Quick answer

An online lending app may lawfully contact you about a genuine debt, but it generally may not threaten to publish your personal data, shame you online, message unrelated people in your contacts, misuse your photos, or damage your reputation to force payment.

Act quickly:

Preserve the threats and all account records.
Revoke unnecessary app permissions and secure your accounts.
Send a written demand to the lender and its data protection officer to stop the threatened disclosure.
Report unfair collection practices to the Securities and Exchange Commission (SEC).
If personal data is involved, follow the National Privacy Commission (NPC) complaint process.
Report threats, extortion, impersonation, fraud, or immediate safety risks to law enforcement.

Do not delete the app, messages, account, or payment records until you have preserved the evidence. Revoking permissions can stop future access, but it does not necessarily delete data the lender already copied.

The threat itself may violate Philippine rules

The Data Privacy Act of 2012 requires personal-data processing to have a lawful basis and to comply with transparency, legitimate purpose, and proportionality. The borrower also has rights that may include access, correction, objection, erasure or blocking, and damages, subject to legal exceptions.

More specifically, NPC Circular No. 2020-01, as amended by NPC Circular No. 2022-02, regulates personal data used in loan applications and collection. It prohibits unnecessary, excessive, and disproportionate processing. Among other restrictions:

A borrower’s photo must not be used to harass or embarrass the borrower while collecting a delinquent loan.
Unrestrained or “unbridled” processing of phone, email, or social-media contact lists is prohibited.
Contact-list processing that leads to harassment or collection from people other than permitted guarantors is prohibited.
An app may obtain only the permissions suitable, necessary, and not excessive for a specified legitimate purpose.
Camera or photo-gallery access used for identity or payment verification should end when that purpose has been completed.
A character reference is not automatically a guarantor.
A person becomes a guarantor only after separately and expressly consenting to assume responsibility if the borrower defaults.

The government’s March 18, 2026 joint advisory on online lending platforms expressly states that lenders may not contact people in a borrower’s contact list for debt collection unless those people were named as guarantors. It also identifies threats to harm a person’s reputation and threats to take action that cannot legally be taken as prohibited unfair collection practices.

Under SEC Memorandum Circular No. 18, Series of 2019, prohibited collection conduct includes:

threats of violence or other criminal means against a person, reputation, or property;
threats to take action that cannot legally be taken;
obscenities, insults, or profane language amounting to abuse or an offense;
disclosure or publication of borrowers’ names and personal information, except where disclosure is legally allowed;
threatening to communicate false loan information;
false representations or deceptive collection methods; and
contacting people in the borrower’s contact list other than permitted guarantors or co-makers.

A privacy notice, app permission, or consent screen does not necessarily authorize public shaming or harassment. Whether a particular disclosure is unlawful will still depend on what data was used, how it was obtained, the stated purpose, the recipient, the loan documents, and any applicable legal basis.

What to do immediately

1. Preserve evidence before blocking or uninstalling anything

Create a chronological evidence folder. Keep original electronic copies where possible—not only cropped screenshots.

Preserve:

screenshots and screen recordings showing the sender, full message, date, and time;
the phone number, email address, social-media account, username, profile URL, and page URL used;
voice messages, recordings lawfully obtained, call logs, and voicemail;
any message threatening to contact your employer, family, friends, clients, or social-media contacts;
posts, group chats, edited photos, fake notices, or public comments already published;
notices received by your contacts and their written accounts of what happened;
the app’s name, developer, download page, package name, website, and displayed corporate information;
the privacy notice, consent screens, permission requests, loan agreement, disclosure statement, repayment schedule, and collection notices;
proof of disbursements and every payment, including receipts and transaction references;
your phone’s current permission settings;
emails or tickets sent to the lender and proof that they were received; and
any demand for payment to a personal bank, e-wallet, or other account not identified in the loan documents.

Ask affected contacts to preserve the original messages on their devices. Record when and how they received them. Avoid editing screenshots or adding markings to the only copy.

2. Reduce further access to your device

After preserving the relevant screens:

Open your phone’s settings and revoke access to contacts, photos, storage, camera, microphone, location, calendar, and call logs unless a permission remains genuinely necessary.
Review the app’s device-administrator, accessibility, screen-overlay, notification-access, and “install unknown apps” privileges.
Change passwords for your email, social-media, cloud-storage, and financial accounts if the app or a collector may have obtained them.
Enable multifactor authentication.
Sign out unknown sessions and check account-recovery phone numbers and email addresses.
Remove public visibility from posts or profile details that could be used for impersonation.
Contact your mobile provider, bank, or e-wallet immediately if there are signs of SIM takeover, unauthorized transactions, or account compromise.

