Receiving threats from an online lending app can feel terrifying, especially when collectors start messaging your relatives, employer, group chats, or Facebook contacts. In the Philippines, a lender may collect a legitimate debt, but it must do so through lawful and reasonable means. Harassment, public shaming, threats of violence, fake criminal accusations, and misuse of your contact list are not “normal collection.” This guide explains what Philippine law says, what evidence to save, where to report the app, and how to protect yourself without making your situation worse.

First: Separate the Debt From the Harassment

A common mistake is thinking there are only two choices: pay immediately or ignore everything. In reality, there are two separate issues:

The loan obligation — whether you borrowed money, how much was actually disbursed, what fees and interest were disclosed, and what remains unpaid.
The collection conduct — whether the online lending app, its collectors, or its outsourced collection agency violated Philippine law while trying to collect.

Even if you owe money, the lender is not allowed to shame, threaten, deceive, or unlawfully process your personal data. On the other hand, harassment does not automatically erase a valid debt. The practical goal is to stop the abusive conduct, document the violations, verify the correct amount, and deal only with the legitimate creditor through written channels.

What Online Lending Apps Are Not Allowed to Do

The Securities and Exchange Commission (SEC) regulates lending companies and financing companies. Under SEC Memorandum Circular No. 18, Series of 2019, these companies may collect debts only through reasonable and legally permissible means, and they must observe good faith and reasonable conduct. The circular treats certain collection practices as unfair, abusive, or prohibited.

An online lending app, collector, or third-party collection agency should not:

Collection behavior	Why it matters
Threaten violence, harm, or criminal means against you, your reputation, or your property	SEC rules prohibit threats or criminal means to harm a borrower’s person, reputation, or property.
Threaten legal action that cannot legally be taken	Fake threats of “immediate arrest,” “warrant,” “police pickup,” or “automatic estafa” are red flags.
Use obscene, insulting, or profane language that amounts to an offense	Abusive messages can be evidence of unfair collection and, in some cases, a criminal complaint.
Publish your name, photo, ID, or loan status to shame you	SEC rules prohibit disclosure or publication of names and personal information of borrowers allegedly refusing to pay.
Message your contact list, relatives, co-workers, or employer when they are not guarantors or co-makers	Contacting people in your phonebook other than guarantors or co-makers is treated as unfair debt collection.
Pretend to be a lawyer, police officer, court sheriff, barangay official, or government agency	Deceptive means to collect are prohibited.
Call or message at unreasonable hours	SEC MC No. 18 identifies contacts before 6:00 a.m. or after 10:00 p.m. as unfair, subject to the circular’s stated exceptions.
Harvest your contacts, photos, gallery, SMS, or location without a valid purpose	A 2026 joint advisory by the DICT, National Privacy Commission, and SEC warns against unnecessary, excessive, or disproportionate app permissions and the use of personal data for harassment or unlawful collection.

The SEC also makes the lending or financing company responsible for its third-party collectors. If the company outsourced collection to an agency, that agency is treated as its agent, and the principal company remains ultimately responsible for violations.

Your Legal Rights Under Philippine Law

SEC rules on unfair debt collection

SEC MC No. 18, Series of 2019, is one of the most directly relevant rules for abusive online lending collection. It covers financing companies and lending companies, including their collection agents, counsels, and third-party service providers. It prohibits violence, threats, insults, false representations, public shaming, unauthorized disclosure of borrower information, and improper contact with people in the borrower’s contact list.

The penalties can be serious. For lending companies, the circular provides fines of ₱25,000 for a first offense and ₱50,000 for a second offense. For financing companies, the fines are ₱50,000 for a first offense and ₱100,000 for a second offense. A third offense may lead to a higher fine, suspension of lending or financing activities, or revocation of the company’s Certificate of Authority.

Your rights as a financial consumer

The Financial Products and Services Consumer Protection Act, or Republic Act No. 11765 of 2022, recognizes financial consumer rights such as fair and equitable treatment, disclosure and transparency, protection against fraud and misuse, data privacy, and timely handling of complaints. It applies to financial products and services, including credit and digital financial products, offered by financial service providers under the jurisdiction of financial regulators such as the SEC and Bangko Sentral ng Pilipinas (BSP). (Supreme Court E-Library)

This matters because an online loan is not just a private transaction. If the provider is a regulated lending or financing company, it must follow consumer protection standards, not just the terms written in its app.

