Quick answer

Online lending apps and their collectors may demand payment through lawful means, but they may not harass, threaten, publicly shame you, misuse your photos, or contact people in your phonebook to collect your debt unless that person separately agreed to be a guarantor.

Report:

Unfair or abusive collection by a lending or financing company: file with the Securities and Exchange Commission (SEC) through I-MESSAGE.
Unauthorized access, disclosure, or other misuse of personal data: complain to the National Privacy Commission (NPC). Normally, you must first notify the company in writing and allow 15 calendar days for an appropriate response.
Threats, extortion, fraud, impersonation, stalking, or immediate danger: report promptly to law enforcement. Call 911 if anyone faces an immediate physical threat.

The same conduct may justify reports to both the SEC and NPC, and possibly to law enforcement. Preserve the evidence before blocking the collector, revoking permissions, or uninstalling the app.

Reporting harassment does not automatically cancel a valid loan, stop lawful interest under the contract, or erase legitimate payment obligations. The debt and the collection misconduct are separate issues.

What online lenders are prohibited from doing

Unfair debt-collection practices

The Financial Products and Services Consumer Protection Act gives financial consumers rights to fair treatment, data protection, and timely complaint handling. It prohibits abusive collection or debt-recovery practices. A financial service provider is responsible for the conduct of its employees and agents and may be solidarily liable with an accredited third-party service provider involved in debt collection.

SEC Memorandum Circular No. 18, series of 2019 also prohibits unfair collection practices by SEC-regulated lending and financing companies and their collectors. Prohibited conduct can include:

Threatening violence or using other criminal means to harm a person, reputation, or property.
Threatening an action that cannot legally be taken.
Using insults, obscene language, or humiliating messages.
Using deceptive representations to pressure payment.
Publicly shaming the borrower or disclosing the debt to unrelated people.
Using a borrower’s photograph, personal details, or contacts to embarrass or intimidate.
Repeatedly contacting relatives, friends, co-workers, or an employer to pressure the borrower.
Contacting a person from the borrower’s contact list for debt collection when that person did not separately consent to be a guarantor.

A collector cannot have you arrested merely because a loan is unpaid. The Constitution prohibits imprisonment for debt. This does not prevent prosecution for a genuinely separate offense, such as proven fraud, but a private collector cannot create criminal liability simply by labeling an unpaid loan a “criminal case.”

Privacy violations involving contacts, photos, and phone permissions

The Data Privacy Act of 2012, NPC Circular No. 20-01, and its amendment, NPC Circular No. 2022-02, require personal data processing to have a lawful basis and to be transparent, necessary, proportionate, and limited to a legitimate purpose.

These rules apply not only to licensed companies but also to persons acting as lenders without the required SEC authority, as well as their data processors and service providers.

An online lending app generally may not:

Require unnecessary permissions involving contacts, messages, photos, camera, location, or stored files.
Harvest or freely copy an entire contact list for collection activity.
message people in the contact list to announce or collect the borrower’s debt.
Alter, circulate, or post a borrower’s photo to humiliate the borrower.
Retain personal data indefinitely without a continuing lawful purpose.
Use data collected for identity verification for unrelated harassment, marketing, or public shaming.
Treat a character reference as a guarantor without that person’s separate and express consent.

Not every request for permission is automatically illegal. Limited access may be lawful when genuinely necessary—for example, temporary camera or gallery access for identity or payment verification, or minimum access allowing a borrower to select a character reference or guarantor. Proportional metadata about a contact list may also be processed when the legal requirements are met. What is prohibited is unconstrained, excessive, or disproportionate processing, especially processing used for harassment or collection from people who are not guarantors.

A character reference may be contacted only for identity or information verification. The reference must be told how the lender obtained the contact details and should be given an option to have the details removed. A character reference does not become responsible for the loan.

A guarantor is different. The person must expressly consent to undertake the obligation in accordance with the law on guaranty. Merely appearing in someone’s phonebook, being named as a reference, or answering a collector’s call does not make a person a guarantor.

These rules were reiterated in the government’s 18 March 2026 joint DICT-NPC-SEC advisory.

Preserve evidence before changing anything

Make a secure copy of the evidence as soon as possible. Keep the original files and avoid cropping or editing the only copy.

