Quick answer

If an online lending app harasses, threatens, publicly shames, or improperly uses your contacts, photos, messages, or other personal data, you may report it to:

The Securities and Exchange Commission (SEC) for unfair debt-collection practices by lending and financing companies;
The National Privacy Commission (NPC) for unauthorized, excessive, or harmful processing of personal data; and
The DICT Cyber Hotline, National Bureau of Investigation, or police when the conduct involves threats, fraud, impersonation, account compromise, extortion, or immediate danger.

You may need to report the same incident to more than one agency because debt collection, data privacy, and possible criminal conduct are separate issues.

Being behind on a legitimate loan does not authorize harassment or public shaming. Conversely, reporting abusive conduct does not automatically cancel a valid debt or change the loan’s payment terms.

What online lenders are prohibited from doing

SEC Memorandum Circular No. 18, series of 2019 prohibits financing and lending companies—and third-party collectors acting for them—from using unfair collection practices.

Prohibited conduct includes:

Using or threatening violence or other criminal means to harm a person, reputation, or property;
Threatening action that cannot legally be taken;
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense;
Publishing or disclosing a borrower’s name or personal information because of alleged nonpayment, except where disclosure is legally permitted;
Communicating false loan information, or failing to state that a debt is disputed when disclosure is otherwise permitted;
Using false representations or deceptive methods to collect a debt or obtain information;
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., subject to limited exceptions; and
Contacting people in the borrower’s contact list who were not named as guarantors or co-makers.

The time restriction has exceptions where the account has been past due for more than 15 days or the borrower expressly agreed—through written, electronic, or recorded means—that those hours are the only reasonable or convenient time for contact. That does not authorize threats, insults, public shaming, falsehoods, or unlawful use of personal data.

Privacy rules for online lending apps

The Data Privacy Act of 2012 requires personal-data processing to have a lawful basis and to be transparent, legitimate, and proportionate. An app’s privacy notice or a borrower’s acceptance of terms is not unlimited permission to use personal information for any purpose.

Under NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02:

An app must not demand unnecessary permissions or process more personal data than is suitable and necessary for a legitimate purpose.
Consent should be requested when the particular data becomes necessary, accompanied by an accessible, just-in-time notice explaining its use.
Access to the camera or photo gallery may be appropriate for a specified purpose such as identity verification, know-your-customer checks, fraud prevention, or payment verification. It should be turned off—or the borrower should be prompted to revoke it—after that purpose is completed.
A borrower’s photo must not be used to harass or embarrass the borrower.
Unconstrained, excessive, or disproportionate processing of a contact list is prohibited, including processing that leads to harassment, unfair collection, or collection from people other than the borrower’s guarantors.
Character references and guarantors must be handled separately. A character reference is not automatically a guarantor.
A guarantor must have expressly agreed to assume responsibility for the loan in case of default.
Personal data must not be kept indefinitely. It may be retained only while necessary for the original purpose, for legal claims, or as otherwise required by law, and must thereafter be securely disposed of.

A March 2026 joint DICT-NPC-SEC advisory reiterates that lenders may not contact people in a borrower’s contact list for collection merely because the app obtained access to the phone. For collection purposes, they may contact a person who validly consented to act as guarantor.

What to do immediately

1. Preserve the evidence before blocking or uninstalling the app

Save the evidence in at least two secure locations. Collect:

Screenshots and screen recordings showing complete conversations;
Original text messages, emails, chat messages, call logs, and voice recordings already lawfully in your possession;
Dates, times, phone numbers, usernames, account links, and email addresses used by collectors;
Threats, insults, fabricated legal notices, altered photos, public posts, and messages sent to relatives, employers, coworkers, or friends;
Statements from people contacted by the lender, preferably with screenshots from their own devices;
The app’s exact name, icon, store listing, developer, download link, website, and privacy policy;
The lender’s corporate name, SEC registration number, and Certificate of Authority number shown in the app, advertisement, contract, or disclosure statement;
Your loan agreement, disclosure statement, promissory note, repayment schedule, payment receipts, account history, and demand letters;
Screenshots of the permissions requested or enabled by the app; and
Copies of your written complaints to the lender and proof that they were received.

