Quick answer

Report the conduct in writing to the lender first, then use the government channel that matches the violation:

Unfair collection, threats, shaming, false representations, or an unlicensed online lender: file with the Securities and Exchange Commission (SEC) through the SEC iMessage portal.
Unauthorized access, use, disclosure, or retention of contacts, photos, IDs, messages, or other personal data: file a formal complaint with the National Privacy Commission (NPC). Ordinarily, you must first notify the lender in writing and allow 15 calendar days from its receipt for an appropriate response.
A loan issued by a bank, digital bank, e-money issuer, or another BSP-supervised institution: complain first through the institution’s consumer assistance mechanism, then escalate an unresolved complaint to the Bangko Sentral ng Pilipinas (BSP).
Immediate threats, extortion, stalking, impersonation, hacking, identity theft, or dangerous visits: contact the police, NBI, or another cybercrime law-enforcement channel without waiting for the regulatory complaint process.

A real or overdue debt does not give a lender permission to threaten, insult, publicly shame, or misuse personal data. At the same time, reporting misconduct does not automatically cancel a valid loan or suspend lawful collection.

What conduct may be unlawful?

The Financial Products and Services Consumer Protection Act, Republic Act No. 11765 prohibits abusive collection or debt-recovery practices and requires financial service providers to respect client privacy. A provider can also be responsible for acts of its employees, agents, and accredited third-party collection providers.

For SEC-regulated lending and financing companies, SEC Memorandum Circular No. 18, Series of 2019 treats the following as unfair collection practices:

Using or threatening violence or other criminal means against a person, reputation, or property
Threatening action that cannot legally be taken
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense
Publishing or disclosing the borrower’s name or personal information, except where disclosure is legally allowed
Communicating loan information known, or which should be known, to be false—including failing to say that a debt is disputed
Using false representations or deceptive means to collect or obtain information
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., unless the account is more than 15 days past due, or the borrower gave express consent that those are the only reasonable or convenient contact times
Contacting people in the borrower’s contact list who were not named guarantors or co-makers

The late-hour exception does not authorize threats, insults, public shaming, deception, or unauthorized disclosure.

Privacy rules specifically applicable to lending apps

The Data Privacy Act of 2012, Republic Act No. 10173, requires personal data to be processed lawfully, fairly, and only for legitimate and proportionate purposes.

Under NPC Circular No. 2020-01, as amended by NPC Circular No. 2022-02:

An app may request only permissions that are suitable, necessary, and not excessive for a legitimate purpose.
Consent should be obtained when the particular data becomes necessary, with a clear “just-in-time” notice explaining its use.
Camera or photo access may be justified for activities such as identity or payment verification, but access should be turned off—or the borrower told that it may be revoked—after that purpose is completed.
A borrower’s photo may not be used to harass or embarrass the borrower.
Unrestricted or excessive processing of contact lists is prohibited, particularly when it leads to harassment, unfair collection, or collection from people other than guarantors.
Any contact-list access used to select a reference or guarantor must be limited to the minimum necessary. The app should provide a separate interface allowing the borrower to choose that person.
A character reference is not automatically a guarantor. A reference may be contacted to verify the borrower’s identity and the truth of application information—not to collect the debt, market products, or pressure the borrower.
A guarantor must have separately and expressly agreed to assume that role.

Clicking “Allow” during installation is not a blanket authorization for the lender to copy, store, message, or shame everyone in the phone.

What to do immediately

1. Preserve evidence before blocking or uninstalling the app

Save the following, preferably in two secure locations:

Full screenshots showing the sender, date, time, number, account name, and complete message
Original emails, including their headers
Call logs and voice messages already received
Social-media posts, comments, profile links, usernames, URLs, and dates
Messages sent to relatives, colleagues, employers, references, or other contacts
Screenshots or statements from those third parties
The app’s store page, developer name, privacy notice, version, and permissions
The lender’s legal company name, SEC registration details, certificate-of-authority number, office address, and collection-agency name
Loan agreement, disclosure statement, promissory note, repayment schedule, account statement, receipts, and payment confirmations
Your earlier complaints and proof that the company received them
Evidence of resulting harm, such as workplace correspondence, fraudulent account activity, or expenses caused by the incident

Keep unedited originals. Make redacted copies for submissions that do not require every ID number or account detail. Do not factory-reset the phone if law enforcement may need to examine it.

