Quick answer

You may report abusive online lending app conduct to more than one agency:

Report unfair debt collection, public shaming, contact-list messaging, deceptive collection tactics, and an unlicensed lender to the Securities and Exchange Commission (SEC) through the official SEC iMessage portal.
Report unlawful collection, use, or disclosure of personal data to the National Privacy Commission (NPC). Ordinarily, you must first notify the lender or data controller in writing and allow it 15 calendar days from receipt to respond before filing a formal NPC complaint.
Report threats, extortion, impersonation, fraud, hacking, or other possible crimes immediately to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT Cyber Hotline. Do not wait 15 days if anyone faces immediate danger; call 911.

Preserve the evidence before blocking numbers, deleting messages, uninstalling the app, or reporting posts for removal. Filing a complaint does not automatically cancel a valid loan, but owing money does not authorize harassment, threats, public humiliation, or misuse of personal data.

What conduct may be unlawful?

A lender may send accurate, proportionate payment reminders and pursue lawful collection remedies. It may not use collection as a license to abuse or shame people.

Under SEC Memorandum Circular No. 18, Series of 2019, prohibited practices include:

Using or threatening violence or other criminal means to harm a person, reputation, or property;
Threatening action that cannot legally be taken;
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense;
Publishing or disclosing a borrower’s name or other personal information, except where disclosure is lawfully allowed;
Communicating false loan information, including failing to say that a debt is disputed;
Using false representations or deceptive means to collect a debt or obtain information;
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., unless the account is more than 15 days past due or the borrower expressly agreed—through written, electronic, or recorded means—that those are the only reasonable times for contact; and
Contacting people in the borrower’s contact list who were not named as guarantors or co-makers, regardless of the borrower’s supposed consent.

The Financial Products and Services Consumer Protection Act, or Republic Act No. 11765, also prohibits financial service providers from using abusive collection or debt-recovery practices and requires them to respect client privacy.

Privacy violations involving contacts, photos, and other data

The Data Privacy Act of 2012 requires personal data to be processed lawfully, fairly, transparently, and only for a declared, legitimate, and proportionate purpose.

Under NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02:

A lending app must not require unnecessary or excessive permissions.
Camera or photo-gallery access may be used for legitimate purposes such as identity verification, fraud prevention, or payment verification, but access should be turned off or revocable after the purpose is completed.
A borrower’s photo must never be used to harass, embarrass, or shame the borrower.
Unrestricted or disproportionate processing of contact lists is prohibited.
Contact-list access may be limited to letting the borrower choose a character reference or guarantor, or to deriving proportionate metadata for a legitimate purpose. It does not permit mass copying and messaging.
A character reference may be contacted only to verify the borrower’s identity and the truthfulness of application information. A character reference is not automatically a guarantor.
A person becomes a guarantor only after expressly consenting to that obligation. For debt collection, the lender may contact the guarantor—not unrelated contacts, co-workers, relatives, or friends.

The government’s 18 March 2026 joint advisory on online lending platforms reiterates that contacting people on a borrower’s contact list for collection is prohibited unless they are consenting guarantors.

Consent to install an app or accept its terms is not necessarily consent to every later use of personal data. A lender must still show a lawful purpose and comply with transparency, necessity, and proportionality requirements. Deceptive interface designs—such as pre-ticked permissions or making consent easy to give but difficult to withdraw—may undermine valid consent.

What to do immediately

1. Preserve the evidence

Before deleting anything, make copies of:

Text messages, chat threads, emails, social-media posts, and comments;
Call logs showing the number, date, time, and duration;
Voicemails already left on your device;
Screenshots showing the entire screen, including the sender’s account or number, date, time, and URL where applicable;
Messages received by relatives, friends, co-workers, employers, or other contacts;
The app’s store listing, developer name, download link, privacy notice, requested permissions, and in-app collection messages;
The lender’s corporate name, SEC registration number, Certificate of Authority number, office address, and privacy or data-protection contact;
The loan agreement, disclosure statement, payment schedule, account history, receipts, and proof of payments;
Any altered photograph, fake “wanted” notice, fabricated legal document, or false accusation; and
Your written complaints to the lender and proof that they were received.

