Quick answer

If an online lending app threatens, insults, publicly shames, or contacts people who did not legally guarantee your loan, preserve the evidence and report the responsible company to the Securities and Exchange Commission (SEC). If it accessed, copied, disclosed, or misused personal data, also complain to the National Privacy Commission (NPC). For credible threats, extortion, stalking, impersonation, or other possible crimes, contact the police or National Bureau of Investigation (NBI) immediately.

A practical sequence is:

Capture the messages, posts, call logs, app permissions, loan documents, and identity of the lender before blocking or uninstalling anything.
Revoke unnecessary app permissions and secure your accounts.
Send a written complaint to the lender’s consumer-assistance unit and data protection officer.
File an SEC complaint through the SEC iMessage portal.
For privacy violations, follow the NPC’s written-notice requirement and file a notarized complaint using the NPC complaint procedure.
Call 911 or approach the police or NBI if anyone is in immediate danger.

Reporting abusive collection does not automatically cancel a valid loan. The lender may still collect through lawful, respectful means, while disputes about the balance, interest, fees, or validity of the loan are resolved separately.

What conduct may be reported?

The right to collect a legitimate debt does not include the right to threaten, deceive, humiliate, or misuse personal information.

Under SEC Memorandum Circular No. 18, Series of 2019, financing and lending companies—and the third-party collectors they hire—must refrain from unfair collection practices. Reportable conduct includes:

Threatening or using violence or other criminal means to harm a person, reputation, or property.
Threatening action that cannot legally be taken.
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense.
Publishing or disclosing the borrower’s name, photograph, debt, or other personal information to shame the borrower.
Communicating, or threatening to communicate, loan information known or reasonably expected to be false.
Pretending to be a police officer, court employee, lawyer, government representative, or another person, or otherwise using deception to collect.
Contacting the borrower before 6:00 a.m. or after 10:00 p.m., unless the account is more than 15 days past due or the borrower expressly agreed—through written, electronic, or recorded means—that those are the only reasonable times for contact.
Contacting people in the borrower’s contact list who were not named as guarantors or co-makers.

The time-of-contact exception does not authorize threats, insults, deception, or public shaming. Those acts remain prohibited regardless of when the collector communicates.

The Financial Products and Services Consumer Protection Act, Republic Act No. 11765, separately protects financial consumers’ rights to fair treatment, data privacy, disclosure, and timely complaint handling. It prohibits abusive collection or debt-recovery practices. A financial service provider remains responsible for its employees and agents and may be solidarily liable with an accredited third-party service provider involved in debt collection.

Contact-list access, character references, and guarantors

A common violation occurs when an app harvests the borrower’s phone contacts and messages relatives, friends, employers, or co-workers.

Under NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02:

An app may require access to personal data only when suitable, necessary, and not excessive for a legitimate purpose.
Unrestricted or disproportionate processing of contact lists is prohibited.
Contact-list processing that leads to harassment, unfair collection, or collection from people other than the borrower’s guarantors is prohibited.
The app may provide a limited interface that lets a borrower choose a character reference or guarantor, but it should not freely harvest and copy the entire contact list for collection.
A character reference may be contacted to verify the borrower’s identity and the accuracy of application information. A character reference is not automatically a guarantor and should not be pursued for payment.
A guarantor must have separately and expressly agreed to be responsible under the applicable rules on guaranty. The borrower cannot make another person a guarantor merely by entering that person’s phone number.
A borrower’s photo may be processed for a legitimate purpose such as know-your-customer verification or payment verification at the relevant stage. It cannot be altered, posted, or sent to embarrass the borrower.

Allowing a phone permission does not give the lender unlimited authority to copy, retain, disclose, or use the data for harassment. Consent must be informed and tied to a lawful, specific purpose.

Some limited disclosures may still be lawful—for example, disclosures required by law or court order, or necessary communications with an authorized collection agency or legal counsel. Those exceptions do not permit social-media shaming or disclosure to uninvolved relatives, friends, or employers.

