Quick answer

Report harassment by an online lending company to the regulator that supervises the actual lender:

Securities and Exchange Commission (SEC): for lending or financing companies and their online lending platforms, including abusive collection, threats, public shaming, deceptive loan disclosures, or operation without proper authority.
National Privacy Commission (NPC): when the lender accesses or uses your contacts, photos, messages, social-media data, or other personal information without lawful authority, or contacts people who are not your guarantors.
Bangko Sentral ng Pilipinas (BSP): when the lender is a bank, digital bank, e-money issuer, or another BSP-supervised financial institution. Complain to the institution first, then escalate unresolved concerns to the BSP.
Police or cybercrime authorities: for credible threats of violence, extortion, stalking, account intrusion, identity theft, or other possible crimes. Call 911 if anyone is in immediate danger.

One incident may be reported to more than one agency. For example, threats and public shaming involving your phone contacts may justify complaints to both the SEC and NPC, plus a police report if the messages indicate a real safety risk.

Harassment does not automatically cancel a valid loan. Keep legitimate payments separate from the complaint, ask for a written statement of account, and use only the lender’s verified payment channel.

What collection practices may be unlawful?

A lender may demand payment, send reasonable reminders, negotiate a payment plan, or pursue a lawful court case. It cannot use abusive collection methods simply because a borrower is late.

Under the Financial Products and Services Consumer Protection Act, financial service providers are prohibited from using abusive collection or debt-recovery practices. They may also be responsible for the conduct of employees, collection agents, and certain third-party service providers. See Republic Act No. 11765.

SEC rules and official privacy guidance identify practices that may warrant a complaint, including:

threatening violence, arrest, imprisonment, or another action that cannot legally be taken;
using insults, obscene language, intimidation, or repeated communications intended to abuse or humiliate;
falsely representing oneself as a police officer, lawyer, court employee, or government official;
publishing or sending “shaming” posts, altered photographs, accusations, or loan information to relatives, friends, co-workers, employers, or the public;
disclosing the debt to people who are not legally involved;
contacting people in the borrower’s phone list who were not named and did not consent as guarantors;
using a character reference as though that person were a guarantor;
harvesting phone or social-media contacts for collection;
using a borrower’s photograph to embarrass or pressure the borrower;
requesting or retaining app permissions or personal data that are unnecessary or excessive; and
continuing to use personal information for purposes unrelated or disproportionate to the loan transaction.

The government’s current joint guidance states that lenders may contact a borrower’s consenting guarantor for collection, but not other people found in the borrower’s contact list. A character reference supplied only for identity verification is not automatically a guarantor. See the DICT-NPC-SEC Advisory on Online Lending Platforms and NPC guidance on online lenders and contact lists.

Whether a particular message is merely firm collection or actionable harassment depends on its wording, frequency, recipients, surrounding circumstances, and the documents authorizing any disclosure.

Report lending-company harassment to the SEC

The SEC generally supervises lending companies and financing companies, including the online lending platforms they operate. A company’s corporate registration alone is not enough: a lending company must also have SEC authority to operate.

Use the SEC’s official channels:

The SEC’s complaint instructions require:

a completely and accurately filled-out complaint form;
one complaint form for each respondent company;
a copy of a valid government-issued ID; and
supporting evidence relevant to the loan and collection conduct.

Identify both the app or trade name and the lender’s registered corporate name. These may be different. Include the names or numbers used by collectors and any collection agency disclosed in the messages.

Useful attachments include the loan agreement, disclosure statement, promissory note, statement of account, amortization schedule, receipts, screenshots, call logs, recordings lawfully obtained, and copies of messages sent to other people.

The SEC may investigate regulatory violations and impose appropriate administrative action. It does not, through its complaint process, simply rewrite payment terms, declare an interest provision void, cancel the contract, or erase the debt. Those questions may require a court proceeding or individualized legal advice.

File with the NPC when personal data was misused

A privacy complaint may be appropriate when the lender or collector:

accessed or copied your contacts without a lawful and proportionate purpose;
messaged people who were neither borrowers nor consenting guarantors;
disclosed your debt, ID, photograph, address, or other personal information;
posted your information publicly;
used personal data to threaten, shame, or impersonate you;
refused a proper request to correct inaccurate personal information; or
retained or processed data beyond what was necessary or legally permitted.

The Data Privacy Act regulates unauthorized processing, processing for unauthorized purposes, malicious disclosure, and unauthorized disclosure. The exact violation depends on what data was processed, why it was processed, who received it, and what authority or consent existed. See Republic Act No. 10173.

Before filing the formal NPC complaint

As a general rule, first notify the lender or other responsible entity in writing about the privacy violation and ask it to take appropriate action. Preserve proof that the notice was received. You may ordinarily proceed if it does not take timely and appropriate action or does not respond within 15 calendar days after receiving your written notice.

