If an online lending app in the Philippines is harassing you, do not treat it as “just part of debt collection.” Philippine regulators have already recognized that some apps have used public shaming, threats, abusive language, and unlawful access to contact lists and other personal data. The current government advisory from DICT, NPC, and SEC says to report abusive behavior immediately to the SEC Financing and Lending Companies Department (FINLEND), the DICT Cyber Hotline, the NBI Cybercrime Division, or the PNP Anti-Cybercrime Group.
What counts as online lending app harassment?
Harassment is not limited to one rude text message. Under SEC Memorandum Circular No. 18, Series of 2019, unfair collection practices include threats or use of violence, obscene or profane language, public disclosure or publication of a borrower’s name and personal information, contacting people in the borrower’s contact list who are not guarantors, sending false or deceptive messages to collect a debt, and contacting borrowers at unreasonable hours, generally before 6:00 a.m. or after 10:00 p.m., unless narrow exceptions apply. The same circular also makes clear that outsourcing collection to a third-party service provider does not shift away the lending company’s responsibility.
The NPC has also documented the typical pattern in these cases: apps using phonebook or contact-list data to reach third persons without consent, discussing unpaid balances with friends, relatives, co-workers, or even supervisors, and causing embarrassment and emotional stress. In a later enforcement action, the NPC said an online lending operator could be criminally liable for unauthorized processing of personal information under the Data Privacy Act. (National Privacy Commission)
Your rights under Philippine law
Data privacy rights
The Data Privacy Act of 2012 protects personal information and recognizes that data must be collected and processed for a specified, legitimate purpose, using data that is adequate and not excessive. It also gives the data subject rights to be informed, to access information about the processing, to correct inaccuracies, and to lodge a complaint with the National Privacy Commission. (Supreme Court E-Library)
That matters in lending-app harassment because many complaints involve contact lists, phone permissions, photos, messages, and other data that the app did not need for legitimate loan processing. The SEC/NPC/DICT advisory says unnecessary permissions are prohibited, access to contact lists is restricted, and contacting persons on the borrower’s contact list other than guarantors is prohibited.
Consumer and lending-company rules
The SEC has regulatory authority over financing companies and lending companies, and its 2019 circular prohibits unfair debt collection practices. The same current 2026 advisory tells the public to report unfair debt collection and other harassment to the SEC FINLEND department at iMessage SEC, or through the other listed government channels. Violations can lead to administrative sanctions, including fines, suspension, or revocation of authority to operate.
Civil and criminal remedies
If the harassment caused real harm, Philippine civil law may also apply. Articles 19, 20, and 21 of the Civil Code require people to act with justice, good faith, and honesty, and they allow recovery for damage caused by conduct contrary to law, morals, good customs, or public policy. If the app’s messages contain serious threats, Article 282 of the Revised Penal Code on grave threats may be relevant; if the conduct is coercive or intentionally vexing, Article 287 on light coercions and unjust vexations may also come into play depending on the facts. (Lawphil)
How to report online lending app harassment in the Philippines
1) Preserve the evidence before blocking anything
Save the screenshots, chat logs, call logs, voicemail, recording, social-media posts, contact-list access prompts, and the names or numbers of the people the app contacted. Keep copies of the loan app name, the lender’s name, the dates and times of the messages, and any proof that the app reached your contacts, employer, or family. This is important because the NPC complaint rules require evidence and the NBI asks complainants to bring supporting documents and sworn statements. (National Privacy Commission)
2) Check whether the conduct fits the SEC’s prohibited acts
Match what happened to the SEC circular and the joint advisory. Public shaming, threats, obscene language, contact-list harvesting, contacting non-guarantor relatives or co-workers, and calls outside reasonable hours are all red flags. If the app asks for permissions that are unnecessary for lending, that also supports a privacy complaint.