Do not pay a collector merely because of a threat. First verify the creditor’s legal identity, the account balance, and the authorized payment channel. At the same time, do not ignore a valid debt: ask for a written statement of account and handle repayment or any billing dispute separately.

3. Send a focused written notice

Send the notice to the lender’s official support address, complaints channel, and data protection officer if identified in its privacy notice. Use a method that produces proof of delivery.

State:

your name and loan or account reference;
the date, sender, and exact nature of the threat;
which personal data or contacts the collector threatened to expose;
that you object to harassment, public shaming, and disclosure to unauthorized persons;
that the lender must preserve relevant collection records;
that you revoke unnecessary device permissions and any consent that may lawfully be withdrawn;
that you request the source, purpose, recipients, and legal basis for processing the disputed data;
that you demand an immediate stop to the threatened disclosure and deletion or blocking where legally required; and
that you want a written response and a current statement of account.

A practical formulation is:

I object to any public disclosure, shaming, or communication of my loan information to persons who are not lawfully entitled to receive it. Please stop the threatened processing, preserve all relevant records, identify the source, purpose, recipients, and legal basis for using my personal data, and confirm in writing what corrective action has been taken.

Do not admit an amount you genuinely dispute. Keep the privacy complaint and the accounting dispute clear and factual.

Where to report the conduct

Different agencies address different parts of the problem. You may need more than one report.

National Privacy Commission

Use the NPC process when the lender accessed, used, disclosed, retained, or threatened to disclose personal data unlawfully.

Ordinarily, the NPC’s amended Rules of Procedure require you first to inform the lender or other responsible entity in writing and give it an opportunity to act. You may proceed if it does not take timely and appropriate action or gives no response within 15 calendar days after receiving your notice. Attach proof of the notice and receipt.

The NPC may waive this exhaustion requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm, the absence of a plain and adequate remedy, or patently illegal action. Explain and prove the urgency rather than assuming that a waiver is automatic.

The NPC’s complaint guide and forms state that a complaint should be verified and supported by evidence. Depending on the filing method authorized by the NPC, it may be submitted personally, by registered mail, by courier, or electronically. Check the NPC page immediately before filing because format and electronic-submission requirements can change.

A complete complaint should identify the parties, narrate the material facts, specify the relief requested, attach your correspondence and evidence, include supporting affidavits where available, and contain the required certification against forum shopping. A deficient or unsupported complaint may be dismissed outright.

Possible NPC relief can include compliance or enforcement orders, indemnity where appropriate, administrative fines, and a temporary or permanent ban on processing. If the NPC finds grounds for criminal prosecution under the Data Privacy Act, it may refer the matter to the Department of Justice. These outcomes are not automatic and depend on the evidence and proceedings.

Securities and Exchange Commission

Report harassment, intimidation, public shaming, unauthorized contact with other people, false representations, and other unfair collection practices involving a lending or financing company to the SEC’s Financing and Lending Companies Department.

The government’s current advisory directs complaints to the SEC iMessage portal. Select the service relating to financing and lending companies and attach the threats, loan records, company or app details, and proof of communications. The advisory also lists the SEC hotline 1-4732 (1-4SEC).

Check whether the app displays the lender’s corporate name, SEC registration number, and Certificate of Authority number. An app’s brand name may be different from the legal name of the company operating it. The SEC’s lending and financing company information page explains that a lending company may not operate without SEC authority.

Law enforcement and cybercrime authorities

Seek immediate help when the messages involve physical harm, extortion, account takeover, identity theft, impersonation, fraudulent payment instructions, stalking, sexual threats, or another apparent crime. Do not wait 15 days where safety is at risk.

The March 2026 joint advisory lists:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (632) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph; (632) 8723-0401 local 7491

You may also go to the nearest police station or NBI office. Bring identification, your phone, printed copies, original electronic evidence, the loan records, and a concise timeline. The precise offense—if any—depends on the words used, conduct, intent, publication, and resulting harm; let the proper authority evaluate whether laws on threats, coercion, fraud, unlawful data processing, unauthorized disclosure, or cyber-related offenses apply.

If the lender has already posted or messaged your data

Take these steps in order:

Capture the entire post or message, URL, account name, date, time, audience, reactions, shares, and comments.
Save the original image or video if the platform permits it.
Ask recipients to preserve—not forward—the material and provide a signed account of what they received.
Report the content through the platform’s privacy, harassment, impersonation, or doxxing channel.
Send the lender a written preservation and takedown demand.
File the appropriate SEC and NPC complaints and, where criminal conduct may be involved, report it to law enforcement.
Monitor for fake accounts, fraudulent loan applications, password resets, and unauthorized financial activity.

