Quick answer

Online lenders may collect a valid debt, but they may not threaten you, shame you publicly, use obscene or deceptive messages, disclose your loan to unrelated people, or misuse your contacts, photos, and other personal data.

Report:

Harassment or unfair collection by a lending or financing company: Securities and Exchange Commission (SEC).
Unauthorized access, use, or disclosure of personal data: National Privacy Commission (NPC).
A lender supervised by the Bangko Sentral ng Pilipinas: complain first to the institution, then escalate to the BSP if unresolved.
Threats, extortion, impersonation, fraud, account compromise, or other possible crimes: PNP Anti-Cybercrime Group, NBI Cybercrime Division, or the DICT Cyber Hotline.

These remedies can be pursued together because each agency handles a different issue. Preserve the evidence before blocking the collector, revoking permissions, or uninstalling the app. Reporting harassment does not automatically cancel a legitimate loan.

What online lenders and collectors are not allowed to do

Under SEC Memorandum Circular No. 18, series of 2019, lending companies, financing companies, and their collection agents must use reasonable, lawful means and act in good faith.

Unfair collection practices include:

Using or threatening violence or other criminal means against a person, reputation, or property.
Threatening an action that cannot lawfully be taken.
Using obscenities, insults, or profane and abusive language.
Publishing a borrower’s name or personal information to shame the borrower.
Communicating false loan information, including failing to say that a debt is disputed when that fact should be disclosed.
Pretending to be a lawyer, police officer, court employee, government official, or another person, or using deceptive documents or messages.
Contacting a borrower at an unreasonable time—generally before 6:00 a.m. or after 10:00 p.m.—unless the account is more than 15 days past due or the borrower expressly agreed that those hours are reasonable or convenient.
Contacting people in the borrower’s contact list who were not named as guarantors or co-makers, even if the borrower previously allowed the app to access the phone.

The lender remains responsible for collection work outsourced to a third-party agency. Its collectors should disclose their full names or true identities, and the lender should maintain a channel for borrower complaints.

The Financial Products and Services Consumer Protection Act, Republic Act No. 11765, separately protects financial consumers’ rights to fair treatment, data privacy, disclosure, protection against fraud and misuse of assets, and timely complaint handling.

When collection becomes a privacy violation

The Data Privacy Act of 2012, Republic Act No. 10173, requires personal data to be processed lawfully, fairly, transparently, and only for a declared, legitimate purpose.

For loan transactions, NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02, applies even to a person or entity acting as a lender without the required SEC authority. It also covers outsourced collectors and other service providers that process borrower information.

Possible violations include:

Requiring app permissions that are unnecessary, excessive, or unrelated to identity verification, creditworthiness, fraud prevention, or another legitimate purpose.
Copying or harvesting an entire phone contact list for collection.
Messaging relatives, co-workers, employers, friends, or other contacts about the debt.
Using a borrower’s photograph to embarrass, threaten, or shame the borrower.
Posting loan information, identification documents, altered photographs, or accusations on social media.
Using personal data for a purpose that was not properly disclosed.
Keeping personal data indefinitely without a lawful need.
Refusing to explain what data was collected, why it was used, where it came from, or to whom it was disclosed.
Continuing unnecessary processing after the relevant purpose has ended.

The government’s March 18, 2026 joint advisory on online lending platforms clarifies several important distinctions:

A character reference is generally supplied for identification or verification. Being named as a reference does not make that person liable for the loan.
A guarantor must separately consent to assume responsibility in case of default.
For debt collection, the lender may contact a consenting guarantor, but may not contact other people found in the borrower’s contact list.
An app may use a contact-selection interface or derive proportionate metadata when necessary for a specified legitimate purpose, but uncontrolled processing of the contact list is prohibited.
Deceptive designs—such as pre-ticked consent boxes or making refusal or withdrawal unnecessarily difficult—may undermine or invalidate consent.

Tapping “Allow” does not give a lender unlimited authority to copy contacts, publicly shame someone, or use information for an incompatible purpose.

