Quick answer

Report abusive collection and privacy violations to the agency that regulates the actual lender—not merely the app’s brand name:

Problem	Where to report
Harassment or unfair collection by a lending or financing company, its online platform, or collection agency	Securities and Exchange Commission (SEC)
Unauthorized access, use, retention, or disclosure of contacts, photos, loan details, or other personal data	National Privacy Commission (NPC)
Threats of violence, extortion, impersonation, identity theft, fabricated posts, or other suspected crimes	PNP Anti-Cybercrime Group, NBI Cybercrime Division, or the nearest police station
Complaint involving a bank, digital bank, e-money issuer, or another BSP-supervised institution	Institution’s consumer-assistance mechanism first, then the Bangko Sentral ng Pilipinas (BSP)

One incident may properly be reported to more than one agency. For example, sending insulting messages to your coworkers about your debt may involve both unfair collection under SEC rules and unlawful processing or disclosure under privacy law.

Before blocking numbers or uninstalling the app, preserve the messages, call logs, app permissions, loan documents, and proof that other people were contacted.

Harassment is not a lawful collection method

A creditor may demand payment, send reasonable reminders, negotiate a payment plan, assign the account to a legitimate collector, and use lawful court remedies. It may not use abuse, deception, public shaming, or unlawful disclosure as collection tools.

The Financial Products and Services Consumer Protection Act, Republic Act No. 11765 prohibits financial service providers from employing abusive collection or debt-recovery practices. A provider remains responsible for acts performed by its employees, collection agencies, and other authorized representatives.

For lending and financing companies, SEC Memorandum Circular No. 18, series of 2019 identifies practices such as:

Threatening violence or harm to a person, reputation, or property.
Threatening legal action that cannot lawfully be taken.
Using obscenities, insults, or abusive language.
Publishing or disclosing a borrower’s name or personal information outside permitted circumstances.
Giving third parties false or misleading information about a debt, including concealing that the debt is disputed.
Using false representations or deceptive methods to collect or obtain information.
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., subject to the circular’s stated exceptions for accounts overdue by more than 15 days or times expressly accepted by the borrower.
Contacting people in the borrower’s phone list who were not named guarantors or co-makers.

A character reference is not automatically a guarantor. Under the NPC’s amended loan-transaction rules, a guarantor must expressly bind himself or herself to answer for the borrower’s obligation, and the lender must obtain the guarantor’s separate consent. The NPC’s official guidance on NPC Circular No. 2022-02 expressly prohibits contacting people in the borrower’s contact list for collection unless they were declared as guarantors.

When collection becomes a privacy violation

The Data Privacy Act of 2012, Republic Act No. 10173, requires personal-data processing to be lawful, transparent, for a legitimate purpose, and proportionate to that purpose. Consent shown by an app permission is not a blanket license to harvest a phone’s contents or shame a borrower.

Possible privacy violations include:

Copying or saving a borrower’s phone, email, or social-media contacts for collection or harassment.
Messaging relatives, friends, coworkers, employers, or other third parties about the debt when they are not guarantors or co-makers.
Posting the borrower’s name, photograph, identification document, loan balance, or supposed delinquency online.
Editing a borrower’s photograph into a “wanted,” “scammer,” or similarly humiliating image.
Using camera access or a KYC photograph to embarrass the borrower.
Using contacts supplied only as character references to collect the debt.
Continuing to process unnecessary data after the stated purpose has ended.
Using loan-application data for unrelated marketing or sharing it with third parties without a separate lawful basis.
Refusing to explain what data was collected, where it came from, why it was used, or to whom it was disclosed.

The NPC’s loan-related privacy guidance prohibits harvesting phone and social-media contacts for collection or harassment. The amended rules also require accessible, just-in-time privacy notices and prohibit excessive or disproportionate processing.

