Quick answer

If an online lending app is threatening you, publicly shaming you, messaging people in your phone contacts, disclosing your debt to third parties, or misusing personal data taken from your device, you may have grounds to report the conduct even if you genuinely owe money.

For most online lending platforms operated by Philippine lending or financing companies, the main reporting channels are:

Securities and Exchange Commission (SEC) for unfair or abusive debt-collection practices by lending companies, financing companies, and their online lending platforms. The government’s March 2026 joint advisory directs complaints on unfair debt collection to the SEC Financing and Lending Companies Department (FINLEND) through the SEC iMessage system.
National Privacy Commission (NPC) when the app unlawfully accesses, uses, shares, retains, or discloses personal information, including misuse of contacts or other phone data. Before an NPC complaint is ordinarily given due course, the complainant must first notify the company or other concerned entity in writing and give it an opportunity to act, subject to important exceptions discussed below.
PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT Cyber Hotline when the conduct involves threats, fraud, scams, impersonation, or other potentially criminal cyber activity. These are among the channels specifically identified in the March 18, 2026 DICT-NPC-SEC advisory.
Bangko Sentral ng Pilipinas (BSP) if the lender is a BSP-supervised financial institution, such as a bank or another institution under BSP supervision. The BSP instructs consumers to complain first to the financial institution and use the BSP Consumer Assistance Mechanism for unresolved concerns. (Bureau of the Treasury)

These remedies may overlap. For example, sending your relatives humiliating messages about your debt can raise both SEC unfair-collection issues and NPC data-privacy issues, while an accompanying threat of violence may justify a separate police or cybercrime report.

Reporting harassment does not automatically cancel a valid loan. A lawful debt remains subject to the parties' valid agreement and applicable law; what the lender cannot do is use unlawful collection methods simply because payment is overdue. (Lawphil)

What online lenders are prohibited from doing

Philippine law distinguishes legitimate collection activity from abusive collection.

The Financial Products and Services Consumer Protection Act, Republic Act No. 11765, expressly prohibits financial service providers from using abusive collection or debt-recovery practices. It also requires them to respect client privacy, protect client data, and maintain a consumer-assistance mechanism for complaints. (Lawphil)

For online lending platforms specifically, the DICT, NPC, and SEC reiterated in March 2026 that unnecessary app permissions and unauthorized, excessive, or disproportionate processing of personal data are prohibited. Processing a borrower's contacts in a way that results in harassment, collection from people other than proper guarantors, threats of violence, reputational harm, or threats to take legally unavailable action is prohibited.

SEC Memorandum Circular No. 18, Series of 2019, likewise identifies unfair collection practices such as threats of violence or other criminal means, threats to take action that cannot legally be taken, obscene or insulting language, certain disclosures or publication of borrowers' personal information, deceptive collection methods, and improper communications at unreasonable times.

Your phone contacts are not automatically liable for your loan

One of the clearest current rules concerns contact lists.

The March 2026 DICT-NPC-SEC advisory states that an online lender must not contact people appearing in the borrower's contact list for debt collection unless the person is a guarantor. Character references and guarantors are legally different: a character reference is supplied for identification or verification, while a guarantor must have separately and expressly consented to assume responsibility for the loan in case of default.

This means a lender cannot simply take hundreds of names from your phone and treat your relatives, coworkers, friends, clients, or acquaintances as collection targets.

An online lender may obtain access to contacts only within lawful, specified, necessary, and proportionate limits. The 2026 advisory states that access may be used to allow a borrower to select character references or guarantors, or for proportional metadata processing when necessary for a specified legitimate purpose. Unrestrained processing of the entire contact list is prohibited.

A character reference is not a guarantor

Giving someone's name as a reference does not, by itself, make that person responsible for your debt.

The 2026 advisory requires separate treatment of character references and guarantors. A person becomes a guarantor only after separately consenting to undertake that obligation. For purposes of collecting the debt, the lender may contact the guarantor—not everyone whose information happened to be stored on the borrower's device.