Privacy rights you may exercise

The Data Privacy Act of 2012, Republic Act No. 10173, gives data subjects rights that may include:

Being informed about the data collected, its purpose, recipients, and retention period.
Accessing personal data held by the lender.
Correcting inaccurate or incomplete information.
Objecting to certain processing.
Seeking blocking, removal, or destruction of data that was unlawfully obtained, used for unauthorized purposes, is no longer necessary, or is otherwise covered by the statutory grounds.
Filing a complaint and seeking appropriate relief for unlawful processing or disclosure.

Deletion is not automatic or absolute. A lender may retain information that remains necessary for an active loan, regulatory compliance, fraud prevention, accounting, or the establishment or defense of legal claims. A request should therefore identify the particular data and explain why its continued processing is unlawful, excessive, or no longer necessary.

The NPC’s lending rules cover entities acting as lenders or financing companies even if they did not obtain the required SEC authority. An apparently unregistered app may therefore still be reported to both the SEC and NPC.

Preserve evidence before blocking or uninstalling

Create an incident folder and keep the original files whenever possible. Preserve:

The app’s exact name, icon, version, developer, download page, website, and privacy policy.
The corporate name shown in the loan agreement, disclosure statement, privacy notice, payment instructions, or app-store listing.
Any SEC registration number or Certificate of Authority number displayed by the lender.
The loan agreement, disclosure statement, repayment schedule, receipts, and account ledger.
Screenshots or screen recordings showing the permissions requested by the app.
Messages showing the sender’s number or account, complete text, date, and time.
Call logs and existing voicemails.
Social-media posts, including the account name, URL, date, audience, comments, and images.
Messages received by relatives, friends, employers, or other contacts.
Written statements or affidavits from people contacted by the collector.
The collector’s claimed name, company, agency, telephone number, payment account, and identification.
Your written complaint to the lender and proof of delivery or receipt.
The lender’s replies, ticket numbers, promises, or refusal to act.
Proof that disputed information is false, such as payment receipts or a corrected account statement.

Keep an untouched backup in secure cloud storage or another device. Avoid editing screenshots beyond making separate redacted copies for public use.

Do not secretly record a private telephone conversation without legal advice. The Anti-Wiretapping Act, Republic Act No. 4200, generally prohibits secretly recording private communications without authorization from all parties. Existing text messages, voicemails voluntarily left by the caller, call logs, and witness accounts can be preserved without making a covert recording.

Stop further access and secure your accounts

After preserving the evidence:

Revoke the app’s access to contacts, photos, camera, microphone, location, files, SMS, and call logs unless a permission remains genuinely necessary.
Review whether the app has device-administrator, accessibility, notification-access, or “display over other apps” privileges, and disable unnecessary access.
Change passwords for email, social media, cloud storage, and financial accounts if the app may have exposed them.
Enable multi-factor authentication.
Report and request removal of humiliating posts through the relevant social-media platform, but save the URL and evidence first.
Block abusive numbers after preserving the messages.
Tell affected contacts not to send money, reveal information, or argue with the collector. Ask them to preserve what they received.
If identity documents or account credentials were exposed, notify the affected bank, e-wallet, or service provider immediately.

Uninstalling the app does not delete information already copied to the lender’s servers or shared with a collection agency.

Send a written complaint to the lender

Send the complaint to the lender’s consumer-assistance unit and data protection officer using the email address, in-app channel, or address in the contract or privacy notice. Keep proof that it was received.

Include:

Your name and account or loan reference number.
The app’s name and the lender’s corporate name.
A dated timeline of the harassment or privacy violation.
The collector’s numbers, accounts, and claimed identity.
The people contacted and whether any of them actually agreed to be guarantors.
The personal data accessed, copied, altered, posted, or disclosed.
A clear statement of any amount or information you dispute.
Copies of key evidence.
The action requested, such as stopping contact with non-guarantors, removing a post, correcting the account, identifying the collection agency, restricting unlawful processing, and confirming the result in writing.
A request that the lender preserve relevant collection logs, call records, instructions, and access records while the complaint is pending.