There are legitimate exceptions. A lender may process information reasonably necessary to verify identity, evaluate an application, prevent fraud, maintain legally required records, or pursue lawful collection. It may also communicate with a genuine guarantor or co-maker about that person’s contractual responsibility. Whether a particular disclosure was lawful depends on the recipient’s role, the information disclosed, the stated purpose, the loan documents, and the lender’s lawful basis.

Preserve evidence before taking action

Create a folder containing original, unedited copies of:

Screenshots showing the complete message, sender’s number or account, date, and time.
Exported chats, emails, voice messages, and call logs.
Screen recordings showing the app name, developer, privacy policy, permissions, collection messages, and account details.
The app-store listing and download link.
The loan agreement, disclosure statement, promissory note, repayment schedule, statement of account, and receipts.
The lender’s corporate name, SEC registration and Certificate of Authority numbers, if displayed.
Names or aliases used by collectors and the phone numbers, email addresses, social-media profiles, and payment accounts they supplied.
Copies of posts, group messages, comments, or edited photographs, together with their URLs.
Messages received by relatives, coworkers, employers, or other contacts.
Your written complaint to the lender and proof of delivery.
The lender’s response—or proof that it did not respond.

Ask every contacted person to preserve the original message on their own device. Record a short factual statement from each witness identifying when the message arrived, which account sent it, and what was disclosed. Do not crop away timestamps or sender information, alter screenshots, or delete the original conversation.

Avoid publicly reposting the collector’s messages with unredacted names, phone numbers, IDs, account references, or information about other borrowers. That may expose additional personal data and complicate the complaint.

Send the lender a written demand

Use an official customer-service or complaints channel shown in the loan agreement, privacy notice, app, or company website. Address privacy concerns to the company’s Data Protection Officer if one is identified.

State:

The app and lender’s complete names.
Your loan or account reference.
The dates and exact acts complained of.
The numbers or accounts used by the collectors.
Which people were contacted and what was disclosed.
Whether you dispute the debt, amount, fees, or only the collection conduct.
The action you want, such as stopping third-party contact, correcting the balance, identifying the collection agency, preserving records, removing an unlawful post, or explaining the processing of your data.

A concise demand may read:

I demand that you stop contacting persons who are not my guarantors or co-makers, stop disclosing my loan information, and stop all abusive or deceptive collection communications. Please identify the creditor and collection agency, provide my current statement of account, preserve all records relating to this complaint, and confirm what personal data you collected, its source, purpose, recipients, and retention period.

Do not include passwords, PINs, one-time passwords, full card numbers, or unnecessary identity documents.

How to complain to the SEC

The SEC regulates lending and financing companies and their recorded online lending platforms. Complaints against these entities, their apps, and their collection agencies should be filed through the SEC iMessage portal.

The current process is:

Create or use an eSECURE account.
Open a new iMessage ticket.
Select Complaints on Financing and Lending Companies under the Financing and Lending Companies Department.
Provide a clear chronology and identify both the app brand and the corporation behind it.
Upload the loan documents, abusive messages, third-party messages, call logs, written demand, and other evidence.
Save the electronic ticket number and monitor the portal for requests or replies.

The SEC’s iMessage user guide explains ticket creation, document uploads, replies, and status tracking.

Report an app even if its operator appears unregistered, uses several corporate names, or impersonates a legitimate company. Include the app link, developer name, payment destination, phone numbers, advertisements, and any claimed SEC registration or Certificate of Authority. Corporate registration alone does not necessarily mean that the company has authority to operate as a lender.

How to file a privacy complaint with the NPC

As a general rule, you must first notify the lender, its Data Protection Officer, or the responsible entity in writing and allow it to act. Under the 2021 NPC Rules of Procedure, as amended, you may proceed when the entity fails to take timely or appropriate action or does not respond within 15 calendar days from receiving your notice.

The NPC may waive prior exhaustion for good cause or a serious violation—for example, where urgent NPC action is needed to prevent grave and irreparable harm, no adequate remedy is available from the respondent, or the alleged action is patently illegal. Explain and prove why a waiver is necessary rather than simply omitting the prior notice.