Preserve:

Screenshots showing the full message, sender’s number or account, date, and time.
Chat exports, emails, text messages, voicemail notifications, and call logs.
URLs, social-media usernames, post identifiers, and screenshots of public posts.
The app’s name, icon, version, download page, developer name, privacy notice, and displayed company details.
Screenshots of every permission granted to the app.
Screenshots of the loan account, collection notices, payment instructions, and collector identity.
Loan agreements, disclosure statements, promissory notes, statements of account, receipts, and payment confirmations.
The company’s corporate name, SEC registration details, Certificate of Authority information, address, and customer-service or data-protection contact.
Names and numbers of people contacted, together with screenshots they received.
Your written complaint to the company, proof of delivery, acknowledgment, and response.
Documents showing actual harm, such as an employer notice, fraudulent transaction, replacement cost, or medical expense, if relevant to the relief claimed.

Ask contacted relatives, friends, and co-workers to preserve the original messages on their own devices. Their screenshots or affidavits can help establish who was contacted and exactly what was disclosed.

Do not secretly record a private call without legal advice. The Anti-Wiretapping Act can create separate issues when a private communication is recorded without the required consent. Written messages, call logs, contemporaneous notes, and voicemails left by the collector are often safer evidence.

Secure your phone and accounts

After preserving the evidence:

Revoke the app’s access to contacts, camera, photos, files, location, microphone, and SMS unless a permission remains genuinely necessary.
Change important passwords and PINs from a trusted device, especially if you disclosed credentials or installed software from an unofficial source.
Enable multi-factor authentication on email, banking, e-wallet, and social-media accounts.
Review logged-in devices and recent financial transactions.
Tell affected contacts not to pay, click links, disclose information, or argue with the collector. Ask them to preserve and then block the messages.
Keep one written channel available for legitimate account communications if it is safe to do so.
Uninstall the app only after preserving the evidence and any account information you may need.

If an OTP, bank credential, card detail, or e-wallet credential was exposed, contact the relevant financial institution immediately through its official channel.

Send the company a written notice

A written notice gives the company an opportunity to stop the conduct and creates evidence for the SEC and NPC. For an NPC complaint, this is ordinarily required before the complaint will be given due course.

Send the notice to the lender’s consumer-assistance unit, customer-service address, and data protection officer if those details are available. State:

Your name and loan or account reference, without sending unnecessary passwords or PINs.
The dates and exact collection conduct complained of.
The numbers, accounts, collectors, or agencies involved.
The personal data accessed, disclosed, or misused.
The people contacted and what they were told.
The relief requested.
A request for a written response.

You may request that the company:

Stop harassment and public disclosure immediately.
Identify the company and collection agency responsible.
State the lawful basis and purpose for processing the disputed data.
Identify the source and recipients of the data, where your legal access rights apply.
Stop unnecessary contact-list, photo, or device access.
Correct inaccurate data.
Delete or block data that is unlawfully processed or no longer necessary, subject to lawful retention requirements.
Preserve relevant system logs and collection records.
Provide a current statement of account and a lawful payment channel.

For NPC exhaustion purposes, keep proof that the company received the notice. If it provides no response within 15 calendar days, or its response is not timely or appropriate, you may proceed with the formal NPC complaint. The NPC may waive this requirement for good cause or a serious violation—for example, grave and irreparable harm, lack of an adequate remedy, or conduct that is patently illegal—but the facts supporting a waiver must be clearly alleged and proved.

File an SEC complaint

Use the SEC I-MESSAGE portal and select the service for complaints involving financing and lending companies. The joint 2026 advisory also lists the SEC hotline as 1-4732 (1-4SEC).

Identify the corporation operating the app—not just the app’s marketing name. Being registered as an ordinary corporation is not the same as holding a valid Certificate of Authority to operate as a lending or financing company. Record what you find through the SEC’s official verification services, but still report the app if its true operator is unclear or appears unauthorized.

The SEC’s complaint guidance directs complainants to:

Complete the required complaint information accurately.
Attach a valid government-issued ID.
Attach supporting documents and evidence.
Use one complaint form for each respondent company.

