Quick answer

If an online lending app, lender, or collection agent threatens you, publicly shames you, contacts people who are not your guarantors, or misuses your photos, contacts, or other personal data, preserve the evidence and report the conduct to the proper authority:

Report unfair collection by a lending or financing company to the Securities and Exchange Commission (SEC) through SEC iMessage.
Report unauthorized or excessive processing of personal data to the National Privacy Commission (NPC). Ordinarily, first send the lender a written privacy complaint and allow it to act, then file a notarized complaint using the NPC complaint procedure and form.
If the lender is a bank, digital bank, or another BSP-supervised institution, complain first to the institution and then escalate an unresolved complaint through the BSP Consumer Assistance Mechanism.
For threats, extortion, fraud, impersonation, stalking, or an immediate safety risk, contact the police or cybercrime authorities without waiting for the lender’s response.

A legitimate debt does not authorize harassment or privacy violations. Reporting abusive collection also does not automatically erase a valid loan, stop lawful collection, or cancel interest and charges under the contract.

What conduct may be unlawful?

A lender may make lawful, proportionate efforts to collect an overdue account. It may send appropriate reminders, explain the balance, propose payment arrangements, or pursue remedies allowed by the loan agreement and law.

The line is crossed when collection becomes abusive, deceptive, threatening, humiliating, or needlessly exposes personal information.

Unfair debt-collection practices

Under SEC Memorandum Circular No. 18, Series of 2019 and the Financial Products and Services Consumer Protection Act, prohibited or potentially actionable conduct includes:

Using or threatening violence or other criminal means against a person, reputation, or property
Threatening action that cannot legally be taken
Using obscenities, insults, or profane language that amounts to abuse or an offense
Publishing or disclosing a borrower’s name and personal information as a means of collection, except where disclosure is legally allowed
Giving another person false information about the debt, including failing to say that a debt is disputed when that fact should be disclosed
Using false representations or deceptive means to collect a debt or obtain information
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., subject to the circular’s limited exceptions
Contacting people in the borrower’s phone contacts who were not named as guarantors or co-makers

The financial service provider may remain responsible for collection performed by its employees or agents. Under Republic Act No. 11765, it can also be solidarily liable with an accredited third-party service provider for acts or omissions in debt collection.

Privacy violations involving contacts, photos, and messages

The Data Privacy Act of 2012 requires personal-data processing to be transparent, for a legitimate purpose, and proportionate. Consent, when relied upon, must satisfy legal requirements; installing an app does not give the operator unlimited authority to use everything on the phone.

The NPC’s rules for loan-related transactions prohibit unnecessary processing and unnecessary app permissions. Access to data through permissions must be suitable, necessary, and not excessive for a specified legitimate purpose. Once access is no longer needed and no other lawful basis applies, the app should turn it off or prompt the user to revoke it.

Examples that may justify a privacy complaint include:

Copying or repeatedly scanning an entire contact list without a proportionate, lawful purpose
Sending debt messages to relatives, coworkers, employers, clients, or friends who are not guarantors
Using a borrower’s photograph to shame, threaten, or embarrass the borrower
Posting the borrower’s identity, loan details, identification documents, or altered “wanted” graphics online
Accessing photos or a camera after identity or payment verification has been completed
Processing another person’s information simply because that person appears in the borrower’s contacts
Refusing to explain what data was collected, why it was used, who received it, or how long it will be retained
Keeping or using data beyond what is necessary, subject to lawful retention for the account, legal claims, or another requirement of law

The NPC’s 2026 joint advisory on online lending platforms reiterates that contacting anyone in a borrower’s contact list other than a guarantor is prohibited for debt collection.

A reference is not automatically a guarantor

A character reference may be used for identification or verification within lawful limits. That person does not become responsible for the loan merely because the borrower entered the person’s name or number.

A guarantor is different. The person must expressly consent to undertake responsibility for the borrower’s obligation in case of default, consistently with the Civil Code rules on guaranty. Online lending platforms must distinguish character references from guarantors and obtain the guarantor’s separate consent.

What to do immediately

1. Protect yourself if there is a threat

If a message threatens violence, describes your location or family, demands money through intimidation, or suggests an immediate danger:

Move to a safe place and tell a trusted person.
Call 911 or go to the nearest police station.
Do not meet a collector alone.
Do not send additional identity documents, selfies, passwords, one-time PINs, or money to an unverified personal account.
Preserve the threatening message and the sender’s account or telephone details.

The March 2026 government advisory also identifies these channels:

PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; telephone (02) 8723-0401, local 7491
NBI Cybercrime Division: ccd@nbi.gov.ph; telephone (02) 8523-8231 to 38
DICT Cyber Hotline: 1326@dict.gov.ph

Contact details can change, so confirm them through the agencies’ official websites before relying on them.

