Quick answer

If an online lending app or its collector is threatening you, publicly shaming you, messaging people in your phone contacts about your debt, using your photos to embarrass you, or otherwise misusing your personal information, you may have grounds to report the conduct to more than one government agency.

For a lending or financing company’s unfair or abusive debt-collection practices, the principal regulator is the Securities and Exchange Commission (SEC). For unauthorized collection, use, disclosure, or other misuse of personal data, you may file a complaint with the National Privacy Commission (NPC). If the conduct involves threats, coercion, hacking or illegal access, cyber libel, or another possible crime, you may also seek investigation from the NBI Cybercrime Division, PNP Anti-Cybercrime Group, or the appropriate prosecutor’s office. These remedies can overlap; choosing one does not necessarily mean the others are unavailable. (Lawphil)

A genuine unpaid loan does not give a lender unlimited authority to harass a borrower. Republic Act No. 11765, the Financial Products and Services Consumer Protection Act, expressly prohibits financial service providers from using abusive collection or debt-recovery practices and recognizes consumers’ rights to fair treatment, data privacy, and complaint redress. At the same time, reporting harassment does not by itself cancel a valid debt. A creditor may still demand payment, negotiate a settlement, or use lawful judicial remedies. (Lawphil)

What counts as unlawful or unfair online lending-app harassment?

SEC Memorandum Circular No. 18, series of 2019, prohibits unfair debt-collection practices by financing and lending companies and applies to their third-party service providers involved in collection. The circular remains among the SEC issuances governing financing and lending companies. (SEC Appointment System)

Depending on the facts, prohibited conduct can include threats of violence or other criminal means; threatening an action that cannot legally be taken; abusive or insulting communications of the kind covered by applicable law; false or deceptive representations to obtain payment or information; and disclosing or publishing borrowers’ names or personal information for collection outside the circumstances allowed by law.

SEC rules also restrict collection communications during unreasonable hours. As a general rule under MC No. 18, contacting a borrower before 6:00 a.m. or after 10:00 p.m. is treated as an unfair practice, subject to the circular’s specific exceptions, including certain substantially overdue accounts and situations in which the borrower expressly agreed, through a written, electronic, or recorded arrangement, that those are the only reasonable or convenient times for contact.

Importantly, borrower consent does not create a blanket right to call everyone stored in the borrower’s phone. SEC rules prohibit contacting persons in a borrower’s contact list other than the persons falling within the permitted categories, such as named guarantors or co-makers. NPC rules impose additional privacy restrictions on the processing and use of contact lists.

RA No. 11765 provides another layer of protection. Financial service providers may not employ abusive collection or debt-recovery practices, and they are responsible for acts or omissions of their officers, employees, and agents. The law also provides for solidary liability with accredited third-party service providers for acts or omissions in transactions with consumers, including debt collection. A company therefore cannot necessarily avoid responsibility simply by saying that the harassment came from an outside collection agency. (Lawphil)

When collection becomes a privacy violation

The Data Privacy Act of 2012 and NPC rules are especially important in online lending because loan apps can process far more information than a traditional lender.

NPC Circular No. 20-01 requires lenders and persons acting as lenders to limit the personal data they collect to information that is adequate, relevant, suitable, necessary, and not excessive for legitimate loan-processing purposes. An online lending app may not require unnecessary permissions involving personal or sensitive personal information.

The rule does not mean that every request for a phone permission is automatically illegal. Some limited processing may be justified for legitimate purposes such as know-your-customer requirements, determining creditworthiness, preventing fraud, or lawful collection. The important question is whether the permission and resulting processing are suitable, necessary, proportionate, and supported by a lawful basis.

There are, however, particularly clear restrictions. An app may not use a borrower’s photograph to harass or embarrass the borrower into paying. Accessing, harvesting, copying, or saving phone contacts, email lists, or social-media contacts for debt collection or harassment is prohibited under NPC Circular No. 20-01. The NPC later clarified that unbridled processing of a contact list—including processing that leads to harassment, collection from persons outside the borrower’s guarantors, or other unfair collection practices—is prohibited.

