Quick answer

If an online lending app is threatening, insulting, publicly shaming, or contacting people who did not consent to be guarantors, preserve the evidence and report the conduct to the proper agencies:

Unfair collection practices by a lending or financing company: file with the Securities and Exchange Commission (SEC) through SEC iMessage.
Misuse or excessive collection of personal data: first send the lender a written privacy complaint. If it does not take timely and appropriate action—or does not respond within 15 calendar days after receipt—file a formal complaint with the National Privacy Commission (NPC). The NPC may waive this prior-notice requirement for good cause or a serious violation presenting significant risk of harm.
Threats, fraud, impersonation, extortion, or other possible crimes: report promptly to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT Cyber Hotline. If anyone faces immediate physical danger, contact the nearest police station or emergency services at once.

You may use more than one route because the same incident can involve unfair debt collection, a privacy violation, and a possible crime. Reporting harassment does not, by itself, cancel a valid loan or settle a disputed balance.

What online lenders are not allowed to do

A lender may lawfully demand payment and use proportionate information needed to administer or collect a legitimate loan. It does not follow that the lender may use any method it chooses.

Under SEC Memorandum Circular No. 18, Series of 2019, prohibited collection practices by covered lending and financing companies include:

Using or threatening violence or other criminal means to harm a person, reputation, or property;
Threatening action that cannot legally be taken;
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense;
Publishing or disclosing borrowers’ names or other personal information, except where disclosure is legally permitted;
Communicating false loan information, including failing to say that a debt is disputed when that fact should be disclosed;
Using false representations or deceptive means to collect a debt or obtain information;
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., subject to the circular’s stated exceptions: when the account is more than 15 days past due or the borrower has expressly agreed, through written, electronic, or recorded means, that those are the only reasonable times for contact; and
Contacting people in the borrower’s contact list who were not named as guarantors or co-makers—even if the borrower supposedly consented to contact-list access.

The government’s current joint advisory likewise states that contacting people in a borrower’s contact list for debt collection is prohibited unless they are guarantors. The advisory directs complaints about unfair collection practices to the SEC’s Financing and Lending Companies Department. See the DICT-NPC-SEC Joint Advisory dated 18 March 2026.

When collection becomes a privacy violation

The Data Privacy Act of 2012 requires personal-data processing to have a lawful basis and comply with transparency, legitimate purpose, and proportionality. Consent, when relied upon, must be freely given, specific, informed, and evidenced by written, electronic, or recorded means. Borrowers also have rights concerning access, correction, objection in appropriate cases, and the blocking or removal of data that is unlawfully obtained, used for unauthorized purposes, or no longer necessary. These rights have legal qualifications and do not automatically require deletion of records that a lender must retain for a lawful purpose or legal claim. See Republic Act No. 10173.

Examples of conduct that may violate privacy rules include:

Copying or processing an entire phone, email, or social-media contact list without a necessary and proportionate purpose;
Messaging relatives, coworkers, employers, friends, or other contacts to reveal or collect the borrower’s debt when they are not guarantors;
Using the borrower’s photograph to embarrass, threaten, or publicly shame the borrower;
Posting a borrower’s identity, loan details, identification document, photograph, or altered “wanted” image online;
Demanding access to contacts, cameras, photographs, files, or other phone resources when the access is unnecessary for the stated purpose;
Continuing access to a camera or photo gallery after identity, fraud-prevention, or payment-verification purposes have been completed;
Retaining personal data longer than necessary, unless retention is required by law or remains necessary for a legal claim; or
Using manipulative interfaces—such as pre-ticked boxes or deliberately obscured privacy-preserving choices—to obtain apparent consent.

An app may have limited access to a contact list so the borrower can select a character reference or guarantor, or to derive proportionate metadata for a specified legitimate purpose. It may not engage in “unbridled” processing that is excessive, unconstrained, or used for harassment. The detailed rules appear in NPC Circular No. 2022-02, which amended NPC Circular No. 2020-01.