3) File a complaint with the SEC through the official channels
The current DICT/NPC/SEC advisory says to report unfair debt collection practices to the SEC Financing and Lending Companies Department (FINLEND). It gives the SEC filing channel as imessage.sec.gov.ph and the hotline as 1-4732 (1-4SEC). The same advisory says other forms of harassment, threats, frauds, and scams may also be reported to the NBI Cybercrime Division, the DICT Cyber Hotline, and the PNP Anti-Cybercrime Group.
4) File a data privacy complaint with the NPC
If the app misused your contact list, photos, phone permissions, or other personal data, the NPC is the proper agency. The NPC says a formal complaint must be filed in a specific format; you should download the complaint form, print and fill it out, have it notarized, and submit it personally, by courier, or by email if authorized by the Commission. The NPC also says a filled-out and notarized complaint-assisted form or verified complaint must be accompanied by evidence and witnesses’ affidavits. (National Privacy Commission)
The current NPC schedule of fees lists a filing fee for complaints of Php 500.00. If you are also claiming damages, the schedule shows additional fees depending on the amount claimed. (National Privacy Commission)
5) If there are threats, stalking, extortion, or fake posts, add a cybercrime report
The NBI’s CyberCrime Division says a complainant may proceed to the CCD to file a complaint or request for investigation, undergo a preliminary interview and initial investigation, and then execute sworn statements or submit prepared affidavits and relevant documents. The NBI’s citizen’s charter shows the initial intake steps can take about 10 minutes for the complaint sheet, 30 minutes to 1 hour for the interview and initial investigation, and about 1 hour and 10 minutes total for the initial processing. (National Bureau of Investigation)
The current government advisory lists the NBI Cybercrime Division contact details as ccd@nbi.gov.ph and (632) 8523-8231 to 38. It also lists the PNP Anti-Cybercrime Group at acg@pnp.gov.ph, onlinecims.ocs@gmail.com, and (632) 8723 0401 (loc 7491).
6) Consider a civil claim if the harm is serious enough
A separate civil action for damages may be available if the conduct caused reputational harm, emotional distress, or other losses. Civil Code Articles 19, 20, and 21 are the usual starting points in Philippine human-relations cases involving abuse of rights, wrongful acts, or conduct contrary to morals and public policy. (Lawphil)
What to prepare before filing
| What to prepare | Why it matters | Where it is used |
|---|---|---|
| Screenshots of messages, social-media posts, and call logs | Shows the harassment itself and the exact wording used | SEC, NPC, NBI |
| Loan app name, lender name, and timeline | Helps identify the responsible company and the pattern of abuse | SEC, NPC |
| Proof that contacts were reached without consent | Important in contact-list misuse cases | NPC, NBI |
| Affidavit or sworn statement | Required for formal complaints and investigations | NPC, NBI |
| ID and proof of authority, if filing for someone else | Needed for representatives and corporate complainants | NPC |
| Special power of attorney, board resolution, or secretary’s certificate, if applicable | Required when a representative files for another person or entity | NPC |
| Copies of posts, URLs, and account handles | Useful when the harassment was public shaming online | SEC, NPC, NBI |
The NPC’s complaint mechanics say a representative may file only with proper authority, and if the complainant is a juridical entity, the filer must be authorized by a special power of attorney plus a board resolution and secretary’s certificate. That is one of the most common reasons people get delayed at the filing stage. (National Privacy Commission)
Common mistakes that slow down complaints
One common mistake is filing only a single screenshot without showing the date, time, sender, and the rest of the thread. Another is deleting the app before capturing the permissions screen or the abusive messages. A third is filing the NPC complaint without notarization, because the NPC’s formal complaint page specifically requires a notarized form or verified complaint, together with evidence and affidavits. (National Privacy Commission)
Another mistake is assuming the issue is only about the debt. The SEC and NPC materials make clear that even if a debt is real, lenders still cannot use harassment, public shaming, unauthorized contact-list access, or disproportionate data processing to collect it. Outsourcing to a collection agent does not excuse the lender, because the ultimate responsibility stays with the financing or lending company.
