue an arrest warrant. Article III, Section 20 of the 1987 Constitution prohibits imprisonment for debt. Separate conduct—such as an independently alleged criminal act—must be evaluated under the applicable law and proper criminal procedure.

I allowed access to my contacts. Can the app message everyone?

No blanket permission authorizes harassment or unrestricted contact-list use. The SEC rule prohibits contacting unrelated people in the contact list for collection even if the borrower purportedly consented. Consent must also be specific, informed, freely given, and connected to a legitimate and proportionate purpose.

Can a character reference be required to pay?

Not merely because that person was listed as a reference. A character reference is for identity or information verification and is not automatically a guarantor. A guarantor must separately consent to assume the obligation.

Can a relative or friend file a complaint even if they are not the borrower?

Yes, if their own personal data was unlawfully obtained, used, or disclosed, they may file an NPC complaint as the affected data subject. A representative filing for another data subject generally needs a special power of attorney.

Can I demand deletion of all my data?

You may seek blocking, correction, removal, or destruction when data is false, unlawfully obtained, used without authority, or no longer necessary. The right is not absolute: a lender may retain information necessary to service the loan, meet a legal obligation, or establish, exercise, or defend legal claims.

Is there a deadline?

Act immediately while evidence remains available. Claims under Republic Act No. 11765 generally prescribe five years from consummation of the financial-consumer transaction, or five years from discovery of deceit or nondisclosure of material facts, subject to an outside limit of ten years from the violation. Privacy, civil, administrative, and criminal remedies may have different rules, so do not treat that period as applying to every possible case.

Official sources

This article provides general Philippine legal information, not legal advice for a particular loan, complaint, or criminal allegation. Facts, documents, and the lender’s regulatory status can change the correct remedy. Official sources and procedures were checked on 29 July 2026.