If an online lending app is threatening you, insulting you, posting your photo, or messaging your relatives, coworkers, and phone contacts about your debt, save the evidence before blocking anyone. You may report the same conduct to several agencies because each handles a different violation: the Securities and Exchange Commission (SEC) handles abusive collection by lending and financing companies, the National Privacy Commission (NPC) handles misuse of personal data, and law-enforcement agencies investigate threats, impersonation, cyberlibel, and other possible crimes.

What Counts as Online Lending App Harassment?

A lender may send lawful payment reminders, state the correct amount due, propose a payment arrangement, or file a civil collection case. Collection becomes potentially unlawful when it uses intimidation, deception, humiliation, excessive disclosure, or coercion.

Common examples include:

Threatening to arrest or imprison you merely because you cannot pay
Claiming that a warrant, criminal case, or court order already exists when none does
Pretending to be a police officer, lawyer, prosecutor, court employee, or government agency
Threatening physical harm, property damage, or harm to your family
Using obscene, degrading, or insulting language
Repeatedly calling at unreasonable hours
Posting your name, photograph, ID, loan balance, or edited “wanted” poster on social media
Messaging your employer, coworkers, relatives, or unrelated phone contacts to shame you
Treating a character reference as a guarantor even though that person never agreed to guarantee the debt
Accessing or copying an entire phone contact list when only limited information was reasonably necessary
Threatening to seize property or garnish salary without first obtaining a court judgment and the proper writ
Demanding payment through an employee’s personal bank account or e-wallet while refusing to provide an official receipt

A real debt does not give a lender permission to harass the borrower. At the same time, reporting harassment does not automatically cancel the principal, lawful interest, or other valid charges under the loan agreement.

Philippine Laws That Protect Borrowers

SEC rules on unfair debt collection

SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair collection practices by financing companies, lending companies, and third-party collection service providers acting for them.

Prohibited practices include:

Threats, intimidation, violence, or coercion
Obscene, insulting, or profane language
False or deceptive representations
Disclosure or threatened disclosure of false loan information
Communicating with people in the borrower’s contact list who are not guarantors or co-makers
Contacting borrowers at unreasonable or inconvenient hours, generally before 6:00 a.m. or after 10:00 p.m., subject to limited regulatory exceptions
Publishing borrowers’ names and personal information to shame them

A lender remains responsible for collection agencies and outsourced collectors acting on its behalf. It cannot avoid liability simply by saying that an abusive message came from an independent collector.

Republic Act No. 11765, the Financial Products and Services Consumer Protection Act of 2022, strengthens the rights of financial consumers to fair treatment, disclosure, privacy, and effective complaint handling. SEC Memorandum Circular No. 5, Series of 2023 implements the law for institutions under SEC supervision and prohibits abusive debt-recovery practices.

Data Privacy Act and access to phone contacts

Republic Act No. 10173, the Data Privacy Act of 2012, requires personal-data processing to be transparent, for a legitimate purpose, and proportionate to that purpose.

NPC Circular No. 2020-01, as amended by NPC Circular No. 2022-02, specifically regulates personal data used in loan-related transactions. Among other protections:

App permissions must be relevant and limited to what is necessary.
Lenders must provide appropriate privacy information when data is collected.
Access to a contact list cannot be unrestrained or used for harassment.
The app should allow a borrower to select a reference or guarantor without harvesting the entire address book.
A character reference may be contacted to verify the borrower’s identity or information, but not to collect the debt.
A character reference is not automatically a guarantor.
A guarantor must have expressly agreed to undertake that legal obligation under the Civil Code rules on guaranty.

Using a borrower’s contacts or photographs to shame the borrower may amount to unauthorized processing, processing for an unauthorized purpose, unauthorized disclosure, or malicious disclosure under Sections 25, 28, 31, or 32 of the Data Privacy Act.

In Grace M. Trimillos v. FCash Global Lending, Inc., G.R. No. 271360, August 13, 2025, the Supreme Court reinstated an NPC decision awarding nominal damages and recommending prosecution after a lending app accessed a borrower’s contacts and sent loan-related messages to them. The case also shows why evidence from message recipients matters: screenshots should ideally be supported by affidavits from the people who actually received the messages.

