How to Report Online Lending App Harassment to the NBI Cybercrime Division

Online lending app harassment is not “normal collection.” If collectors are threatening you, messaging your contacts, posting your photo, calling your employer, sending fake warrants, or using your personal data to shame you into paying, you can report the incident to the NBI Cybercrime Division and preserve evidence for possible criminal investigation. This guide explains what counts as harassment, which Philippine laws may apply, how to prepare your complaint, what to submit to the NBI, and when to file separate complaints with the SEC or National Privacy Commission.

What Counts as Online Lending App Harassment?

A lender may remind a borrower about a loan, send a statement of account, or make lawful collection demands. What it cannot do is use threats, public shaming, illegal access to personal data, or deception.

Common online lending harassment in the Philippines includes:

• Sending threats like “ipapahiya ka namin,” “pupuntahan ka namin,” “ipapakulong ka namin,” or “may warrant ka na”
• Calling or messaging your family, friends, co-workers, employer, or phone contacts even if they are not guarantors
• Posting your photo, name, ID, address, or loan details in group chats or social media
• Labeling you as a scammer, estafador, thief, or wanted person
• Sending fake court summons, fake NBI/police notices, fake barangay blotters, or fake warrants
• Using your contact list, gallery, location, or phone data beyond what is necessary for the loan
• Creating edited images, memes, or defamatory posts to pressure payment
• Repeated calls or texts at unreasonable hours, especially with insults or intimidation
• Threatening harm to your body, property, job, immigration status, family, or reputation

A 2026 joint public advisory by the DICT, National Privacy Commission, and SEC specifically recognized reports of online lending platforms engaging in harassment, intimidation, public shaming, and unlawful use of personal data in collection practices. The advisory also states that contacting people on the borrower’s contact list, other than those named as guarantors, is prohibited for debt collection.

When Should You Report to the NBI Cybercrime Division?

Report to the NBI Cybercrime Division when the harassment involves the internet, mobile apps, text messages, messaging apps, social media, fake online documents, or misuse of digital data.

The NBI is especially appropriate when there are:

• Threats made through SMS, Messenger, Viber, WhatsApp, Telegram, email, calls, or app notifications
• Public shaming on Facebook, TikTok, Instagram, group chats, community pages, or workplace chats
• Fake online legal documents, fake warrants, fake subpoenas, or fake court notices
• Identity theft, fake profiles, impersonation, or edited photos
• Unauthorized access or misuse of your phone contacts, photos, ID, address, or employer details
• Coordinated harassment by multiple numbers, accounts, or collection agents

The NBI’s own Citizen’s Charter lists “Investigative Assistance for Victims of Computer Crimes” under the Cybercrime Division, available to the general public, with the complainant proceeding to the Cybercrime Division to file a complaint or request investigation. (National Bureau of Investigation)

Legal Basis: Why Online Lending App Harassment May Be Illegal

1. Cybercrime Prevention Act of 2012 — RA 10175

Republic Act No. 10175, or the Cybercrime Prevention Act of 2012, covers cyber-related offenses and also applies when crimes under the Revised Penal Code or special laws are committed through information and communications technology.

For online lending harassment, RA 10175 may become relevant when collectors use digital systems to commit acts such as:

• Cyberlibel, if defamatory accusations are posted or sent online
• Identity theft or impersonation, if fake accounts or false identities are used
• Computer-related fraud or forgery, if fake documents or manipulated digital records are used
• Threats, coercion, or other crimes committed through mobile phones or online platforms

The Supreme Court in Disini v. Secretary of Justice upheld the validity of cyberlibel under RA 10175, explaining that online defamation is not a completely new crime but a digital means of committing libel under the Revised Penal Code. (Supreme Court E-Library)

2. Revised Penal Code provisions on threats, coercion, and defamation

Depending on the facts, harassment by collectors may be evaluated under several provisions of the Revised Penal Code, including:

Conduct	Possible legal issue
Threatening physical harm, arrest, or public humiliation	Grave threats or light threats
Forcing payment through intimidation or illegal pressure	Coercion
Repeated insulting calls or messages	Unjust vexation or related offenses, depending on facts
Calling someone a scammer, thief, criminal, or estafador in public posts or chats	Libel, cyberlibel, slander, or related defamation issues
Sending fake legal notices or pretending to be law enforcement	Possible falsification, usurpation, fraud, or cybercrime-related offenses

The exact charge is not chosen by the victim alone. The NBI investigator and later the prosecutor will evaluate the evidence and determine what law fits the facts.

3. Data Privacy Act of 2012 — RA 10173

Republic Act No. 10173, or the Data Privacy Act of 2012, protects personal information such as your name, mobile number, photo, address, employer, ID, contact list, loan details, and other identifiable data.

This law becomes important when an online lending app:

• Harvests your contact list
• Messages people who are not guarantors
• Uses your photo or ID for shaming
• Discloses your loan details to other people
• Processes your personal data beyond the purpose you agreed to
• Makes it difficult to withdraw permissions or uses deceptive consent screens

The National Privacy Commission has said that online lenders are prohibited from harvesting phone and social media contact lists for harassing delinquent borrowers. (National Privacy Commission) The 2026 joint advisory also states that unnecessary, unauthorized, excessive, or disproportionate processing of personal data through mobile applications is prohibited, especially processing that leads to harassment or collection from non-guarantors.

4. SEC rules on unfair debt collection practices

Many online lending apps are operated by lending companies or financing companies regulated by the Securities and Exchange Commission. The SEC’s rules prohibit unfair debt collection practices, including threats of violence, criminal means to harm a person, reputational harm, or threats to take actions that cannot legally be taken. The 2026 advisory identifies the SEC Financing and Lending Companies Department as the proper office for unfair debt collection complaints and lists the SEC iMessage portal for submissions.

This means an NBI complaint and an SEC complaint can exist at the same time:

• NBI: cybercrime, threats, fake documents, online shaming, impersonation, criminal investigation
• SEC: unfair collection practices by lending or financing companies
• NPC: misuse of personal data, contact-list harvesting, unauthorized disclosure
• PNP Anti-Cybercrime Group: alternative law-enforcement route for cyber-related threats or scams

5. Civil Code rights to dignity, privacy, and damages

Even if some conduct does not result in a criminal charge, the Civil Code may still matter. Articles 19, 20, and 21 require people to act with justice, honesty, good faith, and accountability for wrongful injury. Article 26 protects dignity, personality, privacy, and peace of mind. These provisions can support a civil claim for damages in proper cases, especially when harassment causes reputational harm, anxiety, job problems, or social humiliation. (Lawphil)

Step-by-Step Guide: How to Report Online Lending App Harassment to the NBI Cybercrime Division

Step 1: Preserve the evidence before blocking or deleting anything

Before blocking numbers or uninstalling the app, collect evidence. Many victims delete messages out of panic, but investigators need the clearest possible trail.

Save the following:

1. Screenshots of messages

   • Include the sender’s number, username, profile photo, date, and time.
   • Take full-screen screenshots, not cropped images.

2. Screen recordings

   • Record yourself opening the chat thread from the app or messaging platform.
   • Show the sender profile, number, date, and message history.

3. Call logs

   • Screenshot repeated calls, missed calls, and call times.
   • If your phone legally records calls, preserve the original files.

4. Social media posts or group chats

   • Screenshot the post, comments, group name, URL if visible, date, and account name.
   • Ask friends or co-workers who received messages to send you screenshots.

5. Fake warrants, subpoenas, court notices, or police/NBI documents

   • Save the image or PDF.
   • Do not edit or mark it up.
   • Keep the sender details.

6. Loan app details

   • App name as shown in the app store
   • Developer name
   • Website
   • Email address
   • SEC registration details if shown
   • Privacy policy
   • Screenshots of permissions requested by the app

7. Proof of loan transaction

   • Loan agreement
   • Disclosure statement
   • Amount received
   • Interest, penalties, and due dates
   • Payment receipts
   • GCash/Maya/bank transfer records

8. Timeline

   • Date you installed the app
   • Date you borrowed
   • Amount received
   • Date harassment started
   • People contacted
   • Platforms used
   • Threats made

Electronic evidence can be used in Philippine proceedings if it complies with admissibility rules. The Supreme Court’s Rules on Electronic Evidence state that an electronic document is admissible if it meets the rules on admissibility under the Rules of Court. (Lawphil)

Step 2: Secure your phone and accounts

After saving evidence:

• Revoke unnecessary app permissions for contacts, camera, gallery, storage, microphone, and location.
• Change passwords for email, social media, and e-wallet accounts.
• Turn on two-factor authentication.
• Do not click links sent by collectors.
• Warn family, co-workers, and friends not to engage with unknown collectors.
• Keep your SIM active if it contains evidence, unless safety requires otherwise.
• Back up evidence to cloud storage or another device.

If the threats are immediate — for example, a collector says someone is coming to hurt you, extort you, or harm your family — go to the nearest police station or barangay for immediate safety assistance while preparing the NBI cybercrime complaint.

Step 3: Prepare a concise complaint narrative

Your complaint should be clear, chronological, and evidence-based. Avoid making it emotional only. Investigators need facts they can verify.

A practical format:

1. Your details

   • Full name
   • Address
   • Contact number
   • Email
   • Valid ID details

2. Lender/app details

   • App name
   • Company name if known
   • Collection numbers/accounts
   • App store link or website
   • SEC registration number if shown

3. Loan details

   • Date of loan
   • Amount applied for
   • Amount actually received
   • Due date
   • Payments made
   • Outstanding balance claimed by the app

4. Harassment details

   • What happened
   • When it happened
   • Who sent the threat
   • What exact words were used
   • Who else was contacted
   • What personal data was exposed

5. Evidence list

   • Screenshot file names
   • Screen recordings
   • Message exports
   • Witness screenshots
   • Payment records
   • Fake legal documents

6. Request

   • Investigation of the collector/app/company
   • Preservation and examination of digital evidence
   • Appropriate referral for prosecution if warranted

Step 4: Execute or prepare a complaint-affidavit

The NBI may assist you in filling out a complaint sheet and may require sworn statements. Under the NBI Citizen’s Charter process for computer crime complaints, complainants and witnesses may execute sworn statements or submit prepared affidavits, and relevant devices may be examined. (National Bureau of Investigation)

A complaint-affidavit is a sworn written statement of facts. It should attach or refer to the evidence. If you prepare it in advance, bring the original and extra copies.

For ordinary cases, prepare:

• Complaint-affidavit
• Valid government ID
• Printed screenshots
• Digital copies on USB or cloud link
• Loan records and payment receipts
• Witness affidavits or screenshots from people contacted
• A list of phone numbers, account names, links, and app details

If you are abroad, a complaint-affidavit may need to be signed before a Philippine Embassy or Consulate, or notarized locally and apostilled depending on where it is executed and how the receiving office requires it. Philippine consulates commonly notarize affidavits and other documents for use in the Philippines, and personal appearance is normally required for consular notarization. (Philippine Embassy)

Step 5: File with the NBI Cybercrime Division

You may report through the NBI Cybercrime Division or the nearest NBI Regional or District Office. The NBI Divisions & Services page lists the Cybercrime Division and its official email address as ccd@nbi.gov.ph. (National Bureau of Investigation) The 2026 DICT-NPC-SEC advisory also lists the NBI Cybercrime Division email as ccd@nbi.gov.ph and telephone number (632) 8523-8231 to 38 for harassment, threats, frauds, and scams.

The NBI’s main office is listed at Filinvest Cyberzone Bay, Diosdado Macapagal Boulevard, Pasay City, with hotline (02) 8523-8231. (National Bureau of Investigation)

When filing in person:

1. Bring your ID, complaint-affidavit, printed evidence, and digital evidence.
2. Tell the receiving personnel that the matter involves online lending app harassment and cybercrime-related threats/data misuse.
3. Undergo the preliminary interview.
4. Fill out the complaint sheet.
5. Execute a sworn statement if required.
6. Allow the investigator to review or examine relevant digital evidence.
7. Ask how to follow up and whether your case will be assigned to an agent/investigator.

The NBI Citizen’s Charter states that the basic listed process for investigative assistance to victims of computer crimes has no fees and indicates an initial processing time of about one hour and ten minutes for the filing and preliminary steps, although the actual investigation can take much longer depending on the evidence, number of suspects, platform records, subpoenas, and case complexity. (National Bureau of Investigation)

Step 6: File parallel complaints with SEC and NPC when appropriate

An NBI complaint focuses on criminal/cyber investigation. It does not automatically suspend the lender’s SEC authority, order takedown of the app, or resolve data privacy violations. For a stronger paper trail, file with the appropriate regulator too.

Problem	Office to consider	What to submit
Threats, fake warrants, cyberlibel, fake accounts, online shaming	NBI Cybercrime Division or PNP ACG	Complaint-affidavit, screenshots, messages, app details, witness evidence
Unfair debt collection by lending/financing company	SEC Financing and Lending Companies Department	App name, company name, collection messages, loan records, proof of harassment
Contact-list harvesting, disclosure of loan details, misuse of photos/ID	National Privacy Commission	Notarized NPC complaint form, evidence of data misuse, screenshots from contacts
Immediate physical danger	Local police/barangay, then NBI/PNP ACG	Threat messages, identity of sender, location details

The NPC complaint page states that a formal complaint must be filed in a specific format, printed and filled out, notarized, and submitted in person, by courier, or by scanned email to the NPC. (National Privacy Commission) The SEC iMessage portal is the SEC’s online ticketing system for submitting complaints and checking ticket status. (Securities and Exchange Commission)

Required Documents and Evidence Checklist

Document or evidence	Why it matters	Practical tip
Valid government ID	Confirms complainant identity	Bring original and photocopies
Complaint-affidavit or written narrative	Organizes the facts under oath	Use dates, names, exact words, and platforms
Screenshots of threats	Shows the harassment	Include number/profile, date, and time
Screen recordings	Helps authenticate chat history	Record opening the thread from the app itself
Call logs	Shows frequency and pattern	Screenshot repeated calls by date
Messages sent to contacts	Proves third-party harassment	Ask contacts to send screenshots and short statements
Fake warrants/summons/notices	Shows deception or intimidation	Preserve original image/PDF and sender details
Loan agreement and payment records	Gives context and identifies app/company	Include amount received, payments, and claimed balance
App details and permissions	Supports data privacy issues	Screenshot app store page and permissions
Witness statements	Supports claims of public shaming	Useful when employer, relatives, or co-workers were contacted

Practical Timelines and What Usually Happens After Filing

The first visit or submission is only the start. In practice, timelines vary widely.

Stage	Typical practical reality
Initial filing and interview	Same day if filed in person and the office is available
Evidence review	May happen during filing or after assignment to an investigator
Follow-up requests	Investigator may ask for clearer screenshots, original phone, witness statements, or additional details
Identification of suspects	Can be difficult when collectors use prepaid SIMs, fake names, VPNs, or rotating accounts
Coordination with platforms/telcos	May require formal requests, preservation, subpoenas, or prosecutor/court processes
Referral for prosecution	Depends on whether evidence supports a specific offense and identifies responsible persons
SEC/NPC action	Separate timeline; regulatory agencies may ask for forms, notarization, and additional proof

Common bottlenecks include incomplete screenshots, deleted chats, unknown app operator, fake company names, numbers that are no longer active, and witnesses who are unwilling to give statements.

Common Mistakes That Weaken an NBI Complaint

Deleting the app immediately

Uninstalling the app may remove useful logs, app permissions, notifications, and account details. Preserve evidence first.

Sending only one screenshot

A single screenshot may not show the sender, date, or full context. A better evidence package shows the full thread, the profile or number, dates, repeated conduct, and the effect on other people.

Not getting evidence from contacted relatives or co-workers

If collectors messaged your contacts, ask those contacts for screenshots showing the sender, date, and message. Their evidence is often stronger than your own statement that “they contacted my friends.”

Relying only on verbal narration

Investigators need proof. Prepare a timeline and label your files clearly, such as:

• 01_SMS_threat_2026-03-12.png
• 02_Message_to_employer_2026-03-13.png
• 03_Fake_warrant_sent_by_collector.pdf
• 04_GCash_payment_receipt.png

Ignoring SEC and NPC remedies

NBI investigates possible crimes. SEC and NPC handle regulatory and data privacy violations. Filing only with one office may leave other remedies unused.

Believing that nonpayment automatically means jail

Nonpayment of a loan, by itself, is generally a civil obligation. Collectors often misuse fear by saying “estafa,” “warrant,” or “NBI case” even when no criminal case exists. A real warrant or court order does not come from a collector’s random text message. It comes from a court through proper legal channels.

Special Notes for OFWs, Foreigners, and People Outside the Philippines

If you are outside the Philippines but the app, collector, borrower, or affected contacts are in the Philippines, you can still preserve evidence and start reporting.

Practical steps:

1. Email the NBI Cybercrime Division with a clear summary and evidence index.
2. Prepare a complaint-affidavit.
3. Have your affidavit notarized at a Philippine Embassy or Consulate, or locally notarized and apostilled if required.
4. Ask affected contacts in the Philippines to preserve screenshots and execute statements if needed.
5. Keep your Philippine SIM, e-wallet records, and loan app account accessible.
6. If a representative in the Philippines will follow up, prepare a proper authorization or special power of attorney when required by the receiving office.

Foreigners should include passport bio page, Philippine address or contact details if applicable, and proof showing how the Philippine-based app or collector affected them. If documents are in a foreign language, prepare an English translation when needed.

What to Write in Your NBI Complaint Email

Use a subject line that helps the office identify the issue quickly:

Subject: Online Lending App Harassment Complaint – Threats, Contact-List Shaming, and Fake Legal Notices

A concise email body can follow this format:

I am reporting online lending app harassment involving [app name/company name, if known].

I borrowed [amount] on [date]. Beginning [date], collectors using [numbers/accounts] sent threats and contacted my [family/employer/friends] even though they are not guarantors. They also sent [fake warrant/fake summons/defamatory post/threats].

Attached are my complaint narrative, valid ID, screenshots, call logs, loan records, payment receipts, and evidence from affected contacts. I respectfully request assistance for investigation of the cybercrime-related harassment and misuse of my personal data.

Attach files in organized folders or PDFs. If there are many files, include an evidence index.

Frequently Asked Questions

Can I report an online lending app to the NBI even if I really owe money?

Yes. A real debt does not give collectors the right to threaten you, shame you, contact non-guarantors, misuse your personal data, or send fake legal documents. The NBI complaint concerns the harassment or cybercrime-related conduct, not simply the existence of the loan.

Will filing with the NBI erase my loan?

No. Filing a complaint does not automatically cancel the debt. It may lead to investigation of unlawful collection methods, cybercrime, threats, or data misuse. Loan validity, excessive charges, and unfair collection practices may also be raised with the SEC or in the proper civil/regulatory process.

What if the lending app contacted my employer?

Save screenshots from your employer or HR, including the sender’s number/account, date, and exact message. This can support claims of harassment, public shaming, defamation, unfair collection, and unauthorized disclosure of personal information.

What if the collector sent a fake warrant or fake court summons?

Preserve the document and sender details. Do not panic. A real warrant is issued by a court, not by a lending app collector through a random message. Fake legal documents may support possible criminal, cybercrime, or unfair collection complaints.

Should I file with NBI, PNP ACG, SEC, or NPC?

File with the NBI or PNP ACG for cybercrime-related threats, fake accounts, cyberlibel, scams, or digital harassment. File with the SEC for unfair debt collection by lending or financing companies. File with the NPC for contact-list harvesting, disclosure of personal data, or misuse of photos, IDs, employer details, and loan information.

Can the lender message my references?

A character reference is not automatically a guarantor. The 2026 DICT-NPC-SEC advisory states that online lending platforms must distinguish between character references and guarantors, and that a person must have expressly consented to be a guarantor before being treated as one.

Is it illegal for an online lending app to access my contacts?

Accessing contacts is not automatically illegal in every situation, but unbridled, excessive, unauthorized, or disproportionate processing of contact lists is prohibited. The 2026 advisory states that online lending platforms may access contact lists only for limited legitimate purposes, such as allowing the borrower to select references or guarantors, and that contacting non-guarantors for debt collection is prohibited.

Do I need a lawyer to file with the NBI?

You can file a complaint personally. A well-organized complaint-affidavit, evidence folder, timeline, and witness screenshots are often more important at the initial reporting stage than legal jargon.

How long does an NBI cybercrime complaint take?

The initial filing can be done relatively quickly if documents are ready, but the investigation may take weeks or months depending on the complexity, cooperation of platforms or telcos, identification of suspects, and whether the case is referred for preliminary investigation.

What if I already blocked the collector?

Blocking is understandable, especially for mental health and safety. If possible, preserve screenshots, call logs, and account details before blocking. Ask contacted relatives, friends, or co-workers to save their own screenshots too.

Key Takeaways

• Online lending app harassment can be reported to the NBI Cybercrime Division when it involves threats, fake legal notices, cyberlibel, impersonation, online shaming, or misuse of digital data.
• Save evidence before deleting messages, uninstalling the app, changing phones, or blocking numbers.
• Prepare a clear timeline, complaint-affidavit, valid ID, screenshots, call logs, loan records, payment receipts, app details, and witness screenshots.
• A real loan does not authorize threats, public shaming, contacting non-guarantors, or misuse of your contact list.
• File parallel complaints when needed: NBI/PNP ACG for cybercrime and threats, SEC for unfair debt collection, and NPC for data privacy violations.
• For OFWs and foreigners abroad, complaint-affidavits may need consular notarization or apostille before formal use in the Philippines.

What to Do If Lending Collectors Keep Calling You in the Philippines

Repeated calls from a lending collector can be frightening, especially when the caller threatens to shame you online, contact your employer, message your relatives, or “file a criminal case” if you do not pay immediately. In the Philippines, lenders may collect a valid debt, but they must do it lawfully. A debt does not give a collector permission to harass you, threaten you, expose your personal information, or pressure your family and contacts. This guide explains your rights, what collectors are not allowed to do, what evidence to save, and where to report abusive lending collectors in the Philippines.

Can Lending Collectors Call You in the Philippines?

Yes. A lending company, financing company, bank, collection agency, or authorized representative may contact you to collect a legitimate unpaid loan. The law does not erase your obligation just because the collector is annoying.

But collection must be done with good faith, reasonable conduct, and lawful means. The Securities and Exchange Commission (SEC) specifically regulates lending and financing companies under the Lending Company Regulation Act of 2007, or RA 9474, and related SEC rules. (Lawphil)

The key distinction is this:

Situation	Usually allowed?	Why it matters
Calling you to remind you of a due loan	Yes	Collection itself is lawful if the debt is valid.
Asking for payment, restructuring, or settlement	Yes	Lenders may negotiate repayment.
Calling before 6:00 a.m. or after 10:00 p.m. without a valid exception	Generally no	SEC rules treat unreasonable hours as an unfair collection practice.
Threatening violence, jail, public shame, or fake legal action	No	This may violate SEC rules, civil law, criminal law, and data privacy law.
Messaging your contacts who are not guarantors or co-makers	No	Philippine regulators have repeatedly warned against contact-list harassment.
Posting your name, photo, loan details, or “scammer” accusations online	No	This may involve unfair collection, data privacy violations, and possible defamation or cyberlibel.

