Quick answer

Report unfair collection practices by an online lending app to the Securities and Exchange Commission (SEC). Report unlawful collection, disclosure, or use of personal data to the National Privacy Commission (NPC). Report threats, extortion, fraud, impersonation, account intrusion, or other possible crimes to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT Cyber Hotline.

Preserve the evidence before blocking numbers, revoking permissions, or uninstalling the app. You may use more than one complaint route when different violations are involved, but disclose any related SEC, NPC, police, or court cases when a form asks about them.

Harassment is not made lawful by an unpaid loan. At the same time, filing a complaint does not automatically cancel a valid debt. The lender may still use lawful collection methods or file a proper civil case. The Constitution prohibits imprisonment solely for debt, although separate criminal conduct—such as fraud or issuing a worthless check—may have different consequences. See Article III, Section 20 of the Constitution.

If anyone is in immediate danger

Call 911 or go to the nearest police station if a collector threatens immediate violence, says someone is coming to your home or workplace, publishes your location, threatens your children or family, or attempts to enter your property.

Do not meet a threatening collector alone. Tell a trusted person, building security, barangay officials, or your employer’s security office. Preserve the threatening message and give law enforcement the sender’s number, account, payment instructions, and all available identifying information. The Unified 911 system is the government’s nationwide emergency hotline for police, fire, medical, and rescue services. See the DILG Unified 911 guidance.

What online lenders and collectors may not do

The government’s March 2026 Joint Advisory on Online Lending Platforms reiterates that online lenders may not use harassment, intimidation, public shaming, threats, or unlawful processing of personal data to collect a loan.

Under SEC Memorandum Circular No. 18, Series of 2019, prohibited unfair collection practices include:

Using or threatening violence or other criminal means to harm a person, reputation, or property.
Threatening action that cannot legally be taken.
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense.
Publishing or disclosing a borrower’s name or personal information as a collection tactic, except where disclosure is lawfully allowed.
Communicating false loan information, including failing to state that a debt is disputed when that fact should be disclosed.
Using false representations or deceptive means to collect a debt or obtain information.
Contacting a borrower before 6:00 a.m. or after 10:00 p.m. The circular contains exceptions where the account is more than 15 days past due or the borrower has expressly agreed, through written, electronic, or recorded means, that those are the only reasonable times for contact.
Contacting people in the borrower’s contact list for collection when they were not named as guarantors or co-makers. The circular states that the borrower’s consent does not remove this prohibition.

The complete rule is available in SEC Memorandum Circular No. 18, Series of 2019. Republic Act No. 11765 also prohibits abusive collection or debt-recovery practices and makes a financial service provider responsible for its employees and agents. It may also be solidarily liable with an accredited third-party collector. See the Financial Products and Services Consumer Protection Act.

Character references are not guarantors

A character reference may be contacted only to verify the borrower’s identity and the truthfulness of information provided during the loan application. The lender must explain how it obtained the person’s details and allow the reference to request removal of their data.

A character reference is not automatically liable for the loan. A guarantor must separately and expressly consent to assume responsibility if the borrower defaults. For debt collection, the 2026 joint advisory says lenders may contact the guarantor—not other people found in the borrower’s contact list.

Limited app permissions may be lawful

Not every request for an app permission is automatically unlawful. Access must have a specified, legitimate purpose and be proportionate to that purpose. For example:

Camera or photo-gallery access may be used for identity verification, know-your-customer checks, payment verification, or a similar legitimate purpose. Access should end when that purpose is completed.
Contact-list access may be limited to letting the borrower select a character reference or guarantor, or to deriving proportionate metadata when necessary for a specified legitimate purpose.
A lender may retain information needed to administer an existing loan, comply with law, or establish, exercise, or defend legal claims.

What is prohibited is unnecessary, unauthorized, excessive, or disproportionate processing. This includes processing that results in harassment, collection from people other than guarantors, or other unfair collection practices. See NPC Circular No. 2022-02.

Preserve evidence before changing anything

Create a separate folder for the incident. Keep original files whenever possible, not only cropped screenshots.

