Quick answer

You may report an online lending app to:

The Securities and Exchange Commission (SEC) for harassment and unfair collection by a lending or financing company.
The National Privacy Commission (NPC) for misuse or disclosure of personal data, including contacting people in your phonebook to shame or pressure you.
The Bangko Sentral ng Pilipinas (BSP) if the lender is a BSP-supervised institution, such as a bank, digital bank, or non-bank electronic-money issuer.
The PNP, NBI, or DICT Cyber Hotline when there are threats, impersonation, fraud, extortion, account hacking, or immediate safety concerns.

First preserve the evidence, restrict unnecessary app permissions, and complain to the lender in writing. For an NPC complaint, you generally must give the lender 15 calendar days from receipt of your written notice to take timely and appropriate action. The NPC may waive this requirement for good cause or a serious violation, including grave and irreparable harm.

A real debt may still be collected through lawful means. Harassment, public shaming, deceptive threats, and unlawful use of personal data do not become legal simply because payment is overdue.

What conduct can be reported?

Unfair or abusive debt collection

SEC Memorandum Circular No. 18, Series of 2019 prohibits lending and financing companies—and the collection agencies or other service providers acting for them—from using practices such as:

Violence or threats of violence or other criminal means against a person, reputation, or property.
Threatening an action that cannot legally be taken.
Insults, obscenities, or profane language that abuses the borrower or amounts to an offense.
Publishing a borrower’s name or personal information to shame the borrower.
Communicating false loan information, including failing to disclose that a debt is disputed when communicating about it.
Using false representations or deceptive means to collect or obtain information.
Contacting people in the borrower’s phone contacts who are not properly named guarantors or co-makers.
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., subject to the circular’s exceptions where the account is more than 15 days past due or the borrower has expressly agreed that those hours are the only convenient time. Even where a timing exception applies, threats, humiliation, deception, and privacy violations remain prohibited.

The detailed rules are in SEC Memorandum Circular No. 18, Series of 2019. Republic Act No. 11765, the Financial Products and Services Consumer Protection Act, separately prohibits abusive collection and requires fair treatment, data protection, and an effective consumer-assistance mechanism. It also makes financial service providers responsible for their employees and agents and solidarily liable with accredited third-party service providers for covered acts, including debt collection. See Republic Act No. 11765.

A collector may send a civil demand, offer a payment arrangement, report accurate information through legally authorized credit channels, or file a lawful case. A threat to use a genuine legal remedy is different from a fake “warrant,” a fabricated criminal case, impersonation of police or court personnel, or a threat to expose you publicly.

Privacy violations by a lending app

The Data Privacy Act requires personal-data processing to be transparent, for a legitimate purpose, and proportionate. A lender’s access to your phone is not unlimited merely because you clicked “Allow” or accepted broad terms.

Under NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02:

An app may request only permissions that are suitable, necessary, and not excessive for a lawful purpose.
Camera or gallery access may be used for legitimate purposes such as identity verification, fraud prevention, or payment verification, but should be disabled or revocable once that purpose is complete.
A borrower’s photograph must not be used to harass or embarrass the borrower.
Contact-list access is not a license to copy, retain, or message everyone. Limited access may be allowed to let the borrower select character references or guarantors, or to derive proportionate metadata for a specified legitimate purpose.
Unconstrained, excessive, or disproportionate contact-list processing—especially processing that leads to harassment or debt collection against people other than guarantors—is prohibited.
A character reference is for checking the applicant’s identity and information. A character reference does not automatically become a guarantor.
A guarantor must separately and expressly consent to assume responsibility for the loan.
People in the contact list who are not guarantors must not be contacted for debt collection.
Personal data may be retained only while necessary for its lawful purpose, legal claims, or another period required by law, after which it must be securely disposed of.

Consent obtained through deceptive design—such as pre-ticked boxes, hidden privacy-protective choices, or an interface that makes consent easy to give but difficult to withdraw—may be invalid. These points were reiterated in the government’s 18 March 2026 advisory on online lending platforms.

Harassment does not automatically cancel the loan

Reporting misconduct and disputing the debt are separate matters.

The SEC can investigate regulatory violations and impose appropriate sanctions, but its public guidance states that it does not simply rewrite payment terms, declare the contract void, cancel the obligation, or settle the loan for the parties. Contract validity, unconscionable charges, damages, and disputed liability may require a court or another body with proper jurisdiction.