Your Main Legal Rights Against Abusive Debt Collection

1. You cannot be jailed simply for unpaid debt

The Philippine Constitution is clear: “No person shall be imprisoned for debt or non-payment of a poll tax.” (Supreme Court E-Library)

This means a collector cannot truthfully say, “Makukulong ka bukas kapag hindi ka nagbayad,” if the issue is only failure to pay a civil loan.

However, this does not mean all loan-related disputes are impossible to criminalize. Fraud, falsified documents, bouncing checks, threats, identity theft, or cybercrime may create separate criminal issues. But ordinary non-payment of a loan is generally a civil obligation, not a reason for immediate arrest.

A legitimate lender’s usual legal remedy is to file a civil collection case, often a small claims case if the amount qualifies. Under the Rules on Expedited Procedures in the First Level Courts, small claims may cover money claims not exceeding ₱1,000,000, exclusive of interest and costs. (Supreme Court of the Philippines)

2. Collectors must avoid unfair debt collection practices

SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair debt collection practices by financing companies, lending companies, and their third-party service providers. The rule covers abusive practices such as threats of violence or other criminal means, threats to take actions that cannot legally be taken, profane or insulting language, false representations, publication of borrower information, and improper contact with people in the borrower’s contact list.

A lending company cannot escape liability by saying, “Collection agency lang po iyon.” SEC rules state that third-party collectors are treated as agents, and the lending or financing company remains ultimately responsible for collection practices.

3. You have financial consumer rights

The Financial Products and Services Consumer Protection Act, or RA 11765 (2022), recognizes the rights of financial consumers to fair treatment, disclosure and transparency, data privacy and protection, and timely handling of complaints. It also prohibits financial service providers from using abusive collection or debt recovery practices. (Supreme Court E-Library)

RA 11765 is especially important because it makes financial service providers responsible for the acts or omissions of their officers, employees, agents, and accredited third-party service providers, including those involved in debt collection. (Supreme Court E-Library)

4. Your contact list is not collateral

Loan apps and online lenders sometimes pressure borrowers by accessing phone contacts, then messaging relatives, co-workers, employers, neighbors, or Facebook friends. This is one of the most common abusive patterns in the Philippines.

The National Privacy Commission (NPC), SEC, and DICT have warned that unnecessary, excessive, or disproportionate processing of personal data is prohibited, especially when it involves access to borrowers’ contact lists and leads to harassment or unfair collection. Their 2026 public advisory states that for debt collection, lending companies and financing companies may contact the guarantor, not random people from the borrower’s contact list.

Under the Data Privacy Act of 2012, or RA 10173, the State protects the fundamental human right of privacy while regulating the processing of personal information. (National Privacy Commission)

What Collectors Are Not Allowed to Do

Under Philippine law and regulatory rules, the following are serious red flags:

1. Threatening harm

   • “Ipapahiya ka namin.”
   • “Pupuntahan ka namin sa bahay.”
   • “May mangyayari sa pamilya mo.”
   • “Ipapabugbog ka namin.”

2. Threatening illegal or fake legal action

   • Claiming there is already a warrant when there is none.
   • Pretending to be police, NBI, sheriff, court staff, or barangay official.
   • Sending fake subpoenas, fake court orders, or fake arrest notices.

3. Using obscene, insulting, or degrading language

   • Repeated verbal abuse may support complaints before regulators and, depending on facts, possible criminal complaints.

4. Public shaming

   • Posting your photo, name, address, ID, employer, or loan details online.
   • Calling you a “scammer,” “magnanakaw,” or similar accusation in group chats or social media.

5. Contacting third parties who are not legally involved

   • Messaging your spouse, parents, siblings, co-workers, boss, neighbors, or phone contacts when they are not guarantors, co-makers, or properly authorized contacts.
   • Character references are not automatically guarantors.

6. Calling at unreasonable hours

   • SEC rules identify contact before 6:00 a.m. or after 10:00 p.m. as unreasonable or inconvenient, subject to specific exceptions stated in the circular. Even when a time exception may apply, threats, insults, shaming, and data misuse remain prohibited.

7. Hiding the collector’s identity

   • SEC rules require personnel handling collection accounts, whether in-house or third-party collectors, to disclose their full name or true identity to the borrower.

What to Do Immediately If Collectors Keep Calling

1. Do not panic and do not pay blindly

Collectors often create urgency because fear leads to mistakes. Before paying, confirm:

• the exact name of the lending or financing company;
• the collector’s full name and authority;
• the loan account number;
• the principal amount, interest, penalties, and total balance;
• the official payment channels;
• whether the company is SEC-registered or BSP-supervised.

Never send payment to a collector’s personal GCash, Maya, bank account, or crypto wallet unless the lender gives written confirmation that it is an official payment channel. Ask for an official receipt or payment acknowledgment.

2. Ask for written details

A practical message may look like this:

Please send the complete statement of account, loan agreement, breakdown of principal, interest, penalties, and official payment channels. I request that all communications be made in writing or during reasonable hours. Please do not contact my employer, relatives, friends, or phone contacts unless they are legally bound as guarantors or co-makers.

Keep the tone calm. Do not insult the collector back. Your goal is to create a clear record.

3. Preserve evidence before blocking

Blocking may protect your peace, but save evidence first. Regulators usually need proof.

Save:

Evidence	Why it helps
Call logs with date, time, and number	Shows frequency and unreasonable hours.
Screenshots of texts, chats, and emails	Shows threats, insults, false claims, or shaming.
Voice messages or recordings, if available	Captures actual statements made by collectors.
Social media posts or group chat screenshots	Proves public shaming or disclosure of personal data.
Messages sent to relatives, employer, or contacts	Shows third-party harassment.
Loan agreement and disclosure statement	Shows original terms and whether charges match the contract.
Proof of payment	Prevents double collection and supports disputes.
App permissions screenshots	Helps show contact-list or gallery access issues.

If a relative, co-worker, or employer received a message, ask them to preserve the screenshot showing the sender, date, time, and full message.

4. Revoke risky app permissions

For online lending apps, check your phone settings and revoke permissions that are not necessary, especially access to:

• contacts;
• photos or gallery;
• camera, if KYC verification is already complete;
• SMS;
• microphone;
• location.

The 2026 DICT-NPC-SEC advisory states that online lending platforms must not request unnecessary permissions and must prompt users to turn off, disallow, or revoke permissions once the purpose has been achieved.

5. Verify the lender

Check whether the company is a lending company, financing company, bank, cooperative, pawnshop, or another type of financial service provider.

Type of lender	Usual regulator
Lending company or financing company	SEC
Bank, e-wallet, pawnshop, money service business, BSP-supervised financial institution	BSP
Cooperative lending operation	CDA, unless otherwise under BSP or IC
Insurance-related credit or product	Insurance Commission
Unregistered online loan app or scam lender	SEC, NPC, DICT, PNP Anti-Cybercrime Group, or NBI Cybercrime Division depending on the act

The SEC’s public advisory on online lending platforms identifies imessage.sec.gov.ph as the complaint channel for unfair debt collection practices involving financing and lending companies.

Where to File Complaints Against Lending Collectors

SEC complaint for unfair debt collection

File with the SEC if the collector is connected with a lending company, financing company, or online lending platform.

Include:

• your full name and contact details;
• respondent company name and app name, if any;
• collector’s name and number, if known;
• account or loan reference number;
• short timeline of events;
• screenshots, call logs, voice messages, and proof of third-party harassment;
• what you are asking the SEC to act on, such as harassment, contact-list misuse, fake legal threats, or disclosure of your personal information.

SEC Memorandum Circular No. 18 provides penalties for violations, including fines and possible suspension or revocation of authority depending on the facts and gravity of the offense.

NPC complaint for misuse of personal data

File with the National Privacy Commission if the lender or collector:

• accessed your contacts without proper basis;
• messaged people in your phonebook;
• posted your personal information;
• used your ID, photo, address, workplace, or loan details to shame you;
• refused to stop unnecessary data processing.

The NPC’s complaint page states that a formal complaint must follow a specific format, be printed and filled out, notarized, and submitted in person, by courier, or by scanned email. (National Privacy Commission)

BSP complaint if the collector is from a bank or BSP-supervised institution

If the debt is from a bank, credit card issuer, e-wallet, pawnshop, or BSP-supervised financial institution, start with the provider’s Financial Consumer Protection Assistance Mechanism. If unresolved, escalate to the BSP through its consumer assistance channels. BSP materials explain that complaints submitted through BSP Online Buddy, or BOB, are processed and given a case reference number, while email or mail submissions follow BSP handling procedures. (Bureau of Small and Medium Enterprises)

Police, NBI, or prosecutor’s office for threats and cyber harassment

Go beyond regulator complaints when there are:

• threats of physical harm;
• blackmail;
• extortion;
• fake warrants or impersonation of authorities;
• hacking or unauthorized account access;
• cyberlibel or public online shaming;
• sexual threats or threats against family members.

Possible legal bases may include the Revised Penal Code provisions on threats, coercions, unjust vexation, libel or slander, and the Cybercrime Prevention Act of 2012 for online offenses. In Disini v. Secretary of Justice, the Supreme Court recognized that online defamation may fall within cyberlibel under RA 10175 when the legal elements are present. (Supreme Court E-Library)

For repeated acts that unjustly annoy, irritate, or distress a person, Philippine courts have also recognized unjust vexation under Article 287 of the Revised Penal Code, as discussed in Maderazo v. People. (Supreme Court E-Library)

Practical Timeline: What Usually Happens

Step	Typical timing	Practical note
Save evidence and send written boundary notice	Same day	Do this before evidence disappears.
Internal complaint to lender	Same day to 3 days	Ask for a written response and statement of account.
SEC or BSP complaint	Within days after evidence is complete	Stronger if you attach organized screenshots and a timeline.
NPC complaint	After preparing notarized complaint	Privacy complaints are more document-heavy.
Police/NBI cyber complaint	Immediately for threats or public shaming	Bring phone, screenshots, URLs, numbers, and IDs if available.
Civil collection case by lender	Weeks to months, depending on lender	Do not ignore court summons.
Settlement or restructuring	Any stage	Get every agreement in writing.

Common Scenarios

“They keep calling my relatives even though they did not borrow money.”

This is one of the strongest grounds for complaint, especially if your relatives are not guarantors or co-makers. Save screenshots from each person contacted. Ask them not to argue with the collector; they should simply preserve proof.

“They said they will post me on Facebook as a scammer.”

Save the threat. If they actually post, capture the URL, screenshot, date, time, account name, comments, and shares. Public accusation can raise issues under SEC rules, data privacy law, civil damages, and possibly defamation or cyberlibel depending on the exact words and facts.

“They said a police officer will arrest me tomorrow.”

Ask for the case number, court, prosecutor’s office, and copy of the warrant. Real warrants are issued by courts, not by collectors. A fake warrant or impersonation of law enforcement is a serious matter.

“I really owe the money, but the charges are too high.”

Ask for a full breakdown. Under RA 11765, financial consumers have rights to disclosure, transparency, fair treatment, and redress. (Supreme Court E-Library) You may dispute unexplained charges while still acknowledging the legitimate principal balance. In settlement, ask for waiver or reduction of penalties in writing.

“I am an OFW or foreigner outside the Philippines.”

You can still preserve evidence, send written complaints, and use online complaint channels where available. If a representative in the Philippines will file or follow up for you, prepare a Special Power of Attorney. Documents signed abroad may need notarization and, depending on the country, apostille or consular authentication if required by the receiving office or court.

“They filed a small claims case against me.”

Do not ignore it. Small claims are designed to move quickly. Prepare proof of payments, screenshots of settlement discussions, the loan agreement, statement of account, and any proof of excessive or disputed charges. Even if the collector harassed you, the court may still separately determine whether a valid unpaid civil obligation exists.

Documents to Prepare

Purpose	Documents or evidence
SEC complaint	Complaint narrative, screenshots, call logs, loan agreement, statement of account, proof of harassment, proof collector is connected to lender
NPC complaint	Notarized complaint form, screenshots of data misuse, app permissions, messages to contacts, proof of public posting, IDs
BSP complaint	Provider complaint reference, account details, statement of account, screenshots, proof of unresolved complaint
Police/NBI cyber complaint	Phone, screenshots, URLs, sender numbers, account names, voice recordings, witness screenshots, valid ID
Settlement negotiation	Updated statement of account, proposed payment schedule, proof of prior payments, written settlement terms

How to Communicate With Collectors Safely

Use short, controlled messages. Avoid emotional replies.

Good phrases:

• “Please send the complete statement of account and proof of authority to collect.”
• “I dispute the unexplained charges. Please provide a breakdown.”
• “Please communicate only through this number/email and during reasonable hours.”
• “Do not contact third parties who are not guarantors or co-makers.”
• “Any payment arrangement must be in writing and paid only through official channels.”
• “I am preserving these communications for regulatory review.”

Avoid:

• admitting to an amount you have not verified;
• promising a date you cannot meet;
• sending your new employer’s details;
• sending additional IDs unless necessary and secure;
• arguing through voice calls where there is no record;
• paying a collector personally without official acknowledgment.

Frequently Asked Questions

Can a lending collector call me every day?

A collector may follow up, but repeated calls can become abusive depending on frequency, timing, language, and purpose. Calls with threats, insults, deception, or unreasonable-hour harassment may support a complaint.

Can I be arrested for not paying an online loan?

Not for ordinary unpaid debt alone. The Constitution prohibits imprisonment for debt. Arrest becomes a different issue only if there is a separate criminal case, lawful warrant, or criminal act such as fraud, threats, falsification, or cybercrime.

Can online lending apps message my contacts?

They should not message random contacts for debt collection. Regulators have warned that contact-list processing must not be excessive, and debt collection contact should be limited to proper guarantors where applicable.

What if my relative was only a character reference?

A character reference is not automatically a guarantor. A guarantor is someone who separately and clearly agreed to answer for the debt if the borrower defaults. Without that obligation, collection pressure against the reference is improper.

Is it legal for collectors to call my employer?

Usually, no, if the purpose is to shame or pressure you. Contacting an employer may expose your personal loan information and can become unfair collection or data privacy misuse.

Should I uninstall the loan app?

First save evidence, screenshots, account details, and payment history. Then revoke unnecessary permissions. Uninstalling may reduce further access, but make sure you retain records needed for complaints or payment disputes.

What if the lender is not SEC-registered?

Save proof that the app or company is operating. Report it to the SEC and, if personal data was misused, to the NPC. Unregistered status does not automatically erase every peso borrowed, but it creates serious regulatory issues for the lender.

Can I sue the collector for damages?

Depending on the facts, civil remedies may be available under the Civil Code. Articles 19, 20, and 21 require persons to act with justice, give everyone their due, observe honesty and good faith, and compensate others for willful or negligent acts contrary to law, morals, good customs, or public policy. (Lawphil)

What should I do if they already posted my photo or loan details online?

Take screenshots immediately, copy the URL, record the account name, and ask trusted contacts to preserve what they saw. Report the post to the platform, then prepare complaints with the SEC and NPC. If the post contains defamatory accusations or threats, preserve evidence for police, NBI, or prosecutor evaluation.

Should I still pay if the collector harassed me?

A collector’s misconduct does not automatically cancel a valid debt. Treat them as separate issues: dispute harassment and illegal charges through complaints, while verifying the legitimate balance and paying only through official channels under written terms.

Key Takeaways

• A lender may collect a valid debt, but collectors cannot harass, threaten, shame, deceive, or misuse your personal data.
• You cannot be jailed simply for unpaid civil debt in the Philippines.
• SEC Memorandum Circular No. 18 prohibits unfair collection practices by lending and financing companies, including abusive third-party collectors.
• RA 11765 protects financial consumers against abusive collection and gives rights to fair treatment, transparency, data privacy, and complaint redress.
• Contact-list harassment by online lending apps is a serious privacy and consumer protection issue.
• Save evidence before blocking collectors: screenshots, call logs, voice messages, URLs, and messages sent to relatives or employers.
• File with the SEC for unfair debt collection, NPC for data privacy violations, BSP for BSP-supervised institutions, and police/NBI for threats, fake warrants, cyber harassment, or public shaming.
• Verify the debt, demand a written breakdown, pay only through official channels, and get any settlement in writing.

How to Request Personal Data Deletion from Online Lending Apps in the Philippines

If an online lending app in the Philippines keeps using your contacts, photos, IDs, messages, or other personal information after you paid, cancelled, or were denied a loan, you can formally request deletion or blocking of your personal data. Philippine law gives you a real process for this, but it is important to ask for the right thing, send it to the right entity, preserve evidence first, and understand what the app may legally keep, especially if you still have an unpaid loan.

What “personal data deletion” means under Philippine law

In the Philippines, the right most people call “data deletion” is legally known as the right to erasure or blocking. It comes from Section 16(e) of Republic Act No. 10173, or the Data Privacy Act of 2012.

This right allows you to request the suspension, withdrawal, blocking, removal, or destruction of your personal information from the filing system of a personal information controller, including live systems and backup systems.

For online lending apps, this may cover:

• your name, phone number, email address, address, birthday, employment details, and ID copies;
• selfies, face scans, proof-of-billing documents, and uploaded payslips;
• device information, app logs, location data, and access history;
• contact list data, character references, guarantor details, and metadata from your phone;
• marketing profiles, credit-scoring inputs, and automated decision-making records;
• personal data shared with collectors, affiliates, third-party processors, or debt collection agencies.

But deletion is not always “delete everything immediately.” A lending company may still retain data that is necessary for lawful purposes such as loan servicing, accounting, tax, regulatory compliance, credit reporting required by law, fraud investigation, or the establishment, exercise, or defense of legal claims.

The practical goal is to force the lender to stop unlawful or excessive processing and delete or block data that is no longer necessary.

Your legal rights against online lending apps

The Data Privacy Act protects borrowers, rejected applicants, references, and contacts

Under the Data Privacy Act, an online lending app is usually a personal information controller or PIC. This means it decides why and how your personal data is collected, used, stored, shared, and deleted.

A PIC must follow the general data privacy principles of:

Principle	What it means in ordinary language
Transparency	The app must clearly tell you what data it collects, why, how long it keeps it, and who receives it.
Legitimate purpose	The app must use your data only for lawful and declared purposes.
Proportionality	The app must collect only data that is necessary and not excessive.

Section 11 of the Data Privacy Act also states that personal information must be retained only for as long as necessary for the purpose for which it was obtained, for legal claims, for legitimate business purposes, or as provided by law.

This matters because many abusive lending apps collect far more than they need, especially contact lists, gallery access, social media contacts, and phone permissions.

Special NPC rules for loan apps

The National Privacy Commission issued NPC Circular No. 20-01, later amended by NPC Circular No. 2022-02, specifically for personal data processing in loan-related transactions.

These rules are important because they directly address online lending app abuses.

Under these NPC circulars:

• online lending apps must not require unnecessary app permissions;
• access to contact lists, camera, gallery, storage, or location must be suitable, necessary, and not excessive;
• unbridled processing of contact lists is prohibited;
• contact list access must not be used for harassment, debt shaming, or collection from persons who are not guarantors;
• character references must not automatically be treated as guarantors;
• a guarantor must separately consent to be a guarantor;
• lending and financing companies must provide an option for a character reference to have their personal data removed as a character reference;
• personal data must not be retained forever just because the company may want to use it later.

The 2026 DICT-NPC-SEC Public Advisory on Online Lending Platforms also reminds the public that unnecessary processing, excessive contact-list access, harassment, public shaming, and unfair debt collection practices are prohibited.

SEC rules also matter when the issue involves collection harassment

The Securities and Exchange Commission regulates lending companies under Republic Act No. 9474, the Lending Company Regulation Act of 2007, and financing companies under Republic Act No. 8556, the Financing Company Act of 1998.

The SEC also handles unfair debt collection complaints against lending and financing companies. Republic Act No. 11765, the Financial Products and Services Consumer Protection Act, strengthens consumer protection in financial products and services.

For data deletion, the main agency is the National Privacy Commission. For abusive collection, unregistered lending activity, threats, or harassment by a lending or financing company, the SEC may also be involved.

When you can request deletion from an online lending app

You may request deletion, blocking, or removal when you have substantial proof that your personal data is:

• incomplete, outdated, false, or unlawfully obtained;
• used for an unauthorized purpose;
• no longer necessary for the purpose for which it was collected;
• processed unlawfully;
• processed despite your valid objection;
• used in violation of your rights as a data subject.

Common examples include:

Situation	What you can usually request
You paid the loan in full	Deletion or blocking of data no longer needed, closure of account, removal from marketing and collection systems, and retention explanation for records they must keep.
Your loan application was denied	Deletion of application data that is no longer necessary, especially uploaded IDs, selfies, employment documents, and app permissions data.
You cancelled before loan release	Withdrawal of consent and deletion of unnecessary onboarding data.
The app accessed your contacts	Deletion of harvested contacts and proof that contacts were not shared with collectors or affiliates.
Your relatives or officemates were contacted	Removal of their data, disclosure of how their data was obtained, and cessation of processing.
You were listed as a character reference	Removal of your personal data as a character reference.
You were wrongly treated as guarantor	Removal from guarantor records unless you separately and expressly agreed to be one.

What the lending app may refuse to delete

A deletion request is stronger when it is realistic. Lending apps may deny deletion, wholly or partly, if the data is still necessary for:

• the fulfillment of the loan contract;
• collection of an existing unpaid obligation;
• compliance with law or regulation;
• accounting, tax, audit, or regulatory recordkeeping;
• submission or correction of credit data where required by law;
• fraud prevention or investigation;
• establishment, exercise, or defense of legal claims;
• legitimate business purposes consistent with proper retention standards.

For example, if you still owe money, the lender may keep your loan agreement, statement of account, repayment history, and identity verification records. But that does not mean it can keep your entire phonebook, shame you online, message your employer, or contact people who are not guarantors.

Step-by-step guide to request personal data deletion

1. Preserve evidence before deleting the app

Before revoking permissions or uninstalling the app, save proof. This is important because abusive apps may disappear, change names, or remove pages later.

Keep:

• screenshots of the app name, logo, developer, and app store listing;
• the privacy policy and consent screens;
• screenshots of permissions requested by the app;
• account number, loan reference number, and registered mobile number;
• proof of full payment, cancellation, or denied application;
• text messages, emails, chat messages, and call logs;
• screenshots of messages sent to your contacts;
• names and numbers of collectors, if visible;
• proof that third persons were contacted or shamed;
• copies of IDs or documents you uploaded, if available;
• dates and times of incidents.

If relatives, officemates, or friends were contacted, ask them to save screenshots too. Their evidence can be very important.