Use factual language. Do not include threats or publish unredacted IDs and financial records on social media.

For an NPC complaint, this written notice is especially important: the complainant ordinarily must first inform the respondent in writing and allow it to act.

File the SEC complaint

For an online lending platform operated by a lending or financing company, use the SEC iMessage portal. The SEC’s current user guide identifies “Complaints on Financing and Lending Companies” as a service of the Financing and Lending Companies Department.

To file:

Open a new ticket and sign in or register through eSECURE.
Select Complaints on Financing and Lending Companies.
Name the responsible corporation, not only the app or trade name. If the corporation is unknown, provide all identifying details available from the app, contract, privacy notice, payment account, and messages.
Describe each incident separately, with dates, times, channels, recipients, and the words or conduct complained of.
State whether the collector was the lender’s employee or a named collection agency.
Attach the loan documents, screenshots, call logs, posts, correspondence, and witness evidence.
State the relief requested and disclose any related complaints filed with the NPC, police, NBI, BSP, or another agency.
Save the ticket number and monitor the portal for requests for clarification or additional documents.

An unregistered or unauthorized lender should also be reported. Lack of registration is not a reason to withhold a complaint.

File the NPC privacy complaint

Under the 2021 NPC Rules of Procedure, as amended in 2024, the usual process is:

Notify the respondent in writing. Identify the privacy violation or data breach and request appropriate action.
Allow 15 calendar days from receipt. You may proceed if the respondent takes no timely or appropriate action or does not respond within that period.
Use the current Complaints-Assisted Form. Download it from the NPC complaint page. Prepare one complaint form per respondent.
Complete and notarize the form. The complaint must be verified and accompanied by the required certification against forum shopping.
Attach the evidence. Include correspondence with the respondent, proof of receipt, screenshots, witness affidavits if available, and copies of supporting documents.
Submit it to the NPC. The NPC currently accepts filing in person, by registered mail, by courier, or by authorized electronic mail. Its filing page directs scanned complaints to complaints@privacy.gov.ph. Follow the current instructions for PDF and electronic-signature requirements.
Check applicable charges. The NPC publishes its current schedule of fees and charges on the filing page. Exemptions or waivers may apply in circumstances recognized by its rules.

The NPC may waive the prior-notice requirement for good cause or a serious violation, including circumstances involving grave or irreparable harm, lack of an adequate remedy from the respondent, or patently illegal conduct. The facts supporting a waiver should be specifically alleged and supported by evidence; a waiver is discretionary, not automatic.

The NPC rules give the investigating office 30 calendar days from receipt to determine whether to give the complaint due course or dismiss it without prejudice. This is an initial evaluation period, not a promise that the entire case will be decided within 30 days.

If continuing processing creates serious harm, a complainant may ask for a temporary ban on processing. This requires a separate motion, supporting facts, a summary hearing or equivalent submissions, and ordinarily a bond fixed by the investigating officer. Because this remedy has procedural and financial requirements, legal assistance is advisable.

What if the app is connected to a bank or another regulator?

Check the legal entity in the contract and privacy notice.

SEC: Lending companies, financing companies, their online lending platforms, and their collection agencies.
BSP: Banks, digital banks, e-money issuers, and other BSP-supervised financial institutions. Complain first through the institution’s own consumer-assistance mechanism. If unresolved, escalate through the BSP Consumer Assistance Mechanism.
CDA: A cooperative offering credit may fall under the Cooperative Development Authority, subject to exceptions for cooperative banks and other BSP-supervised institutions.
NPC: Privacy violations may be reported to the NPC regardless of which financial regulator supervises the lender.

When unsure, identify the corporate entity and submit the facts to the regulator that appears to have jurisdiction. Disclose any parallel filing so agencies can properly coordinate or refer the matter.