Data privacy rights under the Data Privacy Act

The Data Privacy Act of 2012, or Republic Act No. 10173, protects personal information and recognizes the right to privacy of communication. It applies to the processing of personal information, including collection, use, storage, disclosure, and disposal of personal data. Consent must be freely given, specific, informed, and recorded in an appropriate form. (National Privacy Commission)

You have rights to access information about how your data is processed, correct errors, and ask for blocking, removal, or destruction of personal information that is unlawfully obtained, used for unauthorized purposes, or no longer necessary. You may also seek indemnity for damages caused by inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal information. (National Privacy Commission)

The 2026 DICT-NPC-SEC advisory specifically warns online lending platforms against excessive app permissions, contact-list harvesting, and processing personal data in ways that lead to harassment, threats, violence, or collection from persons other than borrower-provided guarantors. It also clarifies that character references and guarantors must be treated differently: a character reference is for verification, while a guarantor must expressly consent to assume loan responsibility and be contacted for collection.

Criminal laws that may apply

Some abusive collection tactics may cross from regulatory violations into criminal conduct. Depending on the facts, threats, blackmail, fake public accusations, impersonation, account hacking, identity misuse, or online shaming may involve the Revised Penal Code and the Cybercrime Prevention Act of 2012, or Republic Act No. 10175.

RA 10175 covers certain offenses committed through information and communications technology, including cyber-related identity theft and online libel. It also provides that crimes already punishable under the Revised Penal Code and special laws may be covered when committed through a computer system. (Supreme Court E-Library)

For example, if a collector posts your photo and falsely calls you a scammer, criminal, or fraudster, that may raise issues of defamation or cyberlibel, depending on the exact words, publication, identification, and malice. The Supreme Court in Disini v. Secretary of Justice explained that cyberlibel under RA 10175 adopts the Revised Penal Code concept of libel when committed through a computer system. (Supreme Court E-Library)

Civil damages for abuse, privacy invasion, and humiliation

The Civil Code of the Philippines may also apply. Article 19 requires every person to act with justice, give everyone his due, and observe honesty and good faith. Article 20 makes a person liable for damages when they willfully or negligently cause damage contrary to law. Article 21 allows compensation for willful acts contrary to morals, good customs, or public policy. (Lawphil)

Article 26 of the Civil Code also protects a person’s dignity, personality, privacy, and peace of mind. This can be relevant when collectors publicly shame a borrower, repeatedly disturb the borrower’s family, or expose private information to co-workers or social media groups. (Supreme Court E-Library)

What to Do Immediately If You Are Being Threatened or Harassed

1. Do not argue with collectors on calls

Abusive collectors often try to provoke panic. They may want you to say something emotional, admit something inaccurate, or send money to an unverified account.

Instead:

Stop answering repeated calls if they are abusive.
Move communication to text, email, or in-app support.
Do not send additional IDs, selfies, passwords, OTPs, contacts, or screenshots of private accounts.
Do not pay to a personal GCash, Maya, bank, or crypto account unless you have verified that it is an official payment channel of the lender.

A simple written response is enough:

Please communicate only in writing. State the legal name of the lending company, SEC registration or Certificate of Authority details, the loan account number, principal amount released, interest, fees, penalties, payments credited, and total amount you claim is due. I also object to any threat, public disclosure, or contact with persons who are not my guarantors or co-makers.

2. Preserve evidence before blocking, deleting, or uninstalling

Evidence is what turns a stressful story into a usable complaint. Save everything before it disappears.

Prepare:

Screenshots of messages, including the sender’s number, profile name, date, and time.
Screen recordings showing the full chat thread, not just isolated messages.
Call logs showing repeated calls, unusual hours, and caller numbers.
Voice recordings or voicemail, if available.
Messages sent to your relatives, employer, co-workers, group chats, or social media contacts.
Copies of posts, comments, edited photos, fake wanted posters, or public shaming content.
Loan contract, disclosure statement, screenshots of the app, payment history, and receipts.
The app name, developer name, website, app store link, company name, SEC registration details, and customer service contact.
Names and statements of people who received harassment messages.

Do not crop screenshots too tightly. Agencies need context: sender, timestamp, platform, message content, and identity clues.

3. Secure your phone and accounts

Many online lending apps rely on fear created by access to your phonebook, gallery, SMS, or social media information. The 2026 DICT-NPC-SEC advisory warns borrowers to review app permissions and notes that access to the camera, gallery, contacts, or other data should be tied to legitimate and proportionate purposes. It also says users should be prompted to revoke permissions once the purpose has been achieved.

Take these steps:

Go to your phone settings.
Open the app permissions page.
Revoke access to contacts, SMS, call logs, gallery, camera, microphone, and location unless truly necessary.
Change passwords for email, social media, and mobile wallet accounts.
Turn on two-factor authentication.
Warn close contacts not to pay anyone claiming to collect your debt.
Report abusive messages or fake posts to the platform where they appear.

