Quick answer

You may report an online lending app through more than one channel:

Harassment or abusive debt collection by a lending or financing company: complain first to the company’s consumer-assistance unit, then file through the SEC iMessage portal under “Complaints on Financing and Lending Companies.”
Misuse or disclosure of contacts, photos, IDs, messages, or other personal data: notify the company or its Data Protection Officer in writing. If it does not take appropriate action—or does not respond within 15 calendar days—file a formal complaint with the National Privacy Commission.
A loan issued by a bank or another BSP-supervised institution: use the institution’s complaint mechanism first, then escalate through the BSP Consumer Assistance Mechanism.
Threats of violence, extortion, impersonation, account hacking, or other possible crimes: contact the police or another cybercrime authority immediately. Cybercrime incidents may also be reported to the CICC through Hotline 1326.

Having an unpaid balance does not give a lender permission to threaten, shame, deceive, or expose a borrower’s personal information. However, reporting misconduct does not automatically cancel a legitimate debt.

What conduct may be unlawful?

Under the Financial Products and Services Consumer Protection Act, Republic Act No. 11765, financial service providers must treat consumers fairly, protect client data, provide a free complaint mechanism, and refrain from abusive collection or debt-recovery practices. A provider is responsible for the conduct of its employees and agents and may be solidarily liable with an accredited third-party collector.

For SEC-regulated lending and financing companies, SEC Memorandum Circular No. 18, Series of 2019 prohibits practices including:

Using or threatening violence or other criminal means to harm a person, reputation, or property.
Threatening action that cannot legally be taken.
Using obscenities, insults, or profane language whose natural consequence is to abuse the borrower or which amounts to an offense.
Publishing the names or personal information of borrowers who allegedly refuse to pay, except where disclosure is legally allowed.
Communicating loan information known—or which should be known—to be false, including failing to state that a debt is disputed where the rule requires that fact to be communicated.
Using false representations or deceptive methods to collect a debt or obtain information about a borrower.
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., unless the account is more than 15 days past due or the borrower expressly agreed that those hours are the only reasonable opportunities for contact. Even when this time exception applies, threats, insults, deception, and unlawful disclosure remain prohibited.

Examples commonly associated with online lending complaints include:

Sending “wanted,” funeral, mugshot, or humiliating images using the borrower’s name or photograph.
Posting the alleged debt on social media or in group chats.
Messaging relatives, friends, co-workers, clients, or an employer to shame the borrower.
Threatening immediate arrest, a fabricated criminal case, property seizure without legal process, or a nonexistent court or barangay order.
Falsely claiming to be a lawyer, police officer, court employee, government official, or authorized collection agency.
Repeatedly contacting people who did not borrow, guarantee, or otherwise become legally responsible for the loan.
Using a borrower’s contacts, photos, or social-media information for a purpose that was not necessary, proportionate, and lawfully disclosed.

The Constitution prohibits imprisonment merely for debt. The Supreme Court has likewise distinguished an ordinary contractual failure to pay from estafa, which requires separate elements such as deceit or abuse of confidence. This does not prevent prosecution for an independently established offense—for example, fraud or a violation involving a check. A threat of arrest based only on an unpaid app loan should therefore be documented and reported, but any actual subpoena, summons, or court document must not be ignored.

Special rules for contacts, character references, and guarantors

The NPC’s amended loan-related data rules, Circular No. 2022-02, prohibit unnecessary or excessive processing of personal information by lending apps.

The rules make important distinctions:

An app’s access to permissions or protected resources must be suitable, necessary, and not excessive for a legitimate purpose.
Unrestricted or disproportionate processing of contact lists—especially processing that leads to harassment, unfair collection, or collection from people other than the borrower’s guarantors—is prohibited.
An app may use a limited interface that allows the borrower to choose a character reference or guarantor. This does not authorize collection from the borrower’s entire contact list.
A character reference may be contacted to verify the borrower’s identity or the truth of information given in the loan application. A character reference cannot automatically be treated as a guarantor.
A guarantor must have separately and expressly agreed to guarantee the obligation. For debt-collection purposes, the lender may contact the guarantor, but not unrelated people in the borrower’s contact list.
A borrower’s photograph must not be used to harass or embarrass the borrower.