To file:

Download the current Complaint-Affidavit from the NPC complaint page. The form available as of the source-check date is the March 2026 version.
Identify the personal data processed and the respondent responsible for it. If the operator’s legal identity is unknown, provide all facts that may help identify it.
Narrate the events chronologically and specify the relief requested.
Attach your written notice to the respondent, proof of receipt, its response if any, documentary evidence, and witness affidavits where available.
Complete the verification and certification against forum shopping.
Have the complaint notarized and include a valid government-issued ID.
Submit it personally, by registered mail, courier, or by electronic mail as authorized by the NPC. The current form lists info@privacy.gov.ph; follow the filing page’s current PDF and signature requirements.

The standard NPC complaint filing fee is ₱500, plus a legal-research fee of 1% of the filing fee but not less than ₱10. Additional fees apply when damages are claimed. The NPC schedule of fees provides exemptions for qualifying indigent complainants. Its stated criteria include family gross income not exceeding twice the applicable monthly minimum wage and no real property with a fair market value above ₱300,000, supported by the prescribed barangay certificate, affidavits, and tax declaration if any. Obtain an assessment and use only an official NPC payment channel.

The NPC ordinarily has 30 calendar days from receipt to give the complaint due course or dismiss it without prejudice. Its public guidance estimates that proceedings through final adjudication may take approximately 10 to 12 months. Ongoing, serious processing may justify asking about a temporary ban, but that remedy has separate evidentiary, hearing, fee, and bond requirements.

If the creditor is BSP-supervised

If the actual creditor is a bank, digital bank, e-money issuer, or another BSP-supervised institution, first complain through that institution’s Financial Consumer Protection Assistance Mechanism. If its response is unsatisfactory, escalate through the BSP Online Buddy on the BSP website or submit the prescribed complaint form to consumeraffairs@bsp.gov.ph with proof that you first used the institution’s complaints process.

The BSP’s current complaint guide confirms that ordinary lending and financing companies and their online platforms fall under the SEC, not the BSP. Check the disclosure statement rather than assuming that an app’s payment partner or e-wallet is the lender.

When to contact law enforcement immediately

Call 911 if there is an immediate threat to life, safety, property, or an ongoing attempt to locate or attack you. The Unified 911 service connects callers to police and other emergency responders.

Promptly approach the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or your nearest police station when collectors:

Threaten physical violence, kidnapping, sexual harm, or property damage.
Demand payment to prevent the release of private or fabricated material.
Impersonate police officers, judges, lawyers, court personnel, or government agencies.
Use your identity, account, or documents for unauthorized transactions.
Publish fabricated accusations or manipulated photographs.
Continue stalking or targeting your home, workplace, or family.
Operate what appears to be a fraudulent or unlicensed lending scheme.

The NBI online complaint page accepts initial reports, while the NBI’s Cybercrime Division procedure explains in-person interviews, sworn statements, evidence submission, and device examination.

An SEC or NPC complaint does not automatically commence a criminal case. Conversely, filing with law enforcement does not replace the regulatory complaints where SEC or NPC action is also needed.

Protect your phone and accounts

After preserving evidence:

Revoke the app’s access to contacts, call logs, SMS, camera, microphone, location, photos, and storage unless an access permission remains genuinely necessary.
Uninstall the app if it is no longer needed, but understand that uninstalling does not erase data already copied to the lender’s systems.
Change passwords for email, social media, cloud storage, banking, and e-wallet accounts if compromise is possible.
Enable multi-factor authentication and review active sessions and linked devices.
Warn contacts not to click links, send money, reveal codes, or engage with collectors claiming to act for you.
Report abusive accounts and unlawful posts to the platform after preserving their URLs and contents.
Pay only through a verified company channel. Do not send funds to a collector’s personal account merely to stop threats.
Request a written statement of account and official receipt for every payment.

