Quick answer

If an online lending app is threatening you, shaming you, posting or sending your personal information, messaging people in your phone contacts, or misusing permissions to collect data, save the evidence first, send a written complaint to the lender, and report the conduct to the proper government agency.

In the Philippines, the main routes are:

National Privacy Commission (NPC) for unauthorized, excessive, or abusive processing or disclosure of personal data.
Securities and Exchange Commission (SEC) for unfair debt-collection practices by lending or financing companies and issues involving unlicensed or unrecorded online lending platforms.
PNP Anti-Cybercrime Group, NBI Cybercrime Division, or other law-enforcement authorities when the conduct may involve threats, extortion, identity theft, account compromise, fraudulent online posts, or another crime.

A borrower can legitimately owe money and still be protected from unlawful collection practices. A valid debt does not give a lender or collection agent permission to threaten, publicly shame, deceive, or indiscriminately contact people stored in the borrower's phone. At the same time, filing a harassment or privacy complaint does not by itself cancel a valid loan obligation. The debt issue and the legality of the collection methods should be treated separately. (SEC Appointment System)

What online lending practices may be unlawful?

Two sets of rules commonly overlap in online lending complaints: the SEC's rules against unfair debt collection and Philippine data-privacy law.

Threats, insults, public shaming, and deceptive collection

SEC Memorandum Circular No. 18, Series of 2019 regulates unfair debt-collection practices by financing and lending companies. Prohibited conduct includes collection methods involving threats of violence or other criminal means, threats to take action that cannot legally be taken, abusive or insulting language, deceptive representations, and improper disclosure or publication of a borrower's personal information. Lending and financing companies may also remain responsible for collection activities performed through outsourced collectors or third-party service providers. (SEC Appointment System)

A message demanding legitimate payment is therefore not automatically harassment. The problem is usually how the collection is carried out—for example, threatening physical harm, pretending that arrest is inevitable when there is no legal basis for saying so, humiliating the borrower through third parties, or using deceptive tactics to obtain payment.

Accessing or using your phone contacts

An online lending app does not have an unlimited right to harvest everyone in your address book merely because the borrower granted an app permission.

NPC rules restrict excessive processing of contact-list information. An online lending platform may use contact-list functionality only within legitimate, specified, necessary, and proportionate purposes, such as allowing a borrower to select a character reference or guarantor. Unbridled harvesting or processing of the borrower's contacts is prohibited. (National Privacy Commission)

More importantly, for debt-collection purposes, the lender is expressly prohibited from contacting people in the borrower's contact list other than declared guarantors. (National Privacy Commission)

This distinction matters when a collection agent sends messages to coworkers, friends, distant relatives, clients, or other people who were simply stored in the borrower's phone.

A character reference is not automatically a guarantor

A person named as a character reference does not become responsible for the loan merely because the borrower supplied that person's name or number.

NPC Circular No. 2022-02 distinguishes a character reference, whose information may be used for appropriate identity or veracity checks, from a guarantor, who expressly agrees to bind himself or herself to answer for the borrower's obligation in case of default. Separate consent is required for the latter arrangement. A character reference must also be informed about the collection and source of his or her personal information and may request removal where applicable. (National Privacy Commission)

A lender should therefore not tell a mere reference that he or she must pay the borrower's debt unless there is an actual legal basis, such as an express guaranty.

Camera, photographs, and gallery access

Access to a phone's camera or photographs is not automatically illegal. An app may have a legitimate need for a photograph, for example for know-your-customer or identity-verification purposes.

The restriction is that processing must remain tied to a legitimate, disclosed, necessary, and proportionate purpose. NPC guidance specifically warns against using photographs or device permissions for harassment or embarrassment. Once a permission is no longer necessary for its stated purpose, the platform should prompt the user to disable or revoke it. (National Privacy Commission)

Keeping your personal information forever

Online lenders are not entitled to retain every piece of collected personal information indefinitely merely because a borrower once applied for a loan.

The NPC, DICT, and SEC reiterated in their 2026 Joint Advisory that personal data should be retained only for as long as necessary for the purpose for which it was collected, for the establishment, exercise, or defense of legal claims, or as otherwise required by law. Data that no longer needs to be retained should be securely disposed of. (National Privacy Commission)

This also means that a request to delete data is not always absolute. A lender may legitimately have to retain certain records because of regulatory obligations, accounting requirements, an existing dispute, or legal claims. The proper question is whether continued retention of each category of data has a lawful and necessary basis.

Preserve the evidence before blocking, deleting, or uninstalling anything

Good evidence can determine whether an agency can identify the responsible company and understand exactly what happened.

