If an online lending app is threatening to shame you, messaging your contacts, posting your photo, calling your workplace, or using abusive language to collect a loan, you are not powerless. Philippine law allows lenders to collect legitimate debts, but it does not allow harassment, threats, public shaming, unauthorized use of your contacts, or misleading collection tactics. This guide explains where to file a complaint against abusive online lending apps in the Philippines, what evidence to prepare, which government agency handles which issue, and what usually happens after you report.

What Counts as Abusive Online Lending App Behavior?

Online lending apps, often called OLAs or online lending platforms, may lawfully remind borrowers of due dates and demand payment through reasonable means. The problem begins when collection goes beyond lawful demand and becomes harassment, privacy abuse, deception, or cybercrime.

Common abusive acts include:

Threatening to post your photo, ID, or loan details online
Messaging your relatives, friends, employer, co-workers, or phone contacts even if they are not guarantors
Calling you repeatedly at unreasonable hours
Using insults, profanity, or humiliating language
Sending fake “subpoenas,” “warrants,” barangay summons, or police threats
Claiming you will be jailed simply for non-payment of debt
Editing your photo or making fake posts to shame you
Accessing your contacts, photos, SMS, location, or gallery without a legitimate purpose
Charging undisclosed fees, hidden penalties, or misleading interest
Pretending to be a law enforcement officer, lawyer, court staff, or government agency

The Securities and Exchange Commission (SEC), National Privacy Commission (NPC), and Department of Information and Communications Technology (DICT) have specifically warned against online lending platforms that engage in harassment, intimidation, public shaming, and unlawful use of personal data. Their 2026 public advisory states that unnecessary app permissions, excessive processing of contact lists, harassment-related processing, and contacting people in a borrower’s contact list other than named guarantors are prohibited.

Your Basic Rights as a Borrower

A borrower has two separate realities to understand:

A valid loan remains payable. Filing a complaint does not automatically erase the debt.
Debt collection must still be lawful. A lender cannot abuse, threaten, deceive, or humiliate you just because you owe money.

Under the Financial Products and Services Consumer Protection Act, or Republic Act No. 11765 (2022), financial consumers have rights to fair treatment, disclosure and transparency, data privacy and protection, and timely handling and redress of complaints. The law covers financial products and services, including credit and digital financial services, and gives financial regulators such as the SEC authority over providers under their jurisdiction.

This means you can complain about the lender’s unlawful conduct even if you still have a balance.

Legal Basis Against Abusive Online Lending Apps in the Philippines

SEC Rules on Unfair Debt Collection

The SEC is the main regulator for lending companies and financing companies. Under Republic Act No. 9474, the Lending Company Regulation Act of 2007, a lending company must be organized as a corporation and cannot conduct business unless it has authority to operate from the SEC. The SEC may supervise lending companies, require reports, and impose administrative sanctions, including suspension or revocation of authority and fines. (Supreme Court E-Library)

Financing companies are regulated under Republic Act No. 8556, the Financing Company Act of 1998, which recognizes financing companies as corporations extending credit facilities and places them under SEC regulation for covered activities. (Lawphil)

The key SEC rule for abusive collection is SEC Memorandum Circular No. 18, Series of 2019, titled Prohibition on Unfair Debt Collection Practices of Financing Companies and Lending Companies. It applies not only to lending and financing companies, but also to third-party service providers hired by them. It allows reasonable and legally permissible collection, but prohibits abusive practices such as threats of violence, threats to take illegal action, obscene or insulting language, public disclosure of borrower information, false representations, unreasonable-hour contact, and contacting people in the borrower’s contact list other than named guarantors or co-makers.

Data Privacy Law

The Data Privacy Act of 2012, Republic Act No. 10173, protects personal information and sensitive personal information. It gives data subjects rights such as access, correction, blocking, removal or destruction of unlawfully obtained or unauthorized data, and indemnity for damages caused by inaccurate, false, unlawfully obtained, or unauthorized use of personal information. (National Privacy Commission)

For lending apps, the privacy issue usually involves:

Uploading or scraping your phone contacts
Using your ID, selfie, or photo for public shaming
Contacting third parties who were never guarantors
Using personal data for a purpose different from what was clearly disclosed
Keeping or using data after it is no longer necessary
Making consent difficult to understand or withdraw

The NPC complaint route is especially important when the abuse involves your contacts, photos, government IDs, messages, phone permissions, or personal data.

