Being contacted, threatened, or publicly shamed by an online lending app after you have already paid is not something you simply have to tolerate. Your first priorities are to preserve evidence, confirm that the payment was credited to the correct account, demand written correction of the lender’s records, and report any continued harassment to the proper Philippine regulator. Even when a loan is genuinely unpaid, lenders and collection agencies must use lawful, reasonable collection methods. Full payment makes continued collection even harder to justify.

First Confirm What “After Payment” Means

Before treating the problem as deliberate harassment, determine whether you:

Fully paid the entire loan, including agreed interest and disclosed charges;
Paid only the installment currently due;
Paid through the lender’s official payment channel;
Paid before the cutoff time stated in the app;
Received a successful transaction reference rather than a “pending” notice; and
Used the correct loan account or reference number.

A payment-posting error can usually be corrected through reconciliation. Harassment involves something more, such as repeated abusive messages, threats, public shaming, contacting unrelated people, refusing to review clear proof of payment, or continuing collection after the lender has acknowledged full settlement.

Situation	Appropriate response from the lender	Warning sign
Payment is still being verified	Request the receipt and explain the expected posting time	Threatening arrest or exposure without checking the payment
Payment was credited to the wrong account	Give instructions for tracing or transferring the payment	Demanding another payment without an itemized explanation
A small balance allegedly remains	Provide a complete computation and contractual basis	Refusing to disclose how the balance was calculated
Loan is fully settled	Confirm zero balance and stop collection activity	Continuing calls, insults, threats, or messages to your contacts
Collection was outsourced	Coordinate with the collection agency and correct its records	Claiming the lender is not responsible for its collector

Do not immediately make a second payment merely to stop the calls. A duplicate payment can create a separate refund dispute. Ask for a written account ledger showing the principal, interest, fees, payments received, and alleged remaining balance.

Full Payment Generally Extinguishes the Debt

Article 1231 of the Civil Code of the Philippines, Republic Act No. 386 of 1949, provides that an obligation is extinguished by payment or performance. Articles 1232 and 1233 explain that payment includes proper performance of the obligation and that complete delivery or performance is ordinarily required. (Lawphil)

Payment is strongest when made to:

The lender itself;
Its successor-in-interest;
A person or collection agency authorized to receive payment; or
An official channel that the lender instructed you to use.

Article 1240 recognizes payment made to the creditor or an authorized recipient. If you paid through a bank, e-wallet, payment center, QR code, or collection account shown in the app, preserve the screen or message proving that the lender directed you to that channel. (Lawphil)

A transaction receipt is important, but it is not the only possible proof. Useful evidence may include:

E-wallet or bank transaction history;
Official receipt or acknowledgment;
SMS or email confirming payment;
Screenshots showing a zero balance;
The app’s repayment instructions;
The lender’s acknowledgment in chat;
Bank statements;
A certificate of full payment; and
Recorded calls, when lawfully obtained, in which the collector confirms receipt.

Online Lenders Cannot Use Unfair Collection Practices

The Securities and Exchange Commission regulates lending companies under the Lending Company Regulation Act of 2007, Republic Act No. 9474, and financing companies under Republic Act No. 8556. A company engaged in lending ordinarily needs both SEC registration and the appropriate authority to operate as a lending or financing company. (Lawphil)

SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair debt collection practices by lending companies, financing companies, and third-party collectors working for them. Collectors may pursue legitimate debts, but they must act in good faith and refrain from unscrupulous or abusive conduct. (SEC Appointment System)

Conduct that may violate SEC rules includes:

Threatening violence, injury, arrest, or consequences that the collector has no legal authority to impose;
Using insulting, obscene, degrading, or abusive language;
Pretending to be a police officer, lawyer, court employee, or government official;
Falsely claiming that a criminal case, warrant, court order, or legal proceeding already exists;
Publicly posting the borrower’s name, photograph, identification documents, or alleged debt to shame the borrower;
Telling employers, coworkers, relatives, friends, or social-media contacts about the debt when they are not legally involved;
Contacting people taken from the borrower’s phonebook who were not named guarantors or co-makers;
Repeatedly contacting the borrower in a manner intended to intimidate, humiliate, or exhaust the person; and
Continuing to demand payment without fairly investigating credible proof that the loan has been settled.