Before deleting messages or uninstalling the app, preserve:

Screenshots of threatening, insulting, deceptive, or humiliating messages.
Screenshots showing messages sent to relatives, coworkers, employers, friends, clients, or other third parties.
The complete sender phone numbers, account names, social-media profiles, email addresses, and dates and times.
Screen recordings where necessary to show an entire conversation rather than isolated messages.
Copies of public posts, comments, group-chat messages, or altered photographs used to shame you.
Screenshots of the app's permissions, particularly access to contacts, telephone functions, camera, photographs, storage, or location.
The exact app name, developer or publisher, package name if available, and the app-store page or source from which it was downloaded.
The legal or corporate name of the lender shown in the loan agreement, disclosure statement, privacy notice, payment instructions, or app.
The loan agreement, disclosure statement, repayment schedule, receipts, payment records, and account history.
The lender's privacy notice and terms of service, particularly the version shown when you applied if you still have it.
Copies of your written complaints to the lender, its Data Protection Officer, or consumer-assistance channel, together with proof of delivery.
Names and statements of third parties who actually received collection messages.
Any evidence that a collector falsely represented being a police officer, lawyer, court employee, government official, or another person.

Keep the original electronic files where possible. A cropped screenshot may be useful, but an uncropped copy showing the account, timestamp, and surrounding conversation is usually more informative.

Step 1: Send a written complaint to the lender

Start by identifying the company behind the app. Do not rely only on the app's marketing name because the regulated entity may use a different corporate name.

A financial service provider covered by the Financial Products and Services Consumer Protection Act must maintain a consumer-assistance mechanism for complaints, inquiries, and requests. Consumers who remain dissatisfied may elevate the matter to the financial regulator with jurisdiction. (Securities and Exchange Commission)

Your written complaint should briefly identify the loan and then describe the specific conduct: who contacted you, what was said or disclosed, which third parties were contacted, and when it happened. Attach representative evidence and state what you want corrected.

Depending on the problem, reasonable requests may include stopping communications with people who are not guarantors, stopping public disclosure or shaming, restricting collection communications to lawful channels, correcting inaccurate information, explaining the legal basis for processing specified data, revoking unnecessary device permissions, investigating the collector, and deleting personal data that no longer has a lawful retention basis.

For an NPC complaint, this written step has additional importance. Under the NPC's complaint rules, a complainant ordinarily must first inform the respondent in writing and allow it an opportunity to address the privacy concern. As a general rule, if the respondent does not take timely and appropriate action or does not respond within 15 calendar days from receipt, the complainant may proceed with the formal NPC complaint and attach proof of the earlier written notice. (National Privacy Commission)

Do not merely call customer service if you can send a traceable written complaint. Email, ticket confirmations, registered-mail receipts, courier tracking, or another record showing when the company received the complaint can be important later.

Step 2: Report privacy violations to the National Privacy Commission

The NPC is the principal government authority for complaints involving violations of the Data Privacy Act and related privacy regulations. Its powers include receiving complaints, investigating alleged violations, facilitating appropriate dispute-resolution mechanisms, adjudicating cases within its jurisdiction, issuing orders affecting unlawful processing, and referring appropriate matters for criminal prosecution. (National Privacy Commission)

Online-lending privacy issues appropriate for NPC review can include excessive collection of phone contacts, disclosure of personal data to unrelated third parties, use of photographs or personal information for harassment, unlawful retention, lack of transparency, and processing that goes beyond a legitimate and proportionate purpose.

What to file with the NPC

The NPC's complaint procedure provides for the filing of a properly accomplished complaint form or verified complaint together with supporting evidence and, where applicable, witness affidavits. A representative filing for another person must establish the authority to represent that complainant. Submissions may be made through the filing channels authorized by the NPC, including the methods stated on its current complaint page. (National Privacy Commission)

As of August 21, 2026, the NPC publishes a current Complaint-Affidavit template identified as version 2.0 dated March 1, 2026. Use the form currently published by the NPC rather than relying on an old copy obtained from another website or previous complaint. (National Privacy Commission)

The complaint should identify the respondent as precisely as possible. If the app hides the company's identity, provide everything you have: screenshots of the app, payment-account details, privacy notice, app-store listing, website, telephone numbers, collector names, loan documents, and correspondence.

Do you always have to wait 15 days?

No. The 15-calendar-day prior-notice requirement is the general rule, not an absolute rule in every situation.

The NPC's Rules of Procedure allow the Commission to waive exhaustion of remedies for good cause and in serious cases, including circumstances involving a serious Data Privacy Act violation, risk of grave or irreparable harm, or situations in which the respondent cannot provide a plain, speedy, or adequate remedy. A complainant seeking immediate NPC intervention should clearly allege and substantiate why waiting should not be required. (National Privacy Commission)

For ordinary complaints without an urgent risk, following the written-notice procedure is safer than assuming an exception applies.