Keep the original files and an unedited backup. Record a short written timeline while events are fresh. Ask affected contacts to preserve their own messages and provide signed statements if they are willing.

Do not secretly record a private telephone conversation without legal advice. The Anti-Wiretapping Act generally prohibits secretly recording a private communication without authorization from all parties.

2. Secure your phone and accounts

After preserving the evidence:

Revoke the app’s access to contacts, photos, camera, microphone, location, SMS, and storage unless access remains genuinely necessary.
Change passwords that were reused elsewhere and enable multi-factor authentication.
Review logged-in devices, recovery email addresses, and mobile-wallet or bank alerts.
Warn contacts that they may receive unauthorized messages and should not send money or personal information.
Report impersonation or public-shaming content to the platform, but save the URL and screenshots first.
If the app appears malicious, avoid entering more information. Change important credentials from a trusted device before uninstalling it.

3. Send a written demand to the lender or data controller

Write to the lender’s official customer-service and privacy or data-protection contact. Use the legal company name found in the loan documents or privacy notice, not only the app’s brand name.

Your notice should state:

Your name and account or transaction reference;
The app and collector involved;
The dates and exact conduct complained of;
Which personal data were accessed, used, or disclosed;
The names or categories of people contacted;
That you demand an immediate stop to harassment and unauthorized processing;
That you request identification of the lender, collection agency, and persons processing your data;
That you request the source, purpose, legal basis, recipients, and retention period for the affected data;
That you request correction, blocking, deletion, or removal where legally applicable; and
That all relevant records, account logs, call records, instructions to collectors, and access logs must be preserved.

Ask for a written response and save proof of delivery. Deletion is not an absolute right: a lender may retain

Quick answer

You may report an online lending app’s abusive collection practices to the Securities and Exchange Commission (SEC) and its misuse or disclosure of personal data to the National Privacy Commission (NPC). Report threats, fraud, impersonation, extortion, or other possible crimes separately to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or the police.

Before blocking numbers or uninstalling the app, preserve screenshots, messages, call logs, app permissions, loan documents, payment records, and proof that other people were contacted. For an NPC complaint, you ordinarily must first notify the lender or its data protection officer in writing and allow 15 calendar days from receipt for an appropriate response. Serious or urgent cases may justify an NPC waiver, but the grounds must be stated and supported.

Harassment does not automatically cancel a valid loan. The lender may still use lawful collection methods, but it cannot use threats, public shaming, deceptive statements, abusive language, or your contact list as a pressure tool.

What conduct may be unlawful?

A lender may send accurate payment reminders, make a lawful demand, negotiate payment, report credit information when authorized by law, or pursue a civil claim. Collection becomes legally problematic when the method is abusive, deceptive, disproportionate, or uses personal data beyond a lawful purpose.

Under SEC Memorandum Circular No. 18, Series of 2019, prohibited unfair collection practices include:

Using or threatening violence or other criminal means to harm a person, reputation, or property.
Threatening an action that cannot legally be taken.
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense.
Disclosing or publishing borrowers’ names or personal information, except where disclosure is legally allowed.
Communicating false loan information, including failing to say that a debt is disputed when that fact should be disclosed.
Using false representations or deceptive means to collect a debt or obtain information.
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., unless the account has been past due for more than 15 days or the borrower expressly agreed—through written, electronic, or recorded means—that those are the only reasonable contact times.
Contacting people in the borrower’s contact list who were not named as guarantors or co-makers, even if the borrower previously allowed access to the phone.

The Financial Products and Services Consumer Protection Act, or Republic Act No. 11765, also prohibits financial service providers from employing abusive collection or debt-recovery practices and requires them to respect client privacy.