The lender cannot avoid responsibility simply by saying that the harassment came from an outside collection agency. A lender that hires a collector remains responsible for ensuring that personal data under its control is processed lawfully and that its service providers follow applicable collection rules.

Your Data Privacy Rights After Paying the Loan

The Data Privacy Act of 2012, Republic Act No. 10173, requires personal information to be processed fairly, lawfully, transparently, and only for legitimate purposes. Borrowers have rights to information, access, correction, erasure or blocking in appropriate cases, objection, and damages. (Lawphil)

The National Privacy Commission issued NPC Circular No. 20-01 on loan-related transactions, later amended by NPC Circular No. 2022-02. The rules apply not only to authorized lending and financing companies but also to persons acting as lenders without the required SEC authority, as well as their outsourced data processors and collectors.

A lending app cannot harvest your entire contact list for collection

Online lending apps may not copy, save, or harvest phone contacts, email lists, or social-media contacts for debt collection or harassment. The app should instead provide a separate interface through which the borrower voluntarily identifies particular character references or co-makers.

The NPC reinforced this rule in In re: Populus Lending Corporation (Pesopop), finding that requiring access to a user’s contacts and using those contacts in connection with collection violated data privacy and loan-processing rules. The NPC also recognized that contacting people from a borrower’s phonebook, other than properly named guarantors or co-makers, constitutes unfair collection under SEC rules.

Consent does not automatically make harassment lawful

A clause buried in an app’s terms cannot authorize conduct prohibited by law. Even when the borrower clicked “Allow Contacts” or accepted a broad privacy policy, the lender must still show a lawful purpose and comply with the principles of necessity and proportionality. Collecting an entire phonebook merely to pressure one borrower is excessive.

The lender may retain some records, but not forever without reason

Full payment does not necessarily require immediate deletion of every loan record. A lender may need to retain limited information for accounting, fraud prevention, regulatory compliance, audits, tax records, or the defense of legal claims.

However, NPC Circular No. 20-01 specifically requires reasonable retention policies for borrowers who have fully settled their loans. Personal data may not be retained indefinitely for an unspecified possible future use. Continued access to contacts, photographs, or other unnecessary permissions after settlement is particularly difficult to justify.

What to Do Immediately

1. Protect yourself if there is an urgent threat

If the collector threatens physical harm, visits your home aggressively, follows you, threatens your children, or claims to be on the way to attack or arrest you:

Do not meet the collector alone.
Inform household members or building security.
Call 911 or the nearest police station if danger appears immediate.
Save the number, profile, message, recording, and exact wording of the threat.
Note the date, time, location, and possible identity of the collector.

Do not assume that every threat is merely a collection tactic.

2. Preserve evidence before blocking numbers or deleting the app

Create a dedicated folder and save:

Screenshots of every message;
Full chat exports, not only selected screenshots;
Call logs showing dates, times, and frequency;
Voicemails and audio messages;
Social-media posts, comments, and profile URLs;
Screenshots of the app page, developer name, privacy policy, and permissions;
Your loan agreement and disclosure statement;
Every payment receipt and transaction reference;
Messages sent to your contacts;
Names and statements of people who were contacted;
Your written complaints to the lender; and
The lender’s replies or failure to reply.

Where possible, take a screen recording showing the conversation from beginning to end. This helps demonstrate that screenshots were not taken out of context.

Ask affected contacts to preserve the original messages on their own phones. Their screenshots and sworn statements may later support an SEC, NPC, police, NBI, or court complaint.

3. Verify the payment with the payment provider

Contact the bank, e-wallet, or payment center and request confirmation of:

Successful completion;
Exact date and time;
Amount;
Recipient name or merchant;
Reference number;
Whether the transaction was reversed or refunded; and
Whether the funds were delivered to the merchant.

A “successful” screen from your side is stronger when the payment provider can also confirm delivery.

4. Send a formal written demand to the lender

Use email, the app’s official support channel, and any address shown in the loan agreement. Copy the lender’s data protection officer or privacy contact and the collection agency, when known.