Character reference versus guarantor

These roles are not interchangeable:

A character reference is provided for identification or verification. The lender should not treat that person as responsible for the debt.
A guarantor has expressly consented to assume responsibility if the borrower defaults and may be contacted about the obligation.

Entering someone’s name or number as a reference does not, by itself, make that person a guarantor. The 2026 joint advisory says online lending platforms must use separate interfaces for references and guarantors, and a person must consent to being a guarantor.

Preserve evidence before blocking or uninstalling the app

Create a complete, unedited record while the material is still available. Keep copies somewhere the app cannot erase or access.

Preserve:

Screenshots and screen recordings showing complete messages, posts, caller profiles, usernames, URLs, dates, and times;
Original SMS messages, emails, chat exports, call logs, voice messages, and recordings lawfully in your possession;
The app’s exact name, icon, download page, developer name, website, and version;
The lender’s corporate name, SEC registration number, Certificate of Authority number, business address, and privacy or customer-service contact details;
Screenshots of every permission requested or granted to the app;
The privacy notice, consent screens, loan agreement, disclosure statement, promissory note, repayment schedule, and collection notices;
Proof of disbursement and payment, including receipts and transaction references;
Names and numbers used by collectors, including any company or collection agency they claim to represent;
Copies of posts or messages sent to relatives, coworkers, employers, or other third parties;
Written statements or screenshots from those third parties showing what they received;
Your written complaint to the lender and proof that it was delivered; and
A chronological incident log describing what happened, who was involved, and what harm or risk resulted.

Do not crop away identifying details unless you also keep the complete original. Do not edit, annotate, or forward the only copy. When submitting evidence, redact unrelated personal data where possible and use official filing channels.

Take immediate protective steps

After preserving the evidence:

Review and revoke unnecessary permissions. Turn off access to contacts, camera, photos, files, microphone, location, and other resources that the app no longer needs. Revocation may reduce further access but cannot retrieve data already copied.
Secure important accounts. Change reused or exposed passwords, activate multi-factor authentication, review logged-in devices, and protect the email address and mobile number connected to financial accounts.
Warn affected contacts briefly. Tell them not to pay, click links, disclose information, or engage with collectors. Ask them to preserve the messages they received.
Report abusive posts to the platform. Request removal under its harassment, impersonation, privacy, or doxxing rules, but save the post and URL first.
Keep legitimate payment discussions in writing. Ask for an itemized statement of account and official payment instructions. Do not send money to a collector’s personal account without verifying authority and obtaining a receipt.
Dispute inaccuracies specifically. Identify the amount, payment, date, or other information you contest and attach supporting records. Avoid relying only on a general statement that the debt is “wrong.”
Do not retaliate. Threatening collectors, publishing their private information, or fabricating evidence can create separate legal problems.

How to complain to the lending company

Send a written complaint to the company’s consumer-assistance unit, customer-service address, and data protection officer or privacy contact, if identified. Keep proof of delivery.

State:

Your name and safe contact details;
The loan account or application involved;
The app name and the lender’s legal corporate name;
A dated account of the harassment or data use;
Which people were contacted and whether any of them actually consented to be guarantors;
Which personal data or device permissions were involved;
Whether the balance or identity of the borrower is disputed;
The corrective action requested; and
A request for a written response.

Depending on the facts, you may ask the company to stop contacting non-guarantors, stop public disclosure, remove an abusive post, correct inaccurate information, identify the source and recipients of your data, preserve relevant records, restrict unlawful processing, and explain its lawful basis for the processing.

Do not demand destruction of every loan record without qualification. The company may retain information still necessary to perform the contract, comply with law, or establish, exercise, or defend a legal claim.

How to file an SEC complaint

The SEC regulates lending and financing companies and receives complaints concerning unfair collection practices.

Use the current channel identified in the government’s March 2026 advisory:

SEC iMessage
SEC hotline: 1-4732 (1-4SEC)

The SEC’s published complaint guidance calls for a completed complaint form, a copy of a valid government-issued ID, and supporting documents. It instructs complainants to use one complaint form per respondent company. Supporting records may include the disclosure statement, promissory note, amortization schedule, receipts, messages, screenshots, and other documents connected with the loan. Consult the SEC complaint guidance for lending and financing companies before filing because intake instructions can change.

