Quick answer

Report harassment by an online lending app to the Securities and Exchange Commission (SEC) when the lender is a lending or financing company. Report unauthorized access, disclosure, or misuse of contacts, photos, IDs, or other personal data to the National Privacy Commission (NPC). If the messages involve threats, extortion, impersonation, fraud, or immediate danger, also report them to the PNP Anti-Cybercrime Group (PNP-ACG) or NBI Cybercrime Division.

Before blocking numbers or deleting the app, preserve complete screenshots, call logs, messages sent to your contacts, loan records, the app’s permissions and privacy notice, and proof of your complaints to the lender. Filing a complaint does not automatically erase a valid debt, but a lender’s right to collect does not authorize harassment, public shaming, deception, or disproportionate use of personal data.

What lenders and collectors are not allowed to do

SEC-regulated lending and financing companies—and collection agencies acting for them—must use reasonable, lawful collection methods. Under SEC Memorandum Circular No. 18, Series of 2019 and the Financial Products and Services Consumer Protection Act, prohibited or potentially unlawful conduct includes:

Using or threatening violence or other criminal means against a person, reputation, or property.
Threatening an action that cannot legally be taken.
Using obscenities, insults, or profane and abusive language.
Posting or disclosing a borrower’s name, photo, loan details, or alleged refusal to pay, except where a specific lawful disclosure is allowed.
Communicating information known—or which should be known—to be false, including failing to disclose that a debt is disputed when communicating it through a permitted channel.
Pretending to be a lawyer, court officer, police officer, government employee, or another person, or using deceptive documents and representations.
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., subject to MC 18’s exceptions when the account is more than 15 days past due or the borrower expressly agreed that those hours are the only reasonable or convenient times for contact.
Contacting people in the borrower’s contact list for debt collection when they are not guarantors.
Using a borrower’s photograph or other data to shame, embarrass, or pressure the borrower.

The lender remains responsible for relevant acts of its employees, agents, and authorized third-party collectors. It should also require collectors to disclose their true identity.

Character references are not automatically guarantors

A character reference may be contacted to verify the borrower’s identity or the truth of information supplied during the application. The lender must explain how it obtained the reference’s details and allow the reference to request removal of those details. A character reference cannot be treated as a guarantor merely because the borrower entered the person’s name or number.

A guarantor, by contrast, must have separately and expressly agreed to assume the borrower’s obligation if the borrower defaults. For debt collection, current NPC rules allow the lender to contact the guarantor—not every relative, coworker, friend, or person copied from the borrower’s phone.

These rules are stated in NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02, and were reiterated in the government’s March 2026 advisory on online lending platforms.

When app permissions become a privacy violation

An app does not receive unlimited authority over your phone merely because you tapped “Allow” or accepted lengthy terms.

Under the Data Privacy Act of 2012, personal-data processing must be transparent, for a legitimate purpose, and proportionate. A lender must have an applicable lawful basis for processing and may collect only data that are adequate, relevant, suitable, necessary, and not excessive.

Online lending apps may not engage in unbridled processing of contact lists. Limited access may be permitted when necessary to let a borrower select a character reference or guarantor, or to derive proportionate metadata for a specified legitimate purpose. It does not authorize the app to copy the entire address book and message non-guarantors about the debt.

Camera or gallery access may be justified at a particular stage for identity verification, know-your-customer checks, payment verification, or a similar legitimate purpose. Once that purpose is complete, the app should disable the permission or prompt the user to revoke it. Photos cannot be repurposed for shaming or harassment.

Consent may also be defective when obtained through deceptive design—for example, pre-ticked boxes, an easy “accept” button paired with a hidden or difficult refusal option, or a process that makes withdrawal unreasonably difficult.

Not every collection-related use of data is unlawful. A lender may retain or disclose limited information when necessary for an active contract, a legal claim, a lawful credit-reporting obligation, a court or government order, or an authorized collection arrangement. The particular data, recipient, purpose, and manner of disclosure still matter.

Preserve evidence before taking protective action

Save evidence in its original form whenever possible. Do this before uninstalling the app or clearing messages.

Keep:

Full screenshots showing the message, sender or number, date, time, and surrounding conversation.
Screen recordings showing the app name, account, collection message, privacy notice, requested permissions, and relevant screens.
Exported chats, emails, call logs, voicemail, and recordings lawfully received or made.
URLs and screenshots of social-media posts, including the account name, posting date, comments, and audience.
Screenshots received by relatives, coworkers, employers, and other contacts. Ask them to retain the original message on their devices.
The app-store page, developer name, package or application identifier, version number, download link, and privacy-policy link.
The lender’s legal corporate name, business address, customer-service details, SEC registration number, and Certificate of Authority information, if available.
The loan agreement, disclosure statement, amount actually received, fees, payment schedule, receipts, reference numbers, and account statements.
Proof of what information and permissions the app requested when you applied.
Your written complaint to the lender or its data protection officer, delivery confirmation, ticket number, and response.
A dated incident log identifying each call, message, recipient, threat, disclosure, and resulting harm.

