Quick answer

You may report an online lending app to:

The Securities and Exchange Commission (SEC) for harassment, public shaming, deceptive collection tactics, threats, unreasonable contact hours, or collection through unauthorized contacts.
The National Privacy Commission (NPC) for misuse of your contacts, photos, messages, account information, or other personal data.
The Bangko Sentral ng Pilipinas (BSP) if the lender is a bank, digital bank, e-money issuer, pawnshop, or another BSP-supervised institution.
The PNP, NBI, or another cybercrime authority when the conduct includes threats of violence, extortion, impersonation, account intrusion, identity theft, or another possible crime.

You may complain even when the loan is valid or unpaid. A lender may pursue lawful collection, but it may not harass, deceive, threaten illegal action, publicly shame you, or use your personal data without a lawful and proportionate purpose.

Preserve the evidence before blocking numbers, revoking permissions, or uninstalling the app.

What conduct can be reported?

SEC Memorandum Circular No. 18, Series of 2019 prohibits financing companies, lending companies, and their collection service providers from using unfair collection practices.

Conduct	General rule
Threatening violence or harm to a person, reputation, or property	Prohibited
Threatening arrest, prosecution, seizure, or another action that cannot legally be taken	Prohibited
Using obscenities, insults, or profane and abusive language	Prohibited
Posting or circulating the borrower’s name, photo, debt, or other personal information to shame the borrower	Generally prohibited
Giving false information about the loan or failing to disclose that a debt is disputed	Prohibited, subject to lawful disclosures
Pretending to be a police officer, court employee, lawyer, or government agency	A false representation may be an unfair collection practice and, depending on the facts, a possible criminal matter
Calling or messaging before 6:00 a.m. or after 10:00 p.m.	Generally prohibited, unless the account is over 15 days past due or the borrower expressly agreed that those hours are the only reasonable contact times
Contacting people from the borrower’s phone or social-media contacts to collect or shame	Prohibited when they are not actual guarantors; a character reference is not automatically a guarantor
Using a borrower’s photo to embarrass or pressure the borrower	Prohibited
Repeated calls or messages designed to intimidate rather than communicate a legitimate demand	May be reportable depending on frequency, content, timing, and circumstances

The Financial Products and Services Consumer Protection Act also prohibits abusive collection or debt-recovery practices and makes regulated financial service providers responsible for their employees and agents. A lender generally cannot escape responsibility simply by outsourcing collection.

What remains lawful?

A legitimate lender may ordinarily:

Contact the borrower at reasonable times and through lawful channels.
Send a truthful statement of account or demand letter.
Negotiate payment or restructuring.
Use lawful credit-reporting processes.
File an appropriate civil case or use another remedy authorized by the loan agreement and Philippine law.

Harassment does not automatically cancel the loan, erase lawful interest, or prevent a creditor from filing a proper case. The collection conduct and the underlying debt are separate issues.

Privacy rules for lending apps

The Data Privacy Act of 2012 requires personal information to be collected for a specified and legitimate purpose, processed fairly and lawfully, limited to what is necessary, protected against unauthorized access or disclosure, and retained only as long as necessary.

Under NPC Circular No. 2020-01, as amended by NPC Circular No. 2022-02:

App permissions must be suitable, necessary, and not excessive.
Consent should be obtained when the particular information becomes necessary, with an accessible “just-in-time” notice explaining its use.
Camera or photo access allowed for identification, fraud prevention, or payment verification should not remain active when no longer needed.
Unrestrained or disproportionate processing of contact lists is prohibited, particularly when it leads to harassment or unfair collection.
An app may provide a limited interface for the borrower to choose a character reference or guarantor. It should not harvest or freely process the borrower’s entire contact list.
A character reference is for verifying the borrower’s identity and information. The reference is not automatically a guarantor.
A guarantor must separately consent and expressly undertake the obligation required by law.
For debt collection, the lender may contact the actual guarantor—not unrelated people in the borrower’s contacts.

These privacy rules apply to persons acting as lending or financing businesses even if they lack the required SEC authority.