Do not assume that harassment allows you to ignore a legitimate balance. Request a complete statement of account, dispute incorrect charges in writing, and pay only through a verified official channel if payment is due. Never send money to a collector’s personal account without confirming that the lender authorized it.

The Constitution provides that no person may be imprisoned merely for debt. Separate conduct—such as fraud or issuing a bad check under circumstances covered by another law—may nevertheless create criminal exposure. A collector cannot truthfully claim that nonpayment alone automatically produces an arrest warrant. See Article III, Section 20 of the 1987 Constitution.

Where should you complain?

Situation	Appropriate channel
Harassment or unfair collection by a lending or financing company	SEC Financing and Lending Companies Department
Contact-list harvesting, unauthorized disclosure, public shaming, or other misuse of personal data	NPC
Complaint against a bank, digital bank, non-bank electronic-money issuer, or another BSP-supervised institution	The institution’s consumer-assistance mechanism, then BSP
Loan offered by a cooperative	Cooperative’s complaint mechanism, then the Cooperative Development Authority; cooperative banks remain under BSP
Threats, fraud, impersonation, hacking, extortion, or other possible crimes	PNP, NBI, or DICT Cyber Hotline
Immediate danger to life or property	Call 911

One incident can justify reports to more than one agency. An SEC complaint does not replace an NPC complaint, and neither replaces a police or NBI report when criminal conduct or immediate danger is involved.

Step 1: Preserve the evidence before blocking or uninstalling

Create a chronological incident file. Preserve:

Complete screenshots showing the message, sender’s number or account, date, and time.
The full conversation, not only the most offensive sentence.
Voicemails and audio messages sent to you.
Call logs showing repeated calls and their times.
Social-media posts, comments, URLs, account names, and visible timestamps.
Messages received by relatives, friends, employers, or co-workers. Ask each recipient to forward the original message and prepare a brief signed account of what they received.
The app-store page, developer name, app name and version, download link, and privacy notice.
Screenshots of the permissions requested by the app and your phone’s permissions history, if available.
The loan agreement, disclosure statement, promissory note, statement of account, repayment schedule, receipts, and proof of payments.
Names used by collectors, collection-agency details, email addresses, phone numbers, payment instructions, and claimed SEC registration or Certificate of Authority numbers.
Copies of every complaint sent to the lender and proof of delivery or receipt.

Keep original files and a backup. Do not crop away identifying information needed by investigators. You may create redacted copies for ordinary sharing, but retain the originals for the authorities.

Avoid secretly recording a private telephone conversation without legal advice. Republic Act No. 4200 generally prohibits recording a private communication without authorization from all parties, even when the person recording is part of the conversation. Preserve written messages, voicemails voluntarily left, and call logs instead. See the Anti-Wiretapping Act.

Step 2: Secure your phone and accounts

After documenting the relevant permissions and screens:

Revoke unnecessary access to contacts, photos, files, camera, microphone, location, SMS, and social-media accounts.
Change passwords that were reused elsewhere and enable multi-factor authentication.
Review linked devices and active sessions for email and social-media accounts.
Warn contacts not to disclose information, click links, send money, or argue with collectors.
Back up evidence before uninstalling the app.
Report the app to the official app store after preserving its listing and identifying details.

Revoking permission does not necessarily require immediate deletion of data the lender lawfully needs for an active loan or legal claim. It does stop continuing device access, while any request to erase or block stored data must be evaluated under the Data Privacy Act and applicable retention duties.

Step 3: Send the lender a written complaint

Send the complaint to the lender’s official consumer-assistance unit and data protection officer. Use an address shown on its official website, contract, disclosure statement, or privacy notice—not an address supplied only by an unidentified collector.

Include:

Your name and account or loan reference number.
The app name and the lender’s corporate name, if known.
A concise timeline with dates, times, numbers, and accounts used.
The precise conduct complained of.
The personal data accessed, disclosed, or used.
The identities of people contacted and whether any actually consented to be a guarantor.
Any amount or charge you dispute.
The action you want, such as stopping contact with third parties, correcting the account, investigating the collector, or explaining and restricting the processing of your data.
A reasonable deadline for acknowledgment and a request for a written final response.

For privacy concerns, ask the company to identify the data it holds, its source, purpose, legal basis, recipients, retention period, and the collection agency or processor involved. Request correction, objection, erasure, or blocking where legally applicable. A lender may retain information supported by another lawful basis, such as an active contract, a legal obligation, or the establishment or defense of a legal claim, so a deletion request is not automatically absolute.