This distinction matters when an app asks for access to contacts. NPC Circular No. 2022-02 permits only limited, proportionate processing in appropriate circumstances—for example, minimum access needed to allow the borrower to choose a character reference or guarantor. It does not authorize the lender to copy the borrower’s entire address book and start sending collection messages to family members, officemates, clients, or acquaintances.

A character reference is not automatically responsible for your debt

One common online-lending tactic is to message a person whom the borrower listed merely as a “reference.”

NPC Circular No. 2022-02 expressly states that a character reference is not automatically a guarantor. A character reference is principally someone whose details are provided to verify the borrower’s identity and the truthfulness of information supplied in the loan application. Contacting that person for unrelated purposes is restricted.

A guarantor is different. The person must expressly bind himself or herself to answer for the borrower’s obligation if the borrower fails to pay, and the lender must obtain the guarantor’s separate consent consistently with applicable law. For debt collection, the NPC circular states that lenders may contact the guarantor; contacting other persons in the borrower’s contact list who were not named as guarantors is prohibited.

So if an app sends messages such as “Your friend owes us money,” “Tell your employee to pay,” or similar collection messages to dozens of people merely because their numbers appeared in the borrower’s phone, that conduct should be documented and may support both an unfair-collection complaint and a privacy complaint.

Public shaming can create several legal problems

Posting a borrower’s name, photograph, debt information, identification documents, contact information, or similar material in a Facebook group, group chat, messaging thread, or other public or semi-public channel can raise issues under both SEC collection rules and the Data Privacy Act.

The Data Privacy Act penalizes several forms of unlawful processing and disclosure. For example, Section 32 addresses unauthorized disclosure of personal or sensitive personal information, while Section 31 addresses malicious disclosure under the circumstances specified by the law. Whether a particular post constitutes a criminal violation depends on who disclosed the information, what information was involved, the lawful basis for processing or disclosure, consent, intent, and other facts. (Lawphil)

The DOJ Office of Cybercrime has specifically identified online-lending complaints involving access to borrowers’ contact lists, online posting of personal and sensitive information for shaming, death or injury threats, and abusive messages. Its advisory explains that such conduct may, depending on the facts, implicate the Data Privacy Act, the Cybercrime Prevention Act, Revised Penal Code offenses, and SEC rules. (Department of Justice)