Truth in Lending and Hidden Charges

Under the Truth in Lending Act, Republic Act No. 3765 (1963), creditors must disclose the true cost of credit, including finance charges and the percentage that the finance charge bears to the total amount financed expressed as a simple annual rate. (Lawphil)

If the app advertised “low interest” but later imposed undisclosed processing fees, service charges, rollover charges, or penalties that were not clearly disclosed before you accepted the loan, include that in your SEC complaint. It may support a complaint for misleading disclosure or unfair financial consumer practice.

Cybercrime and Criminal Law

Some lending app abuses may also be criminal. Under Republic Act No. 10175, the Cybercrime Prevention Act of 2012, the NBI and PNP are responsible for law enforcement of cybercrime cases, and Regional Trial Courts have jurisdiction over violations of the Act. The law also covers offenses committed through computer systems or where elements or damage occur in the Philippines. (Supreme Court E-Library)

Possible criminal issues may include:

Grave threats or light threats under the Revised Penal Code, depending on the exact threat
Unjust vexation or coercive conduct, depending on facts
Libel or cyber libel if defamatory statements are published online
Identity theft, computer-related fraud, or computer-related forgery under RA 10175, if fake accounts, edited images, or fraudulent digital documents are used
Unauthorized processing or malicious disclosure of personal information under the Data Privacy Act

For cyber libel, the Supreme Court in Disini v. Secretary of Justice, G.R. No. 203335 (2014) upheld cyber libel as constitutional as to the original author, while limiting liability for people who merely receive or react to posts. (Lawphil)

Which Government Agency Should You File With?

Different agencies handle different parts of the problem. In serious cases, file with more than one agency because each has a different power.

Problem	Best office to approach	What the office can address
Harassment by SEC-registered or supposedly registered lending/financing company	SEC	Unfair debt collection, unauthorized lending operations, violation of SEC circulars, possible suspension/revocation/fines
Contact list abuse, photo/ID misuse, data scraping, privacy violations	National Privacy Commission	Data privacy complaint, investigation, orders, possible penalties, privacy-related relief
Threats, fake posts, cyber libel, identity theft, edited photos, hacking, fraud	PNP Anti-Cybercrime Group or NBI Cybercrime Division	Criminal investigation, cybercrime evidence preservation, referral for prosecution
Coordinated cybercrime concern or online harm report	CICC / DICT channels	Cybercrime coordination, referral, incident response, public reporting
Physical threats, actual visits, stalking, violence	Nearest police station / prosecutor’s office	Immediate safety response, blotter, criminal complaint
A bank, e-wallet, or BSP-supervised institution is involved	BSP consumer assistance channels	Complaints involving BSP-supervised financial institutions

For most online lending app harassment cases, the usual practical approach is:

File with the SEC for unfair debt collection and lending-app regulation.
File with the NPC if your personal data or contacts were misused.
File with PNP-ACG or NBI Cybercrime if there are threats, fake posts, identity misuse, cyber libel, or fraud.

Step-by-Step: How to File a Complaint Against an Abusive Online Lending App

1. Preserve Evidence Before Blocking or Deleting Anything

Do not rely on memory. Agencies act faster when the complaint is organized and supported by screenshots, recordings, and clear timelines.

Save:

Screenshots of text messages, Viber, Messenger, WhatsApp, Telegram, email, and in-app messages
Call logs showing date, time, and phone number
Voice recordings or voicemail, if available
Screenshots of posts, comments, edited photos, fake accounts, or public shaming
Proof that your contacts were messaged
Screenshots of the app page in Google Play, App Store, APK page, or website
Loan agreement, disclosure statement, repayment schedule, and receipts
Proof of payment, GCash/Maya/bank transfer screenshots, reference numbers
Any threat using words like “warrant,” “subpoena,” “police,” “estafa,” “cybercrime,” or “barangay”
The exact phone numbers, emails, account names, collector names, and URLs used

Use your phone’s screen recording feature when messages disappear quickly. For Facebook posts, open the post, capture the URL, date, profile name, and visible comments. For calls, take screenshots of call logs immediately because some apps and phones overwrite older logs.

2. Identify the App and the Company Behind It

Many borrowers only know the app name, but the SEC needs the company name if possible.

