Receiving harassing SMS messages, emails, or voicemails from online lending apps can feel invasive and exhausting. These messages often threaten public shaming, legal action, or worse, and sometimes extend to your family, friends, or employer through data the apps should never have used. In the Philippines, these tactics violate clear legal protections on personal data and fair debt collection. Whether the app is registered with regulators or operating in the shadows, you can report the harassment, have it investigated, and push for it to stop. This guide explains the laws that apply, the right agencies to approach depending on what is happening, and the exact practical steps to prepare and file a strong complaint.

What Counts as Harassment from Online Lending Apps

Online lending apps (often called OLAs) cross the line when they move beyond reasonable reminders about a debt. Common illegal tactics include:

Repeated SMS or app messages using abusive language, false legal threats, or demands sent at odd hours.
Emails containing altered photos, lists of your contacts, or public-shaming language.
Voicemails with threats, profanity, or warnings that your debt will be exposed to others.
Contacting third parties (family, friends, coworkers, or employers) using phone contacts or social media data the app harvested during your loan application.
Continuing aggressive contact even after you have paid or settled the loan.

These practices are not legitimate collection. They often rely on unauthorized access to your personal data and cause real harm—stress, damaged relationships, lost opportunities at work, or fear for your safety.

Your Legal Rights and Protections

Several laws directly address this situation and give you enforceable rights.

Data Privacy Violations (Republic Act No. 10173 – Data Privacy Act of 2012)

The Data Privacy Act protects how companies collect, use, and share your personal information. Online lending apps are prohibited from accessing your phone contacts, email lists, or social media connections without your free, specific, and informed consent for that exact purpose. Blanket consent buried in long terms and conditions does not count. Using that data to harass you or shame you to others is unauthorized processing and a clear violation.

The National Privacy Commission (NPC) has issued specific rules on this. NPC Circular No. 20-01 (2020) explicitly bars online lenders from harvesting phone and social media contact lists for debt collection. Violations can lead to fines up to ₱5 million, imprisonment, orders to delete your data, and directives to stop operations or remove the app from stores.

Abusive Debt Collection Practices (Republic Act No. 11765 – Financial Products and Services Consumer Protection Act of 2022, and SEC Rules)

RA 11765 prohibits financial service providers—including lending companies—from using abusive, oppressive, or unfair collection methods. It covers threats, harassment, shaming, and contacting people who are not guarantors or co-makers.

The Securities and Exchange Commission enforces these rules for non-bank lending and financing companies through Memorandum Circular No. 18, s. 2019 (and related issuances). Prohibited acts include:

Using profane or threatening language.
Disclosing your debt to third parties.
Making excessive contacts or calling outside reasonable hours (typically limited to once a day during business hours in many rules).
Public shaming or false statements about your character or legal situation.

Regulators can issue immediate cease-and-desist orders, impose daily fines, suspend or revoke the company’s authority to operate, and coordinate with other agencies.

Criminal Harassment and Threats (Republic Act No. 10175 – Cybercrime Prevention Act of 2012, and Revised Penal Code)

When harassment happens through SMS, email, voicemail, or in-app messages, it often qualifies as a cybercrime. Grave threats (Revised Penal Code Article 282), light threats, unjust vexation, or cyber libel can apply depending on the content. Penalties are higher when committed using information and communications technology.

The Philippine National Police Anti-Cybercrime Group (PNP-ACG) and the National Bureau of Investigation Cybercrime Division investigate these cases. They can build criminal complaints that lead to arrest warrants, prosecution, and court penalties including imprisonment and damages.

You may also have a civil claim for moral and exemplary damages under the Civil Code if the harassment caused you significant distress.

Where to Report: Choose the Right Channel

Different agencies handle different aspects. Many people file with more than one when issues overlap, and the agencies often coordinate.

National Privacy Commission (NPC) – Best starting point for contact harvesting, third-party shaming, or any misuse of your personal data.
Securities and Exchange Commission (SEC) – Ideal for unfair collection practices by lending or financing companies (registered or not).
PNP Anti-Cybercrime Group or NBI Cybercrime Division – Use when there are clear threats, extortion, grave coercion, or other criminal acts via electronic means.
Bangko Sentral ng Pilipinas (BSP) – If the app or lender is a bank or e-money issuer under BSP supervision.

You can also report the app itself to Google Play or the Apple App Store so it can be reviewed or removed for violating their policies on harassment and privacy.