This distinction is important when collectors tell a borrower's family member, employer, coworker, or friend that the person is supposedly responsible for the debt merely because his or her number appeared in the borrower's contacts.

When collection messages may become an SEC violation

Ordinary reminders about an overdue account are not automatically illegal. The problem is usually the method, content, recipient, timing, or purpose of the communication.

Examples that should be documented and considered for reporting include threats to injure you or damage your property; threats to have you arrested when no lawful basis exists for the threatened action; abusive, obscene, or degrading messages; public shaming; dissemination of your debt or personal details to unrelated persons; impersonation or deceptive representations; repeated collection messages to non-guarantors taken from your phone; and similar conduct intended to pressure you through humiliation or fear.

SEC Memorandum Circular No. 18 also treats communication at unreasonable or inconvenient times as an unfair collection practice. It identifies communications before 6:00 a.m. or after 10:00 p.m. subject to the particular exceptions stated in the circular, including where an account has been past due for more than 15 days or the borrower has expressly agreed that those hours are the only reasonable or convenient time for contact. The facts and the applicable SEC rules should therefore be examined before treating the time of a call, by itself, as conclusive.

Privacy violations can exist even when the debt is real

The Data Privacy Act of 2012 does not disappear simply because a person borrowed money.

Personal information must be processed according to transparency, legitimate purpose, and proportionality. Information must be relevant and not excessive, must be processed fairly and lawfully, and generally must not be retained longer than necessary for its lawful purpose, legal claims, legitimate business purposes, or requirements imposed by law. (Lawphil)

The law also gives a data subject rights that can be important in an online-lending dispute. Depending on the circumstances, you may request information regarding what data was processed, where it came from, who received it, and why it was disclosed. You may seek correction of inaccurate information and, upon the conditions specified by law, blocking, removal, or destruction of information that was unlawfully obtained, used for an unauthorized purpose, or is no longer necessary. (Lawphil)

Deletion is not automatic merely because you request it. A lender may lawfully need to retain particular records for legal claims, regulatory duties, or other legitimate purposes recognized by law. The stronger privacy complaint is usually directed at the unlawful acquisition, excessive processing, improper disclosure, harassment-related use, or unnecessary continued retention of data—not at the mere existence of every legitimate loan record. (Lawphil)

Step 1: Preserve evidence before blocking or uninstalling the app

Do this as soon as possible. Many complaints become difficult to prove because the borrower deletes the application or conversation history before documenting what happened.

Preserve, where available:

Screenshots of SMS, Messenger, Viber, WhatsApp, in-app messages, emails, or other communications, showing the full message, sender, date, and time.
Screenshots supplied by relatives, coworkers, employers, friends, or other third parties who were contacted.
Call logs showing the number, date, time, and frequency of calls. For calls already received, make contemporaneous written notes of what was said and who claimed to be calling.
Any voicemail or voice message voluntarily sent to you.
Screenshots of public posts, group chats, or messages in which your name, photograph, debt, ID, or other information was disclosed.
The app-store listing, website, app name, developer name, privacy notice, and permissions requested by the application.
The loan agreement, disclosure statement, promissory note or electronic contract, payment schedule, and documents showing the amount actually released to you.
Payment receipts, bank or e-wallet records, and proof of amounts already paid.
Copies of your written complaints to the lender, its customer-service unit, or Data Protection Officer and all replies.
A simple chronology identifying what happened, when it happened, who was contacted, and what information was disclosed.

Keep the original files where possible rather than preserving only cropped screenshots. Back up the evidence in another device or secure storage.

Do not publish your own IDs, loan documents, account numbers, addresses, or other sensitive evidence on social media merely to expose the lender. Give evidence to the proper regulator or law-enforcement authority instead.

Step 2: Identify the company behind the app

An app's marketing name may be different from the corporation legally making the loan.

Look at the loan agreement, privacy notice, disclosure statement, collection messages, payment instructions, and app-store listing for the lender's full corporate name. Record any SEC registration number, Certificate of Authority number, office address, customer-service details, and Data Protection Officer details that appear.