A blanket app permission or buried privacy-policy clause does not automatically make excessive or prohibited processing lawful. The Data Privacy Act still requires transparency, legitimate purpose, proportionality, and an applicable lawful basis.

Preserve evidence before blocking, deleting, or uninstalling

Evidence often determines whether a regulator or investigator can act. Before changing the app or phone, preserve:

Full screenshots of messages showing the sender, number or account, date, and time.
The complete conversation—not only the most offensive line.
Original emails, text messages, chat exports, voicemails, and call logs.
Social-media posts, comments, account URLs, group names, and profile details.
Copies of messages received by relatives, references, co-workers, or other contacts.
The app’s store page, developer name, version, privacy policy, and permissions screen.
The lender’s legal or corporate name, app name, website, office address, collector’s name, and collection agency, if known.
Loan agreements, disclosure statements, statements of account, repayment schedules, receipts, and proof of disputed or unauthorized transactions.
Your written complaint to the lender and proof of delivery or receipt.
A dated incident log identifying what happened, who was contacted, and the effect of each incident.

Keep original files and make a backup. Avoid cropping, annotating, or editing the only copy. Ask third-party recipients to preserve their own screenshots and, if necessary, prepare affidavits based on what they personally received.

After preserving evidence, revoke unnecessary access to contacts, photos, camera, microphone, location, SMS, or files. Change reused passwords and enable multi-factor authentication. If the app creates an immediate security risk, prioritize safety and uninstall it after saving what you reasonably can.

Do not secretly record a private telephone conversation without legal advice. The Anti-Wiretapping Act generally requires authorization from all parties, and the Supreme Court has applied the prohibition even to a participant who secretly records a private conversation. Saving a voicemail deliberately left for you is different from secretly recording a live call, but uncertain situations should be discussed with counsel.

Step 1: Send a written complaint to the lender

Use the company’s published consumer-assistance or customer-service channel and, for privacy concerns, its Data Protection Officer. Send the complaint by email or another method that produces proof of delivery.

Include:

Your name and account or loan reference number.
The lender’s corporate name and the app involved, if known.
A chronological account of the conduct, with dates, numbers, accounts, and names.
The specific people contacted and personal data disclosed or used.
Whether you dispute the balance or claim the transaction was unauthorized.
The action you want, such as:
- Stop threatening or abusive communications.
- Stop contacting and disclosing information to third parties.
- Correct false information.
- Identify the company, collection agency, and responsible agents.
- Disclose what personal data was obtained, its source, recipients, purpose, and retention period.
- Block, remove, or delete data unlawfully obtained or no longer necessary, subject to lawful retention requirements.
- Provide an itemized statement of account and a written final investigation result.
- Preserve collection logs and other records relevant to the complaint.

If you dispute an amount or report an unauthorized transaction, say so expressly. Under RA 11765, pending its final investigation report, the covered financial service provider must suspend the imposition of interest, fees, and charges or provide a similar reasonable accommodation.

Do not admit an amount you genuinely dispute merely to stop the messages. Conversely, do not make a false denial of a valid loan. Keep the collection-conduct complaint separate from any good-faith discussion of repayment.

Step 2: Report an SEC-regulated lender through iMessage

The SEC is generally the regulator for lending and financing companies and their online lending platforms.

Identify the company behind the app. Check the loan documents, privacy notice, app-store listing, website, and payment instructions. You may also use the SEC’s Check with SEC service or request confirmation through iMessage.
Go to the SEC iMessage portal and select Open a New Ticket.
Sign in through an eSECURE account.
In the service field, choose “Complaints on Financing and Lending Companies” under the Financing and Lending Companies Department.
Provide a clear chronology and attach the evidence, loan documents, company complaint, and response or proof of non-response.
Save the ticket number and monitor the portal. Respond promptly if the SEC requests clarification or additional documents.