Step-by-Step Practical Guide

1. Preserve Strong Evidence Right Away

Good evidence makes the difference between a complaint that moves forward and one that stalls.

Take clear, full screenshots of every SMS thread, email (include sender, date, time, and as much of the body as possible), and any in-app messages. Do not crop or edit.
For voicemails: Save the original audio files if your phone allows, or create accurate written transcripts with exact date, time, caller ID or number, and what was said.
Screenshot the app’s permission settings (Settings > Apps > [App Name] > Permissions) showing access to contacts, SMS, storage, or phone.
Save or screenshot the loan agreement, privacy policy, and any terms you agreed to at the time of borrowing.
Ask affected family members or friends for their own screenshots or short written statements about what they received and when.
Keep records of all payments you made and any settlement communications.
Back everything up to a separate device or cloud storage. Do not delete messages even if they upset you.

Act quickly—some apps change numbers or delete old messages.

2. Send a Formal Demand to Cease and Desist

Before or while filing official complaints, send a written demand (email is fine; keep proof of sending) to the app’s customer support and any listed Data Protection Officer.

State clearly:

Your loan details and that you have evidence of all communications.
That the continued contact, use of your data, and any third-party outreach violate RA 10173, RA 11765, NPC Circular No. 20-01, and SEC rules.
Your demand that they immediately stop all contact with you and your contacts, delete your personal data, and confirm in writing within a set number of days (e.g., 7 days).

Block the numbers and emails after sending. This creates a paper trail showing you tried to resolve it directly and that any continuation is in bad faith.

3. File with the National Privacy Commission (NPC)

This is often the most direct route for contact-related and shaming complaints.

Download the latest Complaint-Affidavit form from the NPC website (privacy.gov.ph under Filing a Complaint).
Fill it out in detail: your personal information, the exact name of the app and company (check the privacy policy or app store listing), a clear chronological description of what happened, how your data was misused, and the impact on you and others.
Attach your evidence as clearly labeled annexes.
Have the completed form notarized (bring a valid government ID; notary fees are usually ₱100–200).
Submit by scanning and emailing to complaints@privacy.gov.ph, uploading through any online portal available on the NPC site, or delivering in person or by courier to the NPC office at the PICC Complex in Pasay City.

The NPC typically acknowledges receipt within a few business days. They may request more information, conduct an investigation (which can include requiring the company to respond), and issue orders such as data deletion, fines, or referral for criminal action. Resolution often takes several weeks to a few months depending on complexity.

4. Report to the Securities and Exchange Commission (SEC)

Use this channel to highlight unfair collection practices.

Submit through the convenient SEC i-Message portal at imessage.sec.gov.ph (recommended for most people).
Or email the relevant division (commonly flcd_complaints@sec.gov.ph or cgfd@sec.gov.ph) with a clear narrative, your evidence, loan details, and screenshots.
Include the same strong documentation you prepared for the NPC.

The SEC can investigate whether the company is properly registered, issue cease-and-desist orders, impose fines, and coordinate with the NPC or law enforcement. Many abusive apps have faced regulatory action after accumulated complaints.

5. File a Criminal Complaint with PNP-ACG or NBI (When Threats Are Involved)

If messages contain serious threats, extortion, or other criminal elements:

Prepare a sworn affidavit detailing the facts and attaching your evidence.
File at your nearest police station (they can refer the case to the Anti-Cybercrime Group) or directly with the PNP-ACG at Camp Crame in Quezon City.
You can also use online e-complaint options or call the Cybercrime Hotline at (02) 8723-0401 local 7491 or the emergency hotline 117 for immediate threats.
For complex digital forensics cases, the NBI Cybercrime Division is another option (ccd@nbi.gov.ph or main NBI contact numbers).

Police will enter the incident in the blotter, investigate (possibly examining devices or tracing numbers), and refer the case to a prosecutor if there is probable cause. Criminal cases move more slowly than administrative complaints but carry stronger penalties.

Additional Options

If the harassment is causing severe emotional distress, consult a doctor or mental health professional and keep records—these can support a claim for damages. You can also explore a separate civil case for moral and exemplary damages in small claims court (for qualifying amounts) or regular court. These can run alongside administrative or criminal complaints.

If you are abroad or a foreigner, the same reporting channels work via email and online portals. For any notarization, visit the nearest Philippine Embassy or Consulate. Philippine authorities generally have jurisdiction when the acts target a person in the Philippines or use Philippine platforms and data.