Preserve evidence before taking other action

Keep the original files wherever possible. Create a backup on another device, secure cloud account, or external drive.

Preserve:

Full screenshots showing the message, sender’s number or account, date, time, and surrounding conversation.
Original SMS, chat, email, voice-mail, and social-media notifications.
URLs and screenshots of public posts, including the account name and posting date.
Call logs showing the number, frequency, date, time, and duration of calls.
Copies of messages received by relatives, co-workers, employers, references, or other contacts.
A short signed statement from each contacted person explaining what was received and when.
The app’s name, icon, developer, app-store page, package name if visible, website, privacy notice, and requested permissions.
Screenshots of the phone’s permission settings before permissions are revoked.
Loan application, disclosure statement, contract, promissory note, payment schedule, account statement, receipts, and proof of all payments.
The collector’s claimed name, company, agency, telephone numbers, email addresses, payment accounts, and instructions.
Prior complaints to the lender, its data protection officer, or its customer-service channel, together with proof of delivery and any response.
Proof of actual harm, such as employer correspondence, medical records, counselling expenses, lost-income documents, or costs incurred in responding to the incident.

Do not edit or crop the only copy. Keep an untouched original and use a separate redacted copy when sharing evidence outside an official complaint.

Be cautious about secretly recording private calls. The Anti-Wiretapping Act may apply depending on how a conversation is recorded. Preserve voice-mail and written communications, and obtain legal advice before making undisclosed recordings.

Take immediate protective steps

After preserving the evidence:

Revoke unnecessary permissions. Turn off access to contacts, photos, files, microphone, camera, location, call logs, and SMS unless a permission remains genuinely necessary.
Secure your accounts. Change passwords, enable multi-factor authentication, review active sessions, and inform your bank or e-wallet immediately if account credentials or one-time passwords may have been exposed.
Send a written notice to the lender and its data protection officer. Identify the incidents and request that unlawful collection and unnecessary processing stop. Keep proof that the notice was received.
Ask for verification. Request the legal corporate name of the lender, its SEC authority, the collector’s identity, the amount claimed, an account breakdown, and the basis for each fee.
Ask contacts to preserve their own evidence. They should avoid deleting messages until copies have been secured.
Block abusive numbers only after preservation. Blocking may reduce immediate distress but does not preserve deleted material or stop the use of other numbers.
Report impersonation or compromised accounts to the platform. An app-store, social-media, or telecommunications report can help remove abusive content, but it does not replace an SEC, NPC, BSP, or criminal complaint.

A written privacy notice may state:

I object to the use or disclosure of my personal data for harassment, public shaming, or contacting persons who are not consenting guarantors. Stop such processing immediately, preserve all relevant collection and access logs, identify the persons and entities that processed or received my data, and provide your written response and lawful basis for the processing.

Do not demand destruction of evidence relevant to your complaint. A lender may also retain limited records when required by law or reasonably necessary to establish, exercise, or defend legal claims.

Where and how to report

1. Securities and Exchange Commission

Use the SEC for unfair collection by a lending company, financing company, online lending platform, or its collection agency. The latest joint government advisory directs complaints to the SEC I-Message Mo portal. The SEC hotline listed in that advisory is 1-4732 (1-4SEC).

In the complaint:

Name both the app and the legal company operating it, if known.
Identify any collection agency or individual collector.
Give a chronological account with dates, times, numbers, accounts, and exact acts.
State whether unrelated contacts were messaged or the debt was publicly disclosed.
Attach the loan documents, payment records, screenshots, call logs, and witness evidence.
Explain what action you requested from the lender and how it responded.
If several companies are involved, separate the evidence by company and follow the portal’s instructions for filing against each respondent.

The SEC may investigate and impose administrative sanctions, including fines or suspension or revocation of authority when legally justified. It may also refer privacy or criminal matters to the proper agency.

The SEC does not ordinarily cancel a loan, rewrite payment terms, declare a contract void, or conclusively decide that an interest provision is invalid. Those issues may require a court case. Harassment and the validity or amount of the debt are separate questions.