A practical notice can read:

Subject: Formal Notice of Full Payment and Demand to Stop Collection

I fully paid Loan Account No. ______ on ______ in the amount of ₱____ through ______. The transaction reference is ______. Copies of the receipt and transaction confirmation are attached.

Despite payment, I continue to receive collection calls or messages from the following numbers/accounts: ______. The collectors have also contacted the following persons or published the following information: ______.

Please:

Reconcile the account and provide an itemized statement;

Confirm in writing that the account has a zero balance;

Issue a certificate or acknowledgment of full payment;

Immediately stop all collection activity relating to the settled account;

Instruct all collection agencies and service providers to correct their records;

Stop disclosure of my loan information to unauthorized third persons;

Correct inaccurate personal or credit information;

Disable unnecessary access to contacts, photographs, location, and device storage;

Identify the collection agency and persons processing my data; and

Preserve all collection logs and communications relating to my account.

Please provide a written response within five business days.

A five-business-day deadline is a reasonable practical request, not a universal statutory deadline. For an NPC complaint, the more important rule is that you generally must first notify the lender or other responsible entity in writing and allow up to 15 calendar days for appropriate action or a response.

5. Revoke unnecessary app permissions

After preserving evidence:

Open your phone’s privacy or app-permission settings.
Remove access to contacts, call logs, photographs, storage, location, microphone, and camera unless still genuinely needed.
Change passwords if you reused the same password elsewhere.
Enable two-factor authentication on email, social media, and financial accounts.
Review linked devices and active sessions.
Uninstall the app after saving the loan agreement, payment history, and evidence.

Uninstalling the app stops future access from your device but does not erase data the company may already have copied. Your written demand and regulatory complaint should therefore address both device permissions and previously collected data.

Where to File a Complaint

Office	File here when	Practical first step
Securities and Exchange Commission	The lender or collector uses unfair collection practices, or the lending company may be unauthorized	Submit evidence through the SEC iMessage portal or email the Financing and Lending Companies Division at `flcd_complaints@sec.gov.ph`
National Privacy Commission	Contacts, photos, IDs, messages, or other personal data were accessed, disclosed, posted, or misused	Send a prior written complaint to the lender and preserve proof of delivery
Bangko Sentral ng Pilipinas	The creditor is a BSP-supervised bank, digital bank, e-money issuer, pawnshop, or other supervised financial institution	First use the institution’s internal consumer assistance channel, then escalate through BSP Online Buddy
NBI or police	There are threats, extortion, impersonation, stalking, hacking, or potentially criminal online publication	Preserve the original device and submit a complaint-affidavit with supporting evidence
Prosecutor’s office	You wish to initiate a criminal complaint supported by sworn evidence	Prepare a chronological complaint-affidavit and identify the responsible persons as far as possible

The SEC’s current public consumer-protection directory identifies flcd_complaints@sec.gov.ph and the Financing and Lending Companies Division for lending complaints. BSP complaints against supervised institutions may be filed through BOB or consumeraffairs@bsp.gov.ph after the institution has first been given an opportunity to address the issue. (Bangko Sentral ng Pilipinas)

Filing with the National Privacy Commission

The NPC generally requires proof that you:

Informed the lender, collector, personal information controller, or processor in writing; and
Received no appropriate action or no response within 15 calendar days.

The NPC may waive this requirement for good cause, including serious or potentially irreparable harm.

A formal NPC complaint should ordinarily be:

Written and verified under oath;
Supported by documents and witness affidavits;
Accompanied by a certification against forum shopping;
Filed using the proper complaint format;
Notarized; and
Accompanied by the applicable filing fee, unless an exemption or waiver applies.

The NPC complaint-filing page provides the current Complaints-Assisted Form and filing instructions. Complaints may be submitted personally, by registered mail, courier, or authorized electronic filing. The NPC website currently directs email submissions to complaints@privacy.gov.ph. (National Privacy Commission)

Under the amended NPC Rules of Procedure, a complaint is assigned to an investigating officer within five calendar days of receipt. The investigating officer may give it due course or dismiss it without prejudice during the pre-investigation stage, including when the complaint is incomplete, unsupported, or filed without first giving the respondent a reasonable opportunity to act. Full resolution commonly takes longer because the respondent must be served, allowed to comment, and given procedural opportunities to present evidence.