If you are abroad or filing for someone else
The reporting channels still matter even if you are overseas. The NPC allows complaint submission by email when authorized, and the SEC/NBI/PNP channels in the 2026 advisory are all digital or remote-friendly in the first instance. If a sworn statement or supporting document was executed outside the Philippines, check the applicable apostille or authentication rules before submitting it in a Philippine proceeding, because the DFA’s Apostille guidance explains that an apostille certifies documents for use in another country that is party to the Apostille Convention. (National Privacy Commission)
If you are filing for a family member or company, authority documents matter. The NPC’s rules require proper authorization for representatives, and foreign documents may need the correct form of authentication or apostille depending on where they were executed and where they will be used. (National Privacy Commission)
Frequently Asked Questions
Can I report an online lending app even if I still owe money?
Yes. Debt collection is allowed, but harassment is not. The SEC circular expressly prohibits unfair debt collection practices such as threats, profane language, public shaming, contact-list abuse, and unreasonable-hour contacts, while the NPC has also pursued cases involving misuse of personal data.
Where should I report first: SEC, NPC, or NBI?
Report to the agency that matches the harm. Use the SEC for unfair debt collection by a lending or financing company, the NPC for misuse of your personal data, and the NBI if the conduct looks criminal, such as threats, extortion, stalking, or cyber-related harassment. The current joint advisory lists all of these channels as proper reporting options.
Is it illegal for a lending app to contact my friends or co-workers?
Yes, if they are not guarantors. The SEC/NPC/DICT advisory says contacting persons on the borrower’s contact list other than guarantors is prohibited, and the SEC circular treats disclosure of borrower information to third persons as an unfair collection practice.
Can they message me at midnight?
That is generally an unfair collection practice. SEC Memorandum Circular No. 18 treats contact before 6:00 a.m. or after 10:00 p.m. as unreasonable or inconvenient, unless narrow exceptions apply.
What if they posted my photo or name online?
That can trigger both SEC and NPC issues, depending on how your data was used. The SEC circular prohibits publication or disclosure of borrower names and personal information for collection purposes, and the NPC has handled complaints involving public shaming and misuse of contact data.
Do I need a lawyer to file an NPC complaint?
Not necessarily, but the filing must still follow the NPC’s format. The NPC says the complaint form must be filled out and notarized, or filed as a verified complaint with evidence and witnesses’ affidavits. (National Privacy Commission)
How much does it cost to file with the NPC?
The NPC’s current schedule lists a filing fee for complaints of Php 500.00, with additional fees if you are also claiming damages. (National Privacy Commission)
What if the app says it is only a “third-party collector”?
That does not necessarily protect the lender. The SEC circular says outsourced collectors and third-party service providers do not remove the financing or lending company’s ultimate responsibility for compliant collection practices.
Can online lending harassment be a crime?
Sometimes, yes. Depending on the facts, the conduct may overlap with grave threats under Article 282 of the Revised Penal Code, light coercions or unjust vexations under Article 287, or unauthorized processing and disclosure under the Data Privacy Act. (Lawphil)
Key Takeaways
- Online lending app harassment is not normal debt collection; Philippine regulators have specifically prohibited public shaming, threats, abusive language, contact-list abuse, and unreasonable-hour collection.
- The most useful reporting channels are SEC FINLEND, NPC, NBI Cybercrime Division, and, for other cyber-related harassment, the PNP Anti-Cybercrime Group.
- Save screenshots, call logs, posts, and contact evidence before the app can delete or alter them. (National Privacy Commission)
- NPC complaints require a notarized form or verified complaint with evidence; the current filing fee for complaints is Php 500.00. (National Privacy Commission)
- If there are threats or criminal conduct, add an NBI cybercrime complaint and preserve sworn statements and affidavits. (National Bureau of Investigation)
- The lender stays responsible even when it uses a third-party collector.