Preserve:

Screenshots and screen recordings showing the complete message, sender, phone number or profile, date, time, URL, and surrounding conversation.
SMS messages, emails with full headers, chat exports, call logs, recordings or voice messages already lawfully received, and notices sent to your contacts.
The app’s store page, developer name, download URL, package name, version, privacy notice, consent screens, and requested permissions.
The lender’s corporate name, SEC registration number, Certificate of Authority number, office address, customer-service details, and Data Protection Officer contact information.
Loan agreements, disclosure statements, statements of account, payment receipts, disbursement records, and screenshots of the balance shown in the app.
The name or alias used by each collector, collection-agency name, phone numbers, social-media accounts, bank accounts, e-wallets, QR codes, and payment instructions.
A chronological incident log stating what happened, when it happened, who received the communication, and what personal data was disclosed.
Statements from relatives, co-workers, employers, or friends who received messages. Ask them to keep the original messages and, if needed, prepare a signed affidavit based on what they personally received or witnessed.

Back up the evidence to another device or secure cloud account. Do not edit the originals. Redacted copies may be used for ordinary correspondence, but regulators or investigators may need the unredacted evidence.

Secure your phone and accounts

After preserving the evidence:

Review the app’s permissions and revoke access to contacts, camera, photos, microphone, location, call logs, SMS, and storage when no longer necessary.
Uninstall the app if continued access presents a security risk. Uninstalling does not cancel the loan.
Change passwords for your email, financial accounts, social media, and device account—especially if passwords were reused.
Enable multi-factor authentication and sign out unknown devices or sessions.
Warn your contacts not to respond, click links, provide information, or send money to collectors.
If financial credentials or identity documents may have been compromised, notify the relevant bank or e-wallet immediately and monitor for unauthorized transactions.

First send a written complaint to the lender

Use the lender’s official consumer-assistance channel and send a copy to its Data Protection Officer, if identified. This creates a record and is particularly important before filing a formal NPC complaint.

State:

Your name and loan or account reference, while avoiding unnecessary passwords, PINs, or full card details.
The exact conduct complained of, with dates, times, numbers, accounts, and collector names.
The personal data accessed, used, or disclosed and the people who received it.
Whether the amount, identity of the borrower, or debt itself is disputed.
The corrective action requested.

Reasonable requests may include:

Stop unlawful third-party contact, public shaming, threats, and abusive language.
Preserve all collection records, access logs, recordings, and instructions given to the collector.
Identify the lending company, collection agency, responsible collector, and Data Protection Officer.
Provide an itemized statement of account and correct inaccurate information.
Disclose what personal data was collected, its source, its recipients, the purpose of processing, and the basis for disclosure.
Correct false information and notify recipients of the correction.
Block or delete data shown to have been unlawfully obtained, used for an unauthorized purpose, or no longer necessary—subject to lawful retention requirements.
Confirm in writing what action was taken.

Keep proof that the complaint was received. For NPC purposes, the usual waiting period is 15 calendar days from the company’s receipt of your written notice.

Report unfair collection to the SEC

The SEC regulates financing companies, lending companies, their online lending platforms, and their collection agencies.

Identify the legal company behind the app. Check the privacy notice, loan agreement, disclosure statement, app-store listing, and payment recipient. You may also search the SEC’s Check with SEC portal.
Open a complaint through the SEC iMessage portal. The current portal uses an eSECURE account. Select the service for complaints involving financing or lending companies and follow the upload instructions.
Provide the app name, corporate name, Certificate of Authority number if known, loan reference, collection-agency details, a chronological account, and copies of the evidence.
Include your written complaint to the lender and its response, if any. State whether the harassment is ongoing and identify everyone contacted.
Save the ticket number and monitor the portal for requests for clarification or additional evidence.

The SEC’s current FINLEND hotline is 1-4732 (1-4SEC). An unregistered or unidentified lender should still be reported; explain what you did to identify it and attach the app-store page, developer details, payment accounts, and communications.

Claims under Republic Act No. 11765 generally prescribe five years from consummation of the financial transaction, or five years from discovery of deceit or nondisclosure of material facts, subject to an outside limit of ten years from the violation. Application of those periods to continuing or repeated collection conduct may depend on the facts, so report promptly and obtain legal advice if the incident is old.