First: preserve the evidence

Before uninstalling the app or deleting messages, collect evidence showing who did what, when, and through which account or number.

Preserve:

Uncropped screenshots showing the sender’s number or profile, message, date, and time.
Complete chat exports, text threads, call logs, emails, voicemails, and social-media messages.
URLs and screenshots of public posts containing your name, photo, debt, or personal details.
The app-store listing, app name, developer, version, privacy notice, and listed company.
Screenshots of the app’s permissions and any request for access to contacts, photos, SMS, location, microphone, or social media.
The loan agreement, disclosure statement, payment schedule, receipts, balance statements, and account number.
Names used by collectors, collection-agency details, phone numbers, email addresses, and payment accounts they supplied.
Messages sent to relatives, coworkers, employers, or friends.
Written statements or affidavits from people who were contacted.
Your written complaint to the lender and proof that it was received.
Any response, acknowledgment, ticket number, or refusal from the lender.

Keep the original files. Do not rely only on cropped screenshots or edited compilations. Back up the material to another secure device or account.

Do not secretly record a private telephone conversation without legal advice. The legality and admissibility of recordings can depend on how they were made. Preserve existing voicemails and recordings that were lawfully created.

Secure your phone and accounts

After preserving evidence:

Revoke permissions the lending app no longer needs, especially access to contacts, photos, SMS, location, camera, and microphone.
Check whether the app has accessibility access, device-administrator privileges, notification access, or permission to install unknown apps.
Change passwords for your email, app store, social-media accounts, bank, and e-wallet if compromise is suspected.
Enable multi-factor authentication where available.
Tell affected contacts not to pay, click links, disclose information, or engage with the collector. Ask them to preserve the messages.
If the phone appears compromised, back up the evidence and seek technical assistance before performing a factory reset.

Send a written notice to the lender

A written notice creates evidence and is normally required before filing a formal NPC complaint.

Send it to the lender’s customer-service channel and data protection officer, if identified in the app or privacy notice. Use email or another method that provides proof of delivery.

Subject: Written notice of harassment and privacy violation — [app and account number]

I am notifying [company’s legal name] that its employee, agent, or collection service provider contacted me and/or third parties on [dates] through [numbers/accounts]. The conduct included [brief factual description].

I request that the company:

stop disclosing my loan and personal information to third parties and communicate directly with me through [preferred lawful channel];

identify the lender, collection agency, and persons or accounts involved;

state what personal data was obtained, its source, purpose, lawful basis, retention period, and recipients;

provide access to my personal data and relevant disclosure or collection records;

correct, block, remove, or destroy data that was unlawfully obtained, used for an unauthorized purpose, or is no longer necessary, subject to lawful retention requirements;

preserve all relevant logs, messages, recordings, account notes, and instructions pending investigation; and

provide a written response and corrective action.

This notice does not prevent lawful resolution of any legitimate account. Please provide an accurate statement of account and use only lawful collection methods.

For an NPC complaint, preserve proof that the company received this notice. Under the 2021 NPC Rules of Procedure, as amended, the complainant must ordinarily show that:

the respondent was informed in writing of the violation; and
the respondent failed to take timely or appropriate action, or did not respond within 15 calendar days after receipt.

The NPC may waive this requirement for proven good cause or a serious violation, including circumstances involving grave and irreparable harm, no adequate remedy, or patently illegal conduct. Waiver is discretionary, so explain and document the urgency rather than merely omitting the written notice.

How to file with the SEC

Most stand-alone lending and financing companies, including their online lending platforms and collection agencies, fall under SEC supervision.

Open the SEC’s iMessage ticketing portal.
Select Open a New Ticket and sign in through an eSECURE account.
Choose Complaints on Financing and Lending Companies under the Financing and Lending Companies Department.
Identify both the app’s brand name and the legal company behind it. If a collection agency is involved, name it as well.
Give a short chronological account: date, time, sender, exact conduct, people contacted, and resulting harm.
Upload the evidence, loan documents, written complaint to the lender, and response, if any.
State the action requested, such as investigation, cessation of unfair collection, correction of company records, or referral to another authority.
Save the ticket number and use the portal to monitor or reply to the case.