If you still need screenshots from inside the app, capture them first. After saving evidence, you may uninstall the app or restrict its permissions depending on your situation.

4. Verify whether the lender is registered or licensed

The name shown on the app is not always the legal name of the company. Some apps use different brand names, collection names, and developer names.

Check:

The app name and developer name.
The lending or financing company name.
SEC registration number and Certificate of Authority number.
The loan agreement or disclosure statement.
The official customer service email and physical address.
Whether the app appears to be operated by a registered or licensed entity.

The 2026 DICT-NPC-SEC advisory specifically tells borrowers to download lending apps only from official or verified sources and to check that they are operated by registered or licensed entities.

5. Ask for a clear statement of account

Before paying anything under pressure, ask for a written breakdown:

Principal amount actually released to you.
Interest.
Processing fees.
Service fees.
Late payment charges.
Payments already credited.
Current balance.
Official payment channels.
Name of the creditor and collector.

The Truth in Lending Act, or Republic Act No. 3765 of 1963, requires creditors to disclose finance charges and the true cost of credit before the transaction. This is important when the app deducted fees upfront, changed the due amount, or failed to clearly show the effective cost of the loan. (Lawphil)

For certain small online loans, BSP Circular No. 1133, Series of 2021, approved ceilings on interest, fees, and penalties for unsecured, general-purpose loans offered by lending companies, financing companies, and online lending platforms where the amount is up to ₱10,000 and the tenor is up to four months. The circular states caps of 6% nominal interest per month, 15% effective interest per month including fees and charges, a late-payment penalty cap of 5% per month on the outstanding scheduled amount due, and a total cost cap of 100% of the total amount borrowed.

6. Send a written privacy complaint or objection to the company

For data privacy complaints, the National Privacy Commission generally requires you to first notify the respondent in writing of the privacy violation or breach. If there is no timely or appropriate action, or no response within 15 calendar days from receipt, you may attach proof of that notice when filing with the NPC. (National Privacy Commission)

Send the notice to the company’s customer service, data protection officer, or official email address. Keep proof that it was sent.

Your message can say:

I object to the use, disclosure, or processing of my personal information and the personal information of my contacts for harassment, public shaming, or debt collection from persons who are not my guarantors or co-makers. Please stop all unlawful processing, preserve all records related to my account and collection activity, identify the collector or third-party agency involved, and confirm what corrective action you will take.

Where to Report an Online Lending App in the Philippines

Different agencies handle different parts of the problem. Filing with the wrong office can delay action, so match your complaint to the conduct.

Problem	Where to report	What to prepare
Threats, insults, public shaming, contacting your employer or contacts, abusive collection by a lending or financing company	SEC Financing and Lending Companies Division (FINLEND) through SEC iMessage	Narrative, screenshots, call logs, loan documents, company/app details, payment records, names of collectors
Contact-list harvesting, unauthorized use of photos/IDs, disclosure of your loan to contacts, misuse of personal data	National Privacy Commission (NPC)	Notarized complaint-affidavit or verified complaint, evidence, proof you notified the respondent first, proof of no response or inadequate response after 15 calendar days
Death threats, extortion, hacked accounts, identity theft, fake warrants, blackmail, cyber harassment, scams	PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT Cyber Hotline 1326	Screenshots, URLs, numbers, account names, recordings, IDs of suspects if known, timeline
Loan tied to a bank, e-wallet, money service business, pawnshop, or other BSP-supervised institution	BSP Consumer Assistance channels	Complaint, transaction records, account details, prior communication with the institution
Immediate physical danger	Local police station or emergency response channels	Threat messages, caller details, location, identity clues

The 2026 DICT-NPC-SEC advisory states that unfair debt collection concerns may be reported to SEC FINLEND through SEC iMessage and the SEC hotline 1-4732, also styled as 1-4SEC. It also lists cybercrime-related reporting channels for the DICT Cyber Hotline, NBI Cybercrime Division, and PNP Anti-Cybercrime Group.

For privacy complaints, the NPC’s filing procedure requires a completed and notarized complaint form or verified complaint, supporting evidence, and submission personally, by registered mail, courier, or electronic mail when allowed. The NPC also notes that complaints may be filed by the data subject, an authorized representative with a special power of attorney, or a juridical entity representative with proper authority. (National Privacy Commission)

How to Build a Strong Complaint

A strong complaint is organized, specific, and supported by evidence. Agencies receive many complaints; the easier you make the facts to verify, the better.