Keep the sent email, delivery receipt, ticket number, and response. This documentation is important for escalation under Republic Act No. 11765 and for the NPC’s exhaustion-of-remedies requirement.

Step 4: File the harassment complaint with the SEC

For a lending or financing company, use the SEC’s current iMessage ticketing system:

Open a new ticket and sign in or register through eSECURE.
Search for and select “Complaints on Financing and Lending Companies” under the Financing and Lending Companies Department.
Identify both the app and the corporate lender. An app’s brand name may differ from the legal entity operating it.
Describe each violation chronologically.
Attach the loan documents, valid government-issued ID, screenshots, messages, payment records, witness material, and your complaint to the lender.
Save the ticket number and check the ticket for requests, replies, or compliance instructions.

The SEC iMessage user guide explains account access, ticket creation, status tracking, and replies. You can also use Check with SEC to investigate whether the named company is registered and appears to hold the required secondary license. Registration as an ordinary corporation alone does not necessarily authorize lending operations.

If the company or app appears unlicensed, say so in the complaint and attach the claimed registration details or the absence of required disclosures. Do not postpone a complaint merely because you cannot identify every person behind the app; provide all available names, numbers, links, payment accounts, and screenshots.

Step 5: File the privacy complaint with the NPC

General requirement: notify the company first

Under the 2021 NPC Rules of Procedure, as amended, the complainant generally must prove that:

The lender, its data processor, or the concerned entity was informed of the violation in writing; and
It failed to take timely and appropriate action, or did not respond within 15 calendar days after receiving the notice.

The NPC may waive these requirements for good cause or a serious violation, including grave and irreparable harm, lack of a plain and adequate remedy, or patently illegal conduct. If you seek a waiver, clearly state the facts and attach proof explaining why waiting is unsafe or inadequate.

Prepare and submit the complaint

Use the NPC’s current Complaint-Affidavit form. Complete the applicable questions, identify the respondent as accurately as possible, set out the facts chronologically, identify the affected data, state the relief requested, and attach:

Your written notice to the lender and proof of receipt.
The lender’s response, if any.
Screenshots and original electronic messages.
Witness affidavits, where available.
Loan and account documents connecting the respondent to the app.
The required certification against forum shopping.
Any authority to act for another person.

The complaint must be signed, verified, and notarized as required. It may be filed personally, by registered mail, courier, or authorized email. Current NPC contact information lists complaints@privacy.gov.ph for complaints and the NPC office at 25th–27th Floors, The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Barangay Paligsahan, Quezon City 1103. Confirm current submission and payment instructions on the NPC complaint page before filing.

The current fee schedule sets a ₱500 filing fee, plus a legal research fee equal to 1% of the filing fee but not less than ₱10. Additional fees apply when damages or urgent orders are requested. Qualified indigent litigants are exempt upon submitting the required proof; the income and property requirements are set out in NPC Circular No. 2023-01.

NPC public guidance states that its Complaints and Investigation Division has 30 calendar days after receipt to determine whether to give due course to or dismiss a complaint without prejudice. This is an initial evaluation period, not a guarantee that the entire case will finish within 30 days.

A person whose own number, identity, or other personal data was collected or used may file a complaint about that person’s privacy rights. A borrower cannot automatically file for every contacted friend or relative without proper authority; a representative generally needs a special power of attorney.

Step 6: Use the BSP route when the lender is BSP-supervised

If the credit provider is a bank, digital bank, non-bank electronic-money issuer, or another BSP-supervised institution:

File first with the institution’s Financial Consumer Protection Assistance Mechanism or official customer-service channel.
If dissatisfied with the response, escalate through the BSP Online Buddy (BOB) on the BSP website or official Facebook page.
If you cannot use BOB, complete the BSP Complaint/Inquiry/Reply form and email it, with proof of your first-level complaint and supporting documents, to consumeraffairs@bsp.gov.ph.

The BSP’s current instructions are available in its September 2025 complaint guide and consumer-assistance page.

When police or cybercrime help is urgent

Do not wait for an SEC or NPC process if there is:

A credible threat of physical harm.
Extortion or a demand backed by threats.
Impersonation of a police officer, court, lawyer, or government employee.
A fake warrant, fabricated court document, or demand to pay to prevent immediate arrest.
Hacking, account takeover, identity theft, or unauthorized transactions.
Publication of intimate material or threats to publish it.
Stalking, visits to your home or workplace, or danger to family members.

