Quick answer

If an online lending app threatens, shames, insults, deceives, or contacts people who are not guarantors to pressure you into paying, preserve the evidence and report the conduct to the Securities and Exchange Commission (SEC). If the app accessed, copied, disclosed, or misused your contacts, photos, messages, or other personal data, notify the lender in writing and file a National Privacy Commission (NPC) complaint when the violation is not properly addressed. Report threats, fraud, identity theft, or immediate danger separately to the police, NBI, or DICT.

You may complain even if the loan is unpaid. Harassment and unlawful data processing do not become lawful merely because a debt exists. However, reporting misconduct does not automatically cancel a valid loan, stop lawful charges, or prevent a lender from pursuing proper civil remedies.

What collection practices are prohibited?

Under SEC Memorandum Circular No. 18, Series of 2019, financing and lending companies must not use unfair debt-collection practices. Prohibited conduct includes:

Violence or threats of violence, criminal acts, or harm to a person, reputation, or property.
Threats to take action that cannot legally be taken.
Obscenities, insults, or profane language that abuses the borrower or amounts to an offense.
Publishing or disclosing a borrower’s name or personal information outside lawful exceptions.
Communicating false loan information, including failing to say that a debt is disputed when that is known.
Using false representations or deceptive methods to collect a debt or obtain information.
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., subject to the circular’s stated exceptions for accounts more than 15 days past due or where the borrower gave express consent through written, electronic, or recorded means.
Contacting people in the borrower’s contact list who were not named as guarantors or co-makers.

A truthful, respectful demand for payment or notice that the lender may pursue a lawful case is not automatically harassment. The content, tone, timing, recipients, frequency, truthfulness, and threatened action all matter.

Privacy rules specifically protecting borrowers and their contacts

The Data Privacy Act of 2012 requires personal-data processing to have a lawful basis and to observe transparency, legitimate purpose, and proportionality. Agreeing to an app’s terms does not give it unlimited authority to copy, retain, disclose, or weaponize personal data.

Under NPC Circular No. 2022-02, which amended the rules for loan-related transactions:

An app may request only permissions that are suitable, necessary, and not excessive for a specified legitimate purpose.
Access to a camera or photo gallery may be allowed for identity verification, fraud prevention, or payment verification, but access must be turned off—or the borrower told it may be revoked—after that purpose is fulfilled.
A borrower’s photograph must not be used to harass or embarrass the borrower.
Unconstrained, excessive, or disproportionate processing of contact lists is prohibited.
An app may provide limited access so the borrower can select a character reference or guarantor, but it may not indiscriminately harvest or process the entire contact list.
A character reference may be contacted only to verify the applicant’s identity and the truth of application information. The person must be told how the details were obtained and must be offered a way to have the data removed.
A character reference does not automatically become a guarantor.
A guarantor must separately consent to assume the obligation. For debt collection, the lender may not contact ordinary entries in the borrower’s contact list.

A genuine co-borrower or co-maker may have separate contractual liability. Whether someone actually agreed to that role depends on the signed or authenticated documents—not merely on what a collector calls them.

The DICT, NPC, and SEC reaffirmed these rules in their March 2026 joint advisory on online lending platforms.

What to do immediately

1. Protect yourself

If a message contains a credible threat of physical harm, stalking, extortion, or a threat to visit your home or workplace violently, contact 911 or the nearest police station immediately. Do not wait for an SEC or NPC case to proceed.

Tell trusted household members, workplace security, or your barangay when a specific threat makes that appropriate. Avoid meeting a collector alone.

2. Preserve evidence before blocking or uninstalling the app

Save evidence in its original form whenever possible:

Screenshots showing the complete message, sender’s number or account, date, and time.
Screen recordings showing the conversation, account profile, and surrounding messages.
Original SMS, email, call logs, voice messages, chat exports, and social-media links.
Copies of messages received by relatives, co-workers, employers, or other contacts.
Statements or affidavits from people who were contacted.
The app-store page, app name, developer name, download link, version, and requested permissions.
The privacy notice, consent screens, loan agreement, disclosure statement, repayment schedule, and statement of account.
Proof of payments, official receipts, transaction reference numbers, and collection instructions.
Any edited photograph, public post, fake notice, supposed warrant, or false representation sent by the collector.
Your written complaint to the company and proof that it was received.

Keep an incident log listing each date, time, number, person contacted, exact conduct, and resulting harm. Back up the files to a secure location. Do not crop away information needed to identify the sender.