Threats, coercion, cyberlibel, and other possible crimes

Depending on the exact words, conduct, and evidence, abusive collectors may face investigation under:

Article 282 of the Revised Penal Code on grave threats
Article 286 on grave coercion
Article 287 on unjust vexation
Articles 353 and 355 on libel
Section 4(c)(4) of Republic Act No. 10175, the Cybercrime Prevention Act of 2012, when libel is committed through a computer system
Data Privacy Act offenses involving unauthorized or malicious processing and disclosure

Articles 19, 20, 21, and 26 of the Civil Code may also support a civil claim for damages when conduct violates another person’s rights, privacy, dignity, or peace of mind.

Where to Report Online Lending Harassment

Situation	Primary office	What the office can address
Lending or financing company uses abusive collection tactics	SEC Financing and Lending Companies Department	Administrative violations, fines, suspension, or revocation of authority
App accesses contacts, photos, or other data and discloses them	National Privacy Commission	Privacy violations, administrative fines, damages, compliance orders, and possible DOJ referral
Messages contain threats, impersonation, extortion, fake warrants, or defamatory posts	PNP Anti-Cybercrime Group, NBI Cybercrime Division, or local police	Criminal investigation and evidence gathering
Lender is a bank, e-wallet issuer, or another BSP-supervised institution	Institution’s consumer-assistance unit, then BSP	Financial-consumer complaints involving BSP-supervised entities
Harassment presents an immediate physical danger	911 or the nearest police station	Immediate protection and incident response

Most standalone online lending platforms and financing companies are regulated by the SEC, not the Bangko Sentral ng Pilipinas. The BSP itself directs complaints about financing companies, lending companies, online lending platforms, and their collection agencies to the SEC in its consumer complaint guide.

How to Report an Online Lending App Step by Step

1. Preserve the evidence before blocking or uninstalling the app

Take screenshots showing:

The full message, not only the threatening sentence
Sender’s number, account name, profile, or email address
Date and time
Earlier messages that provide context
The app’s name and developer
Social-media URLs, usernames, group names, and post dates
Call logs showing frequency and time of calls
App permissions for contacts, photos, files, camera, microphone, SMS, and location

Where possible, make a screen recording that begins with the sender’s profile or phone number and continues into the conversation. Export original emails rather than relying only on screenshots. Keep the original phone and messages because investigators may need to examine them.

Ask every relative, coworker, or friend who received a message to:

Retain the original message on their device
Take uncropped screenshots
Record the sender’s number and exact receipt time
Prepare a signed affidavit describing what they personally received

This addresses a common evidentiary weakness identified in the Trimillos case.

2. Identify the company behind the app

The app’s brand name may be different from the corporation that granted the loan. Check:

Loan agreement and disclosure statement
Privacy notice and terms of service
Payment receipts
App-store developer information
Emails containing the approval or statement of account
Collection messages naming a principal company

Use the SEC’s Check with SEC service to see whether the company has the required registration and authority. Record both the app name and corporate name in the complaint. If you cannot identify the company, include the app-store link, developer name, payment account, phone numbers, and every available identifier.

3. Send a written complaint to the lender

Write to the lender’s official customer-service or data-protection address. State:

Your name and loan-account reference
The dates and exact acts complained of
The numbers or accounts used by collectors
Which contacts received messages
What personal information was disclosed
The action requested, such as stopping third-party contact, removing unlawfully collected data, correcting the account, or investigating the collector

Request a written response and save proof of delivery. For an NPC complaint, this step is especially important. The NPC normally requires the complainant to give the respondent an opportunity to address the privacy violation. If the respondent takes no timely or appropriate action, or gives no response within 15 calendar days, attach proof to the formal complaint. If contacting the respondent would be dangerous or impracticable, explain that clearly in the NPC form.

Do not wait 15 days before contacting the police when there is an immediate threat.

4. File a complaint with the SEC

Use the official SEC iMessage ticketing system. Create or sign in through an eSECURE account, then select:

Financing and Lending Companies Department → Complaints on Financing and Lending Companies

Attach:

A chronological complaint summary
Loan agreement or disclosure statement
Screenshots and call logs
Proof of payments
Complaint previously sent to the lender and its reply
Names and affidavits of third-party message recipients
Valid ID, with unnecessary information redacted where appropriate
App-store link and company information
The specific remedy requested

The system issues an electronic ticket that can be monitored online. The SEC iMessage user guide explains how to create a ticket, check its status, and upload additional documents through the conversation thread.

Opening an ordinary complaint ticket does not display a filing fee. The SEC may later require a verified statement, affidavit, original document, or additional submission depending on how the matter is processed. Respond promptly to “for compliance” notices; an incomplete ticket can be closed while awaiting action from the complainant.