Do not crop away identifying details, edit screenshots, or rely only on a typed summary. Keep a backup in a secure account or storage device. When submitting evidence, redact unrelated personal information, passwords, PINs, one-time passwords, and complete financial-account numbers unless the receiving authority specifically requires them through a secure channel.

After preserving the evidence, revoke unnecessary access to contacts, photos, files, microphone, camera, and location. Uninstalling the app may stop future access, but it does not delete information already copied by the operator.

Send a written complaint to the lender

Use the lender’s official consumer-assistance or customer-service channel and, for a privacy issue, its data protection officer. A written complaint creates proof that the company was given an opportunity to act—an important point in an NPC complaint.

Include:

Your name and loan or account reference, without sending passwords or OTPs.
The collector’s name, number, account, or agency, if known.
A chronological description of what happened.
The people contacted and the personal information disclosed or misused.
The specific conduct you want stopped.
The action requested, such as:
- stop contacting non-guarantors;
- stop threats, insults, or public posts;
- remove unlawful posts;
- identify the collector and the company that received your data;
- explain the source, purpose, recipients, and retention period of your data;
- correct inaccurate information;
- block, erase, or securely dispose of data unlawfully obtained, used for an unauthorized purpose, or no longer necessary; and
- communicate only through a specified written channel.
A reasonable deadline for a written response.

Rights to blocking or erasure are not absolute. The lender may retain information that remains necessary for the loan, legal claims, regulatory duties, or another lawful purpose. It should nevertheless explain the legal basis and limit its processing.

If contacting the company would expose you or another person to serious harm, or the operator cannot be identified or located despite reasonable efforts, preserve proof of that circumstance and explain it to the NPC.

File the correct government complaints

1. SEC: unfair collection by lending or financing companies

First identify the corporation behind the app. An app’s brand name may differ from the licensed lender’s name. Check the loan documents, disclosure statement, privacy notice, and app-store listing, then verify the company through Check with SEC.

Submit the complaint to the SEC Financing and Lending Companies Department through the SEC iMessage portal. The March 2026 joint government advisory also lists the SEC hotline 1-4732 (1-4SEC).

Prepare:

A complete complaint form or portal submission.
One complaint for each respondent company.
A copy of a valid government-issued ID.
The loan agreement, disclosure statement, payment records, and other transaction documents.
Screenshots, call logs, posts, witness messages, and your incident chronology.
The lender’s legal name and the app or platform it operates.
Your complaint to the company and its response, if any.
A clear statement of the action you are asking the SEC to take.

The SEC may investigate regulatory violations and impose appropriate administrative measures. A regulatory complaint does not, by itself, cancel the debt, rewrite the loan contract, or establish that every charge is void.

2. NPC: unauthorized access, disclosure, or misuse of personal data

Use the NPC’s current Complaint-Affidavit with Questionnaire, version dated 1 March 2026. Complete it accurately and attach evidence. The form requires a sworn verification and certification against forum shopping, so follow its notarization requirements.

The form asks you to identify:

The complainant and respondent.
The personal information processed.
Whether you first contacted the respondent—or why you did not.
The alleged privacy violations.
The date, time, and place of the incident.
A clear chronological narrative.
The evidence supporting each allegation.
The relief requested.

Failure to attach evidence can cause outright dismissal. If you have filed a case involving the same issues before another court, tribunal, or quasi-judicial agency, disclose it accurately. Do not assume that complaints to different regulators are interchangeable; SEC collection violations and NPC privacy violations may arise from the same events but involve different legal questions.

Submit through the complaint channel shown on the NPC’s current Contact Us page or at:

National Privacy Commission 25th–27th Floors, The Upper Class Tower Quezon Avenue corner Scout Reyes Street Quezon City 1103

The NPC’s listed complaint lines are (+63) 2 5322 1322 local 114 or 115, +63 970 818 0555, and +63 905 506 1478. Confirm contact and filing details on the official page before submission.

3. Law enforcement: threats, fraud, extortion, or cybercrime

Contact law enforcement immediately if there is a credible threat of physical harm, extortion, identity theft, account takeover, impersonation, fraudulent use of documents, or persistent cyber-harassment. For immediate danger, call 911 or go to the nearest police station.

The March 2026 joint advisory lists:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; (02) 8723-0401 local 7491

The NBI also provides official information on investigative assistance for victims of computer crimes.

Bring the original device if investigators request it. Do not reset it, delete the account, or alter files before asking how the evidence should be preserved.

4. If the lender is supervised by another regulator

The regulator depends on the legal entity—not simply on the fact that the loan was offered through an app.