Explain the events chronologically. Include the app name, corporate operator, collection agency, collector numbers, loan details, exact threats or disclosures, affected contacts, and the action you want the SEC to take.

The SEC may investigate regulatory violations and take administrative or enforcement action. It does not automatically rewrite the contract, cancel the loan, declare every disputed interest charge void, or settle the account merely because a complaint was filed.

Under the Financial Products and Services Consumer Protection Act, the SEC also has adjudicatory authority over qualifying actions arising from financial transactions that are purely civil in nature when the relief is solely payment or reimbursement of money not exceeding ₱10 million. Whether a particular case belongs in that process depends on the pleaded facts, requested relief, and applicable SEC procedure; an ordinary harassment report does not automatically become a monetary adjudication.

Claims under that Act generally prescribe five years from consummation of the financial transaction, or five years from discovery of deceit or nondisclosure of material facts, with an ultimate limit of 10 years from the violation. Other causes of action may have different periods, so filing promptly is safer.

File an NPC privacy complaint

An affected data subject may complain to the NPC. This may be the borrower whose debt or photograph was disclosed, or a contacted person whose own name, number, or other personal data was unlawfully processed. A representative must have the required special power of attorney.

Under the 2021 NPC Rules of Procedure, a formal complaint generally must:

Be in writing, signed, verified, and notarized.
Identify the complainant and respondent, or describe facts that may lead to an unknown respondent’s identity.
Narrate the material facts and alleged privacy violations.
State the relief requested.
Include supporting documents and witness affidavits, where available.
Attach correspondence with the company and proof of its action or inaction.
Include the required sworn certification against forum shopping.
Be accompanied by the applicable filing fee unless an exemption or waiver applies.

Use the current form and instructions on the NPC’s formal complaint page. The NPC currently permits submission in person, by courier, or by scanning and emailing the notarized complaint to the address shown on that official page. Check the current fee schedule before filing. Indigent complainants may qualify for an exemption, and the NPC may waive the fee for good cause upon proper request.

A privacy complaint may seek appropriate orders concerning unlawful processing, access, correction, blocking, erasure, or other relief supported by the facts and the Data Privacy Act. Erasure is not absolute: a company may retain data that remains necessary for a lawful purpose, regulatory obligation, or the establishment, exercise, or defense of legal claims.

The NPC’s rules adopt the statutory prescription rules for penal violations of special laws. Because the applicable period can depend on the particular alleged offense and when it was committed or discovered, do not delay while harassment continues or evidence is disappearing.

Report threats, fraud, and other possible crimes

The SEC and NPC are regulators; they are not substitutes for emergency or criminal investigation.

Call 911 if there is an immediate threat to life, physical safety, or property. For online threats, scams, fraud, extortion, or impersonation, the 2026 joint government advisory lists:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; (02) 8723-0401 local 7491

Provide copies of threats, account identifiers, payment instructions, phone numbers, URLs, and transaction records. Do not send money to a collector’s personal account merely because the message uses a police logo, court seal, or urgent arrest threat. Verify any legal document directly with the named court or government office using contact details obtained independently.

The precise criminal offense, if any, depends on the actual words, conduct, intent, publication, and evidence. Let law enforcement, a prosecutor, or a lawyer assess whether the facts may involve threats, coercion, extortion, identity theft, unlawful access, fraud, libel, or another offense.

What if the lender is a bank or another BSP-supervised institution?

Complaints about ordinary lending companies, financing companies, online lending platforms, and their collection agencies generally belong with the SEC. The BSP itself directs those complaints to the SEC.

If the product was instead issued by a bank, digital bank, e-money issuer, or another institution supervised by the BSP, complain first through the institution’s Financial Consumer Protection Assistance Mechanism. If unresolved, escalate through the BSP Consumer Assistance Mechanism, including the BSP Online Buddy or the official complaint form and email channel shown there.

A trade name or app interface may not reveal the actual provider. Check the loan agreement, disclosure statement, privacy notice, and payment recipient to identify the regulated entity.