Contact lists, character references, and guarantors are not the same

The NPC’s amended loan-data rules draw important distinctions:

An app may not engage in unconstrained, excessive, or disproportionate processing of an entire contact list.
A character reference may be contacted to verify the borrower’s identity or the truth of information in the application. A character reference is not automatically a guarantor and should not be contacted for debt collection.
A guarantor must have separately and expressly agreed to assume responsibility if the borrower defaults. For collection purposes, the lender may contact the guarantor.
Contacting other people in the borrower’s contact list for debt collection is prohibited.
Camera or photo-gallery access must be limited to legitimate purposes such as identity or payment verification and turned off when no longer needed. A borrower’s photo may not be used to shame or harass.
A lender remains accountable for processing performed by its collection agency or other service provider.

Consent to install an app or approve a permission is not a blanket license to shame a borrower, broadcast loan information, or use unrelated contacts. Personal-data processing must still be transparent, lawful, necessary, and proportionate. The government’s 18 March 2026 advisory on online lending platforms reiterates these restrictions.

What to do immediately

1. Preserve the evidence before deleting anything

Save the following in their original form whenever possible:

Screenshots showing the full message, sender’s number or account, date, and time.
Screen recordings that show the message thread, profile, URL, or app page in context.
SMS, email, chat, and social-media message exports.
Call logs showing the numbers, dates, times, and frequency of calls.
Voicemail messages already left on your device.
The app’s name, developer, download page, version, permissions, privacy notice, and displayed corporate information.
The loan agreement, disclosure statement, promissory note, repayment schedule, and proof of disbursement.
Receipts, payment confirmations, account statements, and screenshots of the balance claimed.
Messages sent to relatives, friends, co-workers, employers, or other contacts.
Statements or affidavits from people who received collection messages.
Any edited photograph, fake wanted poster, social-media post, group chat, or impersonation account.
Your written complaint to the lender and proof that it was received.

Keep an unedited copy of each file. Make a separate chronological incident log identifying what happened, when it happened, which account or number was used, who received the communication, and what personal information was disclosed.

Do not secretly record a private telephone or spoken conversation without legal advice. The Anti-Wiretapping Act generally prohibits secretly recording a private communication without authorization from all parties. Existing written messages, voicemail voluntarily left by the caller, call logs, and witness accounts can still be preserved.

2. Protect your phone and accounts

After preserving evidence:

Revoke unnecessary contact, camera, photo, location, microphone, and storage permissions.
Change passwords that were reused elsewhere, preferably from a trusted device.
Enable multi-factor authentication and check for unfamiliar logged-in devices.
Warn affected contacts not to pay, click links, disclose information, or respond to impersonators.
Report abusive posts or fake profiles to the platform, but save evidence before requesting removal.
If identification documents or financial-account details may have been exposed, contact the relevant bank, e-wallet, or issuing institution through its official channel.
Uninstall a suspicious app only after preserving the evidence you need. If you suspect malware, stop using the device for financial transactions until it has been checked.

3. Identify the actual company

An app’s brand name may differ from the lender’s registered corporate name. Check the loan agreement, disclosure statement, privacy notice, app-store listing, receipts, and payment instructions for:

Registered corporate name.
SEC registration number.
Certificate of Authority number.
Business address.
Official support and data-protection contacts.
Name of any collection agency.

Include both the app name and corporate name in every report. If you cannot identify the company, provide the phone numbers, payment-account names, URLs, screenshots, app developer, and other facts that may lead authorities to it.

Send a written privacy and harassment notice

For an NPC complaint, first write to the lender, its data protection officer, and—if identifiable—the collection agency. Use an official email address or another channel that produces proof of delivery.

Your notice should:

Identify the app, loan or account, and dates of the incidents.
Describe exactly what information was accessed or disclosed and to whom.
Identify the numbers, profiles, or collectors involved.
State whether the debt or amount is disputed; do not claim a dispute if there is none.
Demand that harassment, public disclosure, and contact with unauthorized third parties stop.
Request the lawful basis, purpose, and source of the personal data being processed.
Request identification of authorized collection agencies or processors.
Request correction of false information and blocking or deletion of unlawfully processed data, subject to lawful retention requirements.
Ask the company to preserve relevant records.
Require a written response.
Attach only necessary copies and retain the originals.