Keep unedited originals. If you annotate a screenshot, preserve the original separately. Avoid cropping out the sender, date, time, or surrounding conversation.

2. Secure your phone and accounts

After preserving evidence:

Review the app’s permissions and revoke access that is no longer necessary, particularly contacts, camera, photos, microphone, location, and storage.
Change passwords for affected email, social-media, cloud-storage, and financial accounts.
Enable multifactor authentication where available.
Review logged-in devices and terminate unfamiliar sessions.
Tell contacts not to respond, send money, click links, or provide information to collectors.
Report abusive posts or messages through the platform’s reporting tools, but save evidence first.
Contact your mobile provider, bank, or e-wallet immediately if a SIM, payment account, or financial credential may have been compromised.

Uninstalling an app may stop some access, but it does not erase data already collected by the operator.

3. Send a written notice to the lender

Identify the company behind the app from the loan agreement, disclosure statement, privacy notice, app-store listing, or payment instructions. Address your notice to the company and, if available, its data protection officer.

State:

Your name and loan or account reference;
The specific calls, messages, disclosures, permissions, or publications being challenged;
The dates and identities or numbers involved;
Why you believe the conduct is unauthorized, excessive, inaccurate, or harassing;
Whether you dispute the debt, the balance, or only the collection method;
Your request that harassment and third-party disclosure stop immediately;
Your request to preserve all relevant records;
Any applicable request to correct, block, erase, or restrict unlawfully processed data; and
A reasonable method through which the lender may communicate with you regarding the account.

Send the notice through a traceable channel. Retain the sent message, delivery receipt, ticket number, and response.

This written notice is particularly important for an NPC complaint because the NPC generally requires prior exhaustion of remedies.

How to report unfair collection to the SEC

The SEC regulates lending and financing companies and receives complaints concerning unfair debt collection and violations of lending or financing laws.

The government’s current channel for these complaints is the SEC iMessage portal. The March 2026 joint advisory also lists the SEC hotline 1-4732 (1-4SEC).

Prepare:

One complaint for each respondent company;
Your complete identifying and contact information;
The app’s name and the legal name of its operator;
A chronological account of what happened;
Copies of the loan and disclosure documents;
Screenshots, call logs, messages, posts, witness evidence, and payment records; and
A valid government-issued ID, if required by the filing channel.

Explain the specific collection acts rather than simply stating that you were harassed. For example: who sent the message, when it was sent, its contents, who else received it, and how that recipient was connected to you.

The SEC may evaluate the complaint, obtain the company’s answer, refer privacy or other issues to the proper agency, or commence administrative proceedings where warranted. Its complaint process does not authorize the SEC to rewrite a contract, cancel a debt, declare a loan void, or settle the borrower’s account. See the SEC’s official lending and financing complaint guidance.

How to file a privacy complaint with the NPC

A borrower, character reference, guarantor, relative, coworker, or other person whose own personal data was unlawfully processed may have an independent privacy complaint. A representative may also file under the NPC rules if properly authorized.

Complete the prior-notice requirement

Before filing, notify the respondent in writing of the privacy violation or personal-data breach and give it an opportunity to act.

Under the NPC’s current complaint mechanics, the requirement is generally satisfied when the respondent:

Does not take timely or appropriate action; or
Does not respond within 15 calendar days after receiving the written notice.

Attach proof of notice and receipt. A complaint may be dismissed outright if the respondent was not first given an opportunity to address the matter. Because exceptional or urgent circumstances can be fact-sensitive, obtain legal advice or contact the NPC if waiting may expose someone to serious or continuing harm.