2. National Privacy Commission

Use the NPC when contacts, photographs, identification documents, messages, location information, or other personal data were collected, used, retained, or disclosed unlawfully.

First notify the respondent in writing

Under the 2021 NPC Rules of Procedure, a formal complaint ordinarily will not be given due course unless:

The complainant informed the lender, collector, or other responsible entity in writing; and
The entity failed to take timely and appropriate action or did not respond within 15 calendar days after receipt.

Attach the notice, proof of receipt, and response, if any.

The NPC may waive this requirement for good cause or a serious violation—for example, grave and irreparable harm that only NPC action can prevent, the absence of a plain and adequate remedy, or conduct that is patently illegal. Explain and prove why a waiver is necessary rather than simply omitting the prior notice.

Prepare the formal complaint

Use the NPC’s current Complaint-Affidavit dated March 1, 2026 or another properly verified complaint. The filing should include:

The complainant’s identity and current contact details.
The respondent’s legal name and address, if known.
The personal data involved.
A clear chronological narration.
The applicable privacy violations, without exaggerating uncertain facts.
All documentary evidence and witness affidavits.
Correspondence showing exhaustion of remedies or facts supporting a waiver.
The specific relief requested.
Verification and certification against forum shopping.
A valid government-issued ID.

The prescribed form contains a jurat and should be properly sworn or notarized. A representative generally needs a special power of attorney.

Complaints may be filed personally, by registered mail, by courier, or by electronic mail when authorized by the NPC. Electronic documents should be digitally signed and submitted in PDF when practicable. Check the NPC filing page and current contact directory before submission. The NPC’s current office is at the 25th–27th Floors, The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Quezon City 1103.

The current fee schedule states a base ₱500 filing fee, with additional fees for claims for damages and certain applications. A legal-research fee and, where applicable, a bond may also be assessed. Qualified indigent complainants may seek exemption by submitting the prescribed proof. Confirm the assessment through the NPC’s official fee schedule before paying.

An investigating officer may give the complaint due course or dismiss it without prejudice within 30 calendar days from receipt. This is an initial evaluation period, not a guarantee that the entire case will finish within 30 days.

Temporary ban on data processing

A complainant may apply for a temporary ban on processing while the case is pending when it is necessary to preserve the complainant’s or other data subjects’ rights. This requires a proper motion, supporting facts, a summary hearing, and ordinarily a bond. The application suspends the main complaint proceedings until it is resolved. Because service, evidence, and bond requirements are technical, legal assistance is advisable.

3. Bangko Sentral ng Pilipinas

Use the BSP route only when the lender is a BSP-supervised institution, such as a bank, digital bank, certain non-bank financial institutions, pawnshop, electronic-money issuer, or another entity within BSP supervision.

First complain through the institution’s Financial Consumer Protection Assistance Mechanism or official customer-service channel. If the response is absent or unsatisfactory, escalate through the BSP Online Buddy (BOB) or submit the BSP Complaint, Inquiry, and Request form to consumeraffairs@bsp.gov.ph.

The BSP consumer-assistance page lists the current procedure, supporting documents, postal and walk-in channels, and telephone assistance. The BSP also maintains a directory of supervised institutions and their complaint channels.

Ordinary financing companies, lending companies, online lending apps, and their collection agencies are generally directed to the SEC rather than the BSP.

4. PNP, NBI, or DICT for threats and possible crimes

Contact law enforcement promptly if messages involve credible threats, extortion, sexual threats, stalking, impersonation, fraudulent payment instructions, account takeover, fabricated government documents, or threats to publish private material.

The March 2026 joint advisory lists:

DICT Cyber Hotline: 1326 or 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph, telephone (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph, telephone (02) 8723-0401 local 7491

The NBI also provides an online complaint page and information on investigative assistance for computer-crime victims.

If there is immediate danger to life or physical safety, call 911 or go to the nearest police station. Do not arrange an in-person meeting with a threatening collector merely to obtain more evidence.