The current SEC iMessage user guide explains ticket creation and status tracking.

If the app appears unlicensed, report that fact and attach the app-store page, advertisements, loan documents, payment instructions, and the name or bank account receiving payments. Do not assume that the absence of an SEC license prevents a complaint.

How to file with the National Privacy Commission

The borrower, a contacted relative or coworker, or any other person whose personal data was misused may file as the affected data subject. A representative generally needs a special power of attorney. Special representation rules apply to minors and persons who cannot act for themselves.

Required steps

Download the NPC’s current Complaint-Affidavit form.
Identify the respondent. If its legal name is unknown, describe the app, developer, numbers, payment accounts, and other facts that may establish its identity.
List the personal information processed or disclosed.
Narrate the facts clearly and chronologically.
Attach the written notice to the lender, proof of receipt, its response, and supporting evidence.
Include affidavits from witnesses when relevant.
Attach a valid government-issued ID and the required certification against forum shopping.
Sign and have the complaint notarized.
Submit it personally, by courier or registered mail, or email a scanned copy to complaints@privacy.gov.ph, following the instructions on the NPC filing page.

The current NPC office is at 25th–27th Floors, The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Quezon City 1103. Confirm contact details on the NPC directory before a physical filing.

The current base complaint filing fee is ₱500, plus the applicable legal research fee and any additional fee for a damages claim. Indigent complainants may seek an exemption if they meet the income and property requirements and submit the required documents. Review the NPC schedule of fees and wait for official payment instructions.

The NPC has 30 calendar days from receipt to determine whether to give the complaint due course or dismiss it without prejudice. The NPC website estimates roughly 10 to 12 months through final adjudication, although actual duration depends on the case.

When to request a temporary ban

If the lender is continuing to disclose or process personal data in a way that may cause serious harm, ask the NPC or a lawyer about an application for a temporary ban on processing.

This is not automatic. The application requires supporting evidence and judicial affidavits, may involve a summary hearing or position papers, and ordinarily requires a bond fixed under NPC rules.

When the BSP is the correct regulator

Use the BSP route if the lender is a BSP-supervised institution, such as a bank, digital bank, non-bank e-money issuer, pawnshop, or another entity listed within BSP supervision.

First complain through the institution’s Financial Consumer Protection Assistance Mechanism or customer-service channel. If the matter remains unresolved:

Use the BSP Online Buddy, or BOB, through the BSP consumer assistance page.
If BOB is unavailable, submit the BSP Complaint, Inquiry, or Reply form to consumeraffairs@bsp.gov.ph with proof of the complaint made to the institution.

The BSP’s current complaint guide expressly states that complaints concerning ordinary financing companies, lending companies, online lending platforms, and their collection agencies are best directed to the SEC.

A cooperative lender generally falls under the Cooperative Development Authority, except for a cooperative bank or another BSP-supervised cooperative financial institution.

When to report to law enforcement

Contact law enforcement promptly when messages contain:

A specific or credible threat of physical harm.
Extortion or demands backed by threats.
Identity theft or unauthorized use of accounts.
Hacking, account takeover, or unauthorized access to a device.
Impersonation of police, courts, prosecutors, or another government office.
Publication that may constitute a criminal offense based on its precise content and circumstances.
Continuing harassment that creates an immediate safety risk.

For an immediate emergency, call Unified 911.

For cybercrime or criminal-investigation assistance, the government’s current complaint guidance lists:

PNP Anti-Cybercrime Group: acg@pnp.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph or the NBI online complaint page
Cybercrime Investigation and Coordinating Center: report@cicc.gov.ph or hotline 1326

Bring the original device when requested, together with identification, a written timeline, screenshots, source files, loan documents, and witnesses. A report to the SEC or NPC does not automatically begin a criminal prosecution; law-enforcement investigation and prosecutorial evaluation are separate processes.