Filing with the NBI or police

Threatening messages, extortion, impersonation, unauthorized account access, and defamatory public posts may justify a criminal investigation. Depending on the facts, possible laws may include provisions of the Revised Penal Code on grave threats, coercion, unjust vexation, or libel, together with Republic Act No. 10175, the Cybercrime Prevention Act of 2012, when an offense is committed through a computer system.

Not every rude or persistent collection message automatically constitutes a crime. Investigators and prosecutors will examine the exact words used, whether the communication was published to another person, whether there was a threat of a wrongful act, the identity and intent of the sender, and whether the evidence can be authenticated.

The NBI accepts online complaints and provides investigative assistance through its Cybercrime Division and regional offices. Its official directory lists the Cybercrime Division and the address ccd@nbi.gov.ph. (National Bureau of Investigation)

Evidence and Documents to Prepare

A well-organized complaint is more likely to be acted upon quickly.

Document	Why it matters
Government-issued ID	Confirms the complainant’s identity
Loan agreement and disclosure statement	Shows the creditor, account, amount, due date, and agreed charges
Payment receipt and provider confirmation	Proves when, where, and how payment was made
Complete account ledger or app history	Shows whether the app recorded the payment
Screenshots and exported chats	Prove the words used and frequency of contact
Call logs and voicemails	Show repeated or threatening calls
Screenshots of public posts	Prove publication and audience
Statements from relatives or coworkers	Show disclosure to third persons
App permissions and privacy policy	Show what information the app requested
Written demand and delivery proof	Shows the lender was notified and given an opportunity to act
SEC or corporate details	Help identify the actual company behind the app
Chronology of events	Allows regulators to understand the case quickly

Label each attachment as Annex A, Annex B, and so on. Prepare a one- or two-page chronology listing the date, event, person or account involved, and supporting annex.

Avoid submitting unnecessary full contact lists, private family conversations, passwords, one-time PINs, complete bank credentials, or unredacted identification numbers. Disclose only what is reasonably needed to prove the complaint.

Common Problems That Delay Complaints

The app name is not the company name

The name displayed in the app store may differ from the corporation that issued the loan. Look for the lender’s legal name in:

The loan agreement;
Disclosure statement;
Privacy policy;
Terms and conditions;
Payment merchant name;
App-store developer details;
Email footer; and
Official receipt.

Name both the app and the legal entity in your complaint. Include the collection agency when identifiable.

Payment was made to a collector’s personal e-wallet

This creates an evidentiary problem. Preserve the collector’s written instruction, identification, authorization, and acknowledgment. Ask the lender whether that person or account was authorized to receive payment.

Never send another payment to a new personal account merely because a caller claims that the first payment “did not count.”

The lender claims you consented to contact-list access

Consent does not validate contact harvesting or public humiliation. The NPC’s loan-related rules prohibit copying or saving contacts for debt collection or harassment, and SEC rules treat contacting unrelated phonebook entries as an unfair collection practice.

The collection agency says its records have not been updated

Send the same proof to both the lender and the agency, but require the lender to correct the source record. A borrower should not be forced to negotiate separately with every outsourced collector after the creditor has received full payment.

The lender removed the app or stopped responding

You may still complain using the company name, website, email, payment account, phone numbers, app package information, screenshots, and SEC details. Removal from an app store does not erase earlier violations.

Civil Remedies for Serious Harm

Apart from administrative and criminal complaints, abusive collection may support a civil claim for damages.

Articles 19, 20, and 21 of the Civil Code require persons to exercise rights with justice, honesty, and good faith and recognize liability for unlawful or willfully injurious conduct contrary to morals, good customs, or public policy. Article 26 protects dignity, privacy, family relations, and peace of mind, even when the conduct does not independently constitute a crime. (Lawphil)

Possible relief may include:

Actual damages for proven financial loss;
Moral damages for serious mental anguish, humiliation, or wounded feelings when legally justified;
Exemplary damages in appropriate cases;
Attorney’s fees when allowed by law;
Correction or blocking of inaccurate data;
Injunctive relief to stop continuing publication or processing; and
Damages available under the Data Privacy Act.