Keep the sent email, delivery receipt, ticket number, and response. The NPC’s rules ordinarily require proof that the company failed to take timely or appropriate action, or did not respond within 15 calendar days after receiving the notice. Do not wait 15 days to seek police or emergency help when there is a threat, extortion attempt, account compromise, or continuing serious harm.

Report unfair collection practices to the SEC

The SEC regulates lending and financing companies, including their online lending platforms and collection practices.

Use the SEC’s current official complaint channel:

Open the SEC iMessage portal.
Register or sign in and create a new ticket.
Route the matter to the Financing and Lending Companies Department (FINLEND) and select the service for complaints against regulated entities or online lending platforms.
Identify the corporate lender, app name, collection agency, account, and collectors involved.
Describe each incident chronologically and identify the specific unfair practices.
Attach the required complaint form, a valid government-issued ID, and supporting evidence.
Submit one complaint form for each respondent company where applicable.
Save the electronic ticket number and use the ticket thread for follow-ups.

The SEC’s lending-company complaint guidance emphasizes complete forms, supporting proof, a valid ID, and one complaint per respondent. The SEC’s 2026 iMessage system replaced informal complaint channels and lets complainants track their tickets.

Report the lender even if you believe it is unlicensed. Lack of registration does not authorize harassment; it is an additional matter for the SEC to investigate.

The SEC may investigate and impose regulatory sanctions, but its complaint process does not itself rewrite the loan, declare the contract void, cancel the balance, or settle the obligation. Contract validity, disputed charges, and damages may require separate legal proceedings.

File a privacy complaint with the NPC

Use the NPC route when the app or collector accessed, copied, retained, disclosed, or used personal data unlawfully—for example, by harvesting contacts, publishing a borrower’s photograph, messaging unrelated contacts, or continuing unauthorized processing.

Ordinary prerequisites

Under the 2021 NPC Rules of Procedure, as amended, you ordinarily must prove that:

You informed the lender, collection agency, or other concerned entity of the privacy violation in writing; and
It failed to take timely or appropriate action, or did not respond within 15 calendar days from receipt.

The NPC may waive these requirements for proven good cause or a serious violation, including grave and irreparable harm that requires NPC action, the absence of a plain and adequate remedy from the respondent, or conduct that is patently illegal. Explain and document why a waiver is necessary; do not simply omit the written-notice requirement.

How to file

Download the NPC’s current Complaint-Affidavit/Reklamong Salaysay form.
Complete the form and its applicable question-and-answer sections.
Identify the respondent and personal information affected. If the respondent is unknown, state all circumstances that may help identify it.
Attach the written notice, proof of receipt, response or proof of no response, evidence, witness affidavits where available, and a valid government-issued ID.
Include the verification and certification against forum shopping contained in the form.
Have the complaint properly notarized.
Follow the NPC’s current filing instructions. The NPC presently permits personal or courier filing and submission of a scanned complaint by email to complaints@privacy.gov.ph.

The current posted NPC schedule of fees lists a ₱500 filing fee, a legal-research fee of 1% of the filing fee but not less than ₱10, and additional fees when damages are claimed. Qualified indigent complainants may seek an exemption by submitting the required proof.

A borrower is not the only possible complainant. A relative, friend, co-worker, character reference, or other person whose own contact details or personal information were unlawfully processed may file as an affected data subject.

Report threats, fraud, or possible cybercrime

A regulatory complaint does not replace a criminal report. If messages contain threats of violence, extortion, impersonation, fraudulent payment instructions, identity misuse, or defamatory public posts, preserve the evidence and report promptly.

The government’s March 2026 advisory identifies these channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; (02) 8723-0401 local 7491

You may also go to the nearest police station. For an immediate threat to life, safety, or property, call the government’s Unified 911 emergency hotline.

Depending on the proven facts, conduct may fall under laws on threats, coercion, extortion, libel or cyberlibel, computer-related identity theft, or Data Privacy Act offenses. These classifications are fact-sensitive; police investigators and prosecutors determine the appropriate charge.