Identify the legal company behind the app—not merely the app’s brand name. State separately whether you are reporting:

Harassment or abusive language;
Contact with non-guarantors;
Public disclosure or debt-shaming;
Threats or deceptive representations;
Calls or messages at prohibited hours;
An unlicensed lender or unrecorded platform; or
Disclosure, interest, fee, or account-computation issues.

A company’s SEC incorporation alone does not prove that it has authority to operate as a lending or financing company. Under the Lending Company Regulation Act, a lending company must have SEC authority to operate. See the SEC’s official overview of lending and financing companies.

How to file an NPC privacy complaint

1. Give the company written notice

As a general rule, first inform the lender, its data protection officer, or the responsible entity in writing about the privacy violation and allow it to act.

You may proceed with a formal NPC complaint if:

The entity does not take timely and appropriate action; or
It does not respond within 15 calendar days from receiving your written notice.

The NPC may waive these prerequisites upon proven good cause or where the allegations involve a serious violation or breach, considering the risk of harm. Examples in the rules include grave and irreparable damage that only NPC action can prevent or mitigate, the absence of a plain, speedy, or adequate remedy from the respondent, or conduct that is patently illegal. Explain and prove the circumstances if requesting a waiver; do not simply omit the prior notice.

2. Prepare the formal complaint correctly

The NPC states that a formal complaint must follow its prescribed format. Its filing page currently directs complainants to:

Download the complaint form;
Print and complete it;
Have it notarized; and
Submit it personally, by courier, or as a scanned copy by email.

Use the form, filing address, email address, and fee instructions shown on the NPC’s current formal-complaint page. Check the linked schedule of fees before submitting.

The complaint should be written, signed, and verified, and should include the required certification against forum shopping. Disclose any other case involving the same issues. If you later learn that a similar action has been filed or is pending, the rules require reporting that fact to the NPC within five calendar days. A defective verification, missing certification, failure to show prior written notice, or insufficient evidence may cause dismissal.

Attach:

Proof that the company received your written privacy complaint;
Its reply, or evidence that 15 calendar days passed without a response;
The privacy notice and consent screens;
Evidence of contact-list, camera, gallery, or other permission use;
Messages or posts disclosing loan or identity information;
Statements or screenshots from affected third parties;
The loan and payment records necessary to explain the context; and
A clear description of the privacy remedy sought.

NPC proceedings address privacy issues. They do not automatically resolve the correct loan balance, cancel a contract, or decide every criminal or civil claim arising from the same events.

Reporting threats, fraud, or other possible crimes

The SEC or NPC administrative process should not delay a safety report. The March 2026 joint advisory identifies these official channels for harassment, threats, fraud, and scams:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; telephone (632) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; telephone (632) 8723-0401, local 7491

Bring or submit the original messages and files, your incident chronology, the sender’s identifying information, account and payment records, and proof of any public posts or contact with third parties.

Whether particular conduct amounts to threats, coercion, extortion, unjust vexation, libel, cyberlibel, identity theft, unauthorized data processing, or another offense depends on the exact words, acts, intent, evidence, and applicable legal elements. Describe the facts accurately and let investigators or counsel determine the proper charge.

If you never borrowed from the app

Treat collection messages about an unfamiliar loan as a possible identity-theft, impersonation, or fraud incident.

Do not confirm sensitive details to an unverified caller.
Ask the company in writing for the alleged loan date, agreement, disbursement destination, account history, and basis for connecting the loan to you.
State clearly that you dispute the loan and request restriction or correction of inaccurate processing.
Secure the email, mobile, e-wallet, and bank accounts that may have been compromised.
Preserve suspicious links, numbers, account names, and transaction details without opening unknown files.
Report the matter to the lender and, depending on the evidence, to the NPC, SEC, PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT Cyber Hotline.