Common mistakes to avoid

Deleting messages or uninstalling the app too early. Preserve the app identity, permissions, privacy notice, and communications first.
Naming only the app. Include the legal lender, developer, collection agency, collector numbers, and payment accounts whenever available.
Submitting screenshots without context. Show the sender, complete message, date, time, and surrounding conversation.
Filing an NPC complaint without the prior written notice. Wait for the response or the 15-calendar-day period unless you can properly support a waiver.
Assuming a broad consent clause authorizes contact blasting. Consent is not unlimited, and processing must remain lawful, necessary, transparent, and proportionate.
Publicly posting unredacted evidence. This may expose your own information and the personal data of innocent contacts.
Paying a collector’s personal account without verification. Confirm the company, authority to collect, balance, and official payment channel.
Ignoring the loan while pursuing the complaint. Ask for an accurate statement of account and address any valid obligation through a documented channel.
Assuming regulatory fines will be paid to you. Administrative sanctions and personal compensation are different remedies. Any claim for damages requires proof and the proper procedure.
Ignoring genuine court papers. A real summons, subpoena, or court order should be reviewed promptly by a lawyer.

When legal help is urgent

Seek prompt assistance from a Philippine lawyer, the Public Attorney’s Office if eligible, or another qualified legal-aid provider when:

You or your family face a credible threat.
Private photos, government IDs, financial credentials, or sensitive records have been circulated.
Your identity or accounts have been used without authority.
The company continues mass disclosure despite written notice.
You need an NPC temporary ban.
You intend to claim substantial damages.
You receive genuine court papers, a prosecutor’s subpoena, or a notice from law enforcement.
The debt, identity of the creditor, interest, payments, or alleged fraud is seriously disputed.

Frequently asked questions

Can I complain even if I have not paid the loan?

Yes. Unpaid debt does not authorize harassment or unlawful data processing. The creditor may still pursue the valid debt through lawful methods.

Can a collector contact my family, coworkers, or employer?

A lender may not disclose your debt or use those people to shame or pressure you. Under the NPC lending rules, debt-collection contact is limited to an actual guarantor. A character reference is not automatically a guarantor.

What if I never borrowed but collectors keep messaging me?

You may complain as the person whose phone number or other personal data is being processed. Tell the lender in writing that you are not the borrower or guarantor, request the source of your information, and ask that inaccurate or unlawfully used data be corrected or removed.

Does granting contacts permission make mass messaging lawful?

No. Permission does not authorize unrestrained, excessive, or disproportionate use. Processing that leads to harassment, collection through non-guarantor contacts, or unfair collection remains prohibited.

Can the lender post my name or photo?

Public shaming and disclosure of a borrower’s personal information are generally prohibited. A borrower’s photo may not be used to harass or embarrass the borrower into paying.

Can I be arrested merely because I cannot pay?

The 1987 Constitution prohibits imprisonment for debt. However, a separate allegation of fraud or another criminal act is fact-dependent and should not be ignored. A collector cannot truthfully claim that an arrest or criminal case is automatic upon nonpayment.

Should I file with both the SEC and NPC?

Often, yes. The same incident may involve unfair collection under SEC rules and unlawful personal-data processing under NPC rules. Each agency has a different mandate.

What if the app is unlicensed or its owner is unknown?

Report it to the SEC and NPC and provide every available identifier. The NPC lending-data rules expressly cover persons acting as lenders whether or not they have SEC authority. Report possible criminal conduct to law enforcement as well.

Is there a deadline?

Report promptly. NPC complaints ordinarily require the written-notice step and a 15-calendar-day opportunity to respond. Other administrative, civil, and criminal remedies have different prescriptive periods. Claims under the Financial Products and Services Consumer Protection Act generally prescribe five years from the transaction or discovery of deceit or material nondisclosure, subject to the Act’s ten-year outer limit. Do not rely on that period when evidence is disappearing or harm is continuing.

Official sources and filing links

This article provides general legal information, not legal advice or a prediction of any case’s outcome. Rights, jurisdiction, and remedies depend on the loan documents, communications, parties, and complete facts. Sources and procedures were checked as of August 10, 2026.