5. File a privacy complaint with the NPC

Use the current NPC Complaint-Affidavit form, which requires:

Complainant and respondent information
Identification of the personal data processed
A chronological narration
Applicable Data Privacy Act violations
Proof that the respondent was first notified, or an explanation for not doing so
An evidence list
The relief requested
A valid government-issued ID
A notarized signature
Supporting affidavits from witnesses or message recipients

The form may be submitted personally, by registered mail or courier, or through the electronic channel authorized by the NPC. Check the NPC complaint page immediately before filing because addresses, email channels, payment instructions, and form versions can change.

The NPC’s current office is at the 25th–27th Floors, The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Barangay Paligsahan, Quezon City. Its official website lists the current complaints hotline and electronic filing channel.

Under NPC Circular No. 2023-01, the basic filing fee is ₱500, plus a legal research fee of at least ₱10. Additional fees apply if damages are claimed. An application for a cease-and-desist order has a separate fee and bond requirement. Qualified indigent litigants may seek exemption by submitting the required barangay certificate of indigency and supporting affidavits.

6. Report criminal conduct to law enforcement

For threats, fake warrants, impersonation, extortion, cyberlibel, or account-related fraud, file with one of the following:

PNP Anti-Cybercrime Group or the nearest police cybercrime unit
NBI Cybercrime Division or a regional NBI cybercrime office
Cybercrime Investigation and Coordinating Center for assistance and referral
The local police station when there is immediate danger

Bring:

A valid ID
Printed and electronic copies of the messages
The original phone or device
A written chronology
Loan documents
Sender numbers, account links, payment accounts, and URLs
Affidavits of recipients or witnesses
A barangay or police blotter, if one was already made

The NBI’s official procedure for computer-crime victims includes executing sworn statements and presenting the relevant device and supporting documents. Intake has no stated government filing fee, although notarization, printing, and travel may cost money.

A police or NBI report begins an investigation; it is not yet a criminal case in court. If evidence supports an offense, the complaint may proceed to the prosecutor for preliminary investigation.

Evidence Checklist

Evidence	Why it matters
Loan agreement and disclosure statement	Identifies the creditor and terms
App-store page and developer details	Connects the app to its operator
Complete screenshots and screen recordings	Shows the sender, wording, date, and context
Original emails or exported messages	Preserves metadata and improves authenticity
Call logs	Shows unreasonable timing or repeated contact
App-permission screenshots	Supports claims of excessive data access
Affidavits from relatives, friends, or coworkers	Proves third-party disclosure and authenticates received messages
Proof of written complaint to the lender	Satisfies or supports NPC exhaustion requirements
Payment records and account statements	Prevents disputes over the account history
Social-media URLs and platform reports	Helps preserve evidence of public shaming
Medical or employment records, if relevant	May support a properly pleaded claim for actual harm

Keep one master folder and label attachments consistently, such as “Annex A – Loan Agreement” and “Annex B-1 – Message dated 15 July 2026.” A short chronological index is more useful than hundreds of unorganized screenshots.

What Happens After You File?

The SEC may require the company to comment, explain its collection practices, identify its collector, or submit records. Administrative proceedings can result in fines or affect the company’s authority to operate.

The NPC first checks whether the complaint is sufficient in form and substance and whether the respondent was given an opportunity to address the issue. An investigating officer may require comments, evidence, affidavits, conferences, or mediation. If a violation is established, the NPC may impose administrative remedies, award appropriate damages, or refer possible criminal violations of the Data Privacy Act to the Department of Justice.

Law-enforcement investigators may ask to examine the original device, obtain subscriber or platform records, identify the sender, and take additional sworn statements. Anonymous prepaid numbers, foreign-hosted platforms, incomplete company information, and deleted messages commonly delay investigations.

There is no reliable uniform completion period. Acknowledgments and ticket numbers may be issued quickly, but a contested administrative or criminal investigation can take several months or longer. Keep every reference number and follow up through the same case thread rather than opening duplicate complaints.

Common Mistakes That Weaken a Complaint

Deleting the app or messages before preserving evidence
Submitting cropped screenshots that hide the sender and date
Filing against only the app name without identifying the corporate lender
Accusing every payment reminder of being harassment
Failing to show which third parties received the messages
Omitting affidavits from message recipients
Filing an NPC complaint without first notifying the respondent or explaining why notification was not possible
Using an obsolete NPC form
Ignoring an agency request for additional documents
Posting unredacted IDs or loan documents publicly
Paying a collector’s personal e-wallet without verifying authority
Assuming that an SEC or NPC complaint automatically suspends the loan

Continue to dispute incorrect charges in writing and request an itemized statement. If making payment, use only a verified official channel and obtain a receipt.