A regulator’s finding of an unfair practice does not automatically establish a criminal offense. Criminal liability depends on the precise messages, conduct, evidence, applicable offense, and findings of prosecutors and courts.

Common mistakes that weaken a complaint

Deleting the app, messages, or account before preserving evidence.
Submitting cropped screenshots that hide the sender, date, time, or context.
Naming only the app without identifying the operating company.
Combining several lenders into one confusing narration.
Describing all collection attempts as harassment without identifying the particular unlawful words or acts.
Failing to attach the loan documents and payment history.
Paying a collector through an unverified personal account.
Sending identification documents or account credentials to unofficial complaint pages.
Filing an NPC case without the written prior notice, proof of receipt, 15-day history, or facts supporting a waiver.
Ignoring an actual court summons because earlier messages were fake. Verify a summons directly with the named court.
Assuming that deleting the app deletes server-held data or extinguishes the loan.
Posting unredacted evidence publicly and exposing your own or other people’s personal information.

When legal help is urgent

Seek a lawyer, the Public Attorney’s Office if eligible, or another qualified legal-aid provider promptly when:

A collector threatens physical harm or is approaching your home or workplace.
Intimate images, identification documents, or sensitive family information are being circulated.
Your employer, customers, or a large contact group has been messaged.
Money, an account, or a SIM has been compromised.
You received a real subpoena, summons, prosecutor’s notice, or court order.
The lender is seeking payment through a postdated check and a possible Bouncing Checks Law issue exists.
You intend to seek damages or a temporary or permanent ban on processing.
Several corporate entities, foreign operators, or anonymous collectors are involved.
The lender’s records conflict materially with your contract or payment receipts.

Frequently asked questions

Can I report harassment even if I still owe money?

Yes. A creditor’s right to collect does not authorize threats, deception, public shaming, or unlawful processing of personal data. Continue to keep proof of lawful payments and communicate through verifiable channels.

Does harassment cancel the debt?

No. A regulatory or privacy violation does not by itself extinguish a valid principal obligation. The SEC expressly does not ordinarily cancel or rewrite loan contracts through its complaint process.

May a lender message my family, employer, or friends?

Not merely because their numbers appeared in your contact list. For debt collection, the 2026 joint advisory allows contact with a person who separately consented to be a guarantor. A character reference does not automatically become a guarantor or debtor.

What if I gave the app permission to access my contacts?

Permission is not unlimited consent. Excessive access, uncontrolled copying, contacting non-guarantors, public shaming, and processing for an incompatible purpose may still violate SEC and privacy rules.

Can I report an unregistered or unidentified lender?

Yes. Report the available app details, payment accounts, telephone numbers, websites, collector identities, and screenshots to the SEC. NPC loan-processing rules also cover persons acting as lenders whether or not they obtained the required SEC authority. Report threats, fraud, or impersonation separately to law enforcement.

Can a borrower be arrested simply for failing to pay a loan?

The 1987 Constitution prohibits imprisonment for debt. However, separate conduct—such as fraud or issuance of a bouncing check—may raise different legal issues if its elements are proven. A collector cannot lawfully manufacture a criminal case or pretend that an arrest warrant already exists.

Is the NPC’s 15-day period a filing deadline?

No. It is ordinarily the period given to the respondent to take appropriate action after receiving the borrower’s written privacy complaint. Preserve evidence and act promptly because other legal prescriptive periods may depend on the possible offense or remedy.

Should I uninstall the app?

Preserve the app details, permissions, messages, loan documents, and other evidence first. Then revoke unnecessary permissions and uninstall if appropriate. Uninstalling does not erase data already copied to the lender’s systems and does not cancel the loan.

Official sources

This article provides general Philippine legal information, not legal advice or a prediction of any complaint’s outcome. Jurisdiction and remedies depend on the lender’s identity, the loan documents, the exact communications, and the available evidence. Official sources and procedures were checked as of August 18, 2026.