2. Preserve evidence before blocking or uninstalling the app

Save evidence in its original form when possible:

Screenshots and screen recordings showing the full conversation, account name, telephone number, date, and time
Original SMS messages, emails, voice messages, call logs, and collection letters
URLs and screenshots of social-media posts, comments, group messages, or public-shaming material
The app’s exact name, developer, download-page URL, version, and app-store listing
Screenshots of requested and granted permissions
The privacy notice, consent screens, loan agreement, disclosure statement, repayment schedule, and terms shown when the loan was taken
Receipts, bank or e-wallet transaction records, and proof of payments
A computation or statement of account from the lender
Messages received by relatives, coworkers, references, or other third parties
The corporate name, trade name, SEC registration number, certificate-of-authority number, office address, and collection agency name, if available
Copies of complaints sent to the lender and proof of delivery
A dated timeline identifying each incident and the people who received disclosures

Ask affected contacts to preserve their own messages and, if willing, provide a signed factual statement. Do not edit screenshots in a way that hides context. Keep an unaltered copy and back it up securely.

3. Secure the phone and accounts

After preserving evidence:

Review and revoke unnecessary permissions for contacts, photos, camera, microphone, location, call logs, and storage.
Change passwords for email, social media, banking, and e-wallet accounts if compromise is suspected.
Enable multi-factor authentication.
Check for unfamiliar apps, device-administrator privileges, forwarding rules, and active account sessions.
Report abusive posts or accounts to the platform, while keeping evidence of the original content and the report.
Do not post the collector’s unredacted personal information in retaliation.

Revoking access may stop future collection from the device, but it cannot retrieve data already copied. It also does not prevent retention that is genuinely necessary for an existing loan, compliance obligation, or legal claim.

Send a written demand to the lender

Write to the lender’s consumer-assistance unit and data protection officer using the official contact details in the app, privacy notice, loan documents, or corporate website. If the collector is a separate agency, copy both the collector and the lender.

State only verifiable facts. Include:

Your name and account or loan reference, with sensitive details masked where possible
The dates and forms of harassment or disclosure
The numbers, accounts, or names used by the collectors
Which third parties were contacted and what they were told
What phone data or personal information appears to have been accessed or used
Whether you dispute the debt, the balance, a payment, or only the collection conduct
The action you want, such as stopping third-party contact, preserving records, correcting the balance, identifying data recipients, restricting unlawful processing, deleting unlawfully obtained data, or investigating the collector
A reasonable deadline for acknowledgment and response
A statement that the evidence must be preserved

Ask for the lender’s corporate identity, regulator, certificate of authority where applicable, data protection officer, collection agency, itemized statement of account, and written investigation result.

A request for deletion is not absolute. The lender may retain information that remains necessary for servicing a valid account, complying with law, or establishing, exercising, or defending legal claims. It should nevertheless stop processing that lacks a lawful and proportionate purpose.

How to file with the SEC

Use the SEC route when the respondent is a lending company, financing company, its online lending platform, or its collection agent and the issue involves unfair collection or another violation within SEC jurisdiction.

The government’s current advisory directs complaints to the SEC Financing and Lending Companies Department through SEC iMessage. The SEC hotline listed in the advisory is 1-4732 (1-4SEC).

Follow the current instructions in the portal. As a practical minimum, submit:

A complete complaint identifying the legal company, not only the app or brand
One complaint per respondent company if the SEC form requires it
A valid government-issued ID
The loan agreement, disclosure statement, repayment schedule, receipts, and statement of account
Screenshots, recordings, call logs, third-party messages, and other proof
Your written complaint to the company and its response, if any
A clear statement of the relief or regulatory action requested

The SEC may furnish the respondent with the complaint for its answer or refer an issue outside its jurisdiction to another agency. An SEC regulatory complaint does not itself authorize the SEC to rewrite the contract, cancel the debt, or automatically declare the loan or interest void; those questions may require a different proceeding and fact-specific legal advice.

Check whether the operator is authorized by consulting the SEC’s official information on lending and financing companies. A corporate registration alone is not necessarily authority to operate as a lending company.

How to file a privacy complaint with the NPC

Use the NPC route for unauthorized access, excessive data collection, debt-shaming, disclosure to contacts, misuse of photos, failure to honor data-subject rights, or other unlawful personal-data processing.

Ordinarily, the NPC expects the complainant first to inform the personal information controller or concerned entity in writing and allow it to take appropriate action. Keep proof that the notice was delivered and any reply. Because exceptions and urgent protective measures may apply, consult the current NPC rules where prior resort to the company would be dangerous, futile, or inappropriate.

The NPC’s current filing instructions require the formal complaint to use the prescribed format, be printed and completed, and be notarized. It may be submitted:

In person
By courier
By scanning and emailing it to the address shown on the NPC filing page

Use the current NPC complaints-assisted form and consult the linked schedule of fees and charges. Include the written complaint sent to the lender, proof of delivery, the response or evidence of nonresponse, and all relevant supporting documents.

If processing creates an urgent and serious risk, the NPC filing page also provides a route for an application for temporary ban. Whether temporary relief is available depends on the evidence and the governing rules; it is not automatic merely because a complaint was filed.