Common mistakes to avoid

Deleting the app or messages before preserving evidence.
Reporting only the app name without identifying the corporation or collection agency.
Sending screenshots that omit the sender, date, or surrounding conversation.
Failing to document messages sent to third parties.
Filing an NPC complaint without first giving written notice—or without explaining why the requirement should be waived.
Submitting an unsigned, unverified, or unnotarized NPC complaint.
Treating a character reference as a guarantor without a signed undertaking.
Paying an unverified account because a collector claims that arrest is imminent.
Ignoring a genuine court summons. Harassment may be unlawful, but the creditor may still pursue a valid civil claim.
Assuming that reporting abuse cancels the loan or suspends interest and payment obligations.

Reporting does not automatically erase the debt

The legality of collection conduct and the validity of the debt are separate questions. A borrower may owe a valid balance while still having enforceable rights against harassment and privacy violations.

The Constitution prohibits imprisonment merely for debt. That does not prevent a creditor from filing a civil case, and it does not protect conduct constituting a separate offense, such as fraud or the issuance of a dishonored check under circumstances covered by law. Never ignore official documents from a court or prosecutor; verify them directly with the issuing office and obtain legal advice promptly.

If the amount is disputed, ask for the signed agreement, disclosure statement, complete payment history, itemized interest and fees, and the basis for each charge. State in writing that the balance is disputed. Continue paying any undisputed amount only through a verified channel if appropriate under your documents and legal advice.

When legal help is urgent

Seek assistance from a Philippine lawyer, the Public Attorney’s Office if eligible, or a legal-aid organization when:

There are credible threats or stalking.
Intimate images, IDs, or sensitive records were posted or threatened with release.
The lender is contacting your employer or large groups of people.
Several apps appear to have shared your data.
You need an urgent order to stop continuing disclosure.
You suffered job loss, financial loss, medical harm, or serious reputational damage.
You received a subpoena, prosecutor’s notice, summons, or other genuine legal process.
You intend to claim damages or pursue criminal charges.
You are unsure which company actually controls the app or personal data.

Frequently asked questions

Can a lender contact my family or employer?

Not simply because their details appear in your phone. Collection contact should generally be directed to you and, where legally relevant, a genuine guarantor or co-maker. Disclosure to unrelated relatives, coworkers, or an employer may constitute unfair collection and unlawful data processing.

I was listed only as a character reference. Must I pay?

No—not on that basis alone. A character reference verifies identity or information; the reference is not automatically a guarantor. A guarantor must expressly undertake the obligation, and the lender must obtain separate consent.

Can collectors post my name or photograph online?

Public shaming and disclosure of loan information are not ordinary lawful collection methods. Preserve the post and URL, request takedown, and report the matter to the SEC and NPC. Contact law enforcement if the post involves threats, impersonation, extortion, identity misuse, or fabricated material.

Does giving the app access to my contacts make every use lawful?

No. Permission must still relate to a disclosed, lawful, necessary, and proportionate purpose. It does not authorize indiscriminate copying, third-party collection messages, or harassment.

May I block the collectors?

Yes, but preserve evidence and provide at least one reliable written channel for legitimate account communications. Blocking a number does not resolve the debt or prevent lawful notices.

Should I report an unregistered or fake app?

Yes. File with the SEC and include the app link, developer, advertisements, claimed company name, payment accounts, and collector details. Report suspected fraud or impersonation to law enforcement as well.

Can a third party who received the messages file a privacy complaint?

Potentially, yes. The recipient’s own name, number, relationship, messages, or other personal information may have been processed. The borrower and contacted person should preserve separate evidence and identify whose data was used or disclosed.

Will an SEC or NPC complaint stop collection immediately?

Not automatically. Ask the lender in writing to stop the unlawful conduct. If disclosure is ongoing and likely to cause grave or irreparable harm, obtain legal advice about urgent remedies, including the NPC’s temporary-ban procedure or appropriate court relief.

Official references

This article provides general Philippine legal information, not advice for a particular case. Outcomes depend on the communications, loan documents, parties’ identities, and available evidence. Laws, procedures, forms, fees, addresses, and filing channels were checked against official sources on 6 August 2026.