Be cautious about secretly recording live calls: the Anti-Wiretapping Act may apply. Preserve existing messages and seek legal advice before making covert recordings.

2. Secure your phone and accounts

After preserving evidence:

Revoke the app’s access to contacts, camera, photos, location, microphone, storage, SMS, and other unnecessary permissions.
Check whether the app has accessibility, device-administrator, notification-access, or “display over other apps” privileges and remove unnecessary access.
Change the passwords of affected email, social-media, bank, and e-wallet accounts using a trusted device.
Enable multi-factor authentication.
Tell affected contacts not to reply, pay, open links, or disclose information. Ask them to preserve the messages they received.
Report public posts or impersonating profiles to the platform, but save evidence before requesting removal.
Never give a collector an OTP, PIN, password, card number, or payment for supposed “data deletion.”

Uninstalling the app may stop further device access, but it does not erase information already copied, cancel the loan, or preserve evidence that was never saved.

Send a written complaint to the lender

Use the company’s Financial Consumer Protection Assistance Mechanism, customer-service channel, and Data Protection Officer listed in the contract, app, website, or privacy notice. If a separate collection agency is involved, send it a copy as well.

Your complaint should state:

Your name and enough account information to identify the loan
The app brand and the lender’s legal corporate name, if known
A dated, factual timeline
The numbers, accounts, collectors, or agencies involved
Exactly what was said, published, accessed, or disclosed
Which people were contacted and whether any were actual guarantors or co-makers
Whether the debt or amount is disputed
The action you want taken

You may request that the company:

Stop threats, insults, public posts, and unauthorized third-party contact
Preserve all collection logs, call records, access logs, instructions, and data-sharing records
Identify the lender, collection agency, and responsible collector
Explain the lawful basis, purpose, source, and recipients of the personal data
Provide access to your processed personal data
Correct inaccurate information
Block, erase, or destroy data that was unlawfully obtained, used for an unauthorized purpose, or is no longer necessary, subject to any lawful retention requirement
Confirm that unauthorized recipients have been notified of a correction or remedial action
Provide an itemized and accurate account statement
Reply in writing

A useful subject line is:

Formal complaint — unfair debt collection and unauthorized processing of personal data — [name/account reference]

Send it through a channel that produces proof of delivery. The 15-calendar-day NPC waiting period runs from the respondent’s receipt of your written notice, not merely from the date you drafted it.

File the unfair-collection complaint with the SEC

For an online lending or financing company, open a ticket through the SEC iMessage portal. The current user guide identifies Financing and Lending Companies Department → Complaints on Financing and Lending Companies as the relevant service.

Attach:

A clear factual narrative
The lender’s corporate name and app name
Your valid government-issued ID
The loan and disclosure documents
Screenshots, messages, call logs, posts, and witness statements
Your complaint to the company and its response, if any
Proof of payment and an explanation of any amount genuinely disputed

Submit one complaint for each respondent company and keep the ticket number. If the app conceals its legal operator or appears unlicensed, provide every identifying detail available and say that the operator is unknown or possibly unauthorized.

The SEC can investigate regulatory violations and impose appropriate administrative action. Its complaint guidance also makes clear that the SEC complaint process does not itself change payment terms, void the contract, declare an interest rate void, or cancel or settle the debt.

File the privacy complaint with the NPC

Observe the 15-day exhaustion rule

Under the 2021 NPC Rules of Procedure, as amended, the NPC ordinarily will not give a complaint due course unless:

You informed the lender, collection agency, or other responsible entity in writing of the privacy violation; and
It failed to take timely and appropriate action or did not respond within 15 calendar days after receiving your notice.