Prepare the formal complaint

Use the NPC’s current complaint-assisted form or submit a properly verified complaint. The complaint-assisted form must be completed and notarized. Include:

The complainant’s and respondent’s identities and contact information, insofar as known;
A clear chronological statement of facts;
The personal data involved;
How the data was collected, accessed, used, disclosed, retained, or published;
The relief requested;
The written notice to the respondent and proof of receipt;
The respondent’s reply, if any;
Supporting documents and electronic evidence; and
Witness affidavits where relevant.

The NPC warns that a complaint insufficient in form, substance, or supporting evidence may be dismissed outright.

Current NPC guidance allows filing personally, by registered mail, by courier, or through email as authorized by the Commission. For online-lending complaints, the NPC currently directs complainants to send the complaint-assisted form and attachments to complaints@privacy.gov.ph. Check the NPC complaint page immediately before submission for the latest form and technical requirements.

Electronic documents should be digitally signed and submitted in PDF format when practicable. Follow the NPC’s instructions concerning page size, notarization, file naming, and service on any opposing party.

Reporting threats, fraud, or other possible crimes

Regulatory complaints do not replace an urgent safety or criminal report.

If there is an immediate threat to life, physical safety, or property, call 911 or go to the nearest police station. Do not meet a collector alone or comply with demands made under threats.

The March 2026 joint government advisory identifies these reporting channels for other forms of harassment, threats, fraud, or scams:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph

Provide the original messages, account identifiers, URLs, payment instructions, phone numbers, and a concise incident timeline. If money was transferred, promptly notify the bank or e-wallet and preserve the transaction reference. Investigators or prosecutors—not the complainant or lender—determine which criminal laws, if any, apply to the established facts.

Check whether the lender is authorized

An app-store listing does not prove that an operator is licensed.

A Philippine lending company must have SEC authority to operate. Check:

The lender’s corporate name;
Its SEC registration number;
Its Certificate of Authority number;
Whether the online lending platform is associated with that company; and
Whether the company’s authority has been suspended or revoked.

The SEC maintains official information concerning lending and financing companies and related company lists. If the company name in the contract differs from the app name, include both names in your report. Also preserve evidence if the app hides its operator, uses multiple names, or directs payment to an unrelated personal account.

An unauthorized lender’s conduct should be reported, but do not assume on your own that every obligation is automatically erased. The legal consequences may depend on the contract, the parties, the lender’s status, and the particular violation.

If you are only a contact or character reference

You do not become liable for another person’s loan merely because:

Your number appeared in the borrower’s phone;
The borrower listed you as a character reference;
A collector called or texted you; or
The app described you as a guarantor without your consent.

A character reference is used to help verify an applicant’s identity or information. A guarantor, by contrast, must expressly agree to assume responsibility in case of default. Whether an enforceable guarantee exists depends on the actual agreement and applicable legal requirements—not on the collector’s label.

Tell the company in writing that:

You did not consent to act as guarantor, if true;
You object to the use of your information for collection;
You request the source and purpose of the processing;
You request removal of your details as a character reference where applicable; and
Further harassment or disclosure should stop.

Preserve every message and report misuse of your own personal data to the NPC.

Dealing with the underlying loan

Keep the collection complaint separate from the account itself.

Ask for a written statement of account and itemized computation.
Compare it with the disclosure statement, loan agreement, payment schedule, and receipts.
Make payments only through a verified official channel.
Obtain a receipt and updated balance after every payment.
Do not give collectors one-time passwords, passwords, PINs, or remote access to your device.
Do not sign an acknowledgment, restructuring agreement, or waiver you do not understand.
If you dispute the debt or amount, state the dispute in writing and identify the specific entries involved.
If you want to negotiate, propose only an amount and schedule you can realistically maintain.

Stopping abusive collection does not necessarily extinguish a lawful unpaid balance. At the same time, a lender’s right to seek payment does not excuse unlawful methods.