2. Revoke unnecessary app permissions

After preserving evidence, revoke permissions in your phone settings.

For Android, check:

• Settings → Apps → App name → Permissions
• Remove access to Contacts, Camera, Photos, Files, Microphone, Location, SMS, and Phone where not necessary.

For iPhone, check:

• Settings → Privacy & Security
• Review Contacts, Photos, Camera, Location Services, Tracking, and Microphone permissions.

Revoking permissions does not automatically delete data already collected. It only stops or limits future access from your device. You still need to send a written deletion request.

3. Identify the legal company behind the app

Many online lending apps use trade names, app names, or collection names different from the registered company.

Look for the company’s:

• registered corporate name;
• SEC registration number;
• Certificate of Authority number, if listed;
• privacy policy;
• Data Protection Officer or DPO email;
• customer support email;
• office address;
• app developer name in Google Play or App Store;
• collection agency name, if different.

You can check the SEC’s public information pages, including the SEC list of recorded online lending platforms, through the official SEC Philippines website and related lending and financing company pages. For complaints, the SEC now uses the iMessage SEC portal.

4. Send a written data subject request

Send your request by email, in-app support ticket, registered mail, courier, or any official channel listed in the privacy notice. Email is usually fastest, but keep proof that it was sent.

Use a subject line like:

Request for Erasure/Blocking of Personal Data under RA 10173 – [Your Name] – [Registered Mobile Number]

Your request should include:

1. your full name;
2. registered mobile number and email used in the app;
3. loan reference number or account ID, if any;
4. clear statement that you are exercising your right to erasure or blocking;
5. specific data you want deleted or blocked;
6. reason for deletion;
7. request for confirmation of deletion;
8. request for a list of third parties who received your data;
9. request to notify those third parties of the deletion;
10. attachments proving identity and supporting facts.

5. Ask for access and deletion together when needed

If you are not sure what data the app collected, combine your deletion request with a right of access request.

Ask the lending app to disclose:

• what personal data it collected;
• where it obtained the data;
• why it processed the data;
• who received it;
• whether collectors, affiliates, or overseas processors received it;
• how long it will be retained;
• whether automated credit scoring or profiling was used;
• whether contact-list data was copied, stored, or shared.

This is useful because many borrowers do not know whether the app actually uploaded contacts or merely accessed them temporarily.

6. Attach only necessary proof of identity

The app may verify that you are the correct data subject. That is allowed. But it should not demand excessive new personal data just to process your request.

Practical attachments may include:

• one valid ID, with unnecessary details covered where possible;
• screenshot of your app account;
• proof of payment or account closure;
• screenshots of offending messages;
• authorization letter or Special Power of Attorney if another person is filing for you.

Avoid sending a full set of new IDs, selfies, bank statements, or passwords unless truly necessary. Data minimization applies both ways.

7. Wait for the proper response period

Under NPC Advisory No. 2021-01 on Data Subject Rights, a personal information controller should comply with data subject requests without undue delay, and not beyond 30 working days after receiving the request and necessary documents. If the request is complex or numerous, it may be extended by up to another 15 working days, but you should be informed of the reason.

For an NPC complaint, however, the NPC Rules of Procedure require exhaustion of remedies. This means you generally need to show that you first informed the company in writing and gave it an opportunity to act. The NPC’s mechanics for complaints state that if the respondent fails to take timely or appropriate action, or there is no response within 15 calendar days from receipt of your written notice, proof of this must be attached to the complaint.

A practical approach is:

• ask the lender to acknowledge and stop unlawful processing within 15 calendar days;
• allow the full data subject rights response period for complete deletion or explanation;
• prepare an NPC complaint if there is no response, an unreasonable denial, continued harassment, or continued unlawful processing.

Sample deletion request you can adapt

Subject: Request for Erasure/Blocking of Personal Data under RA 10173

To the Data Protection Officer / Privacy Office:

I am exercising my right to erasure or blocking under Section 16(e) of Republic Act No. 10173, the Data Privacy Act of 2012, and applicable NPC issuances on loan-related transactions.

Name: [Full name] Registered mobile number: [Number] Registered email: [Email] Loan/account reference number: [If available] App name: [App name]

I request the deletion, blocking, or removal of my personal data that is no longer necessary, unlawfully obtained, excessive, or used for unauthorized purposes, including any contact-list data, uploaded photos, device permissions data, marketing profile, and data shared with collectors, affiliates, or third-party processors beyond what is legally necessary.

I also withdraw consent for marketing, cross-selling, contact-list processing, and disclosure to third parties not necessary for lawful loan servicing or legal compliance.

Please confirm in writing:

1. what personal data you currently hold about me;
2. the purpose and legal basis for each category of data retained;
3. the recipients or third parties to whom my data was disclosed;
4. what data has been deleted, blocked, or retained;
5. the legal basis and retention period for any data you refuse to delete;
6. whether my contact list, character references, or guarantor information were accessed, stored, or shared; and
7. whether third parties who received my data have been instructed to delete, block, or stop processing it.

Attached are documents supporting my identity and request. Please respond within the period required by NPC rules and advisories.

[Name] [Date]

Documents, timelines, and where to file

Purpose	Where to send/file	Key documents	Practical timeline
Initial deletion request	Lending app DPO, privacy email, support email, in-app ticket, registered mail, or courier	ID, account details, screenshots, proof of payment or cancellation	Acknowledgment may vary; full response should generally be within 30 working days, extendible by 15 working days for complex requests
NPC privacy complaint	National Privacy Commission	Notarized complaint-affidavit, proof of written notice, evidence, IDs, affidavits if available	NPC evaluates sufficiency; respondent may be required to comment if given due course
SEC unfair collection complaint	SEC through iMessage SEC	Loan documents, screenshots, call logs, proof of harassment, app details	Ticket-based handling; timeline depends on completeness and agency action
Cyber harassment, threats, fraud, or scams	DICT Cyber Hotline, NBI Cybercrime Division, PNP Anti-Cybercrime Group, local police where appropriate	Screenshots, links, numbers, names, call logs, account details, affidavits	Urgent threats should be documented immediately
Barangay or police blotter	Barangay or police station	Screenshots, witnesses, IDs	Useful for documenting harassment, but it does not replace NPC or SEC complaints

How to file a complaint with the National Privacy Commission

If the lending app ignores your request, refuses without a valid reason, continues using your data, or keeps harassing your contacts, you may file a formal complaint with the NPC.

The NPC’s official filing a complaint page requires a complaint in the proper format. The NPC has also implemented updated complaint-affidavit templates, so use the latest form from the NPC website before filing.

In general, you need:

• a completed complaint-affidavit or verified complaint;
• notarization;
• your evidence;
• proof that you first informed the company in writing;
• proof of no response, inadequate response, or continued violation;
• witness affidavits, if available;
• proof of identity;
• Special Power of Attorney if someone else files for you.

You may file personally, by registered mail, by courier, or by email if authorized by the NPC. Electronic submissions should be in PDF format where practicable and must comply with NPC rules on electronic filing.

For OFWs, Filipinos abroad, and foreigners outside the Philippines, the NPC Rules of Procedure allow complaints filed from outside the Philippines, but notarization may need to be done through a Philippine Embassy or Consulate, or with an apostille certificate from the country of origin, depending on the document and place of execution.

Common problems and how to handle them

The app says it cannot delete anything because you borrowed money

That is too broad. If you still owe money, the lender may retain records necessary for the loan, collection within legal limits, accounting, and legal claims. But it must still justify retention and should not keep excessive data.

A better response is:

• request deletion of contact-list data, gallery data, marketing data, and excessive app permissions data;
• request blocking of data not needed for collection;
• request the retention period and legal basis for loan records;
• request that third-party collectors stop processing data not necessary for lawful collection.

The loan is fully paid but the app keeps calling your contacts

Once the loan is fully settled, collection-related processing should stop. Ask for account closure, deletion of unnecessary data, removal from collection systems, and confirmation that collectors and processors were instructed to stop.

Attach proof of full payment. If they keep contacting third parties, preserve screenshots and escalate to NPC and SEC.

You were only a character reference

A character reference is not automatically a guarantor. NPC Circular No. 2022-02 states that character references should be informed that they were chosen, told how their details were obtained, and given the option to have their personal data removed.

Your request can be short:

“I did not borrow from your company and did not agree to be contacted for collection. Please remove my name and number as a character reference and confirm deletion or blocking of my personal data.”

The app claims your consent allowed contact-list access

Consent must be freely given, specific, informed, and tied to a legitimate purpose. Blanket consent hidden in a long privacy policy is weak if the processing is excessive or used for harassment.

NPC rules specifically prohibit unbridled contact-list processing. Even if you clicked “Allow,” the app cannot use that permission to shame you, pressure relatives, or collect from persons who are not guarantors.

The app is not registered or uses a fake company name

Unregistered or hard-to-trace apps are common. Still preserve evidence and file complaints using all identifying details available:

• app name;
• package name or app store link;
• developer name;
• phone numbers used;
• GCash, bank, or payment channels;
• collection messages;
• privacy policy link;
• screenshots of ads and social media pages.

Report the data privacy issue to NPC, the lending/collection issue to SEC, and threats or scams to cybercrime authorities.

You are a foreigner who used a Philippine lending app

The Data Privacy Act protects data subjects, not only Filipino citizens. If a Philippine lending app or Philippine-based company processed your personal data, you may exercise data subject rights. For formal complaints filed from abroad, expect identity verification and possible notarization, consular acknowledgment, or apostille requirements.

What not to do

Avoid these common mistakes:

• Do not delete the app before saving evidence.
• Do not rely only on phone calls; send a written request.
• Do not send unnecessary IDs, selfies, or bank documents.
• Do not admit to facts you dispute just to get deletion.
• Do not threaten the company with false accusations.
• Do not ignore a legitimate unpaid loan; deletion rights do not erase debt.
• Do not file an NPC complaint without proof that you first notified the company, unless there is a strong reason why prior notice was not possible or safe.
• Do not confuse a character reference with a guarantor. A guarantor must separately agree to answer for the debt.

Frequently Asked Questions

Can I ask an online lending app to delete my data after I fully pay my loan?

Yes. After full payment, you can request account closure and deletion or blocking of personal data no longer necessary. The lender may retain some records for legal, accounting, tax, regulatory, or claims-related purposes, but it should explain what it is keeping, why, and for how long.

Can I request deletion if I still have an unpaid loan?

Yes, but the lender may retain data necessary for lawful collection and legal claims. You can still request deletion or blocking of excessive data, especially contact-list data, gallery access data, marketing data, and information about people who are not guarantors.

Can the app contact everyone in my phonebook?

No. NPC rules prohibit unbridled contact-list processing. For debt collection, lending and financing companies may contact the guarantor. Contacting people in your contact list who were not named as guarantors is prohibited under NPC rules and may also violate SEC rules on unfair debt collection.

Is a character reference responsible for my loan?

No. A character reference is not automatically a guarantor. A guarantor must expressly agree to be responsible for the borrower’s obligation in case of default. If a lending app treats a character reference as a guarantor without separate consent, that is a serious red flag.

How long should the lending app take to answer my deletion request?

Under NPC Advisory No. 2021-01, the PIC should act without undue delay and generally not beyond 30 working days after receiving the request and necessary documents. For complex or numerous requests, it may extend by up to 15 working days, but it should notify you of the reason.

What if the lending app ignores me?

Save proof of your written request and proof of receipt or sending. If there is no response, an inadequate response, or continued unlawful processing, prepare an NPC complaint. For collection harassment, also file with the SEC through iMessage SEC.

Can I make the app delete my data from its collectors and affiliates?

You can request that the lending app inform third parties who received your personal data of the erasure or blocking. The PIC remains accountable for personal data under its control or custody, including data processed by third-party processors.

Can I file a complaint even if I am abroad?

Yes, but formal documents executed abroad may need consular notarization or an apostille. If someone in the Philippines files for you, prepare a specific authorization or Special Power of Attorney.

Is uninstalling the app enough?

No. Uninstalling may stop some future access, but it does not delete data already collected, copied, uploaded, or shared. Send a written deletion or blocking request and preserve evidence before uninstalling.

Can I demand deletion of negative credit records?

Not automatically. If the data is accurate and lawfully reported under applicable credit or financial regulations, the lender may have a legal basis to retain or report it. If the information is false, outdated, excessive, or unlawfully processed, request correction, blocking, or deletion and attach proof.

Key Takeaways

• The Philippine legal right to “delete my data” is the right to erasure or blocking under the Data Privacy Act.
• Online lending apps cannot collect or keep excessive data, and unbridled contact-list processing is prohibited.
• A deletion request does not erase a valid debt, but it can stop unlawful use of contacts, photos, IDs, marketing data, and unnecessary app permissions data.
• Send a written request to the lending app’s DPO or official privacy channel and keep proof of sending.
• The app generally has up to 30 working days to comply with a data subject request, with a possible 15-working-day extension for complex requests.
• Before filing with the NPC, preserve proof that you first informed the company in writing and gave it an opportunity to act.
• File with the NPC for data privacy violations and with the SEC for unfair debt collection or unauthorized lending activity.
• Character references are not guarantors, and guarantors must separately consent to be responsible for the loan.

Can Online Lending Apps Contact Your Employer? Philippine Borrower Rights Explained

An online lending app cannot legally call your employer just to shame you, pressure you to pay, or tell HR that you have an unpaid loan. Philippine rules allow lenders to collect legitimate debts, but collection must be lawful, fair, and respectful of your privacy. The key question is not simply “Did I owe money?” but “How did the lending app use my personal data, and did it disclose my debt to people who had no legal reason to know?” Philippine regulators have repeatedly flagged online lending platforms for harassment, intimidation, public shaming, and unlawful use of personal data in collection practices.

Can online lending apps contact your employer in the Philippines?

Generally, no, not for debt collection, harassment, or public shaming.

An online lending app, lending company, financing company, or third-party collector may not contact your employer, supervisor, HR department, co-workers, relatives, or phone contacts to pressure you into paying, embarrass you, threaten your job, or disclose your loan details.

The DICT, National Privacy Commission (NPC), and Securities and Exchange Commission (SEC) stated in their 2026 public advisory that contacting persons in the borrower’s contact list, other than those named as guarantors, is prohibited for debt collection. The advisory also states that, for debt collection, lending companies, financing companies, and persons acting for them may only contact the guarantor.

This means an online lending app crosses the line when it sends messages like:

• “Your employee refuses to pay. Please discipline him.”
• “We will report this borrower to HR.”
• “This person is a scammer and has unpaid debt.”
• “Tell your employee to pay today or we will keep calling the office.”
• “We will post this borrower’s ID and company details online.”

Even if you owe money, the lender’s remedy is to collect lawfully, report to proper credit channels when allowed, negotiate payment, or file the proper civil case. It cannot turn your employer into a collection tool.

When contacting an employer may be allowed

There are limited situations where a lender may communicate with an employer or workplace-related contact, but the contact must be specific, necessary, proportionate, and properly disclosed.

Situation	Usually allowed?	Important limit
Employment verification during loan application	Sometimes	The lender should only verify relevant employment or income information and should not disclose unnecessary loan details.
Employer is part of a salary loan or payroll deduction arrangement	Sometimes	There must be a valid arrangement and borrower authorization; processing must stay within that purpose.
Employer or HR officer was named only as a character reference	Limited	A character reference is for identification or verification, not debt collection.
Employer personally signed as guarantor or co-maker	Yes, if true	A guarantor must have expressly consented to assume responsibility for the loan.
Collector calls HR to shame or pressure the borrower	No	This is likely unfair collection and may violate privacy rules.
Collector threatens to get the borrower fired	No	A collector cannot threaten action it has no legal right to take.
Court, lawful government order, or proper legal process	Possible	The disclosure must follow the exact legal authority and scope.

The 2026 advisory is clear that online lending platforms must separate character references from guarantors. Character references are provided for identification or verification purposes, while guarantors are persons who expressly consent to assume responsibility for the loan in case of default.

The legal basis: borrower privacy and fair collection rules

Data Privacy Act of 2012: your loan information is personal data

Republic Act No. 10173, or the Data Privacy Act of 2012, protects personal information in government and private-sector information systems. The law defines personal information broadly as information from which a person’s identity is apparent or can be reasonably and directly ascertained. It also defines consent as a freely given, specific, and informed indication of will, evidenced by written, electronic, or recorded means. (National Privacy Commission)

Loan-related data can include:

• your name, phone number, address, and ID;
• your employer, job title, and salary details;
• your loan amount, due date, penalties, and payment history;
• screenshots of your ID, face, payslip, or company ID;
• your character references and guarantors;
• your phone contacts if the app accessed them.

Under the Data Privacy Act, data processing must have a lawful basis and must be limited to a declared purpose. A lender cannot collect one set of data for loan verification, then use it later to shame you before your employer or co-workers.

The law also gives data subjects rights to dispute inaccurate data and to seek blocking, removal, or destruction of personal information that is unlawfully obtained, used for unauthorized purposes, or no longer necessary for the purpose for which it was collected. (National Privacy Commission)

NPC rules on loan-related data

The NPC issued Circular No. 20-01 on the processing of personal data for loan-related transactions after receiving complaints that online lending apps were illegally using borrowers’ personal data and contact lists in ways that damaged reputations and violated data subject rights. (National Privacy Commission)

The NPC later amended those guidelines through NPC Circular No. 2022-02, covering the processing of personal data for evaluating loan applications, granting loans, collecting loans, closing loan accounts, character references, and guarantors. (National Privacy Commission)

A practical way to understand the rule is this:

• A lender may collect data needed to evaluate and administer a loan.
• It may contact a proper guarantor for collection if that person truly agreed to be responsible.
• It may not harvest your contact list and blast messages to people who never agreed to be involved.
• It may not use your employer’s name, HR number, or office contact details as leverage to shame you.

SEC rules on unfair debt collection

SEC Memorandum Circular No. 18, Series of 2019, applies to financing companies, lending companies, and third-party service providers hired by them. It allows reasonable and legally permissible collection, but requires good faith and prohibits unscrupulous or untoward acts.

The SEC circular treats the following as unfair collection practices:

• use or threat of violence or other criminal means to harm a person’s body, reputation, or property;
• threats to take action that cannot legally be taken;
• obscenities, insults, or profane language meant to abuse the borrower;
• disclosure or publication of names and personal information of borrowers who allegedly refuse to pay;
• communicating or threatening to communicate false loan information, including failing to say that the debt is disputed;
• false representation or deceptive means to collect a debt;
• contacting persons in the borrower’s contact list other than named guarantors or co-makers.

The same circular says lenders must keep borrower data strictly confidential for collection purposes, subject only to specific exceptions such as borrower consent, disclosure to authorized credit information channels, court or government orders, collection agencies or counsel enforcing the lender’s rights, service providers, or insurers for limited purposes.

Lending companies must be regulated

Online lending platforms usually operate through lending companies or financing companies. Lending companies are regulated under Republic Act No. 9474, the Lending Company Regulation Act of 2007, while financing companies are regulated under Republic Act No. 8556, the Financing Company Act of 1998. The SEC lists Memorandum Circular No. 18, Series of 2019, and Memorandum Circular No. 19, Series of 2019, under its financing and lending companies issuances. (Lawphil)

Republic Act No. 11765, or the Financial Products and Services Consumer Protection Act, also strengthens protection for consumers of financial products and services, including those offered or marketed by financial service providers. (Lawphil)

What if the lending app says you “gave consent”?

Many online lending apps hide broad consent clauses in long terms and conditions. They may claim that because you tapped “I agree,” they can contact your employer, relatives, Facebook friends, or phone contacts.

That is not how proper consent works.

Under the Data Privacy Act, consent must be freely given, specific, and informed. The 2026 government advisory warns borrowers to watch out for deceptive design patterns such as pre-ticked boxes, interfaces that make consent easy to give but difficult to withdraw, or designs that push users toward more personal data processing while hiding privacy-protective choices.

Also, SEC Memorandum Circular No. 18 says that, notwithstanding the borrower’s consent, contacting persons in the borrower’s contact list other than named guarantors or co-makers is an unfair debt collection practice.

So even if the app flashes “You consented,” ask:

1. Consent to what exact act?
2. Was it only for verification, or also for debt collection?
3. Was the employer a guarantor or merely employment information?
4. Did the lender disclose your debt to people who had no need to know?
5. Did the app use pressure, threats, or shaming?

Broad, vague, or forced consent does not automatically legalize abusive collection.

Can you be jailed for not paying an online loan?

For ordinary unpaid debt, no. The 1987 Philippine Constitution states that no person shall be imprisoned for debt or non-payment of a poll tax. (Lawphil)

A lending app cannot truthfully say:

• “We will have you arrested today.”
• “Police are coming to your office.”
• “You will go to jail if you do not pay by 5 p.m.”
• “We filed a criminal case because you are late.”

A lender may file a civil collection case if it has a valid claim. A criminal case may arise only when there are separate criminal acts, such as fraud, falsification, identity theft, or issuance of bouncing checks under applicable laws. Simple inability to pay a loan is not automatically a crime.

What to do if an online lending app contacted your employer

Act quickly, but stay organized. Regulators and investigators need clear proof.

1. Preserve evidence before it disappears

Save:

• screenshots of messages to you, your employer, HR, co-workers, or family;
• screenshots showing the sender’s number, profile, app name, and date/time;
• call logs showing repeated calls;
• emails from HR or co-workers confirming what was received;
• the loan agreement, disclosure statement, privacy notice, and app screenshots;
• proof of payments, if any;
• app permissions showing access to contacts, photos, SMS, camera, or storage.

Be careful with secret call recordings. Republic Act No. 4200, the Anti-Wiretapping Law, prohibits secretly recording private communications without authorization from all parties to the communication. (Lawphil)

2. Tell the lender in writing to stop improper contact

Send a short written message through the app, email, or official customer service channel:

I am requesting that you stop contacting my employer, HR department, co-workers, relatives, and phone contacts for debt collection. Any loan-related communication should be directed to me or to a lawful guarantor, if any. I dispute any disclosure of my personal loan information to unauthorized third parties and request a copy of your privacy notice, loan agreement, and basis for processing my employer’s information.

Keep proof that you sent it.

This written notice is useful because the NPC complaint process generally requires exhaustion of remedies: the complainant must first inform the respondent in writing of the privacy violation or personal data breach and allow the respondent to address it. If the respondent does not take timely or appropriate action, or fails to respond within 15 calendar days from receipt, proof of that written notice should be attached to the complaint. (National Privacy Commission)

3. Notify HR calmly

You do not need to reveal every personal detail. A practical HR message can say:

I am dealing with an online lending app that appears to be contacting third parties improperly. Please do not disclose my employment records, salary, schedule, personal contact details, or disciplinary information to callers claiming to be collectors unless there is a verified lawful basis or proper legal process. Please forward any messages or call details to me for documentation.

This protects you from rumors and helps HR treat the call as a privacy and security issue, not workplace misconduct.