Provider	Main financial regulator
SEC-licensed lending or financing company and its online platform	SEC
Bank, digital bank, or other BSP-supervised financial institution	BSP
Cooperative offering credit	CDA
Privacy violation by any of these entities	NPC
Threat, fraud, extortion, or cybercrime	PNP, NBI, or other appropriate law-enforcement body

For a BSP-supervised institution, complain first through the institution’s consumer-assistance mechanism. If unresolved, escalate through the BSP Consumer Assistance Mechanism, preferably using BSP Online Buddy. The BSP also accepts its Complaints, Inquiries and Requests form at consumeraffairs@bsp.gov.ph.

For a cooperative, use its internal financial-consumer assistance mechanism first and then the CDA’s consumer-assistance process or appropriate CDA Extension Office. A privacy complaint may still be filed with the NPC.

If the loan or collector may be fake

Do not pay solely because a caller knows your name, contacts, or ID details. Ask for:

The lender’s complete legal name.
Its regulator and authority to operate.
The original loan and disclosure statement.
A complete statement of account.
The collector’s full name and authority to collect.
An official payment channel registered to the lender—not an unexplained personal e-wallet or bank account.

If you never borrowed, say in writing that you dispute the debt and do not acknowledge liability. Report the suspected identity theft or scam to the SEC and law enforcement, and report any misuse of your personal data to the NPC.

Common mistakes that weaken a complaint

Naming only the app instead of the corporation operating it.
Deleting the app or conversation before preserving evidence.
Submitting cropped screenshots with no sender, date, time, or context.
Describing harassment generally without listing the exact words, recipients, and dates.
Failing to attach the loan documents and payment records.
Filing against several companies on one SEC complaint form.
Giving regulators—or anyone claiming to assist—your password, PIN, or OTP.
Paying a collector through an unverified personal account.
Publicly reposting unredacted IDs, phone numbers, or private messages.
Assuming that acceptance of app permissions makes every later use lawful.
Assuming that harassment automatically cancels the principal debt.
Ignoring a genuine court document. A collector’s threatening message is not itself a court summons, but an authentic summons or order should be verified with the named court and handled promptly.

When legal help is urgent

Consult a Philippine lawyer, the Public Attorney’s Office if eligible, or an appropriate legal-aid organization promptly when:

A threat identifies your home, workplace, children, or planned physical action.
Intimate images, altered photos, IDs, medical information, or financial credentials were posted or distributed.
Money is being demanded under threat of exposure or harm.
Your identity was used to obtain a loan you did not apply for.
A real complaint, subpoena, summons, or court order has been served.
A bank or e-wallet account was accessed or funds were taken.
You suffered job loss, financial loss, serious reputational harm, or other measurable damage.
You are considering damages, an injunction, or a criminal complaint.

The Constitution provides that no person may be imprisoned solely for debt or nonpayment of a poll tax. This does not prevent prosecution for a distinct alleged offense, such as fraud or a violation involving a dishonored check, when its legal elements and procedural requirements are independently present. Never ignore authentic legal process merely because the dispute began as a loan.

Frequently asked questions

Can a lending app contact my family, friends, or employer?

Not for debt collection merely because their numbers appeared in your contact list. Current NPC rules permit collection contact with a person who separately agreed to be a guarantor. A character reference may be contacted for identity or information verification but is not automatically liable for the debt.

Can collectors post my photo and call me a scammer or delinquent borrower?

Using a borrower’s photo or personal information for public shaming or harassment is prohibited. Preserve the post, URL, account name, date, comments, and audience before requesting removal and reporting it.

I allowed contact access when I installed the app. Does that defeat my complaint?

No. Consent must be informed, specific, and freely given, and processing must remain lawful, necessary, and proportionate. Contacting non-guarantors for debt collection is prohibited even where the lender relies on broad app consent.

Can I demand deletion of all my data immediately?

You may request blocking, erasure, or destruction of unlawfully obtained, inaccurately processed, unauthorized, or no-longer-necessary data. The lender may retain limited information still necessary for the contract, legal claims, regulatory duties, or another lawful basis. Ask it to identify the specific data retained, purpose, legal basis, recipients, and retention period.

Does filing a complaint stop interest or collection?

Not automatically. Continue disputing incorrect charges in writing and, if you can do so safely, request a verified statement of account and a lawful payment or restructuring arrangement. Do not treat silence from the lender or the filing of a complaint as cancellation of the obligation.

What if the lender is unlicensed or no longer appears in the app store?

Preserve the app’s identifiers and all transaction records, then report it to the SEC and law enforcement. Privacy rules may apply even to an unrecorded or unauthorized operator, and removal from an app store does not resolve existing violations.

Is there a filing deadline?

Different administrative, civil, and criminal remedies have different limitation periods, and the correct period can depend on the legal claim and when the violation was discovered. File promptly while evidence, accounts, and witnesses remain available. Follow every deadline stated in an SEC, NPC, police, prosecutor, or court notice once a case is opened.

This article provides general Philippine legal information, not legal advice for a particular loan, complaint, or case. Applicable remedies depend on the lender’s identity, the contract, the data processed, the exact communications, and available evidence. Official laws, procedures, forms, channels, and guidance were checked as of 11 August 2026.