Step 3: Report unfair collection practices to the SEC

Lending companies and financing companies operating in the Philippines are regulated by the SEC and generally require the appropriate SEC authority to conduct their regulated business. The SEC also maintains information and advisories concerning recorded online lending platforms. (SEC Appointment System)

Before filing, check whether the corporate lender is registered and whether the online lending platform appears in the SEC's current records. An app's presence in an app store does not by itself prove that the lending operation is authorized.

For complaints against financing and lending companies, the SEC's iMessage system provides a route under the Financing and Lending Companies Department, then Legal and Enforcement Division, for complaints concerning financing and lending companies. Follow the current portal instructions for the required supporting documents and any applicable assessment or filing requirements rather than relying on an old checklist. (Securities and Exchange Commission)

A useful SEC complaint package should clearly connect the complained-of conduct to the regulated company. Include the corporate name if known, the online lending platform, account or loan information, names or numbers used by collectors, a chronology, copies of the offending communications, and your prior complaint to the company.

If the operation appears unlicensed, suspended, revoked, or unrecorded, state that separately and attach the information that will help investigators identify the operator, such as its app-store listing, website, payment channels, telephone numbers, claimed company name, and screenshots of its loan solicitation.

The SEC itself distinguishes regulatory complaints from privacy complaints: unfair collection by a lending or financing company may fall within SEC jurisdiction, while improper processing or disclosure of personal information may independently be brought before the NPC. The same incident can therefore raise issues for more than one agency. (SEC Appointment System)

Step 4: Report possible crimes promptly

Some collection conduct may go beyond a regulatory violation.

Credible threats of violence, extortionate demands, identity theft, unauthorized access to accounts, fraudulent impersonation, fabricated online posts, or other criminal acts should be preserved and reported promptly to law-enforcement authorities. The Cybercrime Prevention Act also applies to specified computer-related offenses and to certain offenses committed through information and communications technologies, although the correct criminal charge always depends on the actual facts and evidence. (Lawphil)

The PNP Anti-Cybercrime Group maintains channels for cybercrime complaints, while the NBI Cybercrime Division receives complaints and requests for investigation. If threats create an immediate physical-safety risk, prioritize personal safety and contact the nearest police station or appropriate local emergency service rather than waiting for the regulatory complaint process. (National Bureau of Investigation)

Do not assume that every rude collection text is automatically a cybercrime. Regulatory harassment, a privacy violation, defamation, threats, fraud, extortion, and identity-related offenses have different legal elements. Give investigators the evidence and let the appropriate offense be determined from the facts.

What should you ask the lender to do?

The appropriate request depends on what actually occurred. A written demand can ask the lender to:

Stop contacting anyone who is not lawfully contactable for debt-collection purposes.
Stop publishing or sending your loan information, photographs, IDs, or other personal data to unauthorized third parties.
Identify the company and collection agency responsible for the communications.
Investigate named collectors or telephone numbers.
Explain the source, purpose, and legal basis for specified personal information being processed.
Correct inaccurate or misleading personal data.
Remove unnecessary app permissions and stop excessive data collection.
Delete or securely dispose of information that no longer has a lawful purpose or retention basis.
Preserve relevant logs and records while the complaint is being investigated.
Confirm in writing what corrective action was taken.
Use a designated lawful communication channel for future collection correspondence.

Do not demand deletion of records that the company is legally required to keep or reasonably needs for an existing legal claim. A more precise request—identifying the particular data and explaining why its continued processing appears unnecessary—is usually more useful.

Special problem: the lender messaged your family, friends, or employer

Start by determining how the lender obtained the person's details and what role that person actually had.

If the person was merely stored in your phone and was not a declared guarantor, using that contact for debt collection is specifically restricted by the NPC's online-lending rules. A character reference is also not automatically a guarantor. (National Privacy Commission)

If the third party actually executed a guaranty, the analysis is different because legitimate communications concerning the guaranteed obligation may be permissible. Even then, a guarantor's status does not authorize threats, humiliating disclosures, or processing unrelated to the legitimate collection purpose.

There may also be situations in which a company can lawfully disclose or process certain information because of another legal obligation, a regulatory requirement, or the establishment or defense of a legal claim. The existence of any such exception should be determined from the documents and circumstances, not simply assumed from the fact that a debt exists.

Special problem: the app already copied your contacts

First preserve screenshots of the permissions and any evidence showing third-party contact. You can then review the app's permissions and revoke access that is no longer necessary.

Revoking permission or uninstalling the application does not necessarily delete information that has already been transmitted to the lender's servers. If you believe information was unlawfully collected, specifically ask the company to identify what contact information or metadata it obtained, why it processed that information, whether it disclosed the data, how long it will retain the data, and what it has deleted or restricted following your objection.