The government advises borrowers to use online lending platforms operated by duly registered and licensed entities. The SEC maintains pages for financing and lending companies, recorded online lending platforms, revoked or suspended companies, and advisories.

Do not assume that appearing in an app store proves that the lender is legally authorized to operate.

The SEC's regulatory framework was further updated in 2026 through SEC Memorandum Circular No. 20, Series of 2026, concerning prudential, disclosure, and market-conduct requirements for financing and lending companies and online lending platforms. The SEC also continues to publish advisories regarding unauthorized online lending platforms. (Securities and Exchange Commission)

Step 3: Send a written complaint to the lender

Even when you intend to complain immediately to the SEC, a clear written demand to the company creates useful evidence.

Send it to the lender's official consumer-assistance channel, customer service, and, for privacy issues, its Data Protection Officer if the contact information is available.

State the facts without unnecessary argument. Identify your account, specify the numbers or accounts used by the collectors, list the dates and conduct complained of, identify third parties who were contacted, and attach representative evidence.

For a privacy complaint, you can specifically ask the company to:

stop contacting persons who are neither borrowers nor properly consenting guarantors;
identify what personal information it collected from your device;
identify the source and recipients of your personal information where the Data Privacy Act entitles you to that information;
explain the legal basis and purpose for the disputed processing;
stop unauthorized or excessive processing;
correct inaccurate information;
block, remove, or destroy unlawfully obtained or unnecessarily retained data where the legal conditions for doing so exist; and
preserve relevant records, logs, collector instructions, and communications because a regulatory complaint may follow.

Financial service providers are required by Republic Act No. 11765 to maintain a consumer-assistance mechanism and provide information regarding action taken or to be taken on a consumer complaint. (Lawphil)

Step 4: Report unfair debt collection to the SEC

For lending and financing companies regulated by the SEC, the March 2026 DICT-NPC-SEC advisory specifically directs reports of unfair collection practices to the SEC Financing and Lending Companies Department (FINLEND) through iMessage, with the SEC assistance hotline 1-4732 (1-4SEC) also identified in the advisory.

The SEC's current iMessage guide instructs users to open a new ticket, agree to the privacy policy, sign in using an eSECURE account, select the appropriate service, complete the form, and create the ticket. The service list includes “Complaints on Financing and Lending Companies” under the Financing and Lending Companies Department. (SEC Philippines)

In the complaint, make it easy for the regulator to understand the case. Give the legal name of the lender if known, the app name, your account or loan reference, a concise chronology, the conduct complained of, the identities or telephone numbers used by collectors, the people who were improperly contacted, and copies of the strongest supporting evidence.

Save the iMessage ticket number and monitor the ticket for requests for additional documents or clarification.

A lender cannot necessarily avoid responsibility by saying that an outside collection agency caused the harassment. Republic Act No. 11765 makes financial service providers responsible for acts or omissions of their directors, officers, employees, and agents in dealings with financial consumers and provides for solidary liability with accredited third-party service providers for covered acts or omissions, including debt collection. (Lawphil)

Step 5: File a privacy complaint with the NPC when personal data was misused

If the complaint involves unlawful access to your contacts, disclosure of your debt to unrelated people, misuse of photographs, excessive phone permissions, unauthorized dissemination of personal information, or similar privacy violations, the NPC is the principal privacy regulator.

First comply with the NPC's exhaustion requirement

This step is easy to miss.

Under the NPC's 2021 Rules of Procedure, a complaint ordinarily will not be given due course unless the complainant first informs the personal information controller, processor, or concerned entity in writing about the privacy violation and gives it an opportunity to take appropriate action. You may proceed where the company fails to take timely or appropriate action or there is no response within 15 calendar days from receipt of your written notice.

The NPC may waive this requirement for good cause or for a serious Data Privacy Act violation, taking the risk of harm into account. The Rules specifically contemplate circumstances such as grave and irreparable harm that only NPC action can prevent or mitigate, the absence of a plain, speedy, and adequate remedy from the respondent, or conduct that is patently illegal.

Accordingly, do not automatically wait 15 days in a situation involving serious continuing harm without considering whether the waiver provisions apply.