The NPC rules contain circumstances in which this exhaustion requirement may be waived. Do not assume an exception applies; explain any urgent danger, continuing disclosure, or other basis in the complaint and provide evidence.

The NPC requires a complaint in the prescribed form, supporting documents and affidavits, and notarization. It currently allows submission in person, by courier, or by scanned email. Follow the current form and instructions on the NPC filing page and review the NPC complaint mechanics before submitting.

If the disclosure is continuing, clearly say so and identify every known recipient, post, account, group chat, or platform. Ask the NPC about available urgent relief where necessary; do not rely on a complaint alone to protect someone facing an immediate physical threat.

Escalate complaints involving BSP-supervised lenders

Some loan apps are operated by, partnered with, or branded for banks and other BSP-supervised financial institutions. Confirm the legal entity shown in the loan contract, disclosure statement, privacy notice, or payment instructions.

For a BSP-supervised institution:

File a written complaint through the institution’s consumer assistance mechanism.
Keep its acknowledgment, ticket number, and final response.
If the matter remains unresolved or the response is inadequate, elevate it through the BSP Consumer Assistance Mechanism, including the BSP Online Buddy or the official Complaints, Inquiries and Requests form.

The BSP is not the general regulator of every loan app. Ordinary lending and financing companies are generally within SEC jurisdiction, while banks and other BSP-supervised entities fall under the BSP. If the corporate identity is unclear, provide the regulator with the contract, app screenshots, and payment-account details rather than guessing.

Go to law enforcement when threats or other crimes may be involved

Contact the nearest police station or appropriate cybercrime office promptly if the conduct involves:

a specific or credible threat to injure or kill someone;
extortion or a demand backed by an unlawful threat;
stalking or attempts to locate you physically;
hacking, account takeover, identity theft, or use of your identity to contact others;
fabricated warrants, summonses, police notices, or court documents;
publication of defamatory material through a computer system; or
sexual threats, intimate images, or threats involving a child.

For cybercrime complaints, the Department of Justice Office of Cybercrime publishes its reporting information at the DOJ Cybercrime Report page. Its listed contact includes cybercrime@doj.gov.ph. The DOJ Office of Cybercrime acts on cybercrime complaints and referrals.

The Cybercrime Prevention Act covers specified computer-related offenses and certain crimes committed through information and communications technology. The possible charge depends on the evidence and statutory elements; an offensive message is not automatically cyberlibel, extortion, or a threat. See Republic Act No. 10175.

If danger is immediate, call 911, move to a safe place, and alert trusted people or building security. Regulatory complaints can follow after urgent safety measures.

What evidence should you preserve?

Preserve evidence before blocking accounts, deleting apps, changing phones, or closing social-media profiles.

Keep:

full-page screenshots showing the sender, date, time, account name, phone number, and complete conversation;
screen recordings showing the app profile, messages, posts, comments, URLs, and navigation to the content;
original emails with headers and original message files where available;
call logs, voicemail, and recordings obtained in compliance with applicable law;
names and written statements of relatives, co-workers, employers, or other people contacted;
screenshots from each recipient’s own device, if they are willing to provide them;
the app name, developer or publisher, download-page link, version, and requested permissions;
the loan application, contract, disclosure statement, privacy notice, repayment schedule, and statement of account;
proof of disbursement and every payment;
collection notices and the names of any collection agency or law office;
your written complaint to the lender and proof of receipt;
ticket numbers and responses from the lender, SEC, NPC, BSP, app store, social-media platform, or police; and
a chronological incident log describing what happened, when, through which account, and who witnessed it.

Keep unedited originals. Make backup copies in a secure location. Do not crop out information that establishes authenticity, although you may prepare redacted copies for sharing publicly. Avoid reposting the harassment yourself because doing so may expose more personal data.

Practical steps to take now

Protect immediate safety. Treat specific threats seriously. Call 911 or contact the police when necessary.
Identify the legal lender. Check the contract, disclosure statement, privacy notice, receipts, and payment destination—not just the app icon.
Preserve evidence. Capture the complete messages, profiles, posts, call history, loan documents, and third-party contacts.
Secure your accounts. Change compromised passwords, enable multi-factor authentication, review active sessions, and revoke unnecessary app permissions. Do not destroy evidence while doing so.
Send a focused written notice. Tell the lender what conduct occurred, demand that harassment and unlawful disclosures stop, request preservation of relevant records, and ask for the complaint reference number.
Request account information. Ask for a written statement of account and an itemized explanation of principal, interest, fees, penalties, and payments.
File with the correct regulator. Use the SEC, NPC, or BSP route described above. File with more than one when the issues genuinely overlap.
Report apparent crimes separately. A regulator’s administrative process is not a substitute for emergency or criminal reporting.
Continue addressing the debt safely. Do not send money to a collector’s personal account or an unverified payment link. If you dispute the amount, state the dispute in writing and preserve enough funds where possible while seeking advice.