Do not submit additional selfies, IDs, one-time passwords, or account credentials merely because a collector asks for “verification.” Use only contact details independently confirmed through an official source.

Common mistakes that weaken a complaint

Deleting, blocking, or uninstalling the app before preserving evidence;
Naming only the app and not identifying its corporate operator;
Sending screenshots with no visible date, sender, URL, or context;
Claiming every collection message is illegal even when it is a proportionate demand sent to the borrower;
Assuming a character reference is automatically a guarantor;
Filing an NPC complaint without first giving written notice or explaining why the NPC should waive that requirement;
Omitting verification, notarization, or the certification against forum shopping;
Combining complaints against several companies when the SEC requires one form per respondent;
Posting IDs, contracts, phone numbers, or other evidence publicly;
Paying through an unverified personal account;
Assuming harassment erases an otherwise valid debt; and
Ignoring summonses, subpoenas, court papers, or official agency notices because some earlier threats were fake.

When legal help is urgent

Seek prompt help from a Philippine lawyer, the Public Attorney’s Office if you qualify, law-enforcement authorities, or another appropriate legal-aid provider when:

A message contains a credible threat of physical harm, abduction, sexual violence, property damage, or self-harm;
Money or another benefit is demanded under a threat to expose information or harm someone;
Intimate images, identification documents, home addresses, or children’s information have been posted or threatened with publication;
The lender is contacting an employer, clients, school, or large numbers of people;
Someone opened a loan or financial account using your identity;
Money is being taken through an unauthorized transaction;
You receive genuine court papers, a subpoena, or an agency order;
Several complaints or cases may involve the same facts, making forum-shopping disclosures important; or
You need an urgent court order, preservation request, takedown strategy, or assessment of criminal and civil remedies.

Frequently asked questions

Can a lending app contact everyone in my phone?

No. Limited access may be permissible for selecting references or guarantors, or for proportionate metadata connected with a specified legitimate purpose. Unrestricted processing of the list is prohibited, and collection contact should not be directed to people who did not consent to be guarantors.

Can the lender call my character reference about payment?

A character reference is for identification or verification, not debt collection. Only a person who expressly consented to act as a guarantor may be treated as one and contacted concerning the obligation.

Is consent in the app enough to legalize debt-shaming?

No. Consent must be valid, specific, informed, and tied to a lawful purpose. It does not authorize excessive processing, harassment, public shaming, or unfair collection practices. Manipulative interface design may also undermine the validity of supposed consent.

May collectors call late at night?

SEC rules generally define contact before 6:00 a.m. or after 10:00 p.m. as unreasonable. The circular states exceptions where the account is more than 15 days past due or the borrower expressly agreed that those hours are the only reasonable times for contact. Other abusive conduct remains prohibited.

Should I stop paying after reporting harassment?

A complaint does not automatically cancel the loan. Continue to protect your position by requesting an accurate statement, disputing unsupported charges in writing, keeping payment records, and using verified payment channels. Obtain individualized advice if the validity or amount of the debt is contested.

Can a family member or coworker complain if the lender messaged them?

Potentially, yes. A person whose own personal data was improperly processed may be a data subject with a separate privacy concern. They should preserve the message and document how their information was obtained or used. Their status and available remedy depend on the facts.

Must I wait 15 days before contacting the NPC?

The 15-day period concerns the usual prerequisite for a formal NPC complaint after the respondent receives written notice. The NPC may waive the requirement for good cause or a serious violation presenting sufficient risk of harm. Urgent threats or possible crimes should be reported immediately to law enforcement; do not wait for the privacy process.

Will the agencies award damages or jail the collector?

No outcome is automatic. Agency sanctions, civil remedies, and criminal liability require the appropriate proceeding and sufficient proof. The proper respondent and remedy depend on who processed the data, who made the threats, the lender’s regulatory status, and the documents and communications involved.

Official sources

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Procedures and remedies can depend on the lender’s identity, regulatory status, contract, communications, and available evidence. Official sources and filing channels were checked on 3 September 2026.