Look for:

App name
Developer name in the app store
Website domain
Company name in the loan agreement
SEC registration number
Certificate of Authority number
Email address and physical address
Privacy policy name
Payment account name or merchant name
Collection agency name, if mentioned

Check whether the company is listed as a lending or financing company and whether the specific online lending platform is recorded. The SEC’s own FOI response points consumers to official SEC lists for registered lending companies, financing companies, and recorded online lending platforms. (www.foi.gov.ph)

Be careful: SEC registration as a corporation is not the same as authority to operate as a lending company. Under RA 9474, a lending company needs authority to operate from the SEC before conducting lending business. (Supreme Court E-Library)

3. Prepare a Short Timeline

A clear timeline helps investigators see the pattern. Use this format:

Date and time	What happened	Evidence
Jan. 5, 9:00 AM	App approved ₱5,000 loan; only ₱3,500 released after fees	Loan screenshot, wallet receipt
Jan. 10, 7:30 AM	Collector threatened to message employer	SMS screenshot
Jan. 10, 8:15 AM	Employer received message calling borrower “scammer”	Employer screenshot
Jan. 11, 11:30 PM	Collector called repeatedly after 10 PM	Call log
Jan. 12	Fake Facebook post using borrower’s photo appeared	Screenshot and URL

Avoid long emotional narration in the first page. Put the most serious acts first: threats, contact-list abuse, public shaming, fake posts, and undisclosed charges.

4. File a Complaint With the SEC

The SEC has an online public ticketing platform called SEC iMessage, where the public may submit complaints, report issues, open a new ticket, and check ticket status. The SEC iMessage page describes it as a platform for feedback, reporting issues, and submitting complaints, with options to open a new ticket and check ticket status. (imessage.sec.gov.ph)

In your SEC complaint, state:

Your full name and contact details
App name and company name, if known
Loan amount, amount actually received, and due date
Collection acts complained of
Whether your contacts were messaged
Whether threats or public shaming occurred
Whether the app disclosed fees and charges clearly
What relief you are asking for, such as investigation, action against the company, stopping unlawful collection practices, and correction of records if applicable

Use a direct subject line, for example:

Complaint Against [App Name / Company Name] for Unfair Debt Collection, Contact List Harassment, and Undisclosed Charges

Attach your evidence in organized files. If the portal has upload limits, combine screenshots into a PDF or upload the most serious evidence first.

5. File a Formal Complaint With the National Privacy Commission

File with the NPC when the lending app accessed, used, disclosed, or threatened to disclose personal data without proper basis. This includes contacting people in your phonebook who are not guarantors, using your selfie or ID for shaming, or collecting unnecessary app permissions.

The NPC requires a formal complaint in a specific format. Its official complaint page instructs complainants to download the form, print and fill it out, have it notarized, and submit it in person, by courier, or by scanning and emailing it to the NPC. (National Privacy Commission)

For an NPC complaint, prepare:

Notarized complaint form or complaint-affidavit
Valid government ID
Screenshots showing misuse of contacts, photos, IDs, or personal data
Proof that contacted persons were not guarantors
App privacy notice, permission screen, or consent screen
Loan documents
Screenshots of app permissions requested
Any demand to delete, block, or stop processing data, if you sent one

Practical tip: If relatives or co-workers were messaged, ask them to send screenshots showing the sender’s number, message content, date, and time. Their screenshots are often stronger than your statement alone.

6. Report Criminal or Cybercrime Elements to NBI or PNP

If the conduct involves threats, fake public posts, edited photos, identity misuse, cyber libel, hacking, fraud, or impersonation, go beyond SEC and NPC. Report it to law enforcement.

The NBI Cybercrime Division’s Citizens Charter states that the general public may request investigative assistance for computer crimes, with complainants proceeding to the Cybercrime Division to file a complaint or request investigation. It also describes initial steps such as filling out a complaint sheet, preliminary interview, sworn statements, and submission of supporting documents, with no fees listed for the initial process. (National Bureau of Investigation)

Bring printed and digital copies of:

Complaint-affidavit or written statement
Valid ID
Screenshots and call logs
URLs and account links
Device used to receive threats, if requested for examination
Names and contact details of witnesses
Proof of loan and payments
Any prior SEC or NPC complaint reference number

In practice, cybercrime investigators may ask you to execute a sworn statement, submit your phone for viewing or forensic documentation, or provide original screenshots from the device. Do not edit screenshots except to compile them; if you must redact private information for copies, keep the original unredacted file.

7. Notify Your Contacts and Reduce Further Harm

If the app has already contacted people in your phonebook, send a short neutral message:

“Please ignore any message from unknown numbers about me or an alleged loan. I am already documenting and reporting the harassment. Please screenshot the message, including the number, date, and time, and send it to me.”