4. File a complaint with the SEC for unfair debt collection

For abusive collection by a lending company, financing company, or online lending platform, file with the Securities and Exchange Commission, particularly the Financing and Lending Companies Department. The 2026 advisory identifies SEC as the authority for unfair debt collection practices and points the public to SEC’s iMessage platform and hotline 1-4732 or 1-4SEC.

The SEC iMessage platform is the SEC’s official web-based ticketing system for submitting complaints, reports, and requests, and it allows users to open a new ticket and check ticket status. (Securities and Exchange Commission)

Attach:

• screenshots of the employer contact;
• screenshots of threats, shaming, or false statements;
• the name of the app and corporate operator, if known;
• your loan agreement or disclosure statement;
• proof that the collector contacted your workplace;
• your written demand to stop contacting third parties.

5. File a privacy complaint with the NPC

If the issue involves unlawful processing, excessive access to contacts, disclosure of loan details, use of employer information, or harassment through personal data, file with the National Privacy Commission.

The NPC’s filing page states that a formal complaint must be in the required format, printed and filled out, notarized, and submitted in person, by courier, or by scanned email to the NPC complaints address. (National Privacy Commission)

The NPC mechanics page says a complaint should include copies of evidence and witness affidavits, and that insufficient evidence may cause outright dismissal. (National Privacy Commission)

NPC Circular No. 2023-01 lists a ₱500 filing fee for complaints, with additional fees if claims for damages are included.

6. Report threats, scams, or cyber harassment when needed

If the collector threatens violence, uses identity theft, fake police documents, extortion, or online shaming, you may also report to law enforcement.

The 2026 government advisory identifies these channels for other forms of harassment, threats, frauds, and scams:

Issue	Office mentioned in the advisory
Cyber threats, scams, or harassment	DICT Cyber Hotline
Cybercrime investigation	NBI Cybercrime Division
Online threats or anti-cybercrime concerns	PNP Anti-Cybercrime Group

The same advisory lists the relevant email addresses and contact numbers for these offices.

Depending on the facts, abusive collectors may expose themselves to liability under the Revised Penal Code for threats, coercions, unjust vexation, oral defamation, or libel; and under Republic Act No. 10175, the Cybercrime Prevention Act of 2012, if defamatory or unlawful acts are committed through a computer system. In Disini v. Secretary of Justice, the Supreme Court discussed cyber libel under RA 10175 in relation to libel under the Revised Penal Code. (Lawphil)

Practical documents checklist

Document or proof	Why it matters
Screenshot of the collector’s message to employer	Shows unauthorized third-party contact
HR email or written confirmation	Proves the workplace actually received the communication
Call logs	Shows repeated or harassing contact
Loan agreement and disclosure statement	Identifies lender, amount, terms, and consent clauses
Privacy notice or app consent screen	Shows what data use was disclosed
App permission screenshots	Shows whether the app requested contacts, photos, camera, SMS, or storage
Payment receipts	Helps correct exaggerated or false balance claims
Written demand to stop contacting employer	Supports exhaustion of remedies for NPC filing
Affidavit of borrower or witness	Useful for formal complaints and investigations
Police blotter, if threats were made	Useful when there are threats, extortion, or safety concerns

Common real-life scenarios

“The app called HR and said I am a scammer.”

That is not legitimate collection. Accusing a borrower of being a scammer, thief, or criminal before HR may be defamatory, may be unfair debt collection, and may involve unauthorized disclosure of personal loan information. Preserve the message and ask HR for a copy.

“They said they will report me to my employer if I do not pay today.”

A threat to report your private debt to your employer as pressure for payment is highly problematic. SEC rules prohibit threats to take action that cannot legally be taken and prohibit conduct that harms reputation or property through unfair collection.

“I listed my employer in the application. Does that mean they can call?”

Not automatically. Employment information may be relevant for verification, but that does not mean the lender may disclose your delinquency to HR or use your employer for collection. The purpose matters.

“My boss received a message because the app accessed my contacts.”

That is exactly the type of practice regulators have warned against. The NPC has stated that online lenders are prohibited from harvesting phone and social media contact lists for harassing delinquent borrowers, and the 2026 advisory prohibits unauthorized, excessive, or disproportionate processing of borrowers’ contact lists. (National Privacy Commission)

“The collector is from an agency, not the lending app.”

The lender may still be responsible. SEC Memorandum Circular No. 18 states that financing and lending companies may outsource collection to third-party service providers, but the ultimate responsibility for collection practices and compliance remains with the financing or lending company.

“I am an OFW or foreigner outside the Philippines.”

You can still preserve digital evidence and file written complaints. If documents must be notarized abroad for use in the Philippines, check whether the document needs consular acknowledgment or apostille depending on where it is executed and what the receiving office requires. For NPC complaints, the formal complaint process requires notarization and supporting evidence, so overseas complainants should plan for authentication and scanning time.

Frequently Asked Questions

Can online lending apps call my employer in the Philippines?

They generally cannot call your employer to collect, shame you, disclose your unpaid loan, or pressure HR to discipline you. Limited verification may be allowed if necessary and properly disclosed, but debt collection through your employer is a different matter.

Can a lending app message my boss on Facebook or Messenger?

No, not for harassment or debt collection. Messaging your boss about your unpaid loan may be an unauthorized disclosure of personal information and an unfair collection practice, especially if your boss is not a guarantor or co-maker.

What if my employer was listed as my character reference?

A character reference is not the same as a guarantor. Under the 2026 advisory, character references are for identification or verification, while guarantors must expressly consent to assume responsibility for the loan in case of default.

Can the lending app contact my guarantor?

Yes, if that person truly agreed to be a guarantor. A guarantor is someone who expressly consented to answer for the loan if you default. The lender should not treat random contacts, HR officers, or co-workers as guarantors.

Can I be fired because an online lending app contacted my employer?

A private debt is not automatically a valid ground for dismissal. If your employer takes action, it must still comply with Philippine labor rules on just or authorized causes and due process. The more immediate concern is stopping unauthorized disclosure and documenting the collector’s conduct.

Can an online lending app post my name, ID, or company online?

No. SEC rules prohibit disclosure or publication of names and personal information of borrowers who allegedly refuse to pay, except as allowed under the confidentiality rules. Public shaming may also raise privacy, defamation, and cybercrime issues.

Should I delete the lending app?

Do not delete it before saving evidence. First screenshot the loan details, privacy notice, permissions, messages, repayment history, and company name. After preserving evidence, you may review and revoke unnecessary app permissions.

Where do I complain if the app contacted my employer?

For unfair collection, file with the SEC through iMessage or the SEC Financing and Lending Companies Department. For privacy violations, file with the NPC. For threats, scams, identity theft, or cyber harassment, consider reporting to DICT, NBI Cybercrime Division, or PNP Anti-Cybercrime Group. (Securities and Exchange Commission)

Do I still have to pay if the lender violated my privacy?

A privacy or collection violation does not automatically erase a valid debt. However, it may give you grounds to complain, demand that unlawful processing stop, dispute improper charges or false claims, and seek appropriate remedies. Keep the debt issue separate from the harassment issue.

Key Takeaways

• Online lending apps may collect debts, but they must do it lawfully.
• They generally cannot contact your employer, HR, boss, or co-workers to shame you or pressure payment.
• A character reference is not a guarantor.
• A guarantor must expressly consent to be responsible for the loan.
• Broad app consent does not automatically allow harassment, contact-list blasting, or workplace shaming.
• Save screenshots, call logs, HR confirmations, loan documents, app permissions, and payment proof.
• Send a written demand to stop third-party contact before filing with the NPC when possible.
• File unfair collection complaints with the SEC and privacy complaints with the NPC.
• You cannot be jailed merely for ordinary non-payment of debt.
• Do not secretly record private calls without proper consent; preserve evidence through lawful screenshots, logs, emails, and affidavits.

What to Do If an Unauthorized Loan Appears in Your Lending App Account

Seeing a loan balance in a lending app that you never applied for is not something to brush aside. In the Philippines, you should treat it as three problems at once: a disputed debt, a possible identity theft or account-takeover incident, and a possible data privacy violation. Your first goals are to preserve evidence, stop further unauthorized access, formally dispute the loan, prevent wrongful collection or credit reporting, and escalate to the correct government office if the app or lender does not act properly.

Is an Unauthorized Loan Legally Binding in the Philippines?

A loan is still a contract. Under the Civil Code, a contract requires a “meeting of minds” between the parties, and the essential requisites are consent, a certain object, and cause or consideration. Consent is shown by a valid offer and acceptance. A person generally cannot bind another person to a contract without authority, and a contract entered into in another person’s name without authority may be unenforceable unless properly ratified. (Lawphil)

In practical terms, this means a lending app or collection agent should not simply say, “It is in your account, so you must pay.” They should be able to show how the loan was applied for, who accepted the terms, what identity verification was used, where the money was disbursed, and what proof shows that you actually consented.

An unauthorized loan may happen because:

• Someone accessed your lending app account using your mobile number, email, password, OTP, or SIM.
• Someone used your ID, selfie, or personal details to create or verify an account.
• The app processed a loan after confusing or misleading screens.
• A prior borrower entered your number or details by mistake.
• A debt collector is using false or incomplete information.
• A legitimate account exists, but the specific loan transaction was not authorized.

The most important point: do not admit the debt casually. Avoid messages like “I will pay later” or “I just need more time” if your position is that you never borrowed the money. Say clearly and consistently that the loan is unauthorized and disputed.

Your Key Rights Under Philippine Law

You Have the Right to Dispute a Loan You Did Not Authorize

Lending companies are regulated under the Lending Company Regulation Act of 2007, or Republic Act No. 9474, which recognizes the State’s power to regulate lending companies and prevent unfair or prejudicial practices against borrowers. (Supreme Court E-Library)

Digital lending also falls within broader financial consumer protection rules. The Financial Products and Services Consumer Protection Act, Republic Act No. 11765, covers financial products and services accessed through digital channels, and gives financial regulators such as the SEC and BSP authority to act against unfair, unreasonable, abusive, or deceptive practices. It also recognizes that financial service providers may be responsible for acts or omissions of their agents and representatives. (Supreme Court E-Library)

If you did not authorize the loan, your dispute should focus on facts:

• You did not apply for the loan.
• You did not consent to the loan terms.
• You did not receive or benefit from the money, or if money was sent to your account, you did not request it and have not used it.
• You are requesting investigation, suspension of collection, and correction of records.

You Have Data Privacy Rights

Unauthorized lending app loans often involve personal data: names, phone numbers, IDs, selfies, contacts, device information, or location data. The Data Privacy Act of 2012, Republic Act No. 10173, protects personal information in both government and private information systems, and data subjects have rights over the processing of their personal data. (National Privacy Commission)

A March 2026 public advisory by the DICT, National Privacy Commission, and SEC specifically warned online lending platforms against excessive data processing, unnecessary app permissions, and abusive use of contact lists. It stated that online lending platforms should not contact persons in a borrower’s contact list except legitimate guarantors, and guarantors must separately and expressly consent.

This matters because many victims of unauthorized lending app loans are harassed not only personally, but through family members, coworkers, employers, or random phone contacts. That conduct may become both a debt-collection issue and a data privacy issue.

Debt Collectors Cannot Use Harassment, Public Shaming, or False Threats

SEC Memorandum Circular No. 18, Series of 2019, prohibits unfair debt collection practices by financing and lending companies. These include threats, insults, obscene or profane language, false representations, disclosure or publication of borrower information, contacting people other than guarantors or co-makers, and communicating false loan information, including failing to say that a debt is disputed. The circular also provides penalties, which may include fines, suspension, or revocation of authority depending on the violation.

If collectors call your contacts, post your name online, threaten to report you to your employer, send edited photos, or say you will be arrested for a disputed app loan, preserve those messages. Those details are often more useful in a complaint than a general statement that you were “harassed.”

Identity Theft, Account Takeover, and Financial Account Scams May Be Criminal Issues

If someone used your identity, phone, bank account, e-wallet, access credentials, or OTP to obtain a loan, the issue may go beyond civil debt. Depending on the facts, it may involve cybercrime, misuse of access devices, fraud, or financial account scamming.

The Access Devices Regulation Act of 1998, Republic Act No. 8484, covers access devices such as account numbers, cards, codes, PINs, or other means of account access used to obtain money, goods, services, or transfer funds. It also recognizes unauthorized or fraudulently applied-for access devices. (Lawphil)

The Anti-Financial Account Scamming Act, Republic Act No. 12010, covers financial accounts such as deposits, transaction accounts, e-wallets, and other accounts used for financial products or services. It penalizes acts such as social engineering schemes and opening or using accounts under another person’s identity, and it allows temporary holding of disputed funds in certain circumstances. (Lawphil)

What to Do Immediately If an Unauthorized Loan Appears

1. Preserve Evidence Before Deleting the App

Do not uninstall the app until you have captured the evidence. Deleting the app too early can make it harder to prove what appeared in your account.

Take screenshots or screen recordings showing:

• The app name and account profile.
• Loan amount, loan ID, reference number, and date of loan release.
• Repayment schedule, interest, penalties, and charges.
• Any digital contract, disclosure statement, or terms and conditions.
• Disbursement details, including bank, e-wallet, or recipient account if visible.
• Collection messages, call logs, SMS, emails, in-app notices, and push notifications.
• App permissions requested or granted, especially contacts, camera, gallery, SMS, phone, and location.
• App store page, developer name, website, and customer service details.
• SEC registration, certificate of authority, or lending company name shown in the app.

Save copies in more than one place, such as cloud storage and an external drive. If harassment is happening, keep the original messages and call logs. Do not rely only on screenshots if the actual message thread can still be preserved.

2. Secure Your Phone, Email, SIM, E-Wallets, and Bank Accounts

An unauthorized lending app loan may be a symptom of a wider compromise.

Do these immediately:

1. Change the password of the lending app account, email account, e-wallet, online banking, and social media accounts connected to your phone number.
2. Enable multi-factor authentication where available.
3. Log out of other devices.
4. Check whether your SIM recently lost signal, which may suggest SIM swap or unauthorized SIM activity.
5. Call your telco if you suspect SIM replacement, lost SIM access, or OTP interception.
6. Review bank and e-wallet transaction histories for unfamiliar transfers.
7. Revoke unnecessary app permissions, especially contacts and SMS access.
8. Scan your phone for suspicious apps or malware.

If loan proceeds were deposited into your bank or e-wallet account without your request, do not spend the money. Spending it can make the dispute harder. Report it immediately to the lender and the bank or e-wallet provider, and ask for a documented process to reverse, hold, or return the funds.

3. Send a Formal Written Dispute to the Lending App or Company

Do not rely only on phone calls. Send a written complaint through the app, official email, website form, and any customer support channel available. Use a clear subject line:

Formal Dispute: Unauthorized Loan in My Account — Request for Investigation and Suspension of Collection

Your message should include:

• Your full name, registered mobile number, and email address.
• Loan ID, amount, and date appearing in the app.
• A clear statement that you did not apply for or authorize the loan.
• A request to suspend collection, penalties, interest accrual, and credit reporting while the dispute is investigated.
• A request for the full loan documents and digital transaction records.
• A request for proof of consent, KYC records, OTP logs, device logs, IP address logs, and disbursement details.
• A request to preserve all records and recordings.
• A request to stop contacting your references, contacts, employer, relatives, or coworkers unless they are lawful guarantors who separately consented.
• A request for the name, SEC registration details, certificate of authority, and data protection officer or privacy contact of the company.

Keep the ticket number, email headers, automated replies, and screenshots showing when the complaint was submitted.

4. Ask the Lender to Mark the Account as Disputed

This is important because a disputed loan should not be treated as an ordinary overdue account. Ask the lender to:

• Mark the account as formally disputed.
• Stop automated collection messages.
• Stop referring the account to third-party collectors while under investigation.
• Stop adding interest, penalties, and collection fees.
• Stop reporting the account as delinquent to credit bureaus or the Credit Information Corporation while the issue is unresolved.
• Correct or delete any inaccurate record if the loan is confirmed unauthorized.

If a collector continues to pressure you, reply once in writing: “This loan is formally disputed as unauthorized. Please communicate only in writing and provide proof of my consent and the disbursement trail.”

5. File a Complaint With the Proper Government Office

Different agencies handle different parts of the problem. Filing with the wrong office may delay the case, so match your complaint to the issue.

Problem	Where to Report	What to Prepare
Unauthorized loan by a lending or financing company	SEC Financing and Lending Companies Division / SEC iMessage	Screenshots, loan ID, company or app name, complaint letter, collection messages, proof of dispute
Harassment, public shaming, contact-list blasting, threats, abusive collection	SEC	Messages, call logs, names or numbers of collectors, screenshots sent to contacts
Misuse of personal data, excessive app permissions, use of contacts, disclosure of your information	National Privacy Commission	Complaint-assisted form or verified complaint, evidence, witness affidavits if available
Unauthorized bank, e-wallet, payment, or BSP-supervised financial account transaction	Bank/e-wallet provider first, then BSP Consumer Assistance	Transaction details, complaint reference number, screenshots, account statements
Incorrect credit record or wrongful reporting	Credit Information Corporation or relevant credit bureau	Credit report, dispute letter, proof that the loan is unauthorized or under dispute
Hacking, identity theft, extortion, threats, fake accounts, or use of your ID	PNP Anti-Cybercrime Group or NBI Cybercrime Division	Screenshots, device details, account logs, IDs used, transaction trail

The SEC iMessage portal receives reports, feedback, and complaints involving SEC-regulated entities. (Securities and Exchange Commission) The NPC complaint process may require a filled-out and notarized complaint-assisted form or a verified complaint with evidence and affidavits, filed personally, by mail, courier, or authorized email process. (National Privacy Commission) For BSP-supervised institutions, the BSP Online Buddy system issues a case reference number for complaints and provides response channels for financial consumer concerns. (Bureau of Small and Medium Enterprises)

6. Check Whether the Loan Was Reported to the Credit Information Corporation

A wrongful lending app loan can damage your credit record if it is reported as unpaid. The Credit Information System Act, Republic Act No. 9510, gives borrowers the right to access their credit information and dispute erroneous, incomplete, outdated, or misleading credit information. The law provides a verification process and requires correction or deletion if information cannot be verified. (Supreme Court E-Library)

If the unauthorized loan appears in your credit report, file a dispute and attach:

• Your written dispute to the lender.
• The lender’s acknowledgment or ticket number.
• Screenshots showing the unauthorized loan.
• Police, SEC, NPC, BSP, or bank complaint references, if already filed.
• Any proof that you did not receive the proceeds or did not authorize the transaction.

Evidence Checklist for an Unauthorized Lending App Loan

Good evidence is often the difference between a complaint that moves forward and one that gets dismissed as incomplete.

Prepare a folder with the following:

• Government ID used in the app, if known.
• Your own valid ID for identity verification.
• Screenshots of the loan account.
• Loan agreement, disclosure statement, amortization, and repayment schedule.
• Date and time you first discovered the loan.
• All SMS, emails, push notifications, and in-app messages.
• Call logs and recordings, if lawfully available.
• Names, phone numbers, and account names of collectors.
• Screenshots from relatives, coworkers, or contacts who were messaged.
• Bank or e-wallet statements showing whether money was received.
• Proof that you were abroad, offline, hospitalized, at work, or otherwise unable to make the transaction, if relevant.
• Telco reports if you lost SIM access or suspect SIM swap.
• Police blotter or cybercrime complaint reference, if already filed.
• Your formal dispute letter and proof of submission.

For OFWs, foreigners, and Filipinos abroad, evidence may include passport stamps, visa records, overseas employment documents, foreign phone records, or foreign bank statements. If an affidavit is needed for a Philippine proceeding, expect that it may need consular notarization, apostille, or other authentication depending on where it is executed and where it will be submitted.

What to Say in Your Dispute Letter

Keep the letter factual and firm. Avoid emotional accusations unless you can support them with evidence.

You can use wording like this:

I am formally disputing the loan appearing in my account because I did not apply for, authorize, consent to, or benefit from this loan. Please immediately suspend collection activity, interest, penalties, and any reporting to credit bureaus or the Credit Information Corporation while this dispute is under investigation. Please provide the complete loan documents, proof of consent, KYC records, OTP logs, device and IP logs, disbursement details, and the name and authority of the lending company and any collection agency handling the account.

Add this if collectors are contacting others:

Please also stop contacting my relatives, coworkers, employer, phone contacts, or any third person regarding this disputed loan, unless that person is a lawful guarantor who separately and expressly consented. I am preserving all messages, call logs, and screenshots for submission to the proper regulators.

Send the complaint to every official channel you can document: in-app helpdesk, official email, website contact form, and registered business address if available.

Common Mistakes That Make the Problem Worse

Paying “Just to Stop the Calls”

Many people pay because they are embarrassed or afraid. But if you truly did not authorize the loan, payment may create confusion later. The lender may argue that your payment shows acknowledgment or ratification. At minimum, it weakens the clarity of your position.

If money was deposited into your account without your consent, the safer approach is to report it in writing, avoid using it, and request an official reversal or documented return process.

Deleting the App Too Early

Deleting the app may remove access to loan details, transaction IDs, chat support, and notices. Capture evidence first. After preserving the evidence, you can secure the device and revoke permissions.

Arguing With Collectors by Phone

Collectors may pressure you into saying things you do not mean. Keep communications in writing. If you receive a call, ask for the caller’s name, company, authority to collect, and email address. Then say the debt is disputed and request written communication.

Giving New OTPs, IDs, or Selfies

A real investigator does not need your OTP. Never give OTPs, passwords, remote access, or live selfies to anyone claiming they will “verify” or “delete” the loan. Send documents only through official channels after confirming the company identity.

Ignoring Messages Sent to Your Contacts

If the app or collector messages your contacts, ask those people to send you screenshots showing the number, message, date, and time. Do not just tell them to delete the message. Those screenshots may support an SEC or NPC complaint.

Filing Only a Police Report

A police or cybercrime complaint may be necessary, especially for identity theft or hacking, but it does not automatically fix the lending app record, stop collection, or correct credit reporting. You may still need to file with the lender, SEC, NPC, BSP, or CIC depending on the issue.

What If the App Says You Consented Through OTP?

An OTP is evidence, but it is not always conclusive. Ask for the full context:

• What number received the OTP?
• What device submitted the OTP?
• What IP address was used?
• Was the device previously linked to your account?
• Was there a recent password reset?
• Was there a SIM replacement or loss of signal?
• Was the OTP entered after a phishing message?
• Was the loan accepted through clear and separate consent, or through a confusing interface?

For lending apps, consent should be specific, informed, and connected to the actual transaction. A prior account registration does not automatically mean every future loan is authorized.

What If the Loan Proceeds Were Sent to Your Bank or E-Wallet?

If the money entered your account, act quickly and carefully.

Do not withdraw, transfer, spend, or gamble with the funds. Report the transaction to the lender and to the bank or e-wallet provider. Ask them to place the amount on hold or provide an official return process.