Common mistakes to avoid

Reporting only the app name. Regulators need the corporate lender’s identity whenever it can be determined.
Deleting the app or messages too soon. Preserve evidence and loan documents first.
Sending only cropped screenshots. Include dates, sender details, the surrounding conversation, and the URL or profile where relevant.
Paying a personal account out of fear. Verify payment instructions through the lender’s official channel.
Assuming a reference is liable for the debt. A person does not become a guarantor merely because the borrower listed that person as a character reference.
Ignoring real court papers. A collector’s threat is not a summons, but an authentic summons or subpoena must not be ignored. Verify it directly with the named court.
Posting IDs and contracts publicly. Send sensitive evidence through official complaint channels, with appropriate redactions when possible.
Expecting a complaint to erase the loan. Collection misconduct and the underlying debt are separate issues.
Filing an incomplete NPC complaint. Follow the prescribed form, notarization, evidence, and prior-written-notice requirements unless a recognized exception applies.
Negotiating only by phone. Confirm proposals, waivers, settlements, and payment arrangements in writing.

When legal help is urgent

Speak promptly with a Philippine lawyer, the Public Attorney’s Office if you qualify, or another legitimate legal-aid provider when:

you or your family faces a specific threat;
intimate images, identity documents, or sensitive personal information have been disclosed;
the lender contacts your employer or causes a risk of job loss;
someone has impersonated you or accessed financial accounts;
you receive a real summons, subpoena, warrant, or prosecutor’s notice;
the amount claimed is substantial or the contract, interest, or fees are disputed;
you are considering signing a settlement, waiver, acknowledgment, or new promissory note;
the harassment continues despite written notice and regulatory complaints; or
you need damages, an injunction, a criminal complaint, or another court remedy.

A lawyer should review the actual contract, messages, payment records, and identities of the parties before advising on liability or litigation.

Frequently asked questions

Can a lender contact my family or employer?

A lender may communicate with the borrower and, where legally proper, a consenting guarantor. Accessing a contact list and disclosing the debt to unrelated relatives, friends, co-workers, or an employer for pressure or humiliation may violate privacy and collection rules. A limited communication genuinely necessary to locate a borrower can raise different factual issues, but it does not authorize public shaming or disclosure of unnecessary loan details.

Is a character reference responsible for my loan?

Not merely because the person was listed as a reference. Current joint government guidance distinguishes a character reference used for identification or verification from a guarantor who expressly consented to assume responsibility.

Can collectors threaten to have me arrested for not paying?

Ordinary nonpayment of a loan is generally a civil matter, and the Constitution prohibits imprisonment for debt. Fraud or another independently established crime is different. A collector should not present arrest as the automatic consequence of missing a payment or invent a warrant, criminal case, or police authority.

Should I block the collector?

Preserve the complete evidence first. You may then use device and platform controls to protect yourself, but keep at least one safe written channel for legitimate account communications if practical. Blocking a number does not resolve the debt or stop a court case.

Can I complain even if I really owe money?

Yes. A valid debt does not authorize threats, humiliation, or unlawful use of personal data. Be accurate about the debt and focus the complaint on the conduct and evidence.

Will filing with the SEC or NPC cancel the loan?

No. These agencies may address regulatory or privacy violations, but a complaint does not automatically invalidate the contract or extinguish the balance.

Is there a filing deadline?

Do not delay. Different remedies have different prescriptive periods and procedural requirements. Claims under Republic Act No. 11765 generally prescribe five years from consummation of the financial transaction, or five years from discovery of deceit or nondisclosure of material facts, subject to an outer limit of ten years from the violation. Other administrative, civil, privacy, and criminal remedies may follow different rules. Prompt filing also makes digital evidence easier to preserve.

Can I file against an unidentified or illegal loan app?

Report all available identifiers: app name, developer, store link, website, phone numbers, bank or e-wallet accounts, messages, loan documents, and screenshots. Tell the SEC that the operator’s legal identity or authority could not be verified. Report related privacy violations to the NPC and apparent crimes to law enforcement.

What if several apps are harassing me?

Prepare a separate evidence folder and timeline for each lender. The SEC instructs complainants to submit one complaint form per respondent company. Do not combine unrelated companies in a way that makes the evidence difficult to attribute.

Official references

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Procedures and conclusions may depend on the lender’s identity, the contract, the communications, and other evidence. Official sources and filing information were checked as of September 3, 2026.