Do not argue with collectors using your relatives’ phones. Do not admit false allegations in panic. Keep communications short and evidence-focused.

8. Revoke App Permissions and Secure Your Accounts

After preserving evidence:

Revoke the app’s access to contacts, photos, camera, location, and SMS
Uninstall the app if continued access is a risk
Change passwords for email, social media, and e-wallets
Enable two-factor authentication
Warn your workplace or HR if collectors are contacting your employer
Keep your SIM active if it is receiving evidence, unless safety requires otherwise

The DICT-NPC-SEC advisory specifically reminds borrowers to review app permissions, avoid unnecessary permissions, and note that online lending platforms may only access contact lists for limited legitimate purposes such as selecting character references or guarantors, not for unbridled processing.

Documents and Evidence Checklist

Document or evidence	Why it matters
Valid ID	Confirms complainant identity
Loan agreement or in-app loan screen	Shows loan amount, due date, fees, interest, and lender identity
Disclosure statement	Supports Truth in Lending or hidden-charge issues
Payment receipts	Shows what you already paid
Screenshots of threats	Proves unfair collection, threats, or coercion
Screenshots from contacted relatives/co-workers	Proves contact-list harassment
Call logs	Shows frequency and unreasonable-hour contact
App store page or APK source	Links app name to developer or company
Privacy policy and permission screens	Supports Data Privacy Act issues
URLs of fake posts or accounts	Helps cybercrime investigators preserve and trace content
Complaint-affidavit	Usually needed for formal NPC, NBI, police, or prosecutor action
Notarization or consular notarization, if abroad	Helps formalize sworn statements for Philippine use

What If You Are Abroad or You Are a Foreigner?

You can still report abuse if the lending app, borrower, data subject, transaction, computer system, or damage has a Philippine connection.

For data privacy, RA 10173 can apply even to acts done outside the Philippines when the processing relates to personal information about a Philippine citizen or resident, or where the entity has links with the Philippines, including doing business in the Philippines or collecting or holding personal information there. (National Privacy Commission)

For cybercrime, RA 10175 provides jurisdiction when any element is committed within the Philippines, when a computer system wholly or partly situated in the Philippines is used, or when damage is caused to a person who was in the Philippines at the time of the offense. (Supreme Court E-Library)

Practical points for OFWs and foreigners:

You may start with online complaint channels where available.
If a notarized affidavit is required and you are abroad, you may usually execute it before a Philippine Embassy or Consulate, or have it notarized locally and apostilled if the country is part of the Apostille system.
For urgent cybercrime or criminal cases, a trusted representative in the Philippines may help file or follow up, but agencies may still require your sworn statement.
Keep your evidence in Philippine time if possible, or indicate the time zone clearly.

The DFA’s Apostille information pages explain document authentication and apostille requirements, and Philippine consular posts commonly provide notarization services for affidavits and similar documents to be used in the Philippines. (apostille.gov.ph)

Common Mistakes That Weaken Complaints

Deleting the App Before Saving Evidence

Uninstalling the app may remove loan screens, notices, in-app messages, and payment history. Save everything first.

Filing Only With One Agency

SEC, NPC, and cybercrime authorities have different mandates. If your contacts were abused and you were threatened online, one SEC complaint may not cover the whole problem.

Submitting 100 Random Screenshots With No Timeline

Investigators need a story they can follow. Organize evidence by date and label the most serious acts.

Ignoring the Company Name

App names change. Company names, SEC registration numbers, payment merchant names, and website domains are more useful.

Panicking Over Fake Arrest Threats

Non-payment of an ordinary debt is generally a civil matter. A collector cannot simply cause your arrest by texting that you have a “warrant.” Real warrants and subpoenas come from lawful authorities and follow formal procedure.

Posting Back in Anger

Avoid defamatory counter-posts, threats, or exposing collectors’ private information online. Preserve evidence and file complaints instead.

What Can Happen After You File?

Possible outcomes include:

SEC investigation or issuance of directives
Administrative penalties against the lending or financing company
Suspension, revocation, or action against unauthorized operators
NPC investigation, mediation, or orders relating to personal data
Referral for criminal investigation
Takedown or preservation requests for online evidence, depending on the case
Demand for the company to explain its collection practices
Further requests for affidavits, original screenshots, IDs, or witness statements

Timelines vary widely. Simple ticket acknowledgment may be quick, but investigation can take weeks or months depending on agency workload, quality of evidence, whether the company is identifiable, and whether criminal tracing is needed. Cases involving anonymous SIMs, fake accounts, foreign-hosted apps, or deleted posts often take longer.

