Quick answer

Report unfair collection by a lending or financing company to the Securities and Exchange Commission (SEC) through SEC iMessage. Report misuse, excessive collection, or unauthorized disclosure of personal data to the National Privacy Commission (NPC). If there are credible threats, extortion, impersonation, fraud, account takeover, or danger to anyone’s safety, also contact law enforcement immediately.

You may report the same incident to more than one agency because each handles a different wrong. Filing a complaint does not erase a valid loan, but owing money does not authorize threats, insults, public shaming, or disclosure of your debt to unrelated people.

What conduct may be unlawful

Unfair debt collection

SEC Memorandum Circular No. 18, Series of 2019 prohibits practices that include:

Using or threatening violence or other criminal means to harm a person, reputation, or property.
Threatening action that cannot legally be taken.
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense.
Publishing or disclosing the names or personal information of borrowers who allegedly refuse to pay, except where disclosure is legally permitted.
Communicating false loan information, including failing to say that a debt is disputed when that fact should be disclosed.
Using false representations or deceptive means to collect a debt or obtain information.
Contacting the borrower before 6:00 a.m. or after 10:00 p.m.

The time restriction has stated exceptions: SEC MC No. 18 allows contact during those hours if the account is more than 15 days past due, or if the borrower expressly agreed—through written, electronic, or recorded means—that those are the only reasonable or convenient contact times. These exceptions do not permit threats, deception, humiliation, or unlawful disclosure.

The lender cannot avoid responsibility simply by outsourcing collection. Under the Financial Products and Services Consumer Protection Act, financial service providers are responsible for the acts and omissions of their representatives and may be solidarily liable with accredited third-party service providers for collection-related misconduct.

Privacy violations

The Data Privacy Act of 2012 requires personal data processing to be transparent, for a legitimate purpose, and proportionate to that purpose. Consent, when relied upon, must be freely given, specific, informed, and evidenced by written, electronic, or recorded means.

Under NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02, possible violations include:

Requiring unnecessary access to contacts, email lists, social-media contacts, cameras, photos, location, or other phone resources.
Harvesting or using contact lists to pressure or harass the borrower.
Sending loan information, the borrower’s photograph, or insulting messages to relatives, coworkers, employers, friends, or social-media contacts.
Using a borrower’s photograph to embarrass them during collection.
Processing more data than is necessary for identity verification, credit assessment, fraud prevention, or another disclosed lawful purpose.
Keeping personal data indefinitely without a definite lawful purpose.
Hiding important processing details or obtaining supposed consent through deceptive interface design.

Limited contact-list access is not automatically unlawful. It may be used, when necessary and proportionate, to let the borrower select a character reference or guarantor, or to derive proportional metadata for a specified legitimate purpose. The app must provide separate interfaces for references and guarantors and limit access to what is necessary.

A character reference is not automatically a guarantor. References may be contacted to verify the borrower’s identity or the truth of application information, but not used as collection targets. A guarantor must separately and expressly consent to assume the obligation. The government’s 18 March 2026 Joint Advisory on Online Lending Platforms states that, for debt collection, lenders and persons acting for them may contact only the guarantor—not other people in the borrower’s contact list.

A genuine co-borrower or co-maker who signed the loan documents may be contacted regarding that person’s own contractual obligation. Merely being stored in the borrower’s phone, named as a reference, or related to the borrower does not make someone a co-maker or guarantor.

What to do immediately

Preserve the evidence before blocking numbers or uninstalling the app. If there is an immediate security risk, prioritize safety and revoke permissions first.
Revoke unnecessary permissions. In the phone settings, turn off access to contacts, photos, camera, microphone, location, calendar, call logs, and storage unless currently needed for a legitimate purpose.
Secure affected accounts. Change compromised passwords, enable multi-factor authentication, review active sessions, and notify your bank or e-wallet provider of unauthorized activity.
Tell affected contacts not to engage or pay. Ask them to preserve the messages, numbers, account names, and attachments they received.
Identify the company behind the app. Look for the corporate name, SEC registration number, Certificate of Authority number, developer name, address, privacy notice, data-protection officer, and collection agency in the loan agreement, disclosure statement, receipts, app-store page, and messages. An app name may differ from the lender’s legal name.
Send the lender a written complaint. This creates evidence and is ordinarily required before a formal NPC complaint.

Evidence to preserve

Keep original, unedited copies where possible, plus a backup. Useful evidence includes:

Screenshots showing the complete message, sender’s number or account, date, and time.
Screen recordings showing the account profile, message thread, social-media post, or app permissions.
Call logs and recordings lawfully obtained.
Voice messages, emails, chat exports, and collection letters.
URLs and screenshots of public posts before requesting removal.
Messages received by relatives, coworkers, employers, references, or other third parties.
The app-store listing, developer details, version number, and installation date.
The privacy notice and every consent or permission screen you can still access.
The loan agreement, disclosure statement, statement of account, repayment schedule, and collection notices.
Receipts, transaction references, and proof of every payment.
Your written complaint to the lender, proof of delivery, acknowledgment, ticket number, and response.
Names or aliases used by collectors and the collection agency’s details.
A chronological incident log stating what happened, when, through which channel, who received it, and what information was disclosed.
Witness affidavits where third parties personally received or saw the harassment.