What to do: a practical reporting process

Preserve the evidence before blocking numbers, revoking permissions, or uninstalling the app. Take full screenshots showing the sender or account, phone number, date, time, message thread, social-media profile or URL, and the exact statement made. Save your loan agreement, disclosure statement, repayment schedule, receipts, app screenshots, privacy notice, terms and conditions, collection notices, call logs, and any emails. If people in your contacts received messages, ask them to preserve the original messages on their own devices and, where appropriate, provide copies. Avoid altering or heavily cropping the original evidence. Do not secretly record private conversations without first considering the restrictions of Philippine anti-wiretapping law.
Identify the legal company behind the app. The app’s marketing name may be different from the corporation that actually extended the loan. Check the loan agreement, disclosure statement, app-store listing, privacy notice, official payment instructions, and SEC records. The SEC maintains information on financing and lending companies and a List of Recorded Online Lending Platforms. Its current lending-company page also contains advisories regarding unauthorized platforms. (Securities and Exchange Commission)
Send a written complaint to the lender for the privacy violation. Identify the conduct, dates, phone numbers or accounts involved, personal information disclosed, people contacted, and the relief you are requesting. Depending on the situation, you may ask the company to stop the unauthorized processing or disclosure, stop contacting persons who are not proper guarantors, identify the collection agency involved, preserve relevant records, correct inaccurate information, and explain what action it has taken. Keep proof that the company received your complaint. This step is particularly important for an eventual NPC case because the NPC generally requires exhaustion of remedies: the respondent must first be informed in writing of the privacy violation or personal-data breach and given an opportunity to address it. If it does not take timely or appropriate action, or does not respond within 15 calendar days from receipt, proof of that process should accompany the NPC complaint. (National Privacy Commission)
File the unfair-collection complaint with the SEC. The SEC now uses iMessage, its official web-based ticketing system for public complaints and requests. The SEC says iMessage replaces informal channels such as ordinary email and Google Forms and gives each submission a trackable ticket. To use it, open a new ticket, sign in through a registered eSECURE account, select the appropriate service, complete the form, and upload your supporting records. The current service list includes “Complaints on Financing and Lending Companies” under the Financing and Lending Companies Department. (Securities and Exchange Commission)
File a privacy complaint with the NPC when the requirements are met. Use the current complaint form available from the NPC rather than relying on an old copy saved from another website. The NPC states that a complainant may submit a filled-out and notarized complaint form, or an appropriate verified complaint, together with supporting evidence and witness affidavits. Filing may be done personally, by registered mail, by courier, or through electronic mail as authorized by the Commission. For electronic filings, follow the NPC’s current PDF and digital-signature requirements. Include proof of the written notice to the respondent and the resulting response—or lack of one—needed to establish exhaustion of remedies. (National Privacy Commission)
Report possible crimes separately when necessary. Do not treat the NPC's 15-day exhaustion requirement as a waiting period before seeking protection from a threat or reporting a possible crime. If collectors threaten death or physical injury, use coercion or extortion, illegally access accounts or devices, or engage in another apparent cybercrime, preserve the evidence and promptly approach law enforcement or the prosecutor’s office. The DOJ has expressly identified the NBI Cybercrime Division, PNP Anti-Cybercrime Group, and prosecutor’s offices as possible avenues for criminal complaints arising from abusive online-lending conduct. The NBI’s current Citizen’s Charter confirms that members of the public may request investigative assistance from its Cybercrime Division. (Department of Justice)
Continue separating the debt issue from the harassment issue. If the loan is legitimate and the amount is not disputed, unlawful collection conduct ordinarily does not extinguish the underlying obligation. If you intend to pay, use only a verified payment channel belonging to the lender or its authorized provider and retain receipts. If you dispute the principal, interest, fees, identity of the creditor, or an alleged payment default, raise the dispute expressly in writing rather than assuming that a harassment complaint will resolve the account automatically.

What evidence is most useful?

A strong complaint allows the regulator or investigator to reconstruct what happened without having to guess.

Preserve the original message threads, not just one offensive sentence. Show the originating phone number, account, or profile; dates and times; and surrounding messages. Keep screenshots of any social-media post before it is deleted, together with information showing where it appeared and who could see it.

Keep records identifying the app and legal lender, including the loan contract, disclosure statement, privacy policy, app-store page, corporate name, collection-agency name if disclosed, and payment instructions.

For contact-list abuse, preserve evidence from the recipients themselves. A screenshot from your phone saying “my boss was contacted” is less useful than the boss’s original message showing the sender, date, content, and number or account from which it came.

For privacy complaints, keep your written notice to the lender or its data protection contact and objective proof of receipt. This is especially important because the NPC expressly warns that failure to give the respondent an opportunity to address the privacy complaint, insufficient form, or insufficient evidence can lead to outright dismissal. (National Privacy Commission)

After preserving what you need, review the app’s permissions on your device and revoke permissions that are no longer necessary. Removing an app’s access today, however, does not necessarily erase information it may already have copied or transferred.

Common mistakes that can weaken a complaint

Deleting everything immediately. Blocking an abusive collector may be sensible for your peace of mind or safety, but first save the evidence unless doing so puts you at risk.

Submitting only cropped screenshots. A regulator may need to know who sent the message and when. Preserve originals and fuller screenshots whenever possible.