The SEC’s current public iMessage guide confirms that the platform generates a ticket, accepts file uploads, permits follow-up replies, and routes this complaint service to the responsible department.

If the app appears unregistered, uses another corporation’s identity, or hides the actual lender, state those facts without guessing. Include the app URL, developer name, payment accounts, phone numbers, and any documents that may help identify the operator.

Step 3: File a privacy complaint with the NPC

A borrower, character reference, family member, co-worker, or other individual may complain if their own personal data was affected.

Complete the required preliminary step

Under the 2021 NPC Rules of Procedure, as amended in 2024, the complainant generally must first:

Inform the lender, collector, or other responsible entity in writing about the privacy violation; and
Show that the entity did not take timely and appropriate action, or did not respond within 15 calendar days after receiving the written notice.

The NPC may waive this requirement for properly alleged and proven good cause or serious violations, including situations involving grave and irreparable harm, lack of an adequate remedy from the respondent, or patently illegal action. Explain the urgency and attach proof if requesting a waiver.

Prepare and submit the formal complaint

Download the NPC’s current Complaint-Affidavit form.
Complete the complaint and applicable question-and-answer portions accurately.
Identify the respondent. If its full identity is unknown, explain the identifying circumstances, including the app, developer, numbers, accounts, and payment channels.
Attach:
- A valid government-issued ID.
- Your written notice to the respondent and proof of receipt.
- The respondent’s reply, if any.
- Documentary evidence and relevant witness affidavits.
- A clear list of the personal information processed or disclosed.
- The relief requested.
Sign the verification and certification against forum shopping and have the complaint notarized.
Submit it personally, by courier, or as a legible scanned copy by email to complaints@privacy.gov.ph. The current form lists the NPC at 25th–27th Floors, The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Quezon City 1103.
Follow the NPC’s instructions for fees and further submissions.

The NPC’s currently linked schedule of fees lists a ₱500 complaint filing fee, a legal research fee, and additional fees where damages are claimed. Qualifying indigent complainants may request an exemption with the required proof. Check the NPC filing page for any later fee or payment-channel update before paying.

Do not submit an empty form with only general accusations. The NPC’s current form warns that failure to attach supporting evidence can result in outright dismissal.

If the provider is supervised by another regulator

The app name alone does not determine the regulator. Check the entity that actually extended the credit.

Provider	Primary financial regulator and escalation route
Lending or financing company	SEC iMessage
Bank, digital bank, e-money issuer, or other BSP-supervised institution	Institution’s FCP assistance mechanism first, then BSP
Credit cooperative	Cooperative Development Authority, unless it is a BSP-supervised cooperative financial institution
Insurance-related credit product	Insurance Commission, as applicable
Any entity processing personal data	NPC for privacy violations

For a BSP-supervised institution, first complain through its Financial Consumer Protection Assistance Mechanism. If dissatisfied, use the BSP Online Buddy on the BSP website or submit the BSP Complaint/Inquiry/Reply form with proof of the first-level complaint to consumeraffairs@bsp.gov.ph.

When law-enforcement help is urgent

Contact 911, the nearest police station, or the appropriate cybercrime unit immediately if there is:

A credible threat of physical harm.
Extortion or a demand for money to prevent publication of personal data.
Stalking, doxxing, or publication of a home address that creates immediate danger.
Hacking, identity theft, account takeover, or unauthorized financial transactions.
Impersonation of police, courts, lawyers, or government personnel.
Fabricated warrants, subpoenas, court orders, or barangay documents.
Sexual threats or the publication or threatened publication of intimate material.

Cybercrime incidents may be reported to the CICC reporting center or Hotline 1326. A regulatory complaint to the SEC or NPC does not replace a criminal complaint, and a cybercrime report does not replace the lender’s or regulator’s complaint process.

If someone sends an alleged legal document, verify it directly with the named court, prosecutor’s office, barangay, police unit, or law office using independently obtained contact details. Do not rely on the sender’s number or link.