Use the current NPC complaint form and requirements

The NPC states that a data subject affected by a privacy violation or personal data breach may file a complaint. An authorized representative may also file, subject to the applicable special-power-of-attorney requirements. (National Privacy Commission)

The NPC's complaint page instructs complainants to submit a completed and notarized complaints-assisted form or verified complaint together with evidence and, where applicable, witnesses' affidavits. Filing may be done personally, by registered mail, courier, or electronic mail as authorized by the Commission. The NPC also specifies requirements for electronic documents. (National Privacy Commission)

Use the current NPC form. The Commission announced that a new Complaint-Affidavit template took effect on July 1, 2025 and that the previous version would no longer be accepted after the announced transition period. The NPC website currently links the updated complaint form. (National Privacy Commission)

The NPC's posted Schedule of Fees and Charges lists a ₱500 filing fee for complaints. Additional fees apply when damages are claimed, and the schedule contains exemptions and requirements for qualifying indigent litigants and government entities. Check the current NPC instructions before paying because filing and payment procedures can change.

The NPC states that its Complaints and Investigation Division has 30 calendar days from receipt of the complaint to give it due course or dismiss it without prejudice. That is the initial evaluation period, not a promise that the entire case will be finally decided within 30 days. (National Privacy Commission)

Step 6: Report threats, fraud, or scams to cybercrime authorities

Do not limit yourself to an SEC or NPC complaint if collectors are making serious threats or the supposed lender appears to be operating a scam.

The March 18, 2026 government advisory identifies the following channels for other forms of harassment, threats, fraud, and scams:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; telephone (632) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph; onlinecims.ocs@gmail.com; telephone (632) 8723-0401 local 7491.

If there is an immediate threat to someone's physical safety, seek police or emergency assistance without waiting for the SEC or NPC administrative process.

Do not assume that every offensive collection message constitutes the same criminal offense. Criminal liability depends on the actual words and acts, the means used, the identity and intent of the sender, and the elements of the particular offense. Preserve the evidence and allow investigators or counsel to determine the appropriate legal classification.

What if the loan app belongs to a bank or another BSP-supervised institution?

Check who actually extended the credit.

The SEC route described above primarily concerns financing companies and lending companies under SEC supervision. If the lender is a BSP-Supervised Financial Institution, the BSP says the consumer should first lodge a formal complaint with the institution. The BSP Consumer Assistance Mechanism is available for escalation when the consumer remains aggrieved by the institution's conduct, product, service, or handling of the complaint. (Bureau of the Treasury)

A privacy issue may still independently fall within NPC jurisdiction. The proper regulator therefore depends on both the identity of the lender and the type of violation.

Important evidence when third parties were contacted

When relatives, friends, employers, or coworkers received collection messages, their evidence can be especially important because it may show that the lender disclosed your debt or used contact-list data beyond a lawful purpose.

Ask the recipient to preserve the original message or conversation rather than merely telling you what happened. Capture the sender's number or profile, full text, date, time, attachments, photographs, and surrounding messages needed to understand the context.

If the person is willing, obtain a short written account of how the message was received and whether he or she ever agreed to become your guarantor. If a formal NPC proceeding later requires a witness affidavit, the evidence can then be placed in the proper form.

Common mistakes that can weaken a complaint

Deleting everything immediately

Blocking a collector may be sensible after evidence is secured. Deleting messages, call logs, and app information first can make the later complaint much harder to prove.

Naming only the app, not the lender

“Quick Cash App” or a similar brand may not be the legal respondent. Identify the corporation behind the platform whenever possible.

Assuming everyone named as a reference is a guarantor

A character reference is not automatically liable for the loan. Current government guidance requires separate consent before a person is treated as a guarantor.

Filing an NPC complaint without first notifying the company

Unless a waiver applies, the NPC Rules require prior written notice to the concerned entity and either inadequate action or the passage of 15 calendar days without a response. Attach proof that the notice was actually sent and received.