Special Situations

If the app contacts your employer

An employer or coworker is not liable for your personal loan merely because their number appeared in your phone. Ask the recipient to preserve the message and execute an affidavit. Include resulting workplace consequences only if they can be documented.

If you never borrowed from the app

State clearly that the loan is unauthorized or the result of identity misuse. Obtain the supposed agreement, disbursement record, recipient account, IP or device information, and identity-verification documents. Report possible identity theft or fraud to law enforcement as well as the NPC and SEC.

If a character reference is being forced to pay

A reference is not a guarantor. Under the Civil Code, guaranty requires an express undertaking; it is not presumed. The reference may separately complain to the NPC because their own personal data is being processed and they are personally receiving the harassment.

If you are an OFW or foreign national outside the Philippines

SEC iMessage can be accessed online. For a notarized NPC complaint or witness affidavit executed abroad, documents may be signed before a Philippine embassy or consulate. Alternatively, a document notarized in a country covered by the Apostille Convention will generally require an apostille for official use in the Philippines. Documents from non-Apostille countries may require the applicable authentication process. Confirm the agency’s requirements before sending originals.

Citizenship does not excuse a Philippine lender from complying with Philippine consumer-protection and privacy laws when the transaction and data processing fall within their scope.

If the collector threatens to file a case

A lender may lawfully file a civil collection or small-claims case. A genuine case produces official court documents, a case number, and summons served through lawful procedure. A collector cannot create a warrant, garnish wages, or seize property merely by sending a text message.

The Constitution prohibits imprisonment for debt. Fraud committed when obtaining a loan, a bouncing-check offense, or another independently provable crime is different from simple inability to pay.

Frequently Asked Questions

Can an online lending app contact everyone in my phone?

No. Contacting people in your phonebook who are not guarantors or co-makers is an unfair collection practice. NPC rules also prohibit unrestrained processing of contact lists for harassment or debt collection.

Can a lending app post my photo on Facebook?

Using your photo and loan information to shame you may violate SEC collection rules and the Data Privacy Act. Preserve the post’s URL, account name, date, comments, and screenshots before reporting it to the platform, SEC, and NPC.

Can I be arrested for not paying an online loan?

Not for nonpayment alone. A lender must ordinarily use civil remedies. Arrest requires an independently prosecutable offense, proper criminal procedure, and a lawful warrant when one is required.

Should I report to the SEC or NPC?

File with the SEC for abusive collection by a lending or financing company. File with the NPC when personal data, contacts, photos, or loan information were accessed or disclosed improperly. The same incident may justify both complaints.

Can I report an unregistered lending app?

Yes. Give the SEC every available identifier, including the app link, developer, phone numbers, payment accounts, loan documents, and screenshots. Unregistered operation does not remove the app’s obligations under criminal and privacy laws.

Do I need a lawyer to file?

Agency complaint forms are designed to be filed by consumers. The complainant must still present clear facts, identify the respondent as accurately as possible, and attach competent evidence.

Should I block the collector?

Preserve the complete evidence first. You may then block abusive numbers and revoke unnecessary app permissions. Keep at least one safe written channel open if you need an account statement or legitimate payment instructions.

Does filing a complaint erase my loan?

No. The debt and the collection misconduct are separate issues. A valid debt may remain collectible even when the lender or collector is administratively or criminally liable for harassment.

Can my relative file for me?

For an NPC case, an authorized representative generally needs a special power of attorney. If the relative personally received abusive messages or had their own data misused, they may also file as an affected data subject.

How long does an online lending harassment complaint take?

An online ticket or acknowledgment may be issued quickly, but investigation and adjudication can take months or longer, particularly when the sender is anonymous, evidence is incomplete, or the respondent contests the allegations.

Key Takeaways

Preserve complete, uncropped evidence before blocking numbers or uninstalling the app.
Report abusive collection by lending and financing companies through SEC iMessage.
File with the NPC when contacts, photographs, IDs, or loan information were accessed or disclosed improperly.
Report threats, impersonation, fake warrants, cyberlibel, and fraud to the PNP, NBI, or other cybercrime authorities.
Obtain affidavits from relatives, coworkers, or friends who received collection messages.
A character reference is not automatically a guarantor.
Nonpayment alone does not permit arrest, public shaming, or seizure of property.
A harassment complaint does not automatically cancel a valid loan, so keep the account dispute and the misconduct complaint properly documented.