If the lender is supervised by the BSP

A bank, digital bank, or another BSP-supervised financial institution should first receive the complaint through its own consumer-assistance mechanism. Republic Act No. 11765 requires financial service providers to maintain a free complaint-handling channel.

If the institution’s response is unresolved or unsatisfactory, escalate through the BSP Online Buddy and Consumer Assistance Mechanism. The BSP page also provides a Complaints, Inquiries and Requests form and lists consumeraffairs@bsp.gov.ph as an alternative submission channel.

Include:

A concise account of the problem and the resolution requested
Your contact details
The complaint filed with the institution
Its final response, if any
Supporting records

Do not send passwords, PINs, or unnecessary sensitive information.

Does reporting stop the debt?

No. A complaint about harassment or privacy violations is separate from whether the loan is valid, how much remains due, and whether particular interest, fees, or penalties are enforceable.

Continue to:

Request an itemized written balance.
Pay only through verified official channels.
Keep every receipt.
State clearly if an amount or transaction is disputed.
Propose an affordable written arrangement if you accept the debt but cannot pay on schedule.
Avoid signing a settlement, waiver, acknowledgment, or restructuring agreement that you do not understand.

The Constitution provides that no person may be imprisoned merely for debt. That does not prevent lawful civil collection or liability for a separate criminal act, such as conduct involving a genuinely issued check where another law may apply. Treat messages claiming automatic arrest for ordinary nonpayment with caution, but do not ignore authentic court papers.

Common mistakes to avoid

Deleting messages, uninstalling the app, or resetting the phone before preserving evidence
Complaining only against the app’s brand name and failing to identify the company behind it
Posting accusations or collectors’ personal information publicly
Paying a personal account supplied by an unverified collector
Sending additional IDs, selfies, contact lists, passwords, or one-time PINs
Assuming a reference has agreed to guarantee the loan
Treating a regulator’s complaint process as automatic cancellation of the debt
Ignoring summonses, subpoenas, formal demand letters, or genuine court notices
Making broad accusations without dates, screenshots, or documents
Filing different accounts of the same incident with different agencies
Waiting while threatening content, platform records, or device data disappears

When legal help is urgent

Consult a Philippine lawyer or the Public Attorney’s Office promptly when:

There are credible threats of violence, home visits, kidnapping, sexual harm, or harm to family members
Intimate images, identity documents, or altered defamatory materials have been distributed
Money is demanded through extortion or an impersonated government or court account
Your identity was used to obtain a loan
The lender filed a court case or you received a summons, subpoena, or prosecutor’s notice
Your employer or customers were contacted and you suffered serious financial or reputational harm
A settlement document asks you to waive legal rights
You need damages, an injunction, or another judicial remedy
Several lenders or collectors appear to be coordinating access to your personal data

Frequently asked questions

Can a lending app contact everyone in my phone?

No. Unrestrained use of a borrower’s contact list is prohibited. For debt collection, current NPC guidance states that the lender may contact a guarantor, but not other people in the borrower’s contacts. A character reference is not automatically a guarantor.

Can collectors call my employer or relatives?

They cannot use those contacts to shame you, disclose your loan indiscriminately, or pressure people who are not liable for the debt. Whether a narrowly limited communication is lawful can depend on the person’s actual role and the information disclosed. Preserve the exact message rather than relying only on a summary.

I allowed contact access. Does that make every later use legal?

No. Consent does not authorize unlimited or disproportionate processing. The purpose, necessity, scope, timing, transparency, and method of use still matter. Deceptive design or consent obtained without a meaningful choice may also be legally defective.

Can I demand deletion of all my data immediately?

You may exercise applicable data-subject rights, but deletion is not unconditional. Information may be retained while necessary for an active account, legal compliance, or legal claims. Data obtained or used unlawfully should not continue to be processed merely because a debt exists.

Should I file with both the SEC and NPC?

Often, yes, when the same incident involves both unfair collection and misuse of personal data. Explain which issue each agency is being asked to address and disclose related complaints so the record remains consistent.

What if the company is unlicensed or uses only a foreign-looking app name?

Preserve the app-store page, developer details, payment instructions, telephone numbers, websites, and recipient accounts. Report the operator to the SEC and report threats, fraud, or cyber-enabled abuse to law enforcement. Lack of an easily identified company should not stop you from preserving and reporting the evidence.

Will the collector know that I complained?

The respondent may receive the complaint or evidence and be asked to answer it. Tell the agency if disclosure of particular contact details would create a safety risk, and ask what protective measures are available.

What if I was only a contact or reference and never borrowed money?

You may still complain as a person whose data was processed or who received abusive communications. State that you did not borrow, did not guarantee the loan, and did not consent to being treated as liable. Preserve the messages and ask the lender to stop contact and explain the source and use of your data.

Official references

This article provides general Philippine legal information, not legal advice for a particular loan, complaint, or case. Procedures and conclusions may depend on the lender’s regulator, the contract, the evidence, and later issuances. Official sources and filing channels were checked on 3 September 2026.