Quick answer

An online lending app may demand payment of a valid debt, send lawful reminders, negotiate repayment, and use proper court procedures. It may not threaten violence, publicly shame you, insult you, pretend to be a court or government officer, threaten actions it cannot legally take, or contact people in your phone merely to pressure or embarrass you.

If this is happening:

Save the evidence before blocking anyone.
Secure your phone and revoke unnecessary app permissions.
Tell the lender in writing to stop unlawful collection and provide a complete account statement.
Report unfair collection to the Securities and Exchange Commission (SEC).
Report misuse of personal data to the National Privacy Commission (NPC).
Report credible threats, extortion, impersonation, fraud, or other possible crimes to the police, the NBI Cybercrime Division, or the DICT Cyber Hotline.

Reporting harassment does not automatically erase a legitimate loan. It challenges the lender’s collection methods and any unlawful charges or data use; the underlying debt must be assessed separately.

If you are in immediate danger

Treat a specific or credible threat seriously—especially if the sender mentions your address, workplace, children, physical harm, sexual violence, property damage, or a time and place.

Call 911 or go to the nearest police station.
Do not meet a collector alone.
Tell a trusted person, your household, workplace security, or barangay officials if the threat concerns your home or workplace.
Preserve the threatening message, sender’s number or account, date, time, payment demand, and any identifying details.
Do not provoke, threaten, or publicly identify the sender while authorities are assessing the incident.

A lender’s right to collect money does not authorize violence, intimidation, extortion, or other criminal conduct.

What collection practices are prohibited?

SEC Memorandum Circular No. 18, Series of 2019 prohibits financing and lending companies—and the collection agencies, counsels, agents, and representatives they use—from engaging in unfair debt-collection practices. Prohibited conduct includes:

Using or threatening violence or other criminal means against a person, reputation, or property;
Threatening an action that cannot legally be taken;
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense;
Disclosing or publishing borrowers’ names or personal information, except where disclosure is legally permitted;
Communicating false loan information, including failing to disclose that a debt is disputed;
Using false representations or deceptive methods to collect a debt or obtain information; and
Contacting a borrower at unreasonable times—generally before 6:00 a.m. or after 10:00 p.m.

The time restriction has limited exceptions under the circular, including where the account is more than 15 days past due or the borrower has expressly agreed, through written, electronic, or recorded means, that those hours are the only reasonable time for contact. Those exceptions do not authorize threats, insults, public shaming, deception, or misuse of personal data.

The circular also prohibits contacting people in the borrower’s contact list for collection unless they were named as guarantors or co-makers. More recent NPC rules clarify that a character reference is not automatically a guarantor.

The broader Financial Products and Services Consumer Protection Act protects financial consumers’ rights to fair treatment, disclosure and transparency, data privacy, protection against fraud and misuse of assets, and timely complaint handling.

The app generally cannot use your contacts to shame you

Under NPC Circular No. 2020-01, as amended by NPC Circular No. 2022-02, online lenders must not engage in unnecessary, excessive, or disproportionate processing of personal data.

In particular:

Unrestricted or excessive processing of a phone, email, or social-media contact list is prohibited.
A lender must not process contacts in a way that leads to harassment, unfair collection, or collection from people other than the borrower’s guarantors.
An app may have limited access allowing the borrower to select a character reference or guarantor, or may derive proportionate metadata where lawfully necessary. This is not permission to copy the entire contact list and send collection messages to everyone.
A character reference may be contacted for identity and information verification, but is not automatically liable for the loan.
A person becomes a guarantor only by expressly consenting to undertake that obligation in accordance with applicable law.
For debt collection, the lender may contact a genuine guarantor—but not unrelated relatives, friends, coworkers, customers, or other stored contacts merely to pressure the borrower.
A borrower’s photograph must not be altered, posted, or circulated to harass or embarrass the borrower.
Access to a camera or photo gallery must be limited to a legitimate purpose, such as identity or payment verification, and should end when that purpose has been fulfilled.

These protections apply to personal-data processing by lending and financing companies and other persons acting as such, including through online platforms. The Data Privacy Act itself protects data subjects against unauthorized or unlawful processing and disclosure. See Republic Act No. 10173.