Attach proof of both the notice and its receipt.

The NPC may waive this requirement for good cause or a serious violation, including grave and irreparable harm, the absence of a plain and adequate remedy, or patently illegal conduct. If urgent disclosure or harassment is continuing, explain the danger clearly and ask the NPC to consider a waiver. The decision belongs to the NPC.

Prepare the formal complaint correctly

Use the NPC’s Complaints-Assisted Form and current filing instructions. A formal complaint generally must be:

In writing and verified
Signed and notarized
Filed against an identified respondent—or accompanied by facts that may lead to its identification
Supported by documentary evidence and witness affidavits, where available
Accompanied by the required certification against forum shopping
Accompanied by correspondence showing compliance with the exhaustion requirement
Filed with a valid government ID and the required forms

If a representative files for you, a special power of attorney is generally required. A person who was contacted despite not being the borrower may file concerning the processing of their own personal data if they are an affected data subject.

The complaint may be submitted personally, by registered mail or courier, or by authorized email to complaints@privacy.gov.ph. Follow the NPC page’s current requirements for copies, file format, payment assessment, and electronic submission.

The published NPC fee schedule lists a ₱500 complaint filing fee, with additional fees possible for damages claims and legal research. Indigent complainants and other qualified parties may seek an exemption. Wait for an official assessment and payment instruction.

If you also filed a related SEC, police, court, or other proceeding, disclose it accurately in the certification against forum shopping. If you later learn that the same or a similar action has been filed, the NPC rules require you to report that fact within five calendar days.

When the BSP is the proper regulator

Most complaints about financing companies, lending companies, online lending platforms, and their collection agencies belong with the SEC. The BSP route applies when the actual provider is a BSP-supervised institution, such as a bank, digital bank, or qualifying non-bank financial institution.

First complain through the institution’s Financial Consumer Protection Assistance Mechanism. If it remains unresolved or the institution does not act, escalate through the BSP Online Buddy chatbot on the BSP website. Continue until you receive a BSP complaint reference number.

If BOB is inaccessible, the BSP’s current complaint guide permits submission of the Complaint/Inquiry/Reply form to consumeraffairs@bsp.gov.ph, with proof that you first used the institution’s complaint mechanism. The BSP’s published FAQ states that its Consumer Assistance Mechanism may take approximately 55 to 65 days, depending on the case.

When to report to law enforcement

An SEC, NPC, or BSP complaint is not a substitute for a criminal report. Contact law enforcement promptly if the conduct includes:

A credible threat of physical harm
Stalking or threatening visits
Extortion or blackmail
Hacking or takeover of an account
Identity theft or impersonation
Publication of altered, defamatory, intimate, or highly sensitive material
Use of your ID or account for transactions you did not authorize
False claims that the collector is a police officer, court employee, lawyer, or government agent
Demands to pay a personal account under threat of immediate harm

Call 911 if anyone is in immediate danger. You may also approach the nearest police station, the PNP Anti-Cybercrime Group, the NBI online complaint facility, or the NBI Cybercrime Division. The DICT’s Cybercrime Investigation and Coordinating Center also operates the 1326 anti-scam and cybercrime reporting hotline.

Describe the facts rather than selecting a criminal charge yourself. The investigator and prosecutor must determine which offense, if any, is supported by the evidence.

Important limits and exceptions

A complaint does not erase the debt

Continue addressing any legitimate obligation through verified, official payment channels. Ask for an itemized statement and dispute errors in writing. Do not send money to a collector’s personal account merely because of a threat.

Consent is not unlimited

Agreeing to a privacy notice or clicking an app permission does not validate excessive collection, unrelated use, harassment, or disclosure to random contacts. The lender may nevertheless retain and process data when another lawful basis applies—for example, to administer a continuing loan, comply with a legal duty, or establish or defend a legal claim.