Using an outdated NPC form

The NPC has replaced its previous Complaint-Affidavit template. Download the version currently posted by the Commission rather than reusing an old form found elsewhere online. (National Privacy Commission)

Posting all the evidence publicly

Publicly uploading your ID, phone number, home address, loan documents, or other sensitive information can create a second privacy and security problem. Redact unnecessary personal information when sharing evidence outside official proceedings.

Assuming that filing a complaint erases the loan

Harassment and the validity of the debt are separate questions. A borrower can owe a legitimate debt and still be protected against unlawful collection practices. Conversely, if the amount, interest, fees, loan disbursement, identity of the lender, or validity of the agreement is disputed, those issues should be raised separately with supporting records. (Lawphil)

When legal help is urgent

Consider obtaining individual legal advice promptly when there are credible threats of physical harm; collectors have published your ID, photographs, address, workplace, or sensitive personal information; the app appears to have taken over or accessed accounts beyond the permissions you knowingly granted; the lender is threatening a criminal case or arrest and you need to determine whether the threat has any legal basis; substantial sums, disputed payments, or potentially unlawful charges are involved; several government complaints or court proceedings are already pending; or you are seeking damages or urgent orders to stop continuing data processing.

Do not delay solely because you are still negotiating with the collector if evidence may disappear or serious harm is continuing.

Different remedies also have different prescriptive periods. For example, claims accruing specifically under Republic Act No. 11765 are generally subject to the periods stated in Section 14 of that law, while privacy, civil, administrative, and criminal causes of action may be governed by different rules. (Lawphil)

Frequently asked questions

Can an online lending app message everyone in my contacts because I agreed to phone permissions?

Not simply because the app obtained broad permission to access your device. Current government guidance prohibits unauthorized, excessive, or disproportionate processing of contacts and expressly prohibits contacting people in the borrower's contact list for debt collection other than proper guarantors.

Can the lender call my employer?

The answer depends on why the employer is being contacted and the information disclosed. Merely appearing in your contacts does not make your employer a guarantor. Contacting unrelated persons to pressure or shame you, or disclosing your debt through unlawful personal-data processing, can raise SEC and NPC issues.

Can they contact my character reference about payment?

A character reference is not automatically a guarantor. The government's 2026 advisory says character references are for identification or verification purposes, while a guarantor must separately and expressly consent to undertake the loan obligation. For debt collection, the lender may contact the guarantor.

What if a collection agency—not the lending company itself—harassed me?

Document both. Republic Act No. 11765 makes the financial service provider responsible for covered conduct by its agents and provides for solidary liability with accredited third-party service providers for acts or omissions that may include debt collection. (Lawphil)

Do I need a lawyer to complain to the SEC?

The SEC iMessage system allows members of the public to open complaint tickets themselves. A lawyer may nevertheless be useful for complicated cases, substantial claims, disputed contractual liability, parallel criminal complaints, or cases requiring urgent relief. (SEC Philippines)

Do I have to wait 15 days before going to the NPC?

Not in every case. The normal rule requires prior written notice to the company and permits a complaint when the company fails to take timely or appropriate action or gives no response within 15 calendar days. The NPC may waive the requirement for good cause or specified serious violations involving significant risk of harm.

Does uninstalling the lending app stop it from using data it already copied?

Not necessarily. Removing the app can stop some future device access, but it does not itself erase data already transferred to the lender's systems or third parties. Current government guidance requires lenders to retain data only as long as lawfully necessary and to securely dispose of it afterward; the Data Privacy Act separately provides rights concerning unlawful or unnecessary processing.

Can I complain even if I am already overdue?

Yes. Being in default does not authorize abusive collection or unlawful processing of personal data. The lender may use lawful remedies to collect a valid obligation, but consumer-protection and privacy rules continue to apply. (Lawphil)

Official sources and complaint channels

General-information disclaimer

This article provides general Philippine legal information and is not a substitute for advice on a specific case. Liability and the proper remedy depend on the actual loan documents, communications, parties involved, data processing, and evidence. Official procedures and electronic filing requirements can change, so confirm the current agency instructions before submitting a complaint.

Law, agency guidance, complaint procedures, and official sources checked as of 23 August 2026.