Do not repeatedly repost the offending material while seeking help; doing so can spread your own data further. When sending evidence, redact unrelated personal information unless the agency specifically requires an unredacted copy.

What the lender may still lawfully do

Privacy law does not cancel a valid loan. Subject to the contract and applicable law, a lender may generally:

contact you through reasonable and lawful channels;
send accurate billing and collection notices;
process information genuinely necessary to administer or collect the loan;
contact a guarantor who separately and expressly agreed to that role;
retain data while it remains necessary for the transaction, compliance obligations, or the establishment, exercise, or defense of legal claims; and
pursue remedies that are actually available under the contract and law.

A request to erase all data may therefore be denied in part if the lender has a valid legal reason to retain particular records. That does not permit the lender to expose those records publicly, use them to shame you, or process more data than necessary.

Common mistakes to avoid

Paying an unknown personal account without verifying that the recipient is authorized.
Deleting messages, uninstalling the app, or resetting the phone before preserving evidence.
Assuming that revoking permissions deletes data already collected.
Treating every character reference as a guarantor.
Filing an NPC complaint without first sending the required written notice, unless a properly supported exception applies.
Submitting screenshots with no sender, date, URL, account number, or explanation.
Naming only the app and not trying to identify its corporate operator or collection agency.
Posting IDs, loan agreements, contact lists, or unredacted screenshots publicly while asking for help.
Threatening or insulting collectors in return.
Ignoring the underlying balance, interest, fees, or payment records because the collection conduct was abusive.
Filing conflicting factual accounts with different agencies.

When legal help is urgent

Consult a Philippine lawyer or the Public Attorney’s Office promptly if:

there is a credible threat of violence or someone is approaching your home or workplace;
intimate images, identity documents, financial credentials, or a child’s data are involved;
the lender has published accusations to a large audience or contacted your employer or clients;
money is being demanded in exchange for keeping data private;
accounts have been compromised or loans were opened in your name;
you need an urgent order to stop processing or publication;
you received a subpoena, summons, court pleading, or formal demand;
the lender denies receiving your written privacy notice; or
the facts may support civil, administrative, and criminal proceedings at the same time.

A lawyer can assess the loan documents, identify the proper respondents, preserve electronic evidence, and avoid procedural conflicts between complaints.

Frequently asked questions

Can the app message everyone in my contacts because I granted contact access?

Generally, no. App access must still be necessary, proportionate, and used for a legitimate disclosed purpose. Current NPC rules prohibit unbridled contact-list processing and prohibit contacting people for collection merely because they appear in the borrower’s contacts. For debt collection, the 2026 joint advisory says only a properly designated and consenting guarantor may be contacted.

Is a character reference responsible for my loan?

Not merely because the person was listed as a reference. A guarantor must separately and expressly consent to assume responsibility if the borrower defaults.

Can the lender use my selfie or ID photo in a “wanted” poster?

Using a borrower’s photo to harass or embarrass the borrower in collecting a delinquent loan is expressly prohibited by the amended NPC loan-processing rules. Preserve the image and publication details and report them promptly.

Does my consent in the loan app make any disclosure legal?

No. Consent must be valid and tied to a disclosed purpose, and processing must remain lawful, necessary, and proportionate. Deceptive consent screens, unnecessary permissions, and use of data for harassment may still violate the rules. Other legal bases may sometimes permit limited processing, but they do not create a general right to shame a borrower publicly.

Should I block the collector?

Preserve the evidence first. You may then block abusive numbers or accounts if needed for safety and peace of mind, while keeping an official written channel open for legitimate account communications.

Does reporting the app erase my debt?

No. The legality of the collection method and the validity or amount of the debt are separate questions. Request an itemized statement, dispute errors in writing, and pay only through a verified authorized channel.

Must I wait 15 days before asking anyone for help?

No. The 15-day period concerns the ordinary exhaustion requirement for an NPC complaint. You may report immediate safety risks, crimes, fraud, or unfair collection practices to the appropriate authorities at once. The NPC can also waive exhaustion in properly established serious or urgent circumstances.

Can I demand deletion of all my information?

You may exercise applicable rights to object, erase, or block data, but those rights have exceptions. A lender may retain records needed for legal compliance, the loan transaction, or legal claims. It should not retain data indefinitely without a lawful and necessary purpose.

Official references

This article provides general legal information, not legal advice. Rights, remedies, and the proper forum depend on the messages, loan documents, parties, data involved, and urgency of the situation. Official sources and procedures were checked as of September 3, 2026.