Sample Complaint Summary You Can Adapt

Use a concise opening like this in your SEC, NPC, or cybercrime complaint:

I am filing this complaint against [App Name] / [Company Name, if known] for abusive online lending collection practices. After I obtained a loan of ₱[amount] on [date], the app and/or its collectors sent threatening and humiliating messages to me and to people in my contact list who were not guarantors. They also threatened to publish my personal information and used abusive language. Attached are screenshots, call logs, proof of loan, proof of payment, and screenshots from contacted third parties. I respectfully request investigation and appropriate action for unfair debt collection, misuse of personal data, and other violations that may be found.

For NPC complaints, add specific privacy language:

The app accessed or used my personal data, including my contact list / photo / ID / phone number, for debt collection and public shaming beyond the purpose I understood or consented to. Some contacted persons were not guarantors and did not consent to be involved in the loan.

For cybercrime complaints, add the criminal acts:

The collectors also threatened harm / created fake posts / used edited photos / impersonated authorities / publicly accused me of crimes online. I request assistance in preserving and investigating the digital evidence.

Frequently Asked Questions

Can I file a complaint even if I really owe money?

Yes. A valid debt does not give a lender the right to harass you, shame you, threaten illegal action, or misuse your personal data. Your complaint is about unlawful collection behavior, not necessarily about denying the loan.

Can an online lending app message my contacts?

For debt collection, contacting people in your contact list other than named guarantors or co-makers is treated as an unfair collection practice under SEC MC No. 18. The 2026 DICT-NPC-SEC advisory also states that contacting persons on the borrower’s contact list other than named guarantors is prohibited.

Can I be jailed for not paying an online loan?

Ordinary non-payment of debt is generally not a crime by itself. However, separate criminal issues may arise if there is fraud, falsification, identity misuse, or other criminal conduct. Be cautious, but do not believe collectors who say you can be automatically jailed just because you missed a payment.

What if the app is not SEC-registered?

Report it to the SEC anyway. Under RA 9474, engaging in lending business without a valid SEC authority to operate is punishable, and the SEC has authority to regulate and sanction lending companies. (Supreme Court E-Library)

Should I file with the SEC or NPC first?

If the main issue is harassment by collectors, start with the SEC. If the app used your contacts, photos, ID, or personal data, file with the NPC too. If there are threats, fake posts, cyber libel, identity theft, or fraud, report to NBI or PNP cybercrime authorities as well.

Do I need a lawyer to file a complaint?

For many administrative complaints, you can start on your own if your evidence is organized. A lawyer becomes more important if you will file a civil case for damages, respond to a formal court case, pursue criminal prosecution, or deal with complicated facts involving multiple apps, large amounts, or cross-border evidence.

What if the collector says they are from a law office?

Ask for the full name of the lawyer, law office, address, roll number if applicable, written authority to collect, and a formal written demand. Even lawyers and collection agents must follow the law. A law office label does not legalize threats, shaming, or contact-list harassment.

Can I demand deletion of my personal data?

Yes, in proper cases. Under the Data Privacy Act, a data subject may seek blocking, removal, or destruction of personal information that is unlawfully obtained, used for unauthorized purposes, or no longer necessary for the purpose for which it was collected. (National Privacy Commission)

What if the app already posted my photo online?

Take screenshots immediately, copy the URL, record the date and time, and ask trusted people to capture what they can see from their accounts. Report to the platform for removal, but preserve evidence first. Then include it in your SEC, NPC, and cybercrime complaint.

Can I stop paying because the lender harassed me?

Do not assume harassment cancels the loan. The safer approach is to dispute illegal fees, demand a proper statement of account, keep proof of payments, and pursue complaints for abusive practices. If you can pay the undisputed principal or negotiated amount, pay only through traceable channels and keep receipts.

Key Takeaways

Online lending apps may collect debts, but they cannot threaten, shame, deceive, harass, or misuse your personal data.
File with the SEC for unfair debt collection and unauthorized lending issues.
File with the NPC when the app misuses contacts, photos, IDs, phone permissions, or other personal data.
Report to NBI or PNP cybercrime authorities when there are threats, fake posts, identity misuse, cyber libel, fraud, or other criminal acts.
Preserve screenshots, call logs, URLs, loan documents, payment receipts, and third-party messages before deleting anything.
A valid loan may still be payable, but abusive collection practices are separately actionable under Philippine law.