For immediate danger, call 911. Otherwise, the March 2026 government advisory identifies these channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; (02) 8723-0401 local 7491

Bring original evidence and a clear timeline. Let investigators or a prosecutor determine the proper offense; the legal classification depends on the exact words, conduct, identity of the sender, and available proof.

Common mistakes that weaken a complaint

Deleting messages, uninstalling the app, or resetting the phone before preserving evidence.
Naming only the app and not trying to identify the corporate lender or collection agency.
Submitting cropped screenshots that omit the sender, date, time, or surrounding conversation.
Making conclusions without describing the exact acts and words used.
Failing to attach the loan documents, payment records, or disputed statement of account.
Complaining to NPC without attaching the prior written notice and proof of receipt—or without explaining why the exhaustion requirement should be waived.
Secretly recording a private call without understanding the Anti-Wiretapping Act.
Posting the collector’s personal information publicly in retaliation.
Sending IDs or sensitive documents to unofficial accounts.
Paying a personal wallet or unfamiliar bank account because of an urgent threat.
Assuming that an SEC or NPC report automatically suspends every payment obligation or cancels the loan.
Ignoring an authentic summons, subpoena, court notice, or agency order. Verify it directly with the issuing office and obtain legal help promptly.

Important time limits and thresholds

File promptly even if harassment has stopped. Electronic evidence can disappear, numbers can be abandoned, and accounts can be deleted.

For claims arising under Republic Act No. 11765, the statutory period is generally five years from consummation of the financial transaction, or five years from discovery of deceit or nondisclosure of material facts, with an outside limit of ten years from the violation. Other civil, criminal, privacy, or regulatory claims may have different periods.

Under the same law, the SEC and BSP may adjudicate financial-transaction actions that are purely civil and seek only payment or reimbursement of up to ₱10 million. That threshold does not define or limit every administrative, criminal, or privacy remedy.

An aggrieved party seeking judicial review of an SEC or BSP adjudication covered by Republic Act No. 11765 has only ten days from receipt of the decision to file the specified petition for certiorari. Obtain counsel immediately if you receive an adverse final decision.

Frequently asked questions

Can a lender contact my family, friends, or employer?

Not merely because their details appear in your phone. A character reference may be contacted for legitimate verification, but is not automatically a guarantor and should not be pressured to pay. Collection contact may be directed to a person who separately and validly undertook liability, such as a guarantor or co-maker, subject to the governing documents and law. Public shaming and abusive conduct remain prohibited.

Does clicking “Allow contacts” authorize text blasting?

No. Permission must still be tied to a specified, legitimate, necessary, and proportionate purpose. Broad consent does not authorize harassment, disclosure to unrelated contacts, or unfair collection.

Can the collector have me arrested for an unpaid online loan?

Nonpayment of debt alone is not a basis for imprisonment. A genuine criminal allegation based on separate conduct must follow lawful investigation, prosecution, and court process. Verify any supposed warrant directly with the named court or police unit.

Should I block the collectors?

Preserve the evidence first. You may then block abusive numbers for safety, but keep at least one secure written channel open with the lender’s official consumer-assistance unit if you need statements, dispute resolution, or payment instructions.

What if I never applied for the loan?

Dispute it immediately in writing. Ask for the application, identity-verification records, disbursement details, destination account, and processing history. Secure your accounts and report suspected identity theft, fraud, or account compromise to law enforcement and the relevant regulator. Do not pay an unverified demand simply to stop threats.

Can I ask the lender to delete all my data?

You may exercise applicable rights to object, correct, erase, or block data. Deletion is not always immediate or absolute: the lender may retain information necessary for an active contract, regulatory compliance, or establishing, exercising, or defending legal claims. It must still stop unlawful or excessive processing.

Can I complain even if a collection agency sent the messages?

Yes. Identify both the lender and agency where possible. Financial service providers remain responsible for covered acts of their employees and agents, and Republic Act No. 11765 provides for solidary liability with accredited third-party service providers for covered conduct.

Will filing a complaint stop collection immediately?

Not automatically. Ask the lender in writing to stop the specific unlawful conduct. If continued data processing creates grave or irreparable harm, consult the NPC about an application for an appropriate temporary ban or cease-and-desist relief; additional requirements, fees, and a bond may apply.

Official references

This article provides general legal information, not legal advice or a prediction of any case’s outcome. Rights and remedies depend on the contract, messages, parties, evidence, and other facts. Seek a Philippine lawyer promptly for credible threats, identity theft, court papers, substantial financial exposure, or urgent protective relief. Official sources and procedures last checked on 9 September 2026.