Include a clear timeline

Write the events in order:

Date you downloaded or used the app.
Loan amount applied for.
Amount actually received.
Fees deducted.
Due date.
Payments made.
Date harassment started.
Exact threats or messages received.
Names or numbers of collectors.
Names of relatives, contacts, co-workers, or employers who were messaged.
Steps you took to ask the company to stop.

Describe the exact words used

Avoid vague statements like “they harassed me.” Quote the exact words, then attach screenshots.

For example:

“They said they would post my ID and photo if I did not pay by 3 p.m.”
“They messaged my employer saying I am a scammer.”
“They told my mother she would be liable even though she never signed as guarantor.”
“They threatened arrest and said police were already on the way.”
“They created a group chat with my contacts and disclosed my loan.”

Attach evidence in a clean format

Use file names that are easy to understand:

01-loan-agreement.pdf
02-disclosure-statement.png
03-payment-receipt-may-15.pdf
04-threat-message-june-2.png
05-message-to-employer-june-2.png
06-call-log-after-10pm.png
07-email-to-company-dpo.pdf
08-proof-of-no-response-after-15-days.pdf

If relatives or co-workers received messages, ask them to send full screenshots showing the sender, date, time, and message. If they are willing, they may execute a simple affidavit describing what they received.

For OFWs, Filipinos abroad, and foreigners

If you are outside the Philippines, you can still preserve digital evidence and submit complaints through available online, courier, or email channels where permitted. For notarized affidavits or special powers of attorney executed abroad, Philippine agencies or courts may require proper notarization, consular acknowledgment, or apostille depending on the country where the document is executed and the specific use of the document.

Foreigners dealing with a Philippine online lending app should also keep passport or visa details private unless legally required. Do not send additional identity documents to unknown collectors. If the app is operating in the Philippines, collecting from a Philippine resident, or processing personal information connected to the Philippines, Philippine privacy and consumer protection rules may still be relevant. RA 10173 has provisions applying to certain acts done inside or outside the Philippines when the personal information relates to a Philippine citizen or resident or when the entity has links to the Philippines or carries on business in the Philippines. (National Privacy Commission)

Common Scenarios and What They Mean

“The app messaged all my contacts.”

This is one of the clearest red flags. The 2026 DICT-NPC-SEC advisory states that contacting persons on the borrower’s contact list other than named guarantors is prohibited, and that only guarantors may be contacted for debt collection. It also says online lending platforms must separate character references from guarantors. A character reference is for identification or verification; a guarantor must expressly consent to assume responsibility for the loan.

Save screenshots from every contact who received a message. Include these in both your SEC complaint and, if personal data was misused, your NPC complaint.

“They threatened to file estafa and have me arrested.”

Nonpayment of a loan is generally a collection or civil matter. A collector cannot have you arrested simply by texting “estafa case filed” or “warrant issued.” Arrests and warrants follow legal processes, not app messages.

However, be careful: if a borrower used fake identity documents, false employment details, or fraud from the start to obtain money, the facts may be different. The safest response is not to argue about criminal law with the collector. Instead, ask for formal documents, preserve the threat, and report fake legal threats or impersonation.

“They posted my photo, ID, or name online.”

Public shaming is serious. It can involve unfair debt collection, privacy violations, and possibly defamation or cyberlibel depending on the words used and where they were posted. SEC rules prohibit disclosure or publication of borrower information in connection with alleged refusal to pay.

Take screenshots showing the URL, group name, poster profile, date, time, comments, and number of people who could view it. Do not retaliate by posting the collector’s personal details; that can create legal risk for you too.

“They are harassing my mother, spouse, employer, or character reference.”

A relative, spouse, or employer is not automatically liable for your loan. A person generally becomes liable only if they validly agreed to be a co-borrower, co-maker, surety, or guarantor. Under the 2026 DICT-NPC-SEC advisory, guarantors must expressly consent to assume responsibility and be contacted for collection; character references are for verification and should not be treated as guarantors.

The harassed person may also keep their own evidence and file a privacy or harassment complaint if their personal data, phone number, workplace, or reputation was misused.

“The online lending app is unregistered or foreign.”

Report it anyway. The 2026 advisory expressly refers to entities offering or facilitating loans through online lending platforms, whether recorded or unrecorded. It also warns borrowers to check that platforms are operated by registered or licensed entities.

Unregistered or hard-to-trace apps can be more difficult to pursue, but reports still help regulators, cybercrime authorities, and app platforms identify patterns, block abusive operators, and take enforcement action.