When police or NBI help is urgent

Do not wait for an SEC or NPC case if the conduct involves:

A credible threat of physical harm, kidnapping, sexual violence, property damage, or stalking.
Extortion or a demand for money to prevent publication of personal data or intimate material.
Police, court, or government impersonation.
A fabricated arrest warrant, subpoena, criminal complaint, or official document.
Account takeover, identity theft, unauthorized financial transactions, or fraudulent use of an ID.
Publication of a home address or real-time location that creates an immediate safety risk.
Persistent harassment suggesting the collector is approaching the home, school, or workplace.

For immediate danger, call the Philippines’ Unified 911 Emergency Hotline. For cyber-enabled offenses, approach the nearest police station or the NBI. The NBI lists its Cybercrime Division and complaint channels on its official website.

Preserve the device and messages, and follow law-enforcement instructions before resetting the phone. A platform report or regulatory complaint does not replace a criminal report when personal safety is at risk.

Common mistakes to avoid

Uninstalling the app before preserving its permissions, privacy notice, and identifying information.
Naming only the app instead of the corporation responsible for it.
Describing the conduct only as “harassment” without dates, words used, numbers, recipients, or screenshots.
Assuming that every character reference is a guarantor.
Filing an NPC complaint without first sending written notice or explaining why the requirement should be waived.
Omitting proof that the lender received the written notice.
Submitting altered, cropped, or unreadable evidence without retaining the original.
Publishing an unredacted complaint, ID, phone number, address, or loan documents on social media.
Paying a collector’s personal account without verifying that it is an authorized payment channel.
Secretly recording private calls without considering the Anti-Wiretapping Act.
Ignoring genuine court papers. Verify a summons or order directly with the named court or agency rather than relying on a collector’s screenshot or telephone claim.
Assuming that reporting harassment automatically erases the debt or stops lawful interest and charges.

Frequently asked questions

Can a lender contact my family, friends, or employer?

Generally, it may not contact random phone contacts for debt collection. A true guarantor who separately agreed to answer for the debt may be contacted. A character reference may be contacted for the limited purpose of verifying identity and application information, but is not automatically a guarantor. Public shaming or disclosure of the debt to uninvolved people may violate SEC and privacy rules.

What if I clicked “Allow contacts”?

That does not authorize unlimited harvesting, retention, disclosure, or harassment. Processing must still be lawful, necessary, proportionate, transparent, and limited to the stated purpose.

Can a person contacted by the app complain even if they are not the borrower?

Yes, if the app processed or disclosed that person’s own information or directly harassed them. They should preserve the messages and may file in their own name as the affected data subject. The NPC generally requires one complaint per respondent.

Can a collector have me arrested for not paying?

The 1987 Constitution states that no person may be imprisoned for debt. Nonpayment by itself is not a basis for arrest. Separate conduct—such as an independently alleged fraud or another statutory offense—may be investigated through proper legal process, but a collector cannot lawfully invent a criminal case or arrest warrant to frighten a borrower.

Does filing a complaint cancel the loan?

No. A valid principal obligation may remain collectible. Continue requesting an accurate account statement, dispute unauthorized charges in writing, and propose a realistic payment arrangement if appropriate. Do not admit a disputed amount merely to stop harassment.

Should I block the collector?

Preserve the evidence first. You may then block abusive numbers, while leaving a safe written channel through which the lender can send legitimate account information. State that lawful communications should be made through that channel.

Which complaint should I file first?

Send the written notice to the lender immediately. An SEC complaint may then be filed for unfair collection. For the NPC, ordinarily wait until the lender fails to take appropriate action or 15 calendar days pass without a response, unless the facts justify asking the NPC to waive that requirement. Contact law enforcement immediately if there is danger or suspected criminal conduct.

Official references

This article provides general Philippine legal information, not legal advice for a particular case. The correct remedy may depend on the lender’s identity, loan documents, communications, and the specific data processed. Seek a Philippine lawyer promptly where there are threats, pending court papers, substantial financial loss, identity theft, or continuing publication of personal data. Laws, rules, and official procedures were checked as of 6 August 2026.