Common Challenges and How to Handle Them

Many borrowers worry that reporting will not help if the app is unregistered or seems to have disappeared. Unregistered operations are still subject to NPC privacy rules and criminal laws; accumulated complaints have led to app removals from stores and regulatory takedowns. Provide every detail you have (app name, version, screenshots of the interface, developer information).

Another frequent issue is continued contact after payment. Always demand written confirmation of full settlement and data deletion in your demand letter and complaints.

Edited or incomplete screenshots weaken cases. Capture full, original views with visible timestamps and sender information.

Some people hesitate because they still owe money. Owing a debt does not give anyone the right to harass you or violate privacy laws. Legitimate collection must follow the rules.

Foreigners or overseas Filipino workers sometimes assume the process is too complicated from abroad. Electronic filing makes it accessible; many have successfully used email and portals.

What to Expect: Timelines, Outcomes, and Costs

Initial acknowledgment from NPC or SEC is often within a few business days. Full investigations and resolutions typically take weeks to several months. Cases with clear, imminent threats receive faster police attention.

Outcomes can include:

Orders for the company to stop contacting you and delete your data.
Fines and penalties against the operator.
Removal of the app from app stores.
Criminal charges and possible court convictions in serious cases.
Opportunities to claim civil damages.

Initial reporting to these government agencies is generally free or involves only small notary costs. Later civil court filings have fees, but small claims procedures are designed to be simpler and more affordable.

Frequently Asked Questions

Can I report even if I still owe money?
Yes. Your outstanding balance does not excuse illegal harassment or privacy violations. Focus your complaint on the unlawful tactics, not the debt itself.

What evidence is strongest for SMS, email, and voicemail complaints?
Full screenshot chains with visible dates, times, and sender details for SMS and in-app messages. Complete emails or .eml files showing headers and timestamps. Original voicemail audio files or precise transcripts noting exact date, time, and caller information. Third-party statements from people who also received messages add significant weight.

How long does it take for something to happen after I report?
Acknowledgment is usually quick (days). Investigations vary—administrative cases with the NPC or SEC often see action within weeks to a couple of months. Criminal referrals take longer but can result in stronger enforcement. Regulators have acted on thousands of similar complaints in recent years.

Is recording voicemails or calls legal for evidence?
Saving voicemails you received and creating accurate transcripts is standard and accepted. One-party recording of conversations you are part of is generally usable for evidence in complaints and court proceedings in the Philippines, but focus first on preserving the originals without alteration.

What if the app is not registered with the SEC or looks like a scam?
Report it anyway. Unregistered lending is itself problematic, and privacy and criminal violations still apply. Give authorities every identifying detail you have. Many such apps have been removed from stores and faced enforcement after complaints.

Can foreigners or people abroad file these reports?
Yes. Use the same email and online portals. For notarization needs, go through a Philippine Embassy or Consulate. If the harassment affects you or your family and contacts in the Philippines, local authorities have jurisdiction.

Will reporting stop the harassment immediately?
Not always overnight, but many people see reduction or cessation once regulators intervene or after a strong demand letter with evidence. Continue documenting everything. For serious or escalating threats, contact police right away through 117.

Should I file with more than one agency?
Often yes, especially when privacy issues and threats overlap. The NPC, SEC, and PNP-ACG can coordinate, and multiple filings create a stronger overall record.

What happens if the company ignores the complaint?
Regulators can still impose fines, issue cease-and-desist or takedown orders, and refer matters for criminal prosecution even without full cooperation from the respondent. App stores frequently act on patterns of complaints. You can also pursue civil damages separately.

Key Takeaways

Harassment through SMS, email, or voicemail that involves contact harvesting, shaming, threats, or abusive collection violates the Data Privacy Act (RA 10173), RA 11765, SEC collection rules, and cybercrime laws.
Start by preserving complete, unaltered evidence and sending a formal written demand to stop all contact and delete your data.
File privacy and data misuse complaints primarily with the National Privacy Commission (complaints@privacy.gov.ph or their portal).
Report unfair collection practices to the SEC through the i-Message portal or email.
Use PNP-ACG or NBI channels for serious threats or criminal elements via electronic means.
You can file with multiple agencies when appropriate; they often coordinate responses.
The process is accessible even from abroad through online and email options, and thousands of similar cases have led to regulatory action and app removals.
Taking these steps protects your rights and helps authorities address widespread abusive practices in online lending.

Document everything carefully, choose the right agency for the core issue, and follow through with any requests for additional information. You have practical, effective avenues to push back against this kind of harassment.