The proper court and procedure depend on the amount claimed, the residence or business addresses of the parties, and whether the requested relief is limited to money or includes an injunction. Preserve medical records, counseling records, employment consequences, business losses, and other proof of actual harm.

For Borrowers Living Outside the Philippines

A borrower abroad may still preserve evidence and send complaints electronically when the Philippine lender, collector, or data-processing activity falls within Philippine regulatory jurisdiction.

For an NPC complaint filed by a non-resident Filipino who has no authorized representative in the Philippines, the amended rules expressly allow filing provided that the complaint is notarized by a Philippine embassy or consulate or carries an apostille from the country of origin.

A complainant abroad should also:

Retain original electronic files and email headers;
Use a Philippine-addressed written demand when possible;
Keep international courier and email delivery records;
Execute a properly authenticated special power of attorney if appointing a Philippine representative; and
Confirm the receiving agency’s current authentication and filing requirements before sending original documents.

Frequently Asked Questions

Can an online lending app contact my family after I have paid?

It may contact a properly identified guarantor or co-maker for a legitimate purpose, but contacting unrelated relatives, friends, coworkers, or entries harvested from your phonebook is prohibited collection conduct. After full payment, there is ordinarily no legitimate collection purpose for contacting them.

Can the lender post my name and picture on Facebook?

Using your photograph or personal information to shame you into paying may violate SEC collection rules, NPC loan-related rules, the Data Privacy Act, and possibly laws on defamation or cybercrime. Preserve the post, profile URL, comments, date, time, and visible audience before requesting removal.

Should I uninstall the lending app immediately?

Preserve the agreement, payment history, chats, app details, permissions, and screenshots first. Then revoke unnecessary permissions and uninstall it. Deleting the app too early may remove evidence that is difficult to recover.

Can I block the collector’s numbers?

Yes, after preserving the messages and call logs. Keep at least one written channel open with the lender’s official support or legal department so that you can receive its response and demonstrate that you attempted to resolve the issue.

What if the lender says I still owe a small amount?

Ask for a complete written computation showing the principal, interest, penalties, service charges, taxes, payments, and contractual basis. Do not rely solely on a collector’s verbal figure. Dispute any undisclosed or unsupported charge in writing.

Can they have me arrested even though I already paid?

A private collector cannot issue a warrant or order your arrest. A collection agent who claims that police are coming merely to force payment may be making a prohibited or potentially criminal threat. Separate criminal allegations, such as fraud, require an actual complaint, investigation, and lawful judicial process.

Can the lender keep my personal information after full payment?

It may retain limited records when required for legitimate legal, accounting, regulatory, or defense purposes. It should not retain unnecessary contacts, photos, permissions, or personal information indefinitely for an undefined future use.

What if the lender corrects the account but the harassment continues?

Notify the lender that its collector has ignored the correction. Attach the zero-balance confirmation and the later messages. File or update your SEC and NPC complaints and identify both the lender and collection agency.

Is an SEC complaint enough if my contacts were messaged?

The SEC complaint addresses unfair collection. An NPC complaint separately addresses unauthorized or excessive processing and disclosure of personal data. The same events may support complaints before both agencies, provided you disclose related proceedings where the required forms ask about them.

What if I am unsure whether the lending app is registered?

Identify the legal company name from the contract, privacy policy, receipt, and payment merchant. Include all available details in your SEC complaint and ask the SEC to verify whether the entity has authority to operate as a lending or financing company.

Key Takeaways

Full payment generally extinguishes the loan obligation, provided payment was made to the lender or an authorized recipient.
Preserve payment records, messages, call logs, app details, and third-party communications before blocking numbers or uninstalling the app.
Demand a written account reconciliation, zero-balance confirmation, correction of records, and an immediate stop to collection.
Online lenders may not harvest your contacts or use photos and personal data to embarrass you.
Report unfair collection by lending companies to the SEC and privacy violations to the NPC.
Notify the lender in writing before filing an NPC complaint and generally allow 15 calendar days for appropriate action, unless serious circumstances justify a waiver.
Report credible threats, extortion, impersonation, or criminal online publication to the police, NBI, or prosecutor.
Do not make a duplicate payment without first obtaining a verified, itemized explanation of the alleged balance.