What Not to Do

Avoid these common mistakes:

Do not delete evidence just because the messages are upsetting.
Do not pay random collectors without a written statement of account and official payment channel.
Do not send OTPs, passwords, selfies, new IDs, or contact lists.
Do not borrow from another abusive app just to pay the first one.
Do not ignore legitimate written notices from the actual lending company, a court, or a regulator.
Do not retaliate online by posting private information about collectors or employees.
Do not let relatives pay under panic unless the creditor and amount are verified.
Do not sign a settlement you do not understand, especially if it includes inflated fees or a waiver of all complaints.

A calmer approach usually works better: document, verify, object in writing, report to the right agency, and address only the lawful amount through official channels.

Frequently Asked Questions

Can an online lending app message my contacts?

Generally, an online lending app should not contact people in your phonebook for debt collection unless they are valid guarantors or co-makers. The 2026 DICT-NPC-SEC advisory states that contacting persons on the borrower’s contact list other than named guarantors is prohibited, and that only guarantors may be contacted for debt collection.

Can they post my photo or ID if I do not pay?

No. Public shaming, publication of borrower information, or disclosure of your personal data to pressure you into paying can violate SEC debt collection rules and data privacy law. Save screenshots and report the conduct to the SEC and, where personal data is misused, the NPC.

Can I be arrested for not paying an online loan?

A simple unpaid loan does not automatically lead to arrest. Debt collection is normally a civil matter. Be careful, however, if there was alleged fraud, fake identity, or intentional deception when the loan was obtained. Fake threats of immediate arrest, police pickup, or a warrant by text message should be documented and reported.

Where do I file a complaint against an online lending app in the Philippines?

For abusive collection by a lending or financing company, report to SEC FINLEND through SEC iMessage. For misuse of personal data, contact-list harvesting, or unauthorized disclosure, file with the National Privacy Commission. For threats, extortion, hacking, identity theft, or cybercrime, report to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT Cyber Hotline.

Do I still have to pay if the app harassed me?

Harassment does not automatically cancel a valid debt. But the lender or collector may still be reported and penalized for illegal collection, privacy violations, or criminal conduct. You should ask for a written statement of account, verify the lender, check whether charges were properly disclosed, and pay only through official channels.

What evidence should I prepare before filing a complaint?

Prepare screenshots, screen recordings, call logs, voice messages, social media posts, messages sent to your contacts, loan documents, disclosure statements, payment receipts, app details, company information, and a written timeline. For an NPC complaint, also keep proof that you notified the company of the privacy violation and proof of no adequate response after 15 calendar days. (National Privacy Commission)

Is a character reference required to pay my loan?

No. A character reference is not the same as a guarantor. A guarantor must expressly consent to assume responsibility for the loan and to be contacted for collection. A person listed only for verification should not be treated as someone legally liable for your debt.

What if the interest and penalties are extremely high?

Ask for a written breakdown of the principal, interest, fees, penalties, and payments. For covered small loans of up to ₱10,000 with a tenor of up to four months, BSP Circular No. 1133 sets ceilings on interest, effective interest including fees, late-payment penalties, and total cost.

Can I file with the NPC immediately?

For most privacy complaints, the NPC expects you to first notify the respondent in writing and give them a chance to act. If there is no timely or appropriate action, or no response within 15 calendar days from receipt, attach proof when filing your complaint. Complaints must generally be verified or notarized and supported by evidence. (National Privacy Commission)

What if I am an OFW or outside the Philippines?

You can still preserve evidence, send written objections, and use available online or email reporting channels where accepted. If you need to submit affidavits, special powers of attorney, or representative authority from abroad, check whether the receiving agency requires notarization, consular acknowledgment, or apostille. Relatives in the Philippines who were directly harassed may also preserve their own evidence and file appropriate complaints.

Key Takeaways

A lender may collect a valid debt, but it cannot use threats, public shaming, insults, fake legal claims, or contact-list harassment.
SEC rules prohibit unfair debt collection, including disclosure of borrower information and contacting people who are not guarantors or co-makers.
The Data Privacy Act protects you against unauthorized, excessive, or unlawful processing of your personal data.
Character references are not automatically guarantors and should not be forced to pay.
Save evidence before blocking numbers, deleting messages, or uninstalling the app.
Ask for a written statement of account and pay only through verified official channels.
Report abusive collection to the SEC, privacy violations to the NPC, and serious threats or cybercrime to the PNP, NBI, or DICT Cyber Hotline.
Harassment does not automatically erase the debt, but it can create separate liability for the lending company, collection agency, or individual collectors.