After preserving evidence, review the app’s permissions and revoke unnecessary access to contacts, storage, photos, camera, microphone, location, or social media. Change compromised passwords and enable multi-factor authentication. Uninstalling the app does not erase data it may already have copied.

3. Identify the company behind the app

The app’s brand may differ from the lender’s corporate name. Check the loan agreement, disclosure statement, privacy notice, payment records, app-store developer page, and collection messages for:

Corporate name and business address.
SEC registration number.
Certificate of Authority number.
Official email address and privacy or data-protection contact.
Name of any collection agency or third-party service provider.

Use the SEC’s Check with SEC portal to check the entity. Corporate registration alone is not the same as authority to operate as a lending or financing company. Include any missing, inconsistent, or apparently false registration details in your report.

Send a written complaint to the lender

A written complaint creates a record and is normally required before an NPC formal complaint. Send it to the company’s official customer-service address and its data protection officer or privacy contact, if available.

State:

Your name and loan or account reference, without sending unnecessary passwords or one-time PINs.
The app and corporate operator involved.
What happened, when it happened, and who was contacted.
What data appears to have been accessed, copied, disclosed, or misused.
Which statements or threats were false or abusive.
That you dispute any inaccurate loan information.
The action you want: stop the harassment, stop contacting non-guarantors, correct false information, disclose the source and recipients of your data, and block or delete unlawfully processed data subject to lawful retention requirements.
A reasonable request for a written response and preservation of relevant records.

Do not admit an amount you genuinely dispute. Ask for a complete statement of account and an itemized computation. If you intend to pay or negotiate, use a verified company channel—not a collector’s unexplained personal bank or e-wallet account.

Report unfair collection to the SEC

For a lending or financing company, submit a complaint through the SEC’s iMessage portal. Select the service for complaints on financing and lending companies under the Financing and Lending Companies Department, and retain the ticket or reference number.

Include:

The app name and corporate operator.
SEC registration and Certificate of Authority numbers, if known.
Collector or collection-agency details.
A concise chronological account.
Screenshots, recordings, messages to third persons, contracts, payment records, and your incident log.
The specific result requested, such as investigation of unfair collection or unauthorized lending activity.

The March 2026 joint advisory also lists the SEC hotline 1-4732 (1-4SEC). A report to an app store may help stop distribution, but it does not replace a complaint to the proper regulator.

If the lender is a bank, digital bank, e-money issuer, pawnshop, or another BSP-supervised institution, first use that institution’s Financial Consumer Protection Assistance Mechanism. If unresolved, escalate through the BSP Online Buddy (BOB) or follow the BSP complaint instructions. The BSP’s alternative email channel is consumeraffairs@bsp.gov.ph, using its Complaint/Inquiry/Reply form and proof that the institution was first given an opportunity to address the matter.

File a privacy complaint with the NPC

Give written notice first—unless an urgent exception applies

Under the 2021 NPC Rules of Procedure, as amended, an affected data subject normally must:

Inform the lender, app operator, data processor, or concerned entity of the privacy violation in writing; and
Show that it failed to take timely and appropriate action or did not respond within 15 calendar days after receiving the notice.

The NPC may waive these requirements for properly shown good cause or a serious violation posing a risk of harm—for example, grave and irreparable damage that only NPC action can prevent, lack of a plain and adequate remedy, or patently illegal conduct. Explain and document the urgency instead of simply omitting the prior-notice requirement.

This 15-day NPC step does not prevent you from immediately reporting threats or suspected crimes to law enforcement.

Prepare the formal complaint correctly

Use the NPC’s official complaint form and filing instructions. A formal complaint generally must be:

In writing, signed, verified, and notarized.
Filed by the affected data subject or an authorized representative. A representative generally needs a special power of attorney.
Directed against an identified respondent, or accompanied by facts that may lead to the respondent’s identity.
Supported by a clear narration, documentary evidence, witness affidavits when available, and all correspondence with the respondent.
Accompanied by a certification against forum shopping.
Clear about the relief requested.

The NPC currently allows submission in person, by courier, or by emailing a scanned notarized complaint to complaints@privacy.gov.ph.

Under NPC Circular No. 2023-01, the listed basic complaint filing fee is ₱500, plus a legal-research fee of 1% of the filing fee but not less than ₱10. Additional fees or bonds may apply to claims for damages or applications for special relief. Qualified indigent litigants may seek exemption by submitting the required proof. Check the NPC’s current instructions before paying.

A relative, friend, co-worker, or employer whose own contact details were obtained and used may also be an affected data subject and may consider filing a separate or properly joined complaint based on that person’s own facts.