NPC rules require transparency and proportionality; the 2026 Joint Advisory also reiterates that unnecessary permissions should not persist after their purpose has been achieved. (National Privacy Commission)

Common mistakes that can weaken a complaint

Deleting everything immediately

Blocking the collector may be sensible, but first preserve the evidence. Once an account, message thread, public post, or app is deleted, proving what appeared on the screen can become more difficult.

Complaining without identifying the company

An app name alone may not identify the lending company. Look at the loan agreement, disclosure statement, privacy notice, repayment instructions, SEC information, and payment records.

Sending only isolated screenshots

A screenshot saying “PAY NOW” may prove very little without context. A chronology showing the account, sender, date, third-party disclosure, threats, and prior notices is much stronger.

Treating every collection attempt as illegal

Creditors may pursue lawful collection. Focus your complaint on specific conduct that was excessive, deceptive, threatening, publicly humiliating, privacy-invasive, or otherwise prohibited.

Assuming the complaint automatically erases the debt

A regulatory or privacy violation does not automatically extinguish a valid principal obligation. Continue to preserve your loan and payment records, particularly if you dispute the balance, interest, charges, or identity of the creditor.

Paying an unknown collector merely to stop the harassment

Verify the creditor and official payment channel before sending money. Harassment can create pressure to pay quickly, but transferring funds to an unverified personal account can create a separate problem.

Sharing more sensitive information than necessary

A collector does not need your password, one-time password, PIN, or unrestricted access to your accounts simply to receive payment. Likewise, complaints submitted to agencies should include the evidence necessary for the case without unnecessarily circulating sensitive information to unrelated persons.

When legal help is urgent

Consider obtaining individualized legal assistance promptly when the collector has made credible threats of physical harm, published IDs or sensitive information, impersonated authorities, taken control of an account, used your identity, demanded money through apparent extortion, repeatedly contacted your workplace or clients despite notice, or targeted children or other vulnerable family members.

Prompt advice is also important if you have received an actual court summons, subpoena, prosecutor's notice, or other formal legal document. A real legal process should not be ignored merely because the lender previously engaged in abusive collection.

A lawyer may also be useful where the identity of the actual lender is unclear, several lending apps are involved, there are substantial disputed payments, or the case requires coordinated complaints before the SEC, NPC, and law-enforcement authorities.

FAQ

Can an online lending app contact everyone in my phone?

No. The fact that an app technically obtained access to your contacts does not give the lender unrestricted authority to use those contacts. For debt collection, NPC rules expressly prohibit contacting people in the borrower's contact list other than declared guarantors. (National Privacy Commission)

Is my character reference required to pay my loan?

Not merely because he or she was listed as a character reference. A guarantor is different: the person must expressly bind himself or herself to answer for the obligation in case of default. (National Privacy Commission)

Can I file immediately with the NPC?

Usually, you should first notify the respondent in writing and allow the required period for action. The general rule looks to whether the respondent failed to act appropriately or failed to respond within 15 calendar days from receipt. The NPC may waive this exhaustion requirement in qualifying serious or urgent circumstances, but the reason for a waiver should be properly alleged and supported. (National Privacy Commission)

Does uninstalling the lending app solve the privacy problem?

Not necessarily. Uninstalling can stop future device access, but it does not necessarily erase data already transmitted to the lender. Preserve evidence first, revoke unnecessary permissions, and make an appropriate privacy request concerning data already collected.

Can I report the same incident to both the SEC and NPC?

Yes, when different aspects fall within their respective jurisdictions. For example, abusive collection practices may raise SEC issues while unauthorized collection or disclosure of personal data may separately raise NPC issues. Possible crimes can also justify a law-enforcement report. (SEC Appointment System)

What if the online lender is not registered or recorded with the SEC?

Preserve the evidence and report the operator to the SEC. Include enough information to identify it, such as its app-store page, website, app name, claimed corporate identity, telephone numbers, payment accounts, advertisements, and loan documents. The SEC maintains current information concerning financing and lending companies and recorded online lending platforms. (Securities and Exchange Commission)

Does harassment mean I no longer have to pay the loan?

Not automatically. The validity and amount of the debt are separate questions from whether unlawful collection or privacy violations occurred. If you dispute the debt itself, preserve the loan contract, disclosure statement, payment history, and computations so that issue can be addressed separately.

Should I block the collector?

You may block abusive communications after preserving the evidence you need. If you want the company to continue communicating about a legitimate account, you can tell it in writing to use a specific lawful channel such as email.

Official sources

General information disclaimer

This article provides general Philippine legal information, not legal advice for a particular loan, lender, borrower, or collection incident. The proper remedy can depend on the loan documents, identity and regulatory status of the lender, exact communications made, personal data processed, recipients of any disclosure, and available evidence. Government forms, electronic filing systems, fees, office procedures, and contact details may change, so confirm the current requirements on the relevant agency's official website before filing.

Sources checked and current-law review conducted: August 21, 2026.