Can they post your name or photo on social media?

Using a borrower’s name, photograph, identification card, fabricated “wanted” poster, contact information, or loan details to shame the borrower may violate SEC collection rules and data-privacy law. Depending on the exact content and circumstances, it may also raise other civil or criminal issues.

Save:

The original post, not only a cropped screenshot;
The profile name and URL;
The date and time;
Comments, shares, reactions, and group or page name;
Messages sent to relatives, employers, clients, or coworkers; and
Statements from recipients confirming what they received.

After preserving the evidence, report the content to the platform. Ask recipients not to forward it further and to send you an unedited screenshot or exported copy.

Can they threaten arrest or imprisonment?

A collector cannot lawfully arrest you, issue a warrant, or order the police to imprison you. Only lawful authorities and courts can exercise those powers.

The 1987 Constitution, Article III, Section 20 states that no person shall be imprisoned for debt. A lender may, however, pursue lawful civil remedies and obtain a judgment if it proves its claim.

The constitutional protection does not give immunity from a separate criminal case supported by facts—such as allegations involving fraud, identity theft, falsified documents, or a check covered by a penal statute. A message claiming that you will be “automatically arrested tomorrow” merely because a loan is unpaid should be treated with caution, but an authentic subpoena, summons, court order, or prosecutor’s notice should never be ignored.

Verify suspicious documents directly with the court, prosecutor’s office, police unit, or government agency named in them. Do not rely on the collector’s telephone number or payment link for verification.

Preserve evidence before uninstalling or blocking the app

Create a clear record that identifies both the conduct and the company behind it. Keep copies in a secure cloud folder, external drive, or trusted person’s device.

Preserve the following where available:

Screenshots and screen recordings showing complete conversations;
Original SMS messages, emails, call logs, voice messages, and recordings lawfully in your possession;
Sender numbers, usernames, email addresses, URLs, QR codes, and payment-account details;
The app’s name, developer, store listing, download source, version, and privacy notice;
Screenshots of every permission requested or granted;
The lender’s corporate name, SEC registration number, Certificate of Authority number, office address, and customer-service details;
Loan agreement, disclosure statement, promissory note, amortization schedule, and terms accepted in the app;
Proof of the amount actually received;
Receipts, bank or e-wallet records, and payment confirmations;
The lender’s computation of principal, interest, fees, penalties, and balance;
Copies of posts or messages sent to third parties;
Names and written accounts of witnesses or message recipients; and
Your earlier complaints and the lender’s responses.

Do not edit the original files. Make working copies if you need to highlight or redact information. Write a short chronological log identifying each incident, the sender, the recipient, and what happened.

Secure your phone and accounts

After preserving evidence:

Review the app’s permissions and revoke access to contacts, call logs, SMS, storage, camera, microphone, photos, and location unless access remains genuinely necessary.
Remove device-administrator, accessibility, screen-overlay, or notification-access privileges you do not recognize.
Change passwords for your email, e-wallet, banking, and social-media accounts from a trusted device.
Enable multifactor authentication.
Review active login sessions and sign out unfamiliar devices.
Contact your bank or e-wallet immediately if you disclosed a one-time password, PIN, recovery code, or card credentials.
Uninstall the lending app after preserving its identifying details and evidence, if keeping it is no longer necessary or safe.
Ask contacts who received messages not to pay, click links, or disclose more information.

Revoking access does not delete data the app already obtained. You may separately exercise applicable data-subject rights and file a privacy complaint.

Send a written notice to the lender

Use the lender’s official customer-service or complaint channel. Keep the message factual and do not admit an amount you have not verified.

State:

Your name and loan or account reference;
Which messages, calls, posts, or third-party contacts you dispute;
That you demand an immediate stop to threats, shaming, deceptive representations, and unauthorized third-party contact;
That the account or amount is disputed, if applicable;
That future communication should be in writing through a specified channel;
That the company must preserve relevant call recordings, messages, account logs, collector assignments, and data-access records;
That you request the collector’s name, agency, and authority to act;
That you request a complete statement of account and copies of the loan documents; and
The resolution you want, such as correction of the balance, cessation of third-party contact, removal of a post, or a lawful repayment proposal.