If the transaction involves a bank, e-wallet, payment provider, or other financial account, it may also fall under banking, electronic money, consumer protection, or financial account scam rules. RA 12010 recognizes temporary holding of disputed funds in certain cases and requires covered institutions to maintain security measures such as fraud monitoring and multi-factor authentication. (Lawphil)

Your written report should say:

• You did not request the loan.
• You are not using the funds.
• You are requesting investigation and documented reversal.
• You want the account protected from further unauthorized transactions.

What If Collectors Threaten Barangay, Police, Employer, or Social Media Exposure?

Preserve the threat. Do not panic.

Collectors often use words like “legal action,” “field visit,” “barangay report,” “police report,” or “posting” to scare people into paying. Some legal remedies may exist for real debts, but collectors cannot use false threats, insults, public shaming, unauthorized disclosure, or contact-list harassment to collect.

Under SEC rules, unfair collection practices include threats, insults, false representations, disclosure of borrower information, and contacting persons other than guarantors or co-makers.

If they message your employer or coworkers, save:

• The exact message.
• Sender number or account.
• Date and time.
• Name of the person who received it.
• Any screenshot showing your name, photo, loan amount, or accusation.

This evidence can support both an SEC complaint and a data privacy complaint.

If the Lender Actually Files a Case

Most collection threats never become court cases, but do not ignore real court documents.

If you receive an actual summons, subpoena, or court notice, check:

• The name of the court.
• Case number.
• Names of parties.
• Deadline to respond.
• Whether the document was served officially.
• Whether the claim is for a civil debt, fraud allegation, or something else.

Small claims procedures in the Philippines cover certain money claims, including loans and credit accommodations, and the Supreme Court has recognized a small claims threshold of up to ₱1,000,000 under the Rules on Expedited Procedures. (Supreme Court of the Philippines)

Your defense should be evidence-based:

• No consent to the loan.
• No receipt or benefit from the proceeds.
• Account takeover or identity theft.
• Prior written dispute.
• Failure of the lender to produce reliable digital records.
• Abusive or unlawful collection conduct, if relevant.

The important distinction is this: a collector does not decide whether you owe the money; a proper court or regulator evaluates the evidence.

Frequently Asked Questions

Should I pay an unauthorized lending app loan?

If you did not apply for or authorize the loan, do not immediately pay just to stop harassment. First, formally dispute the loan in writing, preserve evidence, ask for proof of consent and disbursement, and request suspension of collection and credit reporting. If funds were deposited into your account, do not spend them; report the transaction and ask for an official reversal process.

Can a lending app contact my phone contacts?

Online lending platforms should not contact people in your contact list except legitimate guarantors who separately consented. The 2026 DICT-NPC-SEC advisory specifically warns against excessive contact-list processing and improper contacting of third persons, and SEC rules also prohibit unfair collection practices involving third parties.

Can I be arrested for not paying a lending app loan?

A disputed app loan is usually a civil collection issue, not something a collector can turn into an arrest by sending threats. However, separate criminal issues may exist if there was actual fraud, identity theft, hacking, falsification, or misuse of financial accounts. If the loan is unauthorized, your focus should be to document that you are the victim or disputed account holder, not the borrower who intentionally refused to pay.

What if I previously borrowed from the same app?

A previous loan does not automatically prove that a later loan was authorized. Each loan transaction should have its own consent, terms, amount, release date, and disbursement record. In your dispute, be specific: you may acknowledge prior legitimate transactions while clearly denying the specific unauthorized loan.

What if the app says my ID and selfie were used?

Ask for copies of the KYC records, timestamps, device information, IP logs, and the method used to capture or upload the ID and selfie. If your ID was used without permission, report possible identity theft and data misuse. If the selfie appears edited, old, AI-generated, or taken from another source, mention that clearly in your complaint.

Can an unauthorized loan affect my credit record?

Yes, if the lender reports it as unpaid. Under RA 9510, borrowers have the right to access and dispute erroneous, incomplete, outdated, or misleading credit information. If the loan appears in your credit report, file a dispute and attach proof that the loan was unauthorized or already formally disputed. (Supreme Court E-Library)

Where should I complain first: SEC, NPC, BSP, or police?

Start with the lender’s written dispute because you need a record that the account is contested. Then file with the agency that matches the issue. Use SEC for lending companies, financing companies, online lending apps, and unfair collection. Use NPC for personal data misuse and contact-list harassment. Use BSP if a bank, e-wallet, or BSP-supervised financial institution is involved. Use PNP-ACG or NBI Cybercrime for hacking, identity theft, extortion, or threats.

What if I am an OFW or foreigner outside the Philippines?

You can still preserve digital evidence, email the lender, and file complaints through official online channels where available. Use your passport, Philippine ID if any, ACR I-Card if applicable, overseas phone records, travel records, and bank or e-wallet statements. If a sworn statement is required, check whether the receiving office needs consular notarization, apostille, or another form of authentication.

How long does it take to resolve an unauthorized lending app loan?

Timelines vary. Some lenders respond within days, while SEC, NPC, BSP, police, or credit-report disputes can take weeks or longer depending on evidence and workload. BSP’s complaint channel provides a case reference for complaints submitted through its system, while RA 9510 provides a verification process for disputed credit information. (Bureau of Small and Medium Enterprises)

Key Takeaways

• An unauthorized lending app loan should be treated as a formal disputed debt, not an ordinary overdue loan.
• Under Philippine contract law, a valid loan requires consent; the lender should be able to prove that you authorized the transaction.
• Preserve screenshots, messages, call logs, loan IDs, app permissions, disbursement records, and complaint tickets before deleting anything.
• Send a written dispute asking the lender to suspend collection, penalties, interest, and credit reporting while investigating.
• Do not pay casually, admit the debt, give OTPs, or spend loan proceeds deposited without your consent.
• Report lending app abuse and unfair collection to the SEC, data misuse to the NPC, bank or e-wallet issues to the provider and BSP, credit-report errors to the CIC, and cybercrime or identity theft to PNP-ACG or NBI Cybercrime.
• Contact-list harassment, public shaming, false threats, and disclosure of borrower information may violate SEC rules and data privacy principles.
• If real court papers arrive, respond based on evidence: no consent, no benefit, prior dispute, identity theft, account takeover, or lack of reliable proof from the lender.

How to File an SEC Complaint Against a Lending App for Public Shaming

When a lending app posts your name, photo, debt details, or insults in a group chat, messages your contacts to shame you, or threatens to tell your employer or barangay that you are a “scammer,” the issue is no longer just unpaid debt. In the Philippines, these acts may violate SEC rules on unfair debt collection, data privacy laws, and even criminal laws on threats or defamation. This guide explains how to file an SEC complaint against a lending app for public shaming, what evidence to prepare, where to submit it, and when to also go to the National Privacy Commission, PNP Anti-Cybercrime Group, NBI Cybercrime Division, or prosecutor’s office.

What Public Shaming by a Lending App Means

Public shaming happens when a lending app, collector, agent, or collection agency uses humiliation as a collection tool. Common examples include:

• Sending your name, photo, address, ID, loan amount, or alleged balance to your phone contacts
• Posting “wanted,” “estafa,” “scammer,” “magnanakaw,” or similar accusations in group chats or social media
• Calling or messaging your employer, co-workers, relatives, neighbors, or barangay officials even if they are not your guarantors or co-makers
• Threatening to publish your photo or personal details if you do not pay immediately
• Telling third parties that you refused to pay, even when the amount, charges, or due date is disputed
• Using obscene, insulting, or degrading language in texts, calls, emails, Facebook Messenger, Viber, Telegram, or WhatsApp

The Securities and Exchange Commission regulates lending companies under Republic Act No. 9474, the Lending Company Regulation Act of 2007, which declares a State policy to regulate lending companies, prevent practices prejudicial to public interest, and set minimum standards for their operations. A lending company is generally a corporation engaged in granting loans from its own capital funds or from funds sourced from not more than 19 persons. (Supreme Court E-Library)

If the business is a financing company instead of a lending company, Republic Act No. 8556, the Financing Company Act of 1998, is relevant. That law also recognizes the public-interest need to regulate financing and leasing companies and prevent practices prejudicial to the public. (Lawphil)

Why Public Shaming Can Be an SEC Violation

The main SEC rule is SEC Memorandum Circular No. 18, Series of 2019, titled Prohibition on Unfair Debt Collection Practices of Financing Companies and Lending Companies. It applies to financing companies, lending companies, and third-party service providers hired by them. The circular was issued because the SEC had received numerous complaints that some lenders were harassing borrowers and using abusive, unethical, and unfair collection methods.

Under SEC MC 18, collectors may use reasonable and legally permissible means to collect, but they must observe good faith, reasonable conduct, and must refrain from unscrupulous or untoward acts. The circular specifically treats the following as unfair collection practices:

Conduct by lending app or collector	Why it matters
Threatening violence or other criminal means	Covers threats to harm a person, reputation, or property
Threatening actions that cannot legally be taken	Covers fake threats of arrest, imprisonment, NBI “blacklisting,” or immediate criminal case for ordinary nonpayment
Using obscenities, insults, or profane language	Covers abusive collection texts and calls
Publishing names or personal information of borrowers who allegedly refuse to pay	Directly covers public shaming and debt-shaming posts
Communicating false loan information to third persons	Covers telling relatives or employers false or disputed debt details
Using deception to collect or obtain borrower information	Covers pretending to be from court, police, NBI, barangay, or government
Contacting at unreasonable hours	Generally before 6:00 a.m. or after 10:00 p.m., subject to stated exceptions
Contacting phone contacts other than named guarantors or co-makers	Important for lending apps that scrape or misuse contact lists

SEC MC 18 also states that, even if a borrower gave consent, contacting persons in the borrower’s contact list other than those named as guarantors or co-makers is an unfair debt collection practice.

This is why “but you allowed phone permissions” is not a complete defense for a lending app. App permission does not automatically allow public shaming, harassment, disclosure of debt to unrelated contacts, or misuse of personal data.

Public Shaming Can Also Involve Data Privacy and Criminal Issues

An SEC complaint focuses on the lending or financing company’s regulatory violation. But the same incident may also fall under other laws.

Data Privacy Act

Republic Act No. 10173, the Data Privacy Act of 2012, protects personal information in government and private-sector information systems. It defines personal information as information from which an individual’s identity is apparent or can reasonably be ascertained, and it gives data subjects rights such as access, correction, blocking, removal, destruction, and indemnity for damages caused by unauthorized use of personal information. (National Privacy Commission)

Publicly posting your name, photo, ID, contact list, loan details, workplace, or address may involve unauthorized processing, malicious disclosure, unauthorized disclosure, or processing for unauthorized purposes, depending on the facts.

Cybercrime and online defamation

Republic Act No. 10175, the Cybercrime Prevention Act of 2012, covers misuse, abuse, illegal access, and certain online offenses involving computer systems and data. (Supreme Court E-Library) If the lending app or collector posts defamatory statements online, cyberlibel may be considered together with the Revised Penal Code provisions on libel.

Under Article 353 of the Revised Penal Code, libel involves a public and malicious imputation of a crime, vice, defect, act, omission, condition, status, or circumstance that tends to cause dishonor, discredit, or contempt. Article 355 punishes libel committed through writing or similar means, while Article 358 covers oral defamation or slander. (Lawphil)

Threats, coercion, and unjust vexation

If the collector threatens harm to your person, honor, property, or family, Article 282 of the Revised Penal Code on grave threats may become relevant. If the conduct involves intimidation, forcing you to do something against your will, or persistent harassment, Articles 286 and 287 on coercions and unjust vexations may also be considered. (Lawphil)

Where to File an SEC Complaint Against a Lending App

The current SEC-wide public platform is iMessage, the SEC’s official web-based ticketing system for public inquiries, complaints, incidents, and requests. The SEC user guide describes iMessage as a centralized platform that replaces informal channels like email and Google Forms, generates an electronic ticket for every submission, and lets users track ticket status in real time. (Securities and Exchange Commission)

For lending app harassment, choose the service for Complaints on Financing and Lending Companies under the SEC Financing and Lending Companies Department. The SEC iMessage user guide lists this complaint service under the department’s Monitoring and Compliance Division. (Securities and Exchange Commission)

The SEC has also historically instructed complainants to use its complaint form, attach supporting evidence, attach a valid government-issued ID, show proof that remedies with the company were first exhausted, and submit one complaint form per respondent company. (www.foi.gov.ph)

Step-by-Step Guide to Filing the SEC Complaint

1. Identify the actual company behind the app

Many borrowers know only the app name, such as the name shown in Google Play, Apple App Store, text messages, or loan reminders. For the SEC complaint, try to identify:

• App name
• Registered corporate name
• SEC registration number, if shown
• Certificate of Authority number, if shown
• Website, app store link, Facebook page, or customer service email
• Collection agency name, if a separate collector contacted you
• Names, aliases, phone numbers, email addresses, or social media accounts used by collectors

If the app refuses to disclose the registered company, say so in your complaint and attach screenshots showing the app profile, loan page, privacy policy, messages, and payment instructions.

2. Preserve evidence before it disappears

Take screenshots immediately. Some lending apps, collectors, or Telegram accounts delete messages after the borrower complains.

Your evidence should show:

• Date and time
• Sender’s phone number, username, email address, or account name
• Full message thread, not just one cropped message
• Public posts, group chat messages, or messages sent to your contacts
• The exact defamatory or humiliating words used
• Your photo, ID, name, workplace, address, or loan details if disclosed
• Proof that the recipient was not your guarantor or co-maker
• Call logs showing repeated calls or calls outside reasonable hours
• App permission screenshots, if the app accessed contacts, photos, or files
• Loan agreement, disclosure statement, repayment schedule, receipts, and proof of payments

For videos or disappearing messages, screen-record when lawful and safe. Save copies in cloud storage and on another device. Rename files clearly, such as 2026-07-05_collector_text_public_shaming.png.

3. Contact the lending company first, unless there is immediate danger

SEC complaint forms have required proof that the complainant tried to exhaust remedies with the company before filing. In practice, this can be a short email or message to the company’s official customer service channel saying:

• You dispute or complain about the public shaming and third-party contact
• You demand that they stop contacting non-guarantor contacts
• You ask them to preserve records of the collector, account, and messages
• You request a written explanation or resolution

If the company does not respond, blocks you, continues the harassment, or gives an unfavorable response, attach that proof to your SEC complaint. A prior FOI response from the SEC explained that borrowers are generally expected to first try resolving the loan issue with the company because the loan agreement is between borrower and lender, but after an unfavorable response or no response, they may file a formal complaint with the SEC. (www.foi.gov.ph)

If there are threats of violence, blackmail, publication of intimate images, identity theft, or imminent harm, file with the relevant enforcement agency immediately and explain in the SEC complaint why prior company resolution was unsafe or impractical.

4. Prepare one complaint per lending or financing company

If three different apps harassed you and they are operated by three different companies, prepare separate complaint packets. If several app names belong to the same company, list all app names in one complaint but make the relationship clear.

Your complaint narrative should be chronological:

1. Date you downloaded or used the app
2. Amount borrowed and amount actually received
3. Due date and amount demanded
4. Whether you disputed charges, fees, or collection conduct
5. Exact public shaming incident
6. Who received the messages or saw the posts
7. Why those people were not guarantors or co-makers
8. Harm caused, such as workplace embarrassment, family conflict, anxiety, reputational damage, or business loss
9. What you asked the company to do
10. Whether the company ignored, continued, or escalated the harassment

5. File through SEC iMessage

Go to the SEC iMessage portal, open a new ticket, sign in with or register for eSECURE if required, choose the correct service, complete the form, upload your complaint and evidence, then create the ticket. The SEC user guide states that users choose a service, fill out the form, create the ticket, and the system assigns the ticket to the responsible department. (Securities and Exchange Commission)

For the subject or description, use a clear format such as:

JUAN DELA CRUZ_ABC LENDING APP_PUBLIC SHAMING AND CONTACTING NON-GUARANTOR CONTACTS

Avoid emotional labels alone, such as “scammer app” or “illegal app,” without facts. SEC evaluators need facts, dates, screenshots, documents, and the specific rule violated.

6. Track the ticket and respond to compliance requests

After submission, monitor the ticket status. The iMessage guide states that open tickets are being processed, while closed tickets may require user action, such as compliance, payment, or resolution. Users may also post replies and upload files in the ticket conversation thread. (Securities and Exchange Commission)

Common SEC follow-up requests include:

• Clearer screenshots
• Complete loan agreement or disclosure statement
• Valid ID
• Proof you contacted the company first
• Correct respondent company name
• Separate complaint form for each company
• More details on dates, phone numbers, or persons contacted

Respond within the period given in the ticket. If you need more time to gather evidence, say so in the ticket and submit what you already have.

Documents and Evidence Checklist

Requirement	Practical notes
Complaint form or written complaint	State facts in chronological order
Valid government-issued ID	Passport, driver’s license, UMID, PhilSys ID, PRC ID, voter’s ID, or similar
Loan agreement or app screenshots	Include disclosure statement, repayment schedule, amount received, charges, and due date
Screenshots of harassment	Show sender, date, time, full message, and recipient if possible
Proof of public shaming	Group chat screenshots, social media posts, messages to relatives, employer, or contacts
Proof recipients were not guarantors/co-makers	Short statements from contacts may help
Proof of prior complaint to company	Email, app ticket, chat, SMS, or screenshot of failed attempt
Payment proof	Receipts, GCash/Maya/bank transfer records, reference numbers
App details	App store page, developer name, privacy policy, website, customer service details
Optional affidavit	Useful if filing parallel NPC, police, NBI, or prosecutor complaint

What the SEC Can Do

The SEC process is administrative and regulatory. It can evaluate whether a lending or financing company violated SEC rules, require explanations or compliance, and impose sanctions when warranted.

Under SEC MC 18, penalties for violations include fines of ₱25,000 for a lending company’s first offense and ₱50,000 for the second offense; for financing companies, ₱50,000 for the first offense and ₱100,000 for the second offense. For a third offense, depending on the facts and gravity, the SEC may impose a fine up to ₱1,000,000, suspension of lending or financing activities for 60 days, or revocation of the Certificate of Authority.

An SEC complaint usually does not automatically erase the debt, award moral damages, or send collectors to jail. Those are different remedies. If the loan is valid, the lender may still pursue lawful collection. What the lender cannot do is collect through public shaming, harassment, false threats, or unlawful disclosure of personal information.

When to File With Other Agencies Too

Situation	Agency or office to consider	Why
Lending app or financing company harassment	SEC	Regulates lending and financing companies and online lending apps
Misuse of contacts, photos, ID, personal data	National Privacy Commission	Handles Data Privacy Act complaints
Hacking, identity theft, threats online, cyberlibel	PNP Anti-Cybercrime Group or NBI Cybercrime Division	Cybercrime investigation
Serious threats, extortion, coercion, defamation	Prosecutor’s office, PNP, or NBI	Criminal complaint route
Bank, credit card, EMI, or BSP-supervised entity	Bangko Sentral ng Pilipinas	Consumer protection for BSP-regulated institutions
Credit report or credit bureau issue	Credit Information Corporation	Credit information concerns

The Credit Information Corporation’s consumer guidance directs harassment by lending and financing companies, online lending apps, and microfinance institutions to the SEC, and data privacy violations to agencies such as the NPC, PNP Anti-Cybercrime Group, NBI Cybercrime Division, and DOJ Office of Cybercrime. (Credit Information Corporation (CIC))

For NPC complaints, the NPC requires a specific complaint format. Its complaint mechanics refer to a filled-out and notarized complaint-assisted form or verified complaint, together with evidence and witness affidavits, submitted personally, by registered mail, courier, or authorized electronic mail. (National Privacy Commission)

Practical Timelines and Bottlenecks

Stage	Usual practical timing	Common bottleneck
Evidence gathering	Same day to 1 week	Deleted messages, disappearing chats, blocked accounts
Prior complaint to company	1 to 10 business days	Company ignores or uses only in-app support
SEC ticket filing	Same day once documents are ready	Wrong service category or incomplete attachments
SEC initial review	Several days to several weeks	Heavy complaint volume or unclear respondent details
SEC follow-up/compliance	Depends on ticket instructions	Missing ID, missing loan agreement, no proof of company contact
Parallel NPC or cybercrime filing	Same day to several weeks	Notarization, affidavits, device evidence, witness cooperation

A well-organized complaint is usually faster to evaluate than a long emotional message with scattered screenshots. Put your evidence in order and label it.

Special Notes for OFWs, Foreigners, and Borrowers Abroad

Filipinos abroad and foreigners dealing with a Philippine lending app can still file if the respondent is a Philippine SEC-regulated lending or financing company, or if the personal data processing has a sufficient Philippine link. The Data Privacy Act can apply to acts done outside the Philippines when the processing relates to a Philippine citizen or resident, or when the entity has links with the Philippines, such as carrying on business in the country or collecting or holding personal information in the Philippines. (National Privacy Commission)

Practical points:

• Use a passport or foreign government ID if you do not have a Philippine ID.
• Provide a Philippine mailing address if the SEC form or process asks where orders or letters may be sent.
• If you are abroad and someone in the Philippines will file or appear for you, prepare a Special Power of Attorney.
• If an affidavit or SPA is executed abroad, it may need consular notarization or apostille depending on where it will be used and what the receiving office requires.
• Screenshots from your own phone usually do not need apostille, but sworn statements executed abroad may require authentication if used in formal proceedings.

Common Mistakes That Weaken SEC Complaints

Filing only a rant without evidence

A complaint saying “they harassed me” is weaker than one showing exact messages, dates, phone numbers, group chats, and proof that the recipients were not guarantors.

Naming only the app, not the company

SEC regulates companies. Always try to identify the operator behind the app. If unknown, explain what steps you took to identify it and attach app store screenshots.

Combining many unrelated apps in one complaint

If different companies are involved, separate the complaints. This avoids confusion and prevents delay.

Deleting the app too soon

Before deleting, capture loan details, terms, transaction history, customer service information, permissions, and messages inside the app.

Ignoring proof of prior company contact

Because the SEC may ask for proof that you first tried to resolve the matter with the company, keep your email, app ticket, SMS, or chat complaint.

Admitting false facts out of fear

Do not write that you committed estafa, fraud, or “refused to pay” if that is not true. State the facts neutrally: amount borrowed, amount received, amount demanded, amount disputed, payments made, and harassment experienced.

Sample SEC Complaint Narrative

Use plain, factual language:

I am filing this complaint against [company/app name] for unfair debt collection practices, specifically public shaming, disclosure of my loan information to third persons, and contacting persons who are not my guarantors or co-makers. On [date], I borrowed ₱____ through the app and received ₱. On [date], I received messages from [number/name] demanding payment of ₱. On [date/time], the collector sent messages to my [relative/employer/contact] stating “[exact words].” This person is not my guarantor or co-maker. The collector also sent my photo/name/address/loan details in [group chat/social media/SMS]. I attach screenshots marked Annexes A to __. I contacted the company on [date] through [email/app/SMS] and requested that they stop contacting third parties and address my complaint, but [no response/harassment continued/response attached]. I request SEC action for violation of SEC MC 18, Series of 2019 and other applicable rules.