Do not crop away identifying details, edit message text, or rely only on forwarded screenshots. Keep the original device and files available if investigators need to authenticate electronic evidence.

Send a written complaint to the lender first

Address the complaint to the lender’s consumer-assistance unit and data-protection officer. Include:

Your name, account or loan reference, and safe contact details.
The app name, lender’s corporate name, and collection agency, if known.
A short chronological account with dates and times.
The exact words or acts complained of.
The personal data accessed, used, or disclosed.
The names or descriptions of third parties contacted.
Whether you dispute the debt, amount, fees, payments, or identity of the lender.
A list of attached evidence.

Ask the company to:

Stop abusive communications and third-party disclosure.
Communicate with you only through a specified reasonable channel.
Identify the collector and collection agency.
Explain the source, purpose, legal basis, recipients, and retention period for your personal data.
Correct inaccurate account or credit information.
Block, remove, or securely destroy unlawfully processed data, subject to lawful retention requirements.
Preserve call recordings, access logs, collection instructions, account notes, and other records relevant to the complaint.
Provide a written investigation result and statement of account.

A deletion request is not absolute. The company may retain information genuinely necessary to comply with law or to establish, exercise, or defend legal claims, but it should not keep data indefinitely for an unspecified future use.

Where to report

Problem	Where to report	Main channel
Unfair collection by an SEC-regulated lending or financing company	SEC Financing and Lending Companies Department	SEC iMessage or hotline 1-4732 (1-4SEC)
Unauthorized or excessive personal-data processing or disclosure	National Privacy Commission	NPC complaint page and complaints@privacy.gov.ph
Threats, fraud, scams, extortion, impersonation, or other possible cybercrime	DICT, NBI Cybercrime Division, or PNP Anti-Cybercrime Group	1326@dict.gov.ph, ccd@nbi.gov.ph, acg@pnp.gov.ph
Complaint against a bank or other BSP-supervised institution	Institution’s consumer-assistance mechanism, then BSP	BSP consumer-assistance channels
Immediate danger	Unified emergency services	911

These channels are confirmed in the government’s 2026 Joint Advisory. A regulatory complaint does not replace a police or cybercrime report when safety or possible criminal conduct is involved.

How to complain to the SEC

Use SEC iMessage and direct the ticket to the Financing and Lending Companies Department for unfair collection involving a lending company, financing company, or its online lending platform.

Provide:

The app and corporate names.
SEC registration and Certificate of Authority details, if known.
The loan and collection-agency details.
A factual timeline.
Copies of messages, posts, call logs, loan documents, payment records, and your complaint to the lender.
The names and statements of third parties contacted.
The specific relief requested, such as investigation and cessation of the collection practice.

Save the SEC ticket number and acknowledgment. If the operator or its authority cannot be verified, say so expressly and attach the app-store and payment details. Corporate registration alone does not establish that an entity has authority to operate as a lending or financing company.

How to file a privacy complaint with the NPC

Ordinarily, you must first inform the company in writing and give it an opportunity to act. Under the 2021 NPC Rules of Procedure, as amended, a complaint may proceed when the company fails to take timely and appropriate action or gives no response within 15 calendar days from receiving your written notice.

The NPC may waive this requirement for proven good cause or a serious violation, including circumstances involving grave and irreparable harm, lack of an adequate remedy from the respondent, or patently illegal conduct. Explain the urgency and attach supporting proof rather than simply omitting the prior notice.

To file:

Download the current NPC Complaint-Affidavit form.
Complete it accurately and chronologically.
Identify the respondent, or explain the facts that may lead to its identification.
Attach your government-issued ID, correspondence with the respondent, documentary evidence, and any witness affidavits.
State the relief requested.
Complete the verification and certification against forum shopping.
Have the complaint notarized.
Submit it personally, by registered mail, courier, or as a scanned filing to complaints@privacy.gov.ph, following the current instructions on the NPC filing page.

Filing fees may apply. The Rules provide exemptions for government complainants and qualified indigent complainants, and permit the NPC to waive fees for good cause upon motion. Check the current fee schedule and filing instructions before submission.

An affected relative, coworker, reference, or other recipient may file a separate NPC complaint if that person’s own personal data or privacy rights were violated.

When to contact law enforcement

Do not wait for the lender’s response or the NPC’s 15-day period if there is:

A credible threat of physical harm.
Extortion or a demand backed by threats.
Impersonation of police officers, lawyers, courts, or government agencies.
Publication of your address, identification documents, intimate material, or information placing someone at risk.
Unauthorized access to your phone, email, social-media, bank, or e-wallet account.
Fraudulent loans or transactions made using your identity.
Instructions to meet a collector in an unsafe location.
Continuing conduct that creates immediate danger.