Deadlines to keep in mind

File as soon as reasonably possible. Delay can cause messages, account records, app listings, and subscriber data to disappear.

For claims under RA 11765, the statute generally provides a five-year prescriptive period from consummation of the financial transaction or from discovery of deceit or nondisclosure of material facts, with an outside limit of 10 years from the violation.

The current consolidated NPC procedural rules no longer state the former complaint-specific six-month/30-day filing formula found in older versions and guides. For penal provisions of the Data Privacy Act, they adopt the prescription periods applicable to violations of special laws under Act No. 3326. The applicable period depends on the alleged offense and possible penalty, so obtain legal advice rather than assuming that an old online deadline applies.

Filing with one agency may not suspend a separate court, criminal, contractual, or statutory deadline.

Common mistakes that weaken complaints

Naming only the app and not trying to identify the corporation behind it.
Deleting the app, messages, or account before preserving evidence.
Submitting cropped screenshots that omit the sender, date, time, or context.
Filing only a social-media post instead of using the official complaint channel.
Failing to notify the lender in writing before an NPC complaint without explaining grounds for waiver.
Treating a character reference as if that person had guaranteed the debt.
Paying an unknown collector’s personal account without verifying its authority and the official balance.
Assuming that reporting harassment automatically erases the loan.
Ignoring a genuine court summons because earlier threats were fake.
Secretly recording private calls without considering the Anti-Wiretapping Act.
Posting the collector’s personal data publicly in retaliation, which may create new legal or privacy issues.

What remedies are possible?

Depending on the evidence and jurisdiction, regulators may order corrective action, impose administrative fines, restrict data processing, require compliance, suspend operations, or cancel regulatory authority. The NPC may award indemnity on matters affecting personal data, impose administrative fines, order a temporary or permanent processing ban, or recommend prosecution. RA 11765 also permits financial regulators to impose enforcement measures and, in appropriate cases, adjudicate purely civil monetary claims within the statute’s limits.

No particular investigation, penalty, debt reduction, data deletion, or damages award is guaranteed. Lawful record-retention duties, an unresolved loan, and the need to preserve evidence may limit immediate deletion.

FAQ

Can I complain even if I really owe the loan?

Yes. A valid debt may be collected only through lawful means. The complaint concerns the collection method, privacy violation, inaccurate amount, or other misconduct—not necessarily the existence of the debt.

Can the lender contact everyone in my phone?

No. Unrestricted or disproportionate processing of the contact list is prohibited. A character reference is not automatically a guarantor, and debt collection from contacts other than a separately consenting guarantor is prohibited under the NPC’s loan-related rules.

Does clicking “Allow contacts” mean I consented to harassment?

No. Consent must be informed and specific, and processing must still be lawful, transparent, proportionate, and limited to a legitimate purpose. App permission does not override the Data Privacy Act or the NPC’s lending rules.

Can a collection agency blame the lender?

The lender may use a third-party collector, but RA 11765 makes the provider responsible for its agents and provides for solidary liability with accredited third-party service providers for relevant acts or omissions.

Will an SEC or NPC complaint cancel my debt?

Not automatically. Continue to request an accurate, itemized balance and use verified payment channels. Negotiate repayment separately if the debt is valid and affordable.

Can I be arrested merely because an online loan is overdue?

Mere nonpayment of a contractual debt is not, by itself, imprisonment-worthy. A separate criminal offense may exist only if its own legal elements are established. Verify any genuine legal process and obtain counsel promptly.

May I file with both the SEC and NPC?

Yes, when the facts involve both unfair collection and misuse of personal data. Each agency has a different mandate. Disclose related proceedings accurately where a form asks about them.

Disclaimer

This is general Philippine legal information, not individualized legal advice. Outcomes depend on the lender’s regulatory status, the loan documents, the communications, and the available evidence. Seek a Philippine lawyer promptly for credible threats, court papers, major financial exposure, identity theft, possible criminal charges, or an approaching deadline. Sources and official procedures were checked on 6 August 2026.