Report privacy violations to the NPC

The NPC handles violations of the Data Privacy Act, including unlawful access, excessive collection, use for unauthorized purposes, malicious or unauthorized disclosure, and denial of data-subject rights.

Satisfy the 15-day notice requirement

Ordinarily, the NPC will not give a complaint due course unless you establish that:

You informed the lender, collector, or other responsible entity in writing about the privacy violation; and
It failed to take timely or appropriate action, or did not respond within 15 calendar days after receiving your written notice.

The NPC may waive this requirement for proven good cause or a serious violation presenting a significant risk of harm—for example, grave and irreparable injury that only immediate NPC action can prevent, lack of a plain and adequate remedy, or conduct that is patently illegal. Explain and document why a waiver is necessary; do not assume it will be granted. See the 2021 NPC Rules of Procedure, as amended.

Prepare the formal complaint

Use the current NPC Complaint-Affidavit form. The form requires, among other things:

Complainant and respondent information.
Identification of the personal data processed.
A clear, chronological narration.
The privacy violations alleged and relief requested.
All supporting documents and relevant witness affidavits.
Correspondence showing exhaustion of remedies, or the reason immediate filing is justified.
A valid government-issued ID.
Verification and certification against forum shopping.

The Complaint-Affidavit must be sworn or notarized as indicated in the form. If someone files for an adult data subject, a special power of attorney is generally required. Different proof applies to parents or guardians representing minors or persons who are legally incapable of acting for themselves.

File and pay the applicable fee

NPC rules allow filing personally, by registered mail, by courier, or by email as authorized by the Commission. The NPC currently directs complaints to complaints@privacy.gov.ph and maintains its complaint desk at:

National Privacy Commission 25th–27th Floors, The Upper Class Tower Quezon Avenue corner Scout Reyes Street Barangay Paligsahan, Quezon City 1103

Follow the current instructions on the NPC complaint page for electronic signatures, PDF formatting, payment, and any original copies that may later be required.

The current base filing fee is ₱500, plus the applicable legal research fee and any additional fee based on a claim for damages. Indigent complainants may seek an exemption by submitting the required proof. Check the NPC Schedule of Fees and Charges before paying.

If disclosure is continuing and creates grave or irreparable harm, ask the NPC whether an application for a temporary ban or other interim relief is appropriate. Such applications have separate requirements, fees, and possible bond obligations.

When the lender is supervised by the BSP

Some digital loans are provided by banks or other BSP-supervised institutions rather than SEC-regulated lending or financing companies. Check the legal provider and the regulator identified in the app, contract, and disclosure statement.

For a BSP-supervised institution:

Complain first through the institution’s Financial Consumer Protection Assistance Mechanism or official customer-service channel.
If dissatisfied, escalate through the BSP Online Buddy chatbot on the BSP website or its official Facebook page.
If BOB is unavailable, submit the BSP Complaint/Inquiry/Reply form to consumeraffairs@bsp.gov.ph, with proof that you first complained to the institution.

The BSP explains this second-level procedure in its official consumer complaint guide. The same guide confirms that complaints about financing companies, lending companies, online lending platforms, and their collectors are best directed to the SEC.

Report threats, fraud, or possible cybercrime

An SEC or NPC complaint is administrative and does not replace a criminal report. Contact law enforcement when communications involve credible threats, extortion, impersonation, unauthorized account access, fabricated documents or images, blackmail, fraud, stalking, or other possible crimes. Whether a particular message constitutes grave threats, unjust vexation, libel, cybercrime, or another offense depends on its words, context, intent, and supporting evidence.

Current official reporting channels include:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38; or the NBI Online Complaint page
PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; (02) 8723-0401 local 7491

These channels appear in the government’s March 2026 joint advisory. Bring a government ID, your incident timeline, original device if requested, screenshots, account and phone details, payment instructions, witness information, and copies of any SEC or NPC complaint.