If you can pay only through a restructuring arrangement, propose an amount you can realistically maintain. Obtain written confirmation of the schedule, allocation of payments, fees, and effect of full payment before sending money.

Verify whether the lender is authorized

A corporation’s registration alone does not necessarily authorize it to operate a lending business. A lending company must have SEC authority to operate.

Check the corporate name and authority stated in the app against the SEC’s official information and published lists. The SEC’s lending and financing company page explains the authorization requirement.

Red flags include:

No corporate name or physical address;
No SEC registration or Certificate of Authority number;
Payment demanded through changing personal accounts;
An app obtained outside an official store;
A collector refusing to identify the creditor;
A company name that differs from the payee;
Fabricated police, prosecutor, court, or barangay documents; or
Demands for an additional “release,” “clearance,” or “verification” fee before an alleged refund or loan disbursement.

Do not assume that an unauthorized lender’s collection conduct is lawful. At the same time, do not conclude without legal advice that lack of regulatory authority automatically cancels every possible obligation arising from money actually received.

Where to report the conduct

Securities and Exchange Commission

For an ordinary online lending or financing company, report unfair debt collection to the SEC’s Financing and Lending Companies Department through the SEC iMessage portal. The March 2026 joint government advisory also identifies the SEC hotline as 1-4732 (1-4SEC).

The SEC’s complaint guidance instructs complainants to complete the required form, attach supporting evidence, provide a valid government-issued ID, and submit one complaint form for each respondent company.

The SEC can investigate regulatory violations and impose appropriate administrative sanctions. Its complaint process does not itself rewrite the contract, cancel the loan, settle the obligation, or judicially declare an interest provision void.

National Privacy Commission

File with the NPC when the app copied or misused contacts, disclosed loan information, circulated your photo or ID, accessed excessive phone data, refused a proper data-rights request, or otherwise violated privacy rights.

The NPC’s current filing instructions require a filled-out and notarized complaint-assisted form or a verified complaint, together with evidence and any witnesses’ affidavits. Filing may be made personally, by registered mail, by courier, or by authorized electronic mail. Follow the current form, signature, format, copy, and fee instructions on the NPC website rather than sending an informal narrative alone.

NPC complaint contact details are available on its official contact page, including complaints@privacy.gov.ph. If harmful processing is continuing and urgent, review the NPC’s procedure for an application for a temporary ban; this is a formal remedy with additional requirements and should not be assumed to issue automatically.

Cybercrime and law-enforcement channels

For threats, fraud, scams, impersonation, extortion, or other possible crimes, the DICT-NPC-SEC Joint Public Advisory dated March 18, 2026 lists:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph; onlinecims.ocs@gmail.com; (02) 8723-0401 local 7491

A regulatory complaint and a criminal report serve different purposes. When the facts involve both unfair collection and possible crime, you may need to report to more than one agency.

Bangko Sentral ng Pilipinas

If the provider is a bank, electronic-money issuer, payment-system operator, or another BSP-supervised financial institution, first use the institution’s own consumer-assistance channel. If the issue remains unresolved, escalate it through the BSP Consumer Assistance Mechanism, including BSP Online Buddy or consumeraffairs@bsp.gov.ph.

Do not send the same complaint indiscriminately to every regulator. Identify the actual provider and the conduct involved, then use the appropriate channel.

Continue dealing with the debt carefully

Harassment does not establish that the lender’s balance is correct, but neither does it prove that nothing is owed.

Ask for:

The signed or electronically accepted agreement;
The disclosure statement supplied before the transaction;
The principal amount approved and actually disbursed;
Each interest rate, fee, charge, and penalty;
The dates and allocation of all payments;
The current balance and payoff amount; and
Written authority if a collection agency or new creditor is demanding payment.

Pay only through a verified channel belonging to the creditor or an authorized payment provider. Require an official receipt. If an account has supposedly been transferred, independently confirm the transfer with the original lender.

Do not borrow from another high-cost app simply to stop harassment. A short extension obtained under pressure can create additional charges and a larger cycle of debt.