Common mistakes to avoid

Deleting messages or uninstalling the app before preserving evidence;
Posting the collector’s unredacted IDs, phone numbers, or personal information publicly;
Responding with threats or abusive language;
Treating a character reference as automatically liable for the loan;
Sending an NPC complaint without first giving the respondent written notice and retaining proof of receipt;
Filing only against the app’s brand name without identifying the company behind it;
Submitting cropped screenshots that omit dates, sender details, or context;
Paying a personal account that cannot be verified as an official lender channel;
Assuming an SEC or NPC complaint automatically suspends payment obligations or court proceedings;
Ignoring a genuine summons, subpoena, or court document because collectors previously sent false threats; and
Trusting anyone who promises to “erase” a debt or complaint in exchange for an unofficial fee.

When legal help is urgent

Consult a Philippine lawyer, the Public Attorney’s Office if eligible, or another qualified legal-assistance organization promptly when:

A threat appears specific, credible, or imminent;
Intimate images, altered photos, government IDs, medical information, or a home address have been published or threatened with publication;
An account, SIM, email, or financial wallet has been taken over;
The lender contacts your employer, clients, school, or large groups of contacts;
You receive authentic court papers, a subpoena, or notice of a criminal or administrative proceeding;
A collector impersonates a court, law-enforcement officer, lawyer, or government agency;
The debt, interest, fees, identity of the creditor, or authenticity of the agreement is seriously disputed;
You are being asked to sign a settlement, waiver, admission, or restructuring agreement;
A child or otherwise vulnerable person is involved; or
The conduct continues despite complaints and creates a serious risk of further disclosure or harm.

Frequently asked questions

Can an online lender call my relatives or employer?

It may communicate only within lawful limits and for a legitimate purpose. Access to a phone’s contact list does not authorize mass collection messages. Contacting people who were not validly named as guarantors or co-makers may constitute unfair debt collection, and using contact data to shame or pressure a borrower may violate privacy rules.

Can the lender post my name, photo, or debt on social media?

Public shaming and disclosure of a borrower’s personal information because of alleged nonpayment are generally prohibited, subject only to disclosures specifically authorized by law. Using a borrower’s photo to harass or embarrass the borrower is expressly prohibited by NPC guidance.

Does accepting app permissions count as consent to contact everyone?

No. Consent must relate to a specified purpose, and processing must remain necessary and proportionate. Excessive harvesting or use of contacts for harassment or collection from people other than guarantors is prohibited.

May collectors call late at night?

As a general rule, contact before 6:00 a.m. or after 10:00 p.m. is an unfair collection practice. Limited exceptions apply when an account is more than 15 days past due or when the borrower expressly agreed that those hours are the only reasonable or convenient time. Other abusive practices remain prohibited regardless of the hour.

Should I file with both the SEC and NPC?

Often, yes. Report abusive collection to the SEC and unauthorized or excessive processing of personal data to the NPC. Report credible threats, fraud, extortion, impersonation, or account compromise to the appropriate investigative authorities as well.

Will filing a complaint erase my debt?

No. An administrative complaint does not by itself cancel a valid loan, alter its terms, or prevent lawful collection or court action. Liability for the debt and liability for abusive collection are separate questions.

What if the app is no longer in an app store?

You may still report it. Preserve the app name, APK or download source, website, operator information, payment instructions, messages, and screenshots. Removal from a store does not establish that the operator has stopped processing previously collected data.

What if the lender does not answer my written privacy complaint?

Keep proof that it received the notice. If it does not respond within 15 calendar days, or does not take timely and appropriate action, you may proceed with an NPC complaint that complies with the required form and evidence rules.

Official sources

This article provides general Philippine legal information, not legal advice for a particular case. Procedures and conclusions may depend on the lender’s regulator, the loan documents, the evidence, and the precise conduct involved. Official sources and reporting channels were checked on September 2, 2026.