Report threats, scams, and possible cybercrime

Collection conduct may also involve offenses such as threats, coercion, defamation, fraud, unlawful access, or computer-related identity theft. The applicable offense cannot be determined from a screenshot alone; intent, wording, publication, authority, and other facts matter. The Cybercrime Prevention Act includes computer-related fraud and identity theft and applies certain existing offenses when committed through information and communications technology.

The March 2026 government advisory lists these channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; (02) 8723-0401 local 7491

You may also report at the nearest NBI or PNP office. Bring identification, the device containing the original evidence, copies of the loan documents, and a chronological incident summary. Filing with the SEC or NPC does not automatically create a criminal case; report suspected crimes through law-enforcement channels as well.

Your debt and your complaint are separate issues

The 1987 Constitution provides that no person may be imprisoned for debt. A collector cannot lawfully arrange your immediate arrest merely because an ordinary loan remains unpaid, and a text message styled as a “warrant” is not a court-issued warrant.

This does not protect independent criminal conduct. Fraud, falsified documents, or the issuance of a dishonored check under circumstances covered by a penal law may present separate issues. A lender may also file a lawful civil case to collect a valid obligation.

Do not ignore a genuine summons, subpoena, court order, or prosecutor’s notice. Verify it directly with the named court or government office using independently obtained contact details, then obtain legal advice promptly.

Common mistakes to avoid

Deleting messages or uninstalling the app before preserving evidence.
Posting IDs, loan contracts, phone numbers, or intimate details publicly while asking for help.
Retaliating with threats or false public accusations.
Paying through an unverified personal account because a collector demands immediate transfer.
Assuming an SEC registration number proves that the app is licensed to lend.
Naming only the app and failing to identify its corporate operator or collection agency.
Filing only an app-store review or social-media complaint.
Treating a character reference as automatically liable for the loan.
Assuming broad app consent permits harassment or unlimited contact-list access.
Waiting for the lender’s 15-day privacy response despite an immediate physical threat or ongoing fraud.
Ignoring a valid debt, formal demand, or genuine court document because a regulatory complaint was filed.

When legal help is urgent

Seek assistance from a lawyer, the Public Attorney’s Office if eligible, or an appropriate legal-aid organization when:

There is a credible threat to your safety or someone is demanding money through threats.
Intimate images, fabricated posts, or identity documents have been published or threatened with publication.
Your accounts or identity appear to have been taken over.
You receive a genuine summons, subpoena, warrant, or prosecutor’s notice.
A lender claims you signed as a co-maker or guarantor but you dispute the document.
You are considering damages, an injunction, or other urgent relief.
Several lenders, collectors, or affected contacts are involved and the correct respondents are unclear.

Frequently asked questions

Can I complain even if I really owe money?

Yes. A valid debt does not authorize threats, public shaming, deception, or unlawful use of personal data. Continue addressing the legitimate account separately.

May the app contact my family, friends, or employer?

Not merely because their information appeared in your contact list. A character reference may be contacted for limited verification purposes, not debt collection. A separately consenting guarantor may be contacted regarding the obligation. A genuine co-borrower or co-maker may be treated differently depending on the contract.

Can a collector threaten me with arrest?

Not for ordinary nonpayment alone. The lender may truthfully describe lawful civil remedies, but it must not falsely claim that arrest, imprisonment, or a warrant is automatic. Separate alleged crimes require proper legal process.

Should I block the collector?

Preserve the complete evidence first. You may then block abusive numbers if necessary for safety, while keeping at least one written channel for legitimate account communications.

Does revoking permissions delete information already copied?

No. It can stop future device access but may not remove data already transferred. Send a written data-subject request asking what was collected, its source, its recipients, retention period, and the lawful basis for continued processing.

Will an SEC or NPC complaint cancel the loan?

Not automatically. The agencies may investigate regulatory or privacy violations, but the enforceability and amount of the debt depend on the contract, disclosures, payments, charges, and applicable law.

Do I need a lawyer to report harassment?

Generally, no. You can submit SEC and law-enforcement reports yourself and use the NPC’s official complaint form. Legal help becomes especially important for urgent court relief, damages, disputed signatures, criminal allegations, or actual court proceedings.

Official references

This article provides general Philippine legal information, not legal advice for a particular case. The proper remedy may depend on the lender’s regulator, the loan documents, the messages, the data accessed, and the identity of the collector. Laws, procedures, fees, and contact channels were checked against official sources on 6 August 2026.