A strong complaint should answer these questions

Organize the complaint so an investigator can understand it without guessing:

Who operated the app and who performed the collection?
When was the loan obtained, due, paid, disputed, or declared delinquent?
What exactly did each collector say or send?
Which phone numbers, accounts, or profiles were used?
What personal data did the app access or disclose?
Who received the disclosure, and what evidence do they have?
Was the person a character reference, an expressly consenting guarantor, or neither?
What permissions did the app request?
When and how did you notify the company?
What did the company do within the next 15 calendar days?
What harm occurred?
What specific relief are you requesting?

Separate facts from conclusions. Quote only the relevant portions of messages, attach the complete originals, and avoid exaggerating. If you do not know who operated a collector account, say so and provide the identifying information you do have.

Common mistakes to avoid

Deleting the app or messages before preserving evidence.
Naming only the app instead of identifying the corporation behind it.
Combining unrelated respondent companies in one SEC complaint form.
Filing an NPC complaint without proof of the prior written notice or without explaining why the 15-day requirement should be waived.
Assuming that tapping “Allow” gave the app unlimited permission to use contacts or photos.
Posting your own IDs, loan documents, phone numbers, or private messages publicly while seeking help.
Sending full passwords, PINs, OTPs, card numbers, or unnecessary IDs to a supposed investigator.
Paying through an unverified personal bank or e-wallet account.
Ignoring genuine court papers because some previous threats were fake.
Assuming that a regulatory complaint automatically suspends or cancels the debt.
Secretly recording private calls without first checking the legal consequences.

When legal help is urgent

Seek prompt help from a lawyer, law-enforcement agency, the Public Attorney’s Office if eligible, or another recognized legal-aid provider when:

A threat appears credible or includes your home, workplace, children, or daily movements.
Private or intimate images are being threatened or circulated.
The collector has taken over an account or used your identity for transactions.
Money was transferred through threats, deception, or impersonation.
Your employer, customers, or a large group of contacts are being targeted.
You receive an authentic summons, subpoena, prosecutor’s notice, or court order.
You want compensation for substantial financial, medical, employment, or reputational harm.
A filing deadline may be approaching.
The harassment continues despite regulatory complaints or protective steps.

Frequently asked questions

Can a lending app contact my family, friends, or employer?

Not to collect your debt merely because their numbers appear in your phone. A character reference may be contacted for identity or information verification, not treated as a debtor. For debt collection, the lender may contact a person who separately and expressly consented to be a guarantor. A lawful court process or another specific legal obligation may present a different situation.

Does agreeing to the app’s privacy policy make contact-list harassment legal?

No. Consent must be valid and processing must still be lawful, transparent, necessary, and proportionate. A broad permission or pre-ticked consent does not give the app unlimited authority to copy contacts, disclose a debt, or shame the borrower.

Am I protected even if the loan is overdue?

Yes. Default may permit lawful collection and legal action, but it does not authorize threats, insults, public shaming, or unlawful data processing.

Should I stop paying after filing a complaint?

Not solely because you filed. Request a verified statement of account and use an authorized payment channel. If the amount, fees, identity of the creditor, or contract is disputed, obtain legal or regulatory advice rather than paying an unknown collector or simply ignoring the account.

Can I block the collector and uninstall the app?

Yes, after preserving the evidence and important account records. Revoke unnecessary permissions immediately. If safe, retain one written company channel for legitimate notices, account statements, and proof of your complaint.

Do I have to wait 15 days before reporting?

The 15-calendar-day requirement normally applies to a formal NPC privacy complaint after written notice to the company. The NPC can waive it for properly demonstrated good cause or a serious violation. You do not need to wait before seeking emergency help, securing accounts, preserving evidence, or reporting credible threats or crimes to law enforcement.

Can a contacted relative or co-worker file a privacy complaint?

Yes, if that person’s own personal data was processed or misused. Each affected person should preserve the messages received. A person filing on someone else’s behalf generally needs a special power of attorney under the NPC rules.

Will the SEC or NPC erase my debt?

No. They may address regulatory, consumer-protection, or privacy violations, but a valid obligation is not automatically erased. Contract validity, disputed charges, payment, and damages may require a separate procedure or legal determination.

Official sources

This article provides general Philippine legal information, not advice for a specific case. Procedures and legal conclusions may depend on the contract, evidence, provider, and exact conduct involved. Official sources and reporting channels were checked as of 11 August 2026.