Your debt and the harassment complaint are separate issues

The Constitution states that no person may be imprisoned merely for debt. A lender therefore cannot have you arrested simply because an ordinary loan remains unpaid. See Article III, Section 20 of the 1987 Constitution.

That protection does not erase a valid debt or prevent a lawful civil collection case. It also does not protect separate criminal conduct, if any, merely because it arose during a loan transaction. Do not ignore genuine court papers, subpoenas, or official notices. Verify them directly with the issuing court or agency rather than through a collector’s phone number.

Continue addressing any undisputed balance through the lender’s verified official channel. Ask for a written statement of account, payment breakdown, restructuring proposal where appropriate, and official receipt. Do not send money to a newly supplied personal account without independently confirming that the payee is authorized.

Common mistakes to avoid

Deleting the app, messages, or social-media posts before preserving evidence.
Submitting cropped screenshots that omit the sender, URL, date, or time.
Naming only the app and not the corporate lender or collection agency.
Filing an NPC complaint without first sending the required written notice or explaining documented grounds for waiver.
Failing to attach proof that the lender received the notice.
Secretly recording a private call without considering the Anti-Wiretapping Act.
Posting the collector’s personal information publicly in retaliation.
Paying an unverified account sent through a threatening message.
Assuming a character reference is legally responsible for the loan.
Assuming an SEC or NPC complaint automatically cancels the debt.
Signing a certification against forum shopping without disclosing another pending case involving the same issues.

The same incident may properly be reported to different authorities because they exercise different powers. If you file parallel complaints, disclose them accurately wherever a form asks about other proceedings.

When legal help is urgent

Consult a Philippine lawyer promptly if:

A collector threatens physical harm, home intrusion, abduction, or damage to property.
Intimate images, identification documents, medical information, or financial credentials were exposed.
The lender is impersonating police, courts, lawyers, or government agencies.
You receive authentic court papers, a subpoena, or notice from a prosecutor.
Money was taken through fraud or an unauthorized transaction.
The lender continues widespread disclosure despite written notice.
You need an injunction, damages, defense in a collection case, or advice about a disputed or allegedly unconscionable loan.
The complaint involves several apps, multiple corporate entities, or an overseas operator that is difficult to identify.

Those unable to afford private counsel may inquire with the Public Attorney’s Office about eligibility for assistance.

Frequently asked questions

Can the lender call my family or employer?

Not merely because their information appears in your contact list. A character reference may be contacted for identity or information verification, not treated automatically as a guarantor. Debt-collection contact is generally limited to the borrower and a person who separately consented to be a guarantor. Any disclosure to an employer or relative must also have a lawful, necessary, and proportionate basis.

I allowed contact access when I installed the app. Can I still complain?

Yes. Permission or consent does not authorize excessive processing, harassment, public shaming, or collection from unrelated contacts. The exact result will depend on the permission notice, purpose stated, data actually accessed, and how the lender used it.

Can a person contacted about someone else’s loan complain?

Yes. If the app processed or disclosed that person’s own information, the person may be an affected data subject for NPC purposes. They should preserve the message and explain how their number was obtained and used.

Should I block the collector?

Preserve the evidence first. You may then block abusive numbers, but retain the original messages, call logs, exports, and incident notes. Blocking one number does not replace filing a report where threats or data misuse continue.

Does reporting harassment stop interest or collection?

Not automatically. The lender may continue lawful collection, and the contract remains subject to its terms and applicable law unless modified by agreement or a competent authority. Ask for a written account breakdown and obtain legal advice if the balance or charges are disputed.

Which complaint should I file first?

Take emergency and security measures first. Send the written privacy notice promptly because it starts the NPC’s 15-calendar-day response period. The SEC complaint and any police or cybercrime report need not wait for that period.

Official legal sources

This article provides general Philippine legal information, not legal advice for a particular loan, message, or dispute. Procedures and conclusions may depend on the documents and proven facts. Official sources and reporting channels were checked as of 1 August 2026.