Debt alone is not grounds for imprisonment

Article III, Section 20 of the 1987 Constitution states that no person shall be imprisoned for debt. This does not prevent proceedings based on separate allegedly criminal conduct supported by law and evidence. Never ignore a genuine court summons, subpoena, or prosecutor’s notice; verify it directly with the issuing office and obtain legal advice.

A collector may communicate with someone who actually assumed liability

A genuine guarantor or co-maker may be contacted concerning the obligation they agreed to assume. A friend, relative, colleague, or character reference does not become a guarantor merely because their number was supplied or found in the borrower’s phone.

Common mistakes to avoid

Deleting messages, posts, or the app before preserving evidence
Sending only cropped screenshots that omit the sender, date, or surrounding conversation
Naming only the app brand and not the legal company or developer
Filing an NPC complaint without first sending written notice or proving receipt, unless a waiver is properly requested
Omitting the notarization, verification, certification against forum shopping, ID, or supporting documents
Hiding a related SEC, police, or court complaint from the NPC
Posting unredacted IDs, loan documents, or other people’s phone numbers publicly
Making public accusations that go beyond what the evidence establishes
Paying an unknown personal account or giving an OTP to stop the harassment
Assuming that blocking the collector, uninstalling the app, or filing a complaint cancelled the debt
Ignoring legitimate legal documents because earlier collector messages were false

When legal help is urgent

Consult a lawyer promptly when there is ongoing public disclosure, a threat to safety or employment, identity theft, a disputed signature, substantial unauthorized transactions, several connected lenders or collection agencies, or a demand for damages.

Legal help is also urgent if you receive a genuine summons, subpoena, prosecutor’s notice, barangay notice, or court pleading. Depending on eligibility and availability, assistance may be sought from the Public Attorney’s Office, an Integrated Bar of the Philippines legal-aid office, a law-school legal clinic, or private counsel.

Claims under Republic Act No. 11765 generally prescribe five years after the financial transaction, or five years after discovery of deceit or material nondisclosure, subject to an outside limit of ten years from the violation. Other civil, privacy, administrative, and criminal claims can have different periods. File promptly rather than relying on the longest possible deadline.

Frequently asked questions

Can the lender post my photo or call me a scammer online?

Using a borrower’s photo to harass or embarrass them for collection is expressly prohibited by the NPC lending-data rules. Public disclosure, altered images, or false accusations may also create additional privacy, civil, administrative, or criminal issues depending on the exact content and circumstances.

Can the app message everyone in my contacts because I allowed contact access?

No. Permission does not authorize unrestricted contact harvesting or debt-collection messages to random contacts. Any permitted access must remain necessary and proportionate, and processing that leads to harassment or collection from non-guarantors is prohibited.

Can a character reference be forced to pay?

Not merely because they were named as a reference. A guarantor must expressly agree to guarantee the debt. A character reference is not automatically a guarantor.

Can I complain even if I already paid?

Yes. Payment does not erase an earlier privacy violation or unfair collection practice. Preserve proof of payment and clearly identify the conduct being reported.

Can I complain if I never borrowed but received collection messages about someone else?

Yes, if your own number, identity, or other personal data was processed or disclosed improperly, you may be an affected data subject. Preserve the message, tell the sender in writing to identify its source and stop unauthorized processing, and consider an NPC complaint.

Will filing a complaint stop all collection calls?

Not automatically. It creates a formal record and may lead to regulatory orders or corrective action, but lawful and respectful collection may continue. State in writing which conduct must stop and whether the amount is disputed.

Do I need a lawyer to file with the SEC, NPC, or BSP?

A lawyer is generally not required for an initial complaint. Legal assistance is valuable when facts are disputed, damages are substantial, urgent protective relief is needed, criminal conduct is alleged, or a formal case has already been filed.

Official sources

This article provides general legal information, not advice for a particular case. Rights, jurisdiction, and remedies depend on the loan documents, the identity of the provider and collector, the data processed, the messages sent, and the available evidence. Official sources and procedures were checked as of 1 August 2026.