Naming only the app. Identify the corporation, financing or lending company, collection agency, and relevant phone numbers or accounts if you can. Apps can change names or be impersonated.

Filing an NPC complaint without first making the required written privacy complaint to the respondent. The NPC’s current public guidance expressly requires proof of exhaustion of remedies and refers to the 15-calendar-day period from the respondent’s receipt. (National Privacy Commission)

Assuming every contact with another person is automatically illegal. The legal analysis differs for a properly consenting guarantor, a mere character reference, a co-maker, and a random person harvested from the phone. State precisely who the person was and why their number was available.

Assuming that accepting app permissions means consenting to anything the lender wants to do. Philippine privacy rules require processing to have a lawful basis and to comply with principles such as necessity and proportionality. Unbridled contact-list processing and using information for harassment are specifically restricted.

Assuming the harassment makes the loan disappear. Collection misconduct and the enforceability or amount of the debt are separate questions.

Paying a collector through an unverified personal account just to stop the threats. Confirm payment instructions through the lender’s legitimate channel. A scammer may impersonate a real lender or collection agent.

What if the online lending app is not authorized by the SEC?

Check both the app and the company behind it. The SEC's current lending and financing section provides its List of Recorded Online Lending Platforms and continues to publish advisories concerning unauthorized OLPs, mobile applications, and websites; the SEC was still issuing such advisories in August 2026. (Securities and Exchange Commission)

An apparently unauthorized operation should be brought to the SEC's attention. But absence of SEC authority does not make privacy protections disappear. NPC Circular No. 20-01 expressly covers personal-data processing connected with loan activities by lending and financing companies and other persons acting as such, whether or not they are authorized by the SEC. Privacy violations by an unlicensed lender can therefore still fall within the NPC framework.

Do not assume, however, that an app is unauthorized merely because you cannot immediately find its brand name. The platform may operate under a different corporate name, and an unauthorized person may also be impersonating a legitimate lending company.

When to seek urgent help

Treat the matter as more than an ordinary regulatory complaint if a collector makes a credible threat of death or physical injury, threatens to come to your home or workplace to harm someone, demands money through threats unrelated to lawful debt collection, gains unauthorized access to your accounts or device, publishes highly sensitive information, or engages in conduct creating an immediate safety risk.

The DOJ has recognized that online-lending harassment can potentially involve grave or light threats, coercion, illegal access, cyber libel, and Data Privacy Act offenses depending on the facts. Such matters may be reported to the NBI Cybercrime Division, PNP Anti-Cybercrime Group, or the appropriate prosecutor. (Department of Justice)

For an NBI cybercrime complaint, the NBI's current procedure contemplates a complaint sheet, preliminary interview and investigation, and, where relevant, sworn statements, affidavits, supporting documents, and examination of a device connected with the investigation. (National Bureau of Investigation)

Do not respond to threats with threats of your own. Preserve the communications and obtain police or investigative assistance when personal safety is genuinely at risk.

What can the NPC do if a privacy complaint succeeds?

The NPC investigates whether the allegations involve the Data Privacy Act or related privacy issuances and whether there is reason to believe that a privacy violation or personal-data breach occurred.

According to the NPC's current complaint guidance, an upheld case may proceed for enforcement of civil damages, fines, and other administrative sanctions when appropriate. If the NPC determines that criminal charges should be pursued against particular individuals, it may forward the case records to the Department of Justice and recommend prosecution. (National Privacy Commission)

That does not mean that every annoying collection call constitutes a Data Privacy Act crime. Criminal liability requires proof of the elements of the particular offense. The nature of the information, the parties involved, authority or consent, purpose of processing, manner of disclosure, and state of mind required by the statute can all matter.

Frequently asked questions

Can an online lending app contact my family, friends, coworkers, or employer?