Frequently Asked Questions

Can I file an SEC complaint if I really owe money?

Yes. A valid debt does not give a lending app the right to shame you publicly, contact unrelated third parties, threaten illegal action, or misuse your personal data. The SEC complaint is about unlawful collection conduct, not simply whether you borrowed money.

Can a lending app message my contacts if I allowed contact permissions?

Not automatically. Under SEC MC 18, contacting persons in the borrower’s contact list other than those named as guarantors or co-makers is an unfair debt collection practice, even if the borrower supposedly gave consent.

What if the collector says they will file estafa if I do not pay today?

Ordinary nonpayment of debt is usually a civil matter. Estafa requires specific criminal elements, such as deceit or abuse of confidence, not merely inability to pay. A fake or automatic threat of criminal prosecution may support your complaint, especially if used to scare you into immediate payment.

Can the SEC remove the public shaming post?

The SEC can act against regulated lending or financing companies, but takedown of online content may require platform reporting, NPC action for privacy violations, or cybercrime assistance depending on the facts. Preserve evidence before reporting the post for removal.

Should I file with the SEC or NPC?

File with the SEC for unfair debt collection by a lending or financing company. File with the NPC when the issue involves misuse, unauthorized disclosure, or unlawful processing of personal data. Many public-shaming cases involve both.

Do I need a lawyer to file an SEC complaint?

The SEC complaint process is designed so ordinary borrowers can file using the complaint form or iMessage ticket. What matters most is complete information, clear facts, and organized evidence.

Is there a filing fee for an SEC lending app complaint?

For ordinary complaint filing through the SEC’s public complaint process, borrowers typically focus on submitting the complaint form and attachments rather than paying a filing fee. If the SEC later requires a specific payment, compliance item, or additional process, follow the instructions in the ticket.

What if the lending app is not registered with the SEC?

Still report it. State that you could not find the app or company in SEC records and attach the app store page, messages, payment accounts, and company names used. Operating as a lending or financing company without authority may create separate regulatory issues.

Can I sue for damages because my employer or relatives were contacted?

Possibly, depending on the evidence and harm. Civil Code principles on human relations, privacy, dignity, and abuse of rights may be relevant, and defamation or data privacy remedies may also apply. The SEC complaint itself is mainly regulatory; damages usually require a separate court, NPC, or criminal/civil process depending on the claim.

What should I do if the collector threatens to visit my house or barangay?

A lawful collector may communicate through legal means, but threats, intimidation, fake police or court claims, public humiliation, or barangay shaming should be documented. If there is a threat to safety, report to local law enforcement and preserve the messages for SEC, NPC, or cybercrime filing.

Key Takeaways

• Public shaming by a lending app can violate SEC MC 18, especially when the app publishes your name, photo, loan details, or contacts people who are not guarantors or co-makers.
• File the SEC complaint against the company behind the app, not only the app name.
• Use SEC iMessage and choose the complaint service for financing and lending companies.
• Attach screenshots, loan documents, ID, proof of payment, proof of prior complaint to the company, and evidence showing third-party disclosure.
• File separate complaints for separate lending or financing companies.
• SEC action is regulatory; data privacy, cybercrime, threats, defamation, and damages may require parallel action with the NPC, PNP, NBI, prosecutor’s office, or court.
• A real debt does not authorize harassment, public shaming, false threats, or misuse of personal information.

What to Do If a Fully Paid Online Loan Still Leads to Harassment

If you already paid your online loan in full but the app, collector, or “legal department” still keeps calling, texting, threatening to post you online, or contacting your relatives and workmates, treat the problem as two separate issues: first, prove that the loan is fully paid or properly disputed; second, document and report the harassment. In the Philippines, a lending company may collect a legitimate unpaid debt, but it cannot use threats, public shaming, abusive language, false claims, or your contact list as collection weapons. Those acts can trigger action by the SEC, the National Privacy Commission, and, in serious cases, law enforcement.

Why harassment can still happen after full payment

A fully paid online loan can still lead to harassment because of poor recordkeeping, delayed posting of payment, third-party collection agencies using outdated account lists, unauthorized “extension fees,” or outright abusive collection tactics.

Common real-life causes include:

• The app did not properly match your GCash, Maya, bank, or payment-center reference number to your loan account.
• The collector is working from an old spreadsheet and was not updated that the account was already paid.
• The app claims there are “late fees,” “processing fees,” or “rollover fees” that were not clearly explained.
• The loan was sold or assigned to a third-party collector that continues to demand payment.
• The online lending platform is unrecorded, unregistered, or operating through shifting app names.
• The borrower paid through an unofficial channel or personal account and now needs to prove where the money went.
• The collector is deliberately pressuring the borrower to pay again just to stop the embarrassment.

The important point is this: even if there were a genuine dispute over a remaining balance, the collector still cannot shame you, threaten violence, reveal your debt to random contacts, or misrepresent legal consequences.

Your key rights under Philippine law

The SEC bans unfair debt collection by lending and financing companies

The Securities and Exchange Commission regulates lending companies under Republic Act No. 9474, or the Lending Company Regulation Act of 2007, and financing companies under Republic Act No. 8556, or the Financing Company Act of 1998. SEC Memorandum Circular No. 18, series of 2019 applies to financing companies, lending companies, and third-party service providers hired by them for collection. It expressly recognizes that collectors may use only reasonable and legally permissible collection methods, and they must act in good faith and with reasonable conduct.

Under SEC Memorandum Circular No. 18, the following are unfair collection practices:

• Threatening or using violence or other criminal means to harm a person, reputation, or property.
• Threatening to take action that cannot legally be taken.
• Using obscenities, insults, or profane language that tends to abuse the borrower or amounts to a criminal offense.
• Publishing or disclosing the names and personal information of borrowers who allegedly refuse to pay, except in limited lawful situations.
• Telling other people about loan information that is false, or failing to say that the debt is disputed when that is known.
• Using false representations or deceptive means to collect a debt or obtain borrower information.
• Contacting the borrower at unreasonable or inconvenient times, subject to the specific rules in the circular.
• Contacting people in the borrower’s contact list other than those named as guarantors or co-makers.

This matters especially when the loan is already paid. If the collector knows or should know that the debt is paid or disputed, continuing to tell third parties that you are a delinquent borrower may create a stronger case for unfair collection, privacy violation, and possible civil or criminal liability.

Contacting your phone contacts is not normal collection

Many online lending harassment cases involve collectors messaging the borrower’s relatives, co-workers, Facebook friends, or phone contacts. In 2026, the DICT, National Privacy Commission, and SEC issued a public advisory on online lending platforms reminding the public that unnecessary app permissions, excessive access to contact lists, and contacting persons other than guarantors for debt collection are prohibited. The advisory states that online lending platforms may only contact the guarantor for collection purposes, and that access to contacts must be limited to legitimate, proportionate purposes such as selecting references or guarantors.

A “character reference” is not automatically a guarantor. A guarantor is someone who separately and expressly agreed to answer for the loan if the borrower defaults. If your app simply asked you to select names from your contacts, that does not mean those people became liable for your debt.

Data privacy law protects your personal information

Republic Act No. 10173, or the Data Privacy Act of 2012, protects personal information processed by private companies, including online lending platforms. For loan apps, the usual privacy problems include excessive access to contacts, use of borrower photos, disclosure of loan information to third parties, public shaming, and continued processing of personal data even after the loan purpose has already ended. (Lawphil)

A lending app may process personal data needed for identity verification, fraud prevention, loan assessment, collection through lawful means, and legal claims. But it should not use your contact list as a pressure tool, expose your debt to people who are not liable, or retain and reuse your data longer than necessary.

The Truth in Lending Act supports your right to a clear breakdown

Republic Act No. 3765, or the Truth in Lending Act, requires disclosure of finance charges and the true cost of credit. This is important when an app says you are “not fully paid” because of unclear charges, penalties, service fees, or “extension” charges that were not properly disclosed. (Lawphil)

A borrower facing post-payment collection should ask for a written statement of account showing:

• principal amount released;
• finance charges and interest;
• penalties or late charges;
• all payments received;
• payment reference numbers;
• remaining balance, if any;
• basis for any remaining charge.

If they cannot give a clear breakdown and instead rely on threats or public humiliation, that weakens their position.

Harassment may also become a criminal or civil issue

Depending on the messages, posts, and calls, the conduct may involve provisions of the Revised Penal Code, Republic Act No. 10175 or the Cybercrime Prevention Act of 2012, and the Civil Code.

Possible legal issues include:

Conduct	Possible legal angle
“We will hurt you,” “we will go to your house,” or threats to harm family	Grave threats or other threats under the Revised Penal Code, depending on wording and circumstances
Forcing payment through intimidation or illegal pressure	Possible coercion or unjust vexation
Posting that you are a scammer, criminal, or debtor on Facebook or group chats	Libel, cyber libel, oral defamation, or civil damages, depending on the medium and facts
Sending abusive, obscene, repeated messages	Unjust vexation or other applicable offenses
Publicly exposing your loan, ID, photos, or contact details	Data Privacy Act issue, Civil Code privacy issue, and possibly cybercrime-related complaint
Disturbing your private life and peace of mind	Civil Code Article 26 on dignity, privacy, and peace of mind

Civil Code Article 26 states that every person must respect the dignity, personality, privacy, and peace of mind of others, and that certain acts may give rise to damages, prevention, and other relief even if they do not constitute a criminal offense. (Lawphil)

What to do immediately if the loan is fully paid but harassment continues

1. Preserve evidence before confronting the collector

Do not rely on memory. These cases often depend on screenshots, payment records, phone logs, and proof that your contacts were messaged.

Save the following:

• loan agreement, disclosure statement, or screenshots of the loan terms;
• app screenshots showing loan ID, amount, due date, and account status;
• payment receipts from GCash, Maya, bank transfer, 7-Eleven, Cebuana, M Lhuillier, or payment gateway;
• transaction reference numbers;
• emails or in-app confirmations;
• screenshots of abusive texts, Viber, Messenger, WhatsApp, Telegram, SMS, or email messages;
• call logs showing repeated calls and the time of calls;
• screen recordings of voice messages or threats;
• screenshots of posts, comments, tags, or group chats;
• messages sent to your relatives, employer, co-workers, or friends;
• names, phone numbers, usernames, and email addresses of collectors;
• the app name, company name, website, and app store link.

For screenshots, capture the full screen showing date, time, sender, and platform. Avoid cropping out phone numbers or usernames. If a relative or co-worker received the message, ask them to forward the original message and take their own screenshot.

2. Make a clean payment timeline

Create a simple timeline. This helps agencies quickly understand that the harassment continued after payment.

Example:

Date	Event	Proof
May 3	Loan released	App screenshot, loan agreement
May 10	Paid ₱5,000 through GCash	GCash receipt, reference number
May 10	App still showed unpaid	Screenshot
May 11	Collector texted threats	SMS screenshot
May 12	Collector messaged borrower’s sister	Messenger screenshot from sister
May 13	Borrower emailed proof of payment	Sent email screenshot
May 14	Harassment continued	Call log and messages

This timeline is more effective than a long emotional narrative. Keep it factual.

3. Send a written dispute and demand for correction

Send the lender a short written notice through official channels: in-app support, official email, website contact form, or registered mail if you can identify the office address.

Use calm, precise wording:

I am disputing further collection because this loan was fully paid on [date] through [payment channel], reference number [number]. Attached are proof of payment and screenshots. Please update my account to fully paid, stop all collection activity, instruct your third-party collectors to stop contacting me and my contacts, and issue a written statement of account or clearance within a reasonable period.

Do not insult the collector. Do not threaten them back. Do not make new admissions such as “I will pay again later” unless you truly agree there is a remaining balance.

4. Do not pay a second time just to stop the embarrassment

Many borrowers pay again because collectors threaten to contact the employer or family. Before paying anything more, require:

• written statement of account;
• legal name of the lending or financing company;
• official payment channel;
• explanation of each charge;
• confirmation that payment will close the account;
• receipt under the company’s name, not a personal wallet or personal bank account.

A demand to send money to a personal GCash or personal bank account is a red flag. If you pay through an unofficial channel, you may have difficulty proving that the company actually received it.

5. Revoke unnecessary app permissions

On your phone, check the app’s permissions. Revoke access to contacts, photos, files, microphone, camera, and location unless still strictly necessary. The 2026 public advisory reminds borrowers to review app permissions and notes that unnecessary permissions and unbridled contact-list processing are prohibited.

For Android and iPhone users, this is usually under:

• Settings
• Apps
• choose the lending app
• Permissions
• remove access that is no longer needed

Deleting the app may stop some access, but preserve evidence first. Take screenshots before uninstalling.

6. Warn your contacts without spreading the issue further

If collectors are messaging your contacts, send a brief neutral notice:

Someone claiming to collect for an online loan may contact you. The account is disputed and has been paid. Please do not engage, do not send money, and please forward any message or screenshot to me for documentation.

Do not accuse named individuals of crimes in public posts unless the facts are verified. Keep your own statements factual to avoid creating a separate defamation issue.

Where to file complaints in the Philippines

SEC: for unfair debt collection by lending or financing companies

File with the SEC when the harassment is connected to a lending company, financing company, or online lending platform. The SEC’s iMessage portal accepts complaints and tickets, and the 2026 public advisory specifically lists SEC FINLEND and the iMessage portal for unfair debt collection practices. (Securities and Exchange Commission)

Include:

• your full name and contact details;
• app name and company name;
• SEC registration number or certificate of authority, if known;
• loan ID or account number;
• amount borrowed and amount paid;
• payment receipts;
• statement that the account is fully paid or disputed;
• screenshots of harassment;
• phone numbers and names used by collectors;
• names of contacts who were messaged;
• requested action, such as stopping collection, correcting the account, and investigating unfair collection practices.

Possible SEC consequences for violations of SEC MC No. 18 include fines. The circular lists penalties starting at ₱25,000 for a lending company’s first offense and ₱50,000 for a financing company’s first offense; later offenses may lead to higher fines, suspension, or revocation of authority, depending on the facts and gravity.

National Privacy Commission: for misuse of personal data

File with the National Privacy Commission if the app accessed your contact list, disclosed your debt, posted your personal information, used your ID or photos improperly, or continued using your data after the loan was paid.

The NPC requires a formal complaint in a specific format. Its filing page states that the complaint form should be downloaded, printed and filled out, notarized, then submitted to the NPC in person, by courier, or by scanned email. (National Privacy Commission)

Prepare:

• notarized complaint form;
• government ID;
• proof of loan and payment;
• screenshots showing unauthorized contact-list use or disclosure;
• messages sent to third parties;
• app privacy notice or consent screen, if available;
• explanation of how the data use was excessive, unauthorized, or harmful.

If you are abroad, you may need a notarized affidavit or complaint executed before a Philippine consulate, or a locally notarized document with apostille, depending on the receiving office’s requirements and the country where you are located.

PNP Anti-Cybercrime Group or NBI Cybercrime Division: for threats, extortion, fake posts, and cyber harassment

Report to law enforcement if there are threats of violence, extortion, identity misuse, fake social media posts, cyber libel, hacking, or coordinated online harassment. The 2026 advisory lists the NBI Cybercrime Division and PNP Anti-Cybercrime Group as reporting channels for harassment, threats, frauds, and scams linked to online lending platforms.

For serious threats, go to the nearest police station immediately and request that the incident be blottered. For online evidence, avoid deleting the messages. Investigators may need to see the original device, account, URLs, phone numbers, and timestamps.

Court action: for damages, injunction, or defense against a collection case

A borrower may consider a civil action if the harassment caused serious damage, loss of employment, reputational harm, medical distress, or public humiliation. Civil Code Articles 19, 20, 21, and 26 are commonly relevant in abusive conduct and privacy-related claims.

If the lender files a collection case despite full payment, do not ignore the summons. In a small claims or civil collection case, your proof of payment, payment timeline, screenshots, and written dispute become your main defense. Court notices are formal documents from the court, not threats sent by random collectors through text.

Documents to prepare

Purpose	Documents
Prove full payment	Official receipts, payment gateway screenshots, bank or e-wallet transaction history, reference numbers, confirmation email
Prove loan identity	Loan agreement, app screenshots, loan ID, borrower profile, disclosure statement
Prove harassment	SMS, chat screenshots, call logs, recordings where lawful, social media posts, messages sent to contacts
Prove third-party disclosure	Screenshots from relatives, co-workers, employer, group chats, affidavits if needed
File with SEC	Complaint narrative, payment proof, harassment evidence, company/app details
File with NPC	Notarized complaint form, ID, privacy-related evidence, screenshots of contact-list misuse
File with PNP/NBI	Original device, screenshots, URLs, phone numbers, account names, threat messages, payment demands
File or defend in court	All of the above, plus organized timeline and copies for the court and opposing party

Practical timelines and bottlenecks

Step	Typical timing	Common bottleneck
Internal dispute with app	A few days to several weeks	No real customer service, bot replies, collectors not updated
SEC complaint	Acknowledgment may be faster through online ticketing; investigation can take longer	Incomplete company name, weak screenshots, no payment proof
NPC complaint	Depends on completeness and notarization	Missing notarized form or unclear privacy violation
Police/NBI cybercrime report	Initial report may be made quickly; investigation varies	Need original links, account identifiers, and preserved digital evidence
Court case for damages or collection defense	Months or longer	Filing fees, service of summons, need for formal evidence

Common mistakes that make the case harder

Deleting the app before saving proof

Borrowers often uninstall the app out of panic. Before deleting it, save your loan details, account status, payment screen, customer service thread, and privacy permissions.

Paying through unofficial channels

If a collector says “send it to my personal GCash so I can close your account,” be careful. Payment should go to the lender’s official channel. If the lender later denies receipt, the burden becomes harder.

Posting angry accusations online

It is understandable to feel humiliated, but public accusations can create a separate defamation issue. Keep public statements factual or avoid posting while the complaint is pending.

Ignoring formal court papers

A collector’s threat is different from a court summons. But if you receive real court documents, respond within the period stated. Attach proof that the loan was paid.

Filing only one complaint when several rights were violated

A single incident may involve several offices:

• SEC for unfair debt collection;
• NPC for misuse of personal data;
• PNP/NBI for threats, extortion, or cybercrime;
• court for damages or defense against collection.

You do not have to choose only one if the facts support several remedies.

Special notes for OFWs and foreigners

Filipinos abroad and foreigners dealing with Philippine online lenders often face extra difficulty because collectors exploit distance and fear. The evidence process is still similar: preserve proof, send a written dispute, and file with the proper Philippine agency.

For documents executed abroad, check whether the receiving agency requires:

• notarization before a Philippine Embassy or Consulate;
• local notarization plus apostille;
• scanned submission first, with hard copies later;
• special authorization if someone in the Philippines will file for you.

Foreigners should also keep copies of passport pages, local contact details used in the loan, Philippine phone number or e-wallet account records, and any written agreement showing the governing terms of the loan. If the online lending app is Philippine-based or operated by a Philippine lending or financing company, Philippine regulators may still be relevant even if the borrower is outside the Philippines.

Frequently Asked Questions

Can an online loan collector still contact me after I fully paid?

They may send reasonable account confirmation or correction messages, but they should not continue collection demands as if the loan were unpaid. If they claim there is still a balance, ask for a written statement of account and proof of the remaining charge. Harassment, threats, shaming, and contact-list messaging remain prohibited.

What if the app says I still owe late fees?

Ask for a complete written breakdown. Check whether the fees were disclosed before you accepted the loan. If the charges are unclear or were never properly disclosed, raise that in your SEC complaint and attach the Truth in Lending issue to your payment dispute.

Is it legal for collectors to message my contacts?

Generally, no, if those people are merely from your phone contact list and are not guarantors or co-makers. The 2026 DICT-NPC-SEC advisory specifically states that contacting persons in the borrower’s contact list other than guarantors is prohibited for debt collection.

Can they post my face, ID, or name on Facebook?

Public shaming can trigger SEC, NPC, civil, and possibly criminal issues. Save the URL, screenshot the post, identify the account, and report it promptly. If the post contains false statements that damage your reputation, cyber libel or civil damages may become relevant depending on the facts.

Should I file first with the SEC or the NPC?

File with the SEC if the main issue is unfair collection by a lending or financing company. File with the NPC if the main issue is misuse or disclosure of personal data, such as contact-list harassment, posting personal information, or excessive app permissions. Many online lending harassment cases justify filing with both.

What if the online lending app is not registered?

Still document everything and file a report. An unregistered or unrecorded app may raise additional regulatory concerns. The 2026 public advisory applies reminders to entities offering or facilitating loans through online lending platforms, whether recorded or unrecorded.

Can collectors threaten me with imprisonment for unpaid debt?

Mere nonpayment of a loan is generally a civil matter. However, separate acts such as fraud, falsification, or bouncing checks may create different legal issues depending on the facts. A collector should not falsely threaten imprisonment just to force payment, especially when the account is fully paid or legitimately disputed.

What if my employer was contacted?

Save the message received by your employer and document who received it, when it was received, and what was said. This can support an SEC complaint for unfair collection and an NPC complaint for unauthorized disclosure of personal data. If your employment was affected, keep HR communications and written proof of the damage.

Can I get damages for harassment after paying the loan?

Possibly, if you can prove wrongful conduct and actual injury, such as reputational harm, emotional distress, job consequences, or public humiliation. Civil Code Article 26 protects dignity, privacy, and peace of mind, and other Civil Code provisions may apply depending on the facts. (Lawphil)

Does deleting the app stop the harassment?

It may stop some app access, but it does not erase data already copied by the lender or collector. Save evidence first, revoke permissions, then consider uninstalling. Also file complaints if your data was already misused.

Key Takeaways

• A fully paid online loan should not continue to be collected as unpaid.
• Even if a balance is disputed, collectors cannot use threats, insults, public shaming, false claims, or contact-list harassment.
• SEC Memorandum Circular No. 18 protects borrowers from unfair debt collection by lending and financing companies and their third-party collectors.
• The Data Privacy Act protects borrowers from excessive, unauthorized, or harmful use of personal data.
• Save proof before deleting the app or blocking numbers.
• Ask for a written statement of account and account correction.
• File with the SEC for unfair collection, the NPC for privacy violations, and PNP/NBI for threats, extortion, cyber harassment, or fake posts.
• Do not pay again through unofficial channels just to stop harassment.
• If court papers arrive, respond and present proof of full payment.