Common mistakes to avoid

Deleting messages or uninstalling the app before preserving evidence.
Sending money to a collector’s personal account without verifying the lender, authority to collect, amount, and written settlement terms.
Posting your complaint publicly with unredacted IDs, addresses, account numbers, or contact information.
Naming only the app brand. Identify the corporate lender, developer, collector, payment recipient, and responsible officers where possible.
Filing an NPC complaint without first sending written notice or waiting 15 calendar days, unless the complaint properly establishes grounds for a waiver.
Using an obsolete NPC form, omitting notarization, failing to attach evidence, or leaving out the certification against forum shopping. These defects can lead to dismissal.
Failing to disclose related proceedings. If you have filed with the SEC, police, prosecutor, court, or another agency, disclose it accurately where the NPC form requires it.
Assuming a character reference owes the debt. Only a person who separately consented to be a guarantor may be treated as one.
Ignoring genuine court documents. A collector cannot lawfully invent a case, warrant, or court order, but a real summons requires a timely response. Verify it directly with the named court and obtain legal help.

When legal help is urgent

Consult a lawyer promptly when:

Private photos, identity documents, medical information, or fabricated sexual content have been published or threatened with publication.
The lender is demanding payment for a loan you never received.
Your identity, bank, e-wallet, email, or social-media account has been taken over.
A real complaint, subpoena, summons, or court order has been served.
You want damages, an injunction, or coordinated SEC, NPC, civil, and criminal remedies.
The respondent is unknown, overseas, or operating through many app names and collection accounts.
Repeated harassment is affecting your safety, employment, health, or children.

Qualified indigent clients may approach the Public Attorney’s Office. The Integrated Bar of the Philippines National Center for Legal Aid may also provide assistance or referrals.

Frequently asked questions

Can a lending app message everyone in my contacts?

No. Contact-list processing must be limited and proportionate. For debt collection, the current government advisory says the lender may contact a guarantor who expressly consented—not ordinary contacts or character references.

Can a lender post my name, photo, ID, or loan details online?

Public shaming or disclosure as a collection tactic is generally prohibited. A lender’s possession of information for legitimate loan administration does not authorize it to publish that information. Lawful disclosures required by courts, regulators, or applicable credit-reporting laws are different and must still comply with legal limits.

What if I am only a character reference?

You do not become liable for the loan merely because your number was supplied. Demand that the lender stop collection calls, explain how it obtained and used your data, and remove your information as a character reference. Preserve the messages and report continued collection to the SEC and any privacy violation to the NPC.

Does reporting harassment cancel the loan?

No. Harassment and debt validity are separate issues. Ask for an itemized statement, dispute unauthorized or inaccurate charges in writing, and continue dealing only through verified official channels.

Can I file with both the SEC and NPC?

Yes, when the facts involve both unfair collection and unlawful personal-data processing. A police or cybercrime report may also be appropriate. Clearly disclose all related proceedings, particularly in the NPC certification against forum shopping.

Do I need a lawyer?

A lawyer is not ordinarily required to open an SEC ticket or submit a properly prepared NPC complaint. Legal assistance is advisable for urgent interim relief, damages, disputed identity, complex evidence, criminal allegations, or court proceedings.

What if the app is unregistered or has disappeared?

Report it anyway. Preserve the app-store listing, APK or package details, developer name, website, privacy notice, payment accounts, advertisements, messages, and phone numbers. Report the unauthorized lending activity to the SEC and any threats or fraud to cybercrime authorities.

Is there a deadline?

Act immediately while evidence and accounts remain available. The NPC ordinarily requires the lender to be given 15 calendar days to respond to your written privacy complaint, subject to limited waiver grounds. Claims under Republic Act No. 11765 have statutory five-year periods and a ten-year outside limit, but the application of these rules to repeated or continuing conduct may require legal advice. Criminal and civil deadlines vary by the specific offense or cause of action.

Official legal sources

This article provides general Philippine legal information, not individualized legal advice. The proper remedy and possible liability depend on the messages, loan documents, consent records, identity of the lender and collector, and other evidence. Laws, procedures, forms, fees, and contact channels were checked against official sources on 6 August 2026.