Not simply because their numbers were found in your phone. NPC rules prohibit unbridled processing of contact lists and state that, for debt-collection purposes, lenders may contact a properly qualifying guarantor rather than unrelated persons in the borrower’s contact list. A mere character reference is not automatically a guarantor. SEC rules also restrict collection contact with persons in the borrower's contact list.

Can a lender call my character reference to demand payment?

A character reference is not automatically liable for the debt. Under NPC Circular No. 2022-02, a character reference is principally for verification of the borrower's identity and information, and the circular expressly distinguishes that role from a guarantor.

Can a loan app access my entire contacts list because I clicked “Allow”?

Permission at the device level does not by itself eliminate the lender's obligations under privacy law. NPC rules prohibit unnecessary permissions and unbridled contact-list processing. Processing must remain suitable, necessary, proportionate, and supported by an applicable lawful basis.

Can they use my selfie or ID photo to shame me into paying?

NPC Circular No. 20-01 expressly states that a borrower's photograph must not be used to harass or embarrass the borrower for purposes of collecting a delinquent loan.

Can I complain even if I really owe the loan?

Yes. A valid obligation does not authorize abusive debt recovery or unlawful processing of personal information. RA No. 11765 expressly prohibits abusive collection practices. Your remaining debt liability, however, must be addressed separately. (Lawphil)

Should I complain to the SEC or the NPC?

For unfair lending or collection practices, file with the SEC. For privacy and personal-data misuse, pursue the NPC process. If the same conduct involves both—for example, a collector harvests your contacts and messages them to shame you—you may have grounds to pursue both regulatory remedies. Possible crimes can also be reported separately to law enforcement or prosecutors. (SEC Appointment System)

Do I have to wait 15 days before reporting anything?

The 15-calendar-day rule discussed above concerns the NPC's exhaustion-of-remedies requirement after your written privacy notice is received by the respondent. It is not a general rule requiring you to wait before filing an SEC complaint or before seeking law-enforcement help for threats or possible crimes. (National Privacy Commission)

Can I complain about an unlicensed or unauthorized lending app?

Yes. Suspected unauthorized lending activity may be reported to the SEC, while the NPC's loan-related privacy rules extend to persons acting as lenders even if they are not SEC-authorized.

Will filing a complaint erase my loan balance?

No. A regulatory, privacy, or criminal complaint does not automatically extinguish an otherwise valid debt. Questions concerning whether the loan is valid, whether amounts were properly disclosed, whether interest or charges are enforceable, and how much remains due require a separate examination of the contract and payment records.

Official sources and filing portals

SEC iMessage official complaint and ticketing portal — use the service for complaints involving financing and lending companies. (Securities and Exchange Commission)

SEC lending and financing companies — advisories, recorded OLPs, and complaints information (Securities and Exchange Commission)

SEC Memorandum Circular No. 18, series of 2019 — unfair debt collection practices (SEC Appointment System)

National Privacy Commission — filing a formal complaint and NPC complaint mechanics and exhaustion-of-remedies guidance. (National Privacy Commission)

NPC Circular No. 20-01 — Guidelines on the Processing of Personal Data for Loan-Related Transactions and NPC Circular No. 2022-02 — amendments concerning contact lists, character references, and guarantors.

Republic Act No. 10173 — Data Privacy Act of 2012 and Republic Act No. 11765 — Financial Products and Services Consumer Protection Act. (Lawphil)

NBI online complaint portal and NBI Cybercrime Division investigative-assistance procedure. (National Bureau of Investigation)

General-information disclaimer

This article provides general Philippine legal information and is not a substitute for legal advice based on a specific loan agreement, collection record, privacy notice, evidence, or set of facts. The proper complaint, respondent, causes of action, defenses, remedies, and deadlines can change depending on the circumstances. Government filing procedures and online portals may also be updated, so confirm the current instructions on the relevant agency's official website before submitting a complaint.

Law and official-source check: 26 August 2026.