How to Escalate a Complaint Against an Online Lending App to the SEC

If an online lending app is threatening you, shaming you to your contacts, adding unexplained charges, or ignoring your requests for a proper statement of account, you can escalate the complaint to the Philippine Securities and Exchange Commission (SEC). The key is to file it as a clear, evidence-backed regulatory complaint against the company behind the app, not just as a general rant against “OLA harassment.” The SEC regulates lending companies, financing companies, and their online lending platforms, and it now uses its iMessage ticketing system for public complaints and requests. (Securities and Exchange Commission)

What the SEC Can Do About an Online Lending App Complaint

The SEC is not just a business registration office. For lending apps, it is the main regulator for:

• Lending companies under Republic Act No. 9474, or the Lending Company Regulation Act of 2007
• Financing companies under Republic Act No. 8556, or the Financing Company Act of 1998
• Online lending platforms used by those companies
• Unfair debt collection practices by registered lending or financing companies and their agents

Under RA 9474, a lending company must be a corporation and cannot conduct business unless it has authority to operate from the SEC. The same law gives the SEC power to regulate, require reports, exercise visitorial powers, and impose sanctions such as suspension or revocation of authority and fines. (Supreme Court E-Library)

This matters because many borrowers only know the app name, such as the name appearing on Google Play, the App Store, Facebook ads, SMS, or GCash instructions. But the SEC complaint should identify, as much as possible, the legal entity behind the app: the corporation, its SEC registration number, Certificate of Authority, office address, customer service email, collection agency, or payment account.

Legal Basis: What Online Lending Apps Are Not Allowed to Do

The most important SEC rule for harassment complaints is SEC Memorandum Circular No. 18, Series of 2019, titled Prohibition on Unfair Debt Collection Practices of Financing Companies and Lending Companies. It applies to financing companies, lending companies, and third-party service providers they hire for collection.

Under this circular, lenders may use reasonable and lawful ways to collect a debt, but they must act in good faith and refrain from unscrupulous or untoward acts. The following are examples of prohibited unfair collection practices:

• Threatening violence or other criminal means against a person, reputation, or property
• Threatening legal action that cannot legally be taken
• Using obscenities, insults, or profane language that tends to abuse the borrower
• Publishing or disclosing names and personal information of borrowers who allegedly refuse to pay
• Telling third persons false information, including falsely saying a debt is disputed or falsely implying that the third person is liable
• Using false representation or deceptive means to collect a debt or obtain borrower information
• Contacting the borrower at unreasonable times, generally before 6:00 a.m. or after 10:00 p.m., subject to the specific exceptions in the circular
• Contacting persons in the borrower’s contact list other than those named as guarantors or co-makers

The circular also makes clear that outsourcing collection does not excuse the lending or financing company. A third-party service provider is treated as the company’s agent, and the ultimate responsibility for collection practices remains with the financing or lending company.

Penalties for Unfair Debt Collection

For violations of SEC MC No. 18, the penalties may include:

Violation level	Lending company	Financing company
First offense	₱25,000	₱50,000
Second offense	₱50,000	₱100,000
Third offense	Fine of at least twice the second-offense fine but not more than ₱1,000,000, and/or 60-day suspension, and/or revocation of Certificate of Authority

The SEC may also consider other penalties under the Revised Corporation Code and other applicable laws, and the courts or other government agencies may impose separate penalties within their own jurisdiction.

When a Complaint Should Be Escalated to the SEC

You should consider escalating to the SEC when the issue involves a lending or financing company, an online lending app, or an app that claims to offer loans in the Philippines, especially if any of these happened:

1. The app or collector threatened you with arrest, barangay blotter, cybercrime charges, public posting, or home visits in a misleading or abusive way.
2. The collector messaged your relatives, employer, co-workers, Facebook friends, or phone contacts.
3. The collector sent screenshots of your ID, selfie, loan details, or private information to other people.
4. The app imposed charges that do not match the disclosure statement or loan agreement.
5. The app appears unregistered, unrecorded, fake, or pretending to be a legitimate company.
6. The lender refuses to provide a statement of account, payment breakdown, or proper customer service channel.
7. You already complained to the app’s customer support but harassment continued.

A complaint to the SEC does not automatically erase a valid loan. If you borrowed money and received the proceeds, the issue of repayment is separate from the issue of illegal collection, excessive charges, privacy violations, or unlicensed lending. The SEC complaint is mainly used to trigger regulatory action, investigation, sanctions, or instructions to the company.

Check First: Is the App Registered, Recorded, or Possibly Fake?

Before filing, try to classify the app. This helps the SEC understand what action may be needed.

What you find	What it may mean	How to describe it in your complaint
Company is in SEC records and has a Certificate of Authority	It may be a regulated lending or financing company	“Respondent appears to be a registered lending/financing company, but its collectors committed unfair collection practices.”
Company is registered, but app name is not in the recorded online lending platform list	The app may be unrecorded or unauthorized	“The app appears connected to a company, but I could not verify that this specific online lending platform is recorded.”
App uses the name/logo of a known company but different payment accounts or numbers	Possible impersonation or fake app	“The app may be misusing the name of a registered company.”
No company name, no SEC number, no address, only Telegram/Viber/SMS/GCash	Possible illegal or unregistered operator	“The app appears to be operating without transparent company information.”

The SEC maintains public resources for checking lending companies, financing companies, and recorded online lending platforms, and its iMessage page also links to “Check with SEC.” (www.foi.gov.ph)

Step-by-Step Guide to Escalating an Online Lending App Complaint to the SEC

1. Preserve evidence before blocking, deleting, or uninstalling anything

Do not rely on memory. SEC reviewers need proof that shows who did what, when, and how.

Save:

• Screenshots of threatening messages, including the sender’s number, username, email address, or profile
• Screenshots showing date and time
• Call logs, SMS logs, Viber/Telegram/Messenger messages, and emails
• Screenshots of messages sent to your contacts
• Statements from relatives, friends, co-workers, or employers who were contacted
• Loan agreement, disclosure statement, repayment schedule, and statement of account
• Proof of loan proceeds received
• Proof of payments already made
• App page screenshots showing app name, developer name, permissions, privacy policy, and customer support details
• Payment instructions showing GCash, Maya, bank account, or QR code details
• SEC verification screenshots, if available

A common mistake is uninstalling the app immediately. If you need to protect your data, take screenshots first. Then review app permissions, revoke unnecessary permissions, and preserve the device if the case may become a cybercrime or privacy complaint.

2. Identify the respondent correctly

In your complaint, list all names connected to the app:

• App name
• Developer name shown in the app store
• Corporate name, if shown
• SEC registration number, if shown
• Certificate of Authority number, if shown
• Website or Facebook page
• Customer service email
• Collection agency or collector name
• Phone numbers and messaging accounts used
• Payment account names and numbers

If you do not know the company behind the app, say so directly. For example:

“The app does not disclose a clear corporate name, SEC registration number, office address, or Certificate of Authority. I am requesting SEC assistance to verify whether this app is authorized to operate as an online lending platform.”

3. Prepare a short timeline

A good complaint is usually chronological. Keep it factual.

Example:

Date	What happened	Evidence
5 March 2026	I borrowed ₱5,000 through the app and received ₱3,850 after deductions.	Loan screenshot, GCash receipt
12 March 2026	Collector texted threats that they would message my employer.	SMS screenshot
13 March 2026	My sister and co-worker received messages saying I was a scammer.	Screenshots from sister and co-worker
14 March 2026	I emailed customer support asking them to stop contacting third parties. No reply.	Email screenshot
15 March 2026	Collector demanded payment to a different GCash number.	SMS and GCash details

This format helps the SEC see the pattern quickly.

4. File through SEC iMessage

The SEC’s iMessage system is its official web-based platform for handling public inquiries, complaints, incidents, and requests. The user guide says it generates a unique electronic ticket, allows users to track status, and centralizes communications that used to be handled through more informal channels. (Securities and Exchange Commission)

To file:

1. Go to SEC iMessage.
2. Choose Open a New Ticket.
3. Agree to the privacy policy.
4. Sign in using an eSECURE account.
5. In the Service field, choose the service related to the Financing and Lending Companies Department.
6. Select Complaints on Financing and Lending Companies.
7. Fill out the form.
8. Upload your evidence files.
9. Submit and save the ticket number. (Securities and Exchange Commission)

The SEC iMessage service list identifies Complaints on Financing and Lending Companies under the Financing and Lending Companies Department’s Legal and Enforcement Division. (Securities and Exchange Commission)

5. Write the complaint in a way the SEC can act on

Use a direct subject line:

Complaint Against [App Name] / [Company Name] for Unfair Debt Collection, Harassment, Possible Unrecorded OLP, and Excessive Charges

In the body, include:

• Your full name and contact details
• App name and company name, if known
• Loan date, amount borrowed, amount received, and due date
• Summary of the abusive collection acts
• Names or numbers of collectors
• Names of third persons contacted
• Whether you already paid anything
• Whether you asked customer support to stop the harassment
• Specific request for SEC action

Possible wording:

I respectfully request the SEC to investigate the respondent company and/or online lending platform for possible violations of SEC Memorandum Circular No. 18, Series of 2019, including threats, abusive language, disclosure of my personal information, and contacting persons in my phone contacts who are not guarantors or co-makers. I also request verification of whether the app is a recorded online lending platform and whether the company has authority to operate as a lending or financing company.

6. Attach organized files

Use clear file names. SEC staff should not have to open 50 random screenshots to understand the case.

Examples:

• 01_Loan_Agreement_AppName.pdf
• 02_Proof_of_Proceeds_GCash_March5.png
• 03_Threats_From_Collector_0917xxxxxxx.pdf
• 04_Message_To_Employer.png
• 05_Request_To_Stop_Harassment_Email.pdf
• 06_SEC_Verification_Screenshot.png

If you have many screenshots, combine them into one PDF and add page numbers. Put the most serious evidence first: threats, public shaming, messages to employer, messages to family, and proof that the contacted persons were not guarantors or co-makers.

7. Track the ticket and reply promptly

After filing, monitor the ticket. The iMessage user guide explains that users can view tickets, check status, open the ticket conversation thread, post replies, and upload files if needed. (Securities and Exchange Commission)

If harassment continues after filing, do not create multiple duplicate tickets unless necessary. Use the existing ticket and post a reply such as:

Additional harassment occurred after my SEC complaint was filed. Attached are new screenshots dated [date]. The collector again contacted my employer and threatened public posting.

This shows continuing conduct and may help establish urgency.

What to Attach: Required Documents and Evidence Checklist

Document or evidence	Why it helps
Government ID	Confirms complainant identity if requested
Loan agreement or disclosure statement	Shows loan amount, charges, due date, and stated lender
Screenshots of app profile and app permissions	Helps identify the online lending platform and possible privacy issues
Screenshots of threats or insults	Supports unfair collection complaint
Messages sent to contacts, employer, or relatives	Shows third-party disclosure or harassment
Proof contacts were not guarantors or co-makers	Important under SEC MC No. 18
Proof of payment	Prevents false claims that no payment was made
Statement of account or demand letters	Shows charges and collection basis
SEC verification screenshots	Helps show whether app/company is registered or unrecorded
Customer support emails	Shows you tried to resolve the matter directly

What If the Main Issue Is Excessive Interest or Hidden Fees?

High interest, by itself, is not always the same as harassment. But for certain small, short-term, unsecured general-purpose loans, there are regulatory caps.

SEC Memorandum Circular No. 3, Series of 2022 implemented BSP Circular No. 1133 for covered loans offered by lending companies, financing companies, and their online lending platforms. It applies to unsecured general-purpose loans not exceeding ₱10,000 with a loan tenor of up to four months, entered into, restructured, or renewed beginning 3 March 2022.

For covered loans, the caps include:

Charge	Ceiling
Nominal interest	6% per month
Effective interest rate, including applicable fees and charges but excluding late-payment penalties	15% per month
Late-payment or non-payment penalty	5% per month on outstanding scheduled amount due
Total cost cap	100% of total amount borrowed

If your complaint is about excessive charges, attach the loan computation and explain the numbers. For example:

I borrowed ₱5,000, received ₱3,500 after deductions, and was asked to pay ₱7,500 after seven days. I request SEC review of whether the charges comply with the applicable ceilings for covered loans.

When to File With Other Agencies Too

Some online lending app cases involve more than one legal issue. The SEC handles the lending or financing company regulation side, but privacy and cybercrime issues may require parallel complaints.

Problem	Possible agency
Lending company harassment, unfair collection, unrecorded OLP, lack of authority to operate	SEC
Harvesting contacts, misuse of phonebook, unauthorized disclosure of personal data	National Privacy Commission
Threats, cyberlibel, identity misuse, hacking, fake accounts, online extortion	PNP Anti-Cybercrime Group or NBI Cybercrime Division
Credit report dispute or improper credit data	Credit Information Corporation dispute process

The Credit Information Corporation’s consumer guidance specifically points consumers to the SEC for lending and financing companies, online lending apps, and microfinance institutions, and points data privacy concerns to the NPC, PNP Anti-Cybercrime Group, NBI Cybercrime Division, and DOJ Office of Cybercrime. (Credit Information Corporation (CIC))

Filing With the National Privacy Commission

If the app accessed or used your contacts, photos, employer details, ID, or private information to shame or pressure you, the issue may fall under the Data Privacy Act of 2012 and NPC rules.

The NPC has stated that online lenders are prohibited from harvesting phone and social media contact lists for harassment, and that unnecessary permissions include accessing phone contact lists, harvesting social media contacts, and saving these for debt collection or harassment. (National Privacy Commission)

A formal NPC complaint must be filed in a specific format. The NPC’s complaint page says to download the form, print and fill it out, have it notarized, and submit it in person, by courier, or by scanned email to the NPC complaints address. (National Privacy Commission)

Filing a Cybercrime or Criminal Complaint

If the collector threatens physical harm, posts defamatory accusations online, uses your identity, or demands money through intimidation, consider a report to cybercrime authorities.

Under the Revised Penal Code, threats may fall under provisions such as Article 282 on grave threats, while coercive or vexatious conduct may implicate Article 287 on light coercions or unjust vexations, depending on the facts. Libel is defined under Article 353, and libel by writings or similar means is punished under Article 355. (Lawphil)

Under Republic Act No. 10175, or the Cybercrime Prevention Act of 2012, cyberlibel covers libel committed through a computer system or similar means, and crimes under the Revised Penal Code or special laws committed through information and communications technologies may be covered by the Act. The law also designates the NBI and PNP as law enforcement authorities for cybercrime cases. (Supreme Court E-Library)

Practical Timelines and What to Expect

Stage	Practical timeline	What usually happens
SEC iMessage ticket creation	Same day	You receive a ticket and can monitor status
Initial routing	A few days to a few weeks	Ticket is assigned to the appropriate SEC department or unit
Clarification or document request	Varies	SEC may ask for clearer evidence, company details, or more documents
Company response or regulatory review	Weeks to months	More complex if the app hides its operator or uses fake names
Enforcement action	Case-dependent	May include warning, penalty, suspension, revocation, advisory, or referral

Bottlenecks commonly happen when the borrower cannot identify the company, only has screenshots without dates, paid through personal e-wallet accounts, or deleted the messages. Cases involving fake apps, foreign operators, or rotating SIM cards may take longer because the SEC may need coordination with platforms, payment channels, or law enforcement.

Common Mistakes That Weaken SEC Complaints

1. Filing only against the app name

The app name is useful, but the SEC regulates legal entities. Always try to identify the corporation behind the app.

2. Sending only emotional statements without evidence

It is understandable to be angry or scared, but a complaint is stronger when it shows dates, screenshots, numbers, names, and exact messages.

3. Deleting messages after being threatened

Keep the evidence. If you need to block the collector, screenshot first.

4. Ignoring the distinction between debt and harassment

The SEC may investigate harassment even if you still owe money. But it helps to be honest about the loan, amount received, and payments made.

5. Paying random personal accounts without documenting

If you pay, save the payment instruction, account name, number, receipt, and confirmation. Some fake or abusive apps use changing payment channels.

6. Filing only with the wrong agency

If the main issue is lending harassment, file with the SEC. If the main issue is contact harvesting or data misuse, file with the NPC too. If there are threats, impersonation, cyberlibel, or extortion, report to cybercrime authorities as well.

Special Notes for OFWs, Filipinos Abroad, and Foreigners

You can file an SEC iMessage complaint online even if you are outside the Philippines. What matters is that the lending app, company, borrower, transaction, or harmful conduct has a Philippine connection.

For Filipinos abroad and foreigners, practical issues usually include:

• Screenshots may show a foreign time zone, so note your location and time zone.
• If a sworn statement is later required for an SEC, NPC, prosecutor, or court proceeding, documents executed abroad may need consular acknowledgment or an apostille, depending on where they were signed and how they will be used.
• If your Philippine relatives or employer were contacted, ask them to preserve their own screenshots.
• If your foreign employer was contacted, document the reputational harm clearly and calmly.
• If payment was made through Philippine e-wallets or bank accounts, keep the transaction reference numbers.

Foreigners should also distinguish between a personal loan dispute and immigration-related threats. A private lender or collector generally cannot deport someone, hold a passport, or cause arrest merely because of an unpaid civil debt. Threats of deportation, imprisonment, or “blacklisting” should be screenshot and included because they may show deceptive or abusive collection tactics.

Frequently Asked Questions

Can I file an SEC complaint even if I still owe the online lending app?

Yes. The SEC complaint focuses on whether the lender, app, or collector violated lending regulations, collection rules, or authority-to-operate requirements. A remaining balance does not give collectors the right to threaten, shame, deceive, or contact unauthorized third persons.

Will the SEC cancel my loan?

Not automatically. The SEC may investigate the company, require compliance, impose penalties, or take regulatory action. Loan validity, exact balance, and civil liability may still depend on the loan documents, payments, charges, and applicable law.

What if the app contacted my family, friends, or employer?

Include screenshots from those people. Under SEC MC No. 18, contacting persons in the borrower’s contact list other than those named as guarantors or co-makers may constitute an unfair collection practice.

What if the app says I will be arrested for not paying?

Non-payment of a loan is generally a civil matter. However, fraud, threats, identity misuse, or other criminal acts may be separate issues depending on the facts. Screenshot the threat and include it in your SEC complaint, and consider a cybercrime or police report if the threat is serious.

What if the app is not on the SEC list?

Say that clearly in your complaint. Ask the SEC to verify whether the company has a Certificate of Authority and whether the app is a recorded online lending platform. If the app is fake or impersonating a registered company, include proof of the impersonation.

Should I file with the SEC or NPC?

File with the SEC for lending company misconduct, unfair debt collection, unrecorded online lending platforms, and excessive covered-loan charges. File with the NPC when the issue involves misuse of personal data, harvesting contacts, unauthorized disclosure, or privacy violations. Many serious online lending app cases justify filing with both.

Do I need a notarized complaint for the SEC?

For an initial SEC iMessage ticket, you submit information and upload evidence through the online system. If the SEC later requires a sworn statement, affidavit, or formal pleading, follow the specific instruction given for that stage. NPC formal complaints, by contrast, are expressly required to be notarized under the NPC’s complaint-filing instructions. (National Privacy Commission)

How long does an SEC online lending app complaint take?

You can usually create the ticket immediately, but review and action may take weeks or months depending on the evidence, the company’s identity, the number of complainants, and whether the app is registered, unrecorded, fake, or using third-party collectors.

Can I complain if the collector used another number after I blocked them?

Yes. Save each number and message. Repeated use of different numbers can help show a pattern of harassment, evasion, or coordinated collection activity.

What should I do if harassment continues after filing?

Update your existing SEC iMessage ticket with new screenshots and dates. If the conduct involves threats, public posting, identity misuse, or contact harvesting, file or update complaints with the NPC and cybercrime authorities as appropriate.

Key Takeaways

• The SEC is the primary regulator for Philippine lending companies, financing companies, and their online lending platforms.
• The strongest complaints identify the company behind the app, not just the app name.
• SEC MC No. 18 prohibits threats, abusive language, false representations, public shaming, and unauthorized contact with people in your contact list.
• For covered small, short-term unsecured loans, SEC MC No. 3, Series of 2022 implements caps on interest, fees, penalties, and total cost.
• File through SEC iMessage under Complaints on Financing and Lending Companies, attach organized evidence, and keep your ticket updated.
• File parallel complaints with the NPC for privacy violations and with cybercrime authorities for threats, cyberlibel, identity misuse, or online extortion.

What to Do If You Still Receive Spam Messages After Deleting a Lending App Account

Receiving spam, threats, or “loan offer” messages after you deleted a lending app account is frustrating—and in many cases, it may point to a data privacy or debt collection problem. In the Philippines, deleting an app from your phone is not the same as deleting your account or erasing your personal data. But once you have withdrawn consent, closed the account, paid the loan, or asked the company to stop using your data for marketing, the lending app cannot simply keep using your number, contacts, photos, or other personal information without a lawful reason. This guide explains what may be happening, what Philippine laws protect you, how to preserve evidence, and where to report the lending app, collector, or spam sender.

Why spam messages may continue after deleting a lending app account

There are several possible reasons you are still receiving messages:

1. You deleted the app, but not the account. Uninstalling the app only removes it from your phone. The company may still have your account records, phone number, ID images, references, payment history, and consent logs.

2. Your account was deleted, but some data is retained for legal or accounting purposes. A lending company may retain limited records if needed for a legitimate purpose, such as loan documentation, regulatory compliance, fraud prevention, or legal claims. But retention must still follow the principles of transparency, legitimate purpose, and proportionality under the Data Privacy Act.

3. You still have an unpaid or disputed loan. If there is a valid debt, the lender may contact you for collection. However, it must do so lawfully. It cannot threaten you, shame you, harass your contacts, or use deceptive messages.

4. A third-party collector has your data. Some online lending platforms use collection agencies or service providers. Under SEC rules, the lending or financing company remains responsible for the acts of its collectors and outsourced service providers.

5. The messages are from scammers using lending-app style tactics. Some spam messages are not from the original lender at all. They may be phishing attempts, fake “loan approval” messages, or threats designed to make you click a link, send money, or reveal an OTP.

The first step is to identify whether the messages are ordinary marketing, unlawful debt collection, a data privacy violation, or a cybercrime-related scam.

Your rights under Philippine law

Your data privacy rights under the Data Privacy Act

The main law that protects your personal information is the Data Privacy Act of 2012, or Republic Act No. 10173. It applies to the processing of personal information, including collection, recording, storage, use, disclosure, retention, blocking, erasure, and destruction. The law requires personal data processing to follow the principles of transparency, legitimate purpose, and proportionality. In simple terms, a company must tell you what it is doing with your data, use it only for a lawful and declared purpose, and avoid collecting or keeping more than necessary. (National Privacy Commission)

As a data subject, you have rights that are especially important when dealing with lending apps. You may ask what data the company has about you, why it is being processed, who received it, how long it will be retained, and whether it was disclosed to third parties. You may also dispute inaccurate data, withdraw consent where consent is the basis of processing, and request blocking, removal, or destruction of personal information that is outdated, unlawfully obtained, used for unauthorized purposes, or no longer necessary. (National Privacy Commission)

This matters because many lending-app complaints involve:

• repeated promotional texts after account closure;
• messages from unknown collectors;
• unauthorized access to phone contacts;
• disclosure of loan details to relatives, friends, co-workers, or employers;
• public shaming on social media or messaging apps;
• threats using personal photos, IDs, or contact lists.