Call 911 for an emergency. For non-emergency cyber reports, the 2026 Joint Advisory lists:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (632) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; (632) 8723-0401 local 7491

Describe the conduct factually. Whether it constitutes grave threats, extortion, cyber libel, identity theft, unlawful data processing, or another offense depends on the evidence and must be determined by investigators and prosecutors.

What happens to the debt

A harassment or privacy complaint does not automatically cancel the principal, lawful interest, or other valid charges. Continue paying any undisputed valid obligation through a verified official channel, or seek a written restructuring arrangement. Do not send money to an unidentified collector’s personal account without confirming authority and obtaining an official receipt.

If the amount is disputed, request an itemized statement showing the principal, interest, penalties, service charges, payments, and current balance. State the disputed items in writing.

The 1987 Constitution prohibits imprisonment merely for debt. A lender or collector cannot issue an arrest warrant. However, conduct separate from nonpayment may have different legal consequences, and a creditor may pursue lawful civil remedies. Never ignore genuine court papers, subpoenas, or notices from government agencies; verify them directly with the issuing office and obtain legal advice promptly.

Common mistakes to avoid

Deleting messages or uninstalling the app before preserving evidence.
Blocking every number before recording the sender and complete conversation.
Naming only the app brand instead of the corporate lender and collection agency.
Filing an NPC complaint without proof that the company was first notified, or without explaining why that requirement should be waived.
Submitting cropped screenshots with no date, time, number, URL, or account identity.
Describing the experience only as “harassment” without identifying the exact words, disclosures, recipients, and dates.
Assuming that clicking “Allow contacts” authorizes public shaming or unlimited collection use.
Assuming a character reference is responsible for the loan.
Treating an app-store listing or SEC corporate registration as proof of lending authority.
Stopping all payments without examining whether the underlying debt remains valid.
Paying a collector who cannot prove authority or provide an official receipt.
Posting unredacted IDs, contracts, phone numbers, or other sensitive evidence publicly while asking for help.

When legal help is urgent

Consult a Philippine lawyer—or the Public Attorney’s Office if you qualify—without delay when:

A threat appears credible or someone knows your home or workplace.
Identification documents, financial credentials, or intimate material were exposed.
Your identity was used for another loan or transaction.
The collector contacted many people or published information publicly.
You suffered employment, financial, medical, or reputational harm that must be documented.
The company disputes that its collectors sent the messages.
You need damages, an injunction, evidence preservation, or coordinated criminal and administrative complaints.
You receive authentic court papers, a prosecutor’s subpoena, or a government order.
Several proceedings involving the same facts are being considered, because the NPC complaint requires disclosure of related cases and a certification against forum shopping.

Frequently asked questions

Can a lending app contact my family, employer, or coworkers?

Not merely because their details appear in your phone. For debt collection, the current joint government advisory states that only a properly named and consenting guarantor may be contacted. A genuine co-borrower or co-maker may be contacted about that person’s own signed obligation. A character reference is for identity or information verification and is not automatically liable for the loan.

Does allowing contact access mean I consented to text blasts?

No. Permission may support limited, necessary processing, but it is not blanket authority to copy your contacts, disclose your debt, shame you, or harass other people. The scope, notice, purpose, necessity, and manner of use still matter.

Can I complain even if I really owe the money?

Yes. The existence of a debt and the legality of collection methods are separate issues.

Should I uninstall the app immediately?

First preserve evidence if it is safe to do so. Then revoke unnecessary permissions. You may uninstall afterward, but keep the installer details, app-store listing, privacy notice, loan documents, and backups of relevant data.

Can I demand deletion of all my data?

You may exercise applicable rights to object, correct, erase, or block data. The company may retain information required by law or genuinely needed for legal claims, but it must have a lawful, disclosed retention basis and securely destroy data when retention is no longer justified.

What if I never borrowed from the app?

State clearly that the loan is unauthorized, secure your accounts, obtain credit and transaction records, and report possible identity fraud to the company, NPC, SEC or BSP as appropriate, and law enforcement.

Is the NPC’s 15-day period a deadline for filing?

It is generally part of the prior-notice requirement: if the company does not respond within 15 calendar days of receiving your written notice, you may show exhaustion of remedies. It is not a reason to delay preserving evidence or reporting an emergency. Other legal time limits depend on the claim and should be assessed promptly.

Can someone who received the shaming message complain?

Yes. A recipient whose own information was misused or who was directly subjected to unlawful processing or harassment may preserve the message, ask for removal of their data, and consider filing their own complaint.

Official legal sources

This article provides general legal information, not legal advice for a particular case. Rights, liability, jurisdiction, and remedies depend on the loan documents, communications, parties, and evidence. Official laws, rules, procedures, and reporting channels were checked as of 1 August 2026.