Common mistakes to avoid

Deleting messages or uninstalling the app before preserving evidence;
Paying a collector’s personal account without verifying authority;
Sharing an OTP, PIN, password, selfie with an ID, or screen-sharing access;
Clicking a shortened link in a threatening message;
Publicly posting unredacted IDs, contracts, phone numbers, or account details;
Retaliating with threats or defamatory accusations;
Assuming a character reference is legally responsible for the loan;
Ignoring a genuine summons, subpoena, or official notice;
Admitting an unverified balance merely to stop repeated calls;
Signing a settlement, waiver, or acknowledgment without understanding its effect;
Filing only a vague complaint without dates, screenshots, company details, and loan documents; or
Believing that an SEC or NPC complaint automatically suspends payment obligations or court deadlines.

When legal help is urgent

Consult a Philippine lawyer promptly if:

You receive an authentic summons, subpoena, prosecutor’s notice, demand involving collateral, or court order;
A case has already been filed;
The lender threatens or attempts to seize property without lawful process;
Someone used your identity to obtain the loan;
You issued a check or submitted a document that is now the subject of a criminal allegation;
Intimate images, altered photographs, or children’s information were used;
Your employer, clients, or business suffered measurable harm;
Money was withdrawn from an account without authorization;
The lender demands that you sign a waiver or acknowledgment;
You are unsure whether a settlement fully releases the account; or
The threats create an immediate risk to your safety.

If you cannot afford private counsel, ask the Public Attorney’s Office whether you qualify for assistance, or approach an accredited legal-aid organization or law-school legal-aid clinic. Eligibility and available services depend on the office and the nature of the matter.

Frequently asked questions

Do I still have to pay if the app harassed me?

Possibly. Unlawful collection methods do not automatically extinguish a valid debt. Verify the contract, amount received, payments, interest, fees, and penalties. Regulatory, privacy, civil, and criminal remedies concerning the harassment are separate from the accounting of the loan.

May the lender call my family or employer?

Not merely to embarrass or pressure you. Debt-collection contact with people in your contact list is prohibited unless they are genuine guarantors or co-makers. A character reference is not automatically a guarantor and may be contacted only within the lawful purpose for which the reference was provided.

Can a character reference be required to pay?

Not simply because the person was listed as a reference. Under NPC rules, a guarantor must expressly consent to undertake the obligation. Whether a person is legally liable ultimately depends on valid documents and applicable contract and guaranty law.

Is repeated calling always illegal?

Not necessarily. Reasonable, truthful collection contact may be allowed. Frequency, timing, language, purpose, recipients, and surrounding conduct matter. Threats, insults, deception, public shaming, and prohibited third-party contact remain improper regardless of whether a debt is due.

Should I block the collector?

Preserve the evidence first. You may then block abusive numbers or accounts, while keeping one written channel open if safe and useful for legitimate account notices. Blocking messages does not stop legal proceedings, so monitor your mail and official notices.

Can the app have me arrested tomorrow for nonpayment?

A private collector cannot order your arrest, and the Constitution prohibits imprisonment for debt. Separate alleged criminal conduct is different and requires lawful process. Verify any claimed warrant, subpoena, or case directly with the named government office.

Can I demand deletion of all my data immediately?

You may exercise applicable data-subject rights, but deletion is not absolute. Some information may lawfully be retained while necessary for the transaction, regulatory compliance, or the establishment, exercise, or defense of legal claims. The lender must not retain or process data without a lawful purpose indefinitely.

What if the company is unlicensed or uses a different name?

Document every name, account, app listing, website, and payment recipient. Report the matter to the SEC and, where fraud or threats are involved, to cybercrime authorities. Do not send additional money until the creditor and payment channel have been independently verified.

What result should I request in my complaint?

Be specific: cessation of threats and third-party contact, removal of unlawful posts, correction of false information, a complete account statement, identification of the collector, restriction or deletion of unlawfully processed data where legally available, and investigation of the responsible company and agents.

Official sources

This article provides general legal information, not advice for a particular case. Rights, liability, remedies, and deadlines may depend on the loan documents, communications, identity of the provider, and surrounding facts. Official sources and public filing channels were checked as of September 3, 2026.