Lending apps cannot freely harvest or use your contacts

The National Privacy Commission has repeatedly addressed abusive online lending practices. In a joint 2026 advisory with the DICT and SEC, regulators warned against online lending platform practices involving harassment, intimidation, public shaming, and unlawful personal data use. The advisory states that online lending platforms should not request unnecessary app permissions, engage in excessive processing of contacts, use personal data for harassment, or contact persons in a borrower’s contact list for debt collection unless they are properly designated guarantors.

This distinction is important:

Person	What the lending app may generally do
Borrower	Contact for account-related matters and lawful collection if there is a valid debt
Character reference	Use for identification or verification, not automatic debt collection
Guarantor	May be contacted about the loan only if the person expressly agreed to be a guarantor
Random contact from your phonebook	Should not be contacted for collection merely because their number was in your phone

The advisory also says personal data should be retained only as long as necessary for the declared purpose, legal claims, or applicable law, and should be securely disposed of afterward.

SEC rules prohibit unfair debt collection practices

If the lending app is operated by a lending company or financing company, the Securities and Exchange Commission (SEC) may have jurisdiction. SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair debt collection practices by financing companies, lending companies, and their third-party service providers. The circular recognizes that lenders may collect debts, but they must do so in good faith and avoid abusive, unethical, or deceptive conduct.

Under SEC rules, unfair collection practices include:

• using threats, violence, or criminal means to harm a person, reputation, or property;
• using obscene, insulting, or profane language;
• falsely representing legal consequences;
• disclosing or publishing the borrower’s names and personal information;
• communicating false credit information;
• using deceptive means to collect;
• contacting the borrower at unreasonable hours, generally before 6:00 a.m. or after 10:00 p.m., unless justified by special circumstances;
• contacting people in the borrower’s contact list other than guarantors or co-makers.

The SEC may impose fines and, for repeated violations, suspension or revocation of authority to operate. The rules also make clear that when a lender outsources collection, the third-party collector acts as an agent and the lending or financing company remains ultimately responsible.

Threats, public shaming, fraud, and identity misuse may involve criminal laws

Some messages go beyond spam or unfair collection. They may involve criminal conduct, especially if they include threats, extortion, fake legal notices, identity theft, or online shaming.

The Cybercrime Prevention Act of 2012, or Republic Act No. 10175, covers several offenses committed through computer systems, including illegal access, identity theft, computer-related fraud, and cyberlibel. It also regulates unsolicited commercial communications, subject to exceptions such as prior consent, service announcements, or clear opt-out mechanisms. (Supreme Court E-Library)

If a collector posts defamatory statements about you online, sends humiliating messages to your contacts, or creates fake posts about your loan, the issue may also touch on cyberlibel. In Disini v. Secretary of Justice, the Supreme Court explained that cyberlibel under RA 10175 is not a completely new offense but applies libel principles to online publication through a computer system. (Supreme Court E-Library)

Separately, Article 26 of the Civil Code recognizes a person’s right to dignity, personality, privacy, and peace of mind. It allows legal relief against acts such as prying into another’s privacy, disturbing private life, or vexing or humiliating a person because of personal circumstances. (Lawphil)

Step-by-step guide: what to do if spam messages continue

1. Preserve evidence before deleting, blocking, or replying

Before blocking the sender, collect proof. Complaints often fail because the victim deleted the messages, lost access to the phone, or could not show the connection between the messages and the lending app.

Save the following:

Evidence	Why it matters
Screenshots of SMS, Viber, Messenger, WhatsApp, Telegram, email, or app notifications	Shows the exact words used, sender ID, number, date, and time
Call logs and voicemail recordings	Helps prove repeated harassment or collection calls
Screen recording of disappearing messages	Useful when messages vanish or are unsent
Account deletion confirmation	Shows you attempted to close the account
Loan contract, disclosure statement, or payment receipts	Helps show whether the loan is paid, unpaid, or disputed
App privacy notice, permission screen, or consent form	Helps show what you supposedly agreed to
App store listing and company name	Helps identify the operator
Messages sent to your contacts	Strong evidence of improper contact-list use
Customer service emails or tickets	Shows you tried to resolve the matter first

For screenshots, include the full sender number or sender ID, date, time, and entire message. Do not crop out important details. If possible, back up the files to cloud storage or another device.

Avoid clicking links in the messages. If a link looks important, take a screenshot instead of opening it.

2. Secure your phone and accounts

After preserving evidence, reduce the risk of further misuse.

Do these immediately:

1. Revoke app permissions for contacts, camera, photos, microphone, location, SMS, and storage.
2. Uninstall the app only after saving evidence and confirming whether account deletion was processed.
3. Change passwords for email, banking apps, e-wallets, and social media.
4. Enable two-factor authentication where available.
5. Never give OTPs, passwords, or ID photos to anyone who contacted you through spam messages.
6. Tell your close contacts not to respond, pay, click links, or provide information if they receive messages about your loan.
7. Block and report the sender through your phone, telco app, or official reporting channels.

If you suspect malware or unauthorized access, update your phone operating system and scan for suspicious apps. If the messages are coming from many changing numbers, focus on preserving samples and reporting the pattern rather than replying to every number.

3. Send a written request to the lending app or its Data Protection Officer

Before filing a privacy complaint with the National Privacy Commission, you usually need to show that you first informed the company in writing and gave it a chance to act. NPC complaint rules require complainants to show proof that they informed the respondent of the privacy violation or personal data breach and that the respondent failed to take timely or appropriate action within 15 calendar days from receipt. (National Privacy Commission)

Send your request by email, in-app ticket, or any official support channel. Keep proof of sending.

You can use wording like this:

I am requesting that you stop sending marketing, promotional, or non-essential messages to my mobile number and any linked channels. I have deleted/closed my account on [date], and I withdraw consent for direct marketing and any optional processing not necessary for a lawful purpose.

Please confirm what personal information you still retain about me, the legal basis for retaining it, the retention period, and the third parties or collectors to whom my data was disclosed.

I also request the blocking, removal, or destruction of personal information that is no longer necessary, unlawfully obtained, used for unauthorized purposes, or processed beyond the purposes disclosed to me.

Please also confirm that my contacts, character references, relatives, friends, co-workers, or employer will not be contacted for collection unless they are lawful guarantors who expressly consented.

If you have already paid the loan, attach proof of payment. If the loan is disputed, clearly say that the debt is disputed and identify why, such as wrong amount, unauthorized charges, payment not credited, or fake account.

4. Identify the company behind the messages

Many lending apps use trade names that are different from their registered company names. Before filing with the SEC or NPC, gather as much identifying information as possible:

• app name;
• registered company name;
• SEC registration number;
• Certificate of Authority number, if shown;
• website, email, customer service number;
• collector’s name or agency;
• sender ID or phone numbers used;
• payment channels or bank/e-wallet accounts used;
• screenshots of the app store page.

If the sender refuses to identify the company, uses only threats, or demands payment to a personal account, treat it as a possible scam and report it as such.

5. File a complaint with the National Privacy Commission for data misuse

File with the National Privacy Commission (NPC) if the issue involves personal data misuse, such as:

• continued marketing after withdrawal of consent;
• refusal to delete or block unnecessary personal data;
• unauthorized access to contacts, photos, or messages;
• disclosure of loan information to relatives, friends, co-workers, or employers;
• failure to explain how your data was used or shared;
• harassment using personal data.

NPC rules allow complaints by the data subject, by an authorized representative through a Special Power of Attorney, or by the NPC on its own initiative. Complaints may be filed using the NPC complaint-assisted form or a verified complaint, with supporting evidence and witness affidavits where applicable. (National Privacy Commission)

The NPC’s own complaint page instructs complainants to download the form, fill it out, have it notarized, and submit it by personal filing, courier, registered mail, or email to the NPC complaints address. (National Privacy Commission)

Prepare these:

Requirement	Practical note
Filled-out NPC complaint form or verified complaint	Must clearly identify the respondent and describe the data privacy violation
Notarized signature	Required for formal complaint documents
Proof of prior written notice to the company	Important because of the 15-calendar-day exhaustion requirement
Screenshots and call logs	Include dates, times, sender numbers, and full message content
Proof of account deletion, payment, or withdrawal of consent	Helps show why continued messages may be improper
Witness statements	Useful if your contacts received messages or calls

If the NPC finds merit, the matter may proceed to investigation and enforcement. The NPC may refer cases involving possible criminal charges to the Department of Justice. (National Privacy Commission)

6. File with the SEC if the issue involves abusive debt collection

File with the SEC Financing and Lending Companies Division if the lending app, financing company, or collector is using unfair collection practices.

Examples include:

• threatening arrest or imprisonment for debt;
• threatening to post your face, ID, or loan details online;
• calling or messaging at unreasonable hours;
• sending insults, profanity, or humiliating language;
• contacting your phone contacts who are not guarantors or co-makers;
• pretending to be a police officer, lawyer, court employee, or government agency;
• refusing to identify the company or collector.

The 2026 DICT-NPC-SEC advisory directs reports involving online lending platforms to the SEC’s FINLEND channel and identifies other cybercrime-related channels for harassment, threats, frauds, and scams.

When filing with the SEC, include:

• full name of the lending app and company, if known;
• app screenshots and app store listing;
• chronology of events;
• loan amount, dates, and payment history;
• screenshots of messages and call logs;
• proof that your contacts were messaged;
• account deletion request or confirmation;
• name or number of the collector;
• explanation of why the conduct violates SEC debt collection rules.

7. Report spam, scam, fraud, or threats to the proper cybercrime and telecom channels

For spam or scam texts, the National Telecommunications Commission has indicated that complaints may be reported through its text scam and text spam channels. NTC guidance has also identified reporting by email with details such as the complainant’s name, address, contact details, complained-of number, screenshots, and a government ID. (www.foi.gov.ph)

For cyber fraud, the Cybercrime Investigation and Coordinating Center has pointed victims to hotline 1326, while persons who merely receive scam texts may report numbers through the eGov app’s eReport feature, with reports forwarded to the NTC for blocking action. (Philippine News Agency)

For threats, extortion, identity theft, fake legal notices, or public shaming, report to the PNP Anti-Cybercrime Group or NBI Cybercrime Division. RA 10175 recognizes the role of the NBI and PNP in cybercrime law enforcement. (Supreme Court E-Library)

Where to file: NPC, SEC, NTC, PNP, or NBI?

Problem	Best office to consider	What to prepare
Continued use of your personal data after account deletion or withdrawal of consent	National Privacy Commission	Written request to company, proof of 15-day waiting period, screenshots, account deletion proof
Lending app contacted your contacts, references, co-workers, or employer	NPC and SEC	Screenshots from your contacts, proof they were not guarantors, app permission evidence
Threats, insults, public shaming, fake arrest threats, abusive collection	SEC, and possibly PNP/NBI	Messages, call logs, collector identity, company/app name
Spam or scam texts from unknown numbers	NTC, telco reporting tools, eGov eReport	Sender number, screenshot, date/time, suspicious links
Identity theft, phishing, extortion, fake legal documents, cyberlibel	PNP Anti-Cybercrime Group or NBI Cybercrime Division	Screenshots, links, account URLs, payment demands, identity documents misused
Actual court summons or prosecutor subpoena	Court or prosecutor’s office named in the document	Do not ignore; verify authenticity directly with the issuing office

Common real-life scenarios

“I already paid my loan, but they still text me loan offers.”

This is usually a marketing and data retention issue. Send a written opt-out and withdrawal of consent for direct marketing. Ask the company to confirm whether your account is closed, what data is retained, and when it will be deleted or anonymized. If messages continue after the company receives your request and fails to act within the required period, consider filing with the NPC.

“I still owe money. Can they still message me?”

Yes, a lender may contact you for legitimate collection if there is a valid unpaid loan. But it must follow the law. It cannot threaten you with jail, shame you publicly, contact random people in your phonebook, use profane language, or pretend to have legal powers it does not have.

The Philippine Constitution also provides that no person shall be imprisoned for debt. (Supreme Court E-Library) This does not mean unpaid debts have no consequences. A creditor may pursue civil collection, report legitimate credit information through lawful channels, or file appropriate actions if fraud is involved. But a simple inability to pay a loan is not a basis for imprisonment.

“They messaged my contacts even after I deleted the app.”

This is a serious red flag. Under the DICT-NPC-SEC advisory, online lending platforms should not contact people in a borrower’s contact list for debt collection unless they are guarantors who expressly consented. Character references are for identification or verification, not automatic debt collection.

Ask your contacts to send you screenshots showing the full message, sender, date, and time. Their statements may help prove that the lender or collector used your contact list improperly.

“The sender says they are from a law office or police station.”

Be careful. Some collectors use fake legal titles or government-style language to scare borrowers. Check whether the message identifies a real company, lawyer, court case number, prosecutor’s office, or police unit. Do not send payment to a personal account just because someone uses words like “warrant,” “subpoena,” “estafa,” or “cybercrime.”

If you receive a supposed court document, verify it directly with the court or government office named in the document. Real court processes are not normally served through random threatening SMS alone.

“I am an OFW or foreigner outside the Philippines. Can I still complain?”

Yes, you can still prepare a complaint if the lending app, borrower account, processing activity, or harm is connected to the Philippines. Practical requirements may be harder because some documents must be notarized or authenticated.

For documents executed abroad, Filipinos commonly use notarization before a Philippine embassy or consulate, or local notarization followed by apostille where applicable. Some Philippine embassies state that consularized affidavits and similar documents require personal appearance, while documents notarized locally may need apostille before use in the Philippines. (Philippine Embassy)

If you are abroad, keep digital evidence, preserve the original messages, and use official agency email or online reporting channels where available.

Practical timelines and expectations

Step	Usual timing	Practical reality
Save evidence and secure accounts	Same day	Do this before blocking or uninstalling anything
Send written request to lending app or DPO	Same day to 3 days	Use email or ticket system so you have proof
Wait for company action before NPC complaint	15 calendar days from receipt	NPC rules generally require proof that you first informed the respondent
Prepare notarized NPC complaint	A few days, longer if abroad	Notarization or consular processing can delay filing
SEC complaint preparation	A few days	Strong screenshots and company identification help
NTC/telco/eGov spam reports	Same day	Useful for blocking numbers, but changing numbers may continue
PNP/NBI cybercrime report	As soon as threats or fraud appear	Bring complete screenshots, links, numbers, and payment demands

Do not wait if there are urgent threats, extortion, identity theft, or public posting of your personal information. Preserve the evidence and report to cybercrime authorities promptly.

Mistakes to avoid

Deleting all messages too early

Blocking is useful, but deleting evidence can weaken your complaint. Save screenshots, exports, and backups first.

Replying emotionally to collectors

Angry replies can escalate the situation. Keep responses short, written, and evidence-focused. If you dispute the debt, say so clearly and ask for a statement of account.

Sending IDs or OTPs to “verify” your account

A legitimate lender should not ask for your OTP. Do not send fresh ID photos, passwords, banking details, or e-wallet codes through spam links or random chat accounts.

Assuming every message is from the original lending app

Some scammers use the names of real lending apps. Identify the company before paying or filing. If you are unsure, report the number as suspicious and verify through official channels.

Ignoring a real court notice

Spam threats are common, but real legal documents should not be ignored. If you receive a summons, subpoena, or notice from a court, prosecutor, police unit, or government agency, verify it directly with that office.

Frequently Asked Questions

Does deleting a lending app account automatically delete my data?

Not always. Deleting the app removes it from your phone. Deleting the account may close your user profile, but the company may still retain limited records if needed for lawful purposes, such as regulatory compliance, accounting, fraud prevention, or legal claims. However, it should not keep or use data longer than necessary, and it should not continue marketing or excessive processing after you withdraw consent.

Can a lending app still text me after I withdraw consent?

It depends on the purpose. If the message is direct marketing or promotional spam, the company should generally stop once you opt out or withdraw consent. If the message is necessary for a legitimate account issue, such as a valid unpaid loan, payment confirmation, fraud warning, or legal notice, the company may still have a lawful basis to contact you. The message must still be fair, accurate, and non-abusive.

Can lending apps contact my contacts after I delete my account?

They should not contact random people from your phonebook for debt collection. Under the DICT-NPC-SEC advisory, contact-list persons should not be contacted for collection unless they are guarantors who expressly consented. Character references are not automatically guarantors. If your relatives, friends, employer, or co-workers received collection messages, save screenshots and consider reporting to the NPC and SEC.

What if I still have an unpaid loan?

The lender may collect the debt, but collection must be lawful. It cannot threaten violence, falsely claim you will be jailed for ordinary non-payment, use profanity, shame you online, contact unrelated people, or send messages at unreasonable hours. Ask for a clear statement of account and keep all communications in writing.

Can I go to jail for not paying an online loan in the Philippines?

For ordinary non-payment of debt, no. The Constitution says no person shall be imprisoned for debt. But this does not protect fraud, identity theft, falsification, or other crimes. If a collector threatens jail for simple inability to pay, preserve the message because it may support a complaint for unfair collection or harassment.

Should I file with the NPC, SEC, NTC, PNP, or NBI?

File with the NPC for data privacy violations, such as unauthorized use of contacts or refusal to stop unnecessary processing. File with the SEC for unfair debt collection by lending or financing companies. Report spam or scam numbers to the NTC, your telco, or eGov eReport. Go to the PNP Anti-Cybercrime Group or NBI Cybercrime Division for threats, extortion, cyberlibel, identity theft, phishing, or fraud.

Do I need a notarized complaint for the NPC?

For a formal NPC complaint, yes, the NPC’s complaint process refers to a notarized complaint form or verified complaint, along with supporting evidence. You also generally need proof that you first informed the company in writing and gave it 15 calendar days to act. If you are abroad, you may need consular notarization or local notarization with apostille, depending on how the document will be used.

What if spam messages come from different numbers every day?

Save samples showing the pattern. Report the numbers through telco, NTC, or eGov channels, but also focus on identifying whether one lending app or collector is behind the campaign. If the messages mention the same loan, same app, same payment channel, or same threats, include that pattern in your NPC, SEC, or cybercrime complaint.

What if the lending app says I consented when I installed the app?

Consent is not a blank check. Under the Data Privacy Act, processing must still be transparent, lawful, and proportional. The NPC and other regulators have warned against unnecessary permissions, excessive contact-list processing, and deceptive design patterns. A lending app cannot justify harassment, public shaming, or unlimited use of your contacts merely by pointing to a broad app permission.

Key Takeaways

• Deleting a lending app from your phone is not the same as deleting your account or personal data.
• Philippine law protects you against excessive data use, unauthorized contact-list processing, harassment, public shaming, and unfair debt collection.
• Save evidence before blocking, deleting messages, or uninstalling the app.
• Send a written request withdrawing consent for marketing and asking for data access, blocking, deletion, or retention details.
• For privacy violations, file with the National Privacy Commission after observing the usual 15-calendar-day prior notice requirement.
• For abusive debt collection by lending or financing companies, file with the SEC.
• For spam, scam texts, threats, identity theft, extortion, or cyberlibel, report to the NTC, telco channels, eGov eReport, PNP Anti-Cybercrime Group, or NBI Cybercrime Division.
• A valid debt may still be collected, but collectors cannot threaten jail for ordinary non-payment, shame you, or contact unrelated people from your phonebook.

How to Protect Your Personal Data from Online Lending Apps in the Philippines

If an online lending app has accessed your contacts, threatened to message your family or employer, used your selfie to shame you, or refused to delete your information after payment, Philippine law gives you real protections. Online lending apps may collect certain personal data for legitimate loan purposes, but they cannot freely harvest your phonebook, embarrass you online, contact everyone you know, or keep your data forever “just in case.” This guide explains your rights under Philippine law, what lending apps can and cannot do, how to lock down your data, what evidence to collect, and where to file complaints in the Philippines.

Why online lending apps are a personal data risk

Online lending apps often ask for fast access to your phone before they release a loan. Some permissions may look harmless at first: contacts, camera, gallery, location, SMS, microphone, storage, or social media access. But in many complaints in the Philippines, borrowers later discover that the app or its collectors used this access to:

• Call or message people in the borrower’s contact list
• Threaten to tell the borrower’s employer, relatives, neighbors, or Facebook friends
• Use the borrower’s selfie, ID, or edited photo to shame them
• Send false accusations such as “scammer,” “estafador,” or “wanted”
• Pressure non-borrowers who never signed the loan
• Keep marketing or sharing borrower data even after the loan was denied or fully paid

The legal issue is not simply “may utang ba o wala?” A valid debt does not give a lender unlimited power over your privacy. In the Philippines, online lending apps are covered by data privacy, lending, consumer protection, cybercrime, and debt collection rules.

Your legal rights under Philippine law

Your rights under the Data Privacy Act

The main law is the Data Privacy Act of 2012, or Republic Act No. 10173. It protects personal information handled by companies, apps, collectors, service providers, and other entities that process data.

Under the law, personal information means information that can identify you, such as your name, mobile number, address, email, photo, ID details, employment information, and contact details. Sensitive personal information includes more protected data, such as government-issued ID numbers, health information, marital status, education, age, and information about legal proceedings.

The Data Privacy Act gives you important rights, including the right to:

• Be informed about how your data will be collected, used, stored, shared, and retained
• Access the personal data the app holds about you
• Correct inaccurate or outdated data
• Object to certain processing of your data
• Suspend, block, remove, or destroy data that is false, outdated, unlawfully obtained, used without authority, or no longer necessary
• Be indemnified for damages caused by inaccurate, incomplete, outdated, unlawfully obtained, or unauthorized use of personal data
• File a complaint with the National Privacy Commission, or NPC

The Implementing Rules and Regulations of the Data Privacy Act also require companies to give clear information about the purpose of processing, legal basis, scope, recipients of the data, automated decision-making or profiling, retention period, and the identity of the personal information controller.

In simple terms: an online lending app must explain what data it collects, why it needs the data, who receives it, how long it keeps it, and how you can exercise your rights.

Specific NPC rules for online lending apps

The National Privacy Commission issued specific rules for loan-related transactions through NPC Circular No. 20-01, later amended by NPC Circular No. 2022-02.

These circulars are very important for borrowers because they directly address online lending apps. They say that lending and financing companies processing personal data for loan transactions are personal information controllers. This means they are responsible for complying with the Data Privacy Act.

The NPC rules require loan apps to observe the principles of:

• Transparency — borrowers must know how their data will be used
• Legitimate purpose — data must be used for a lawful and specific loan-related reason
• Proportionality — the app must not collect more data than necessary

Under the NPC circulars, online lending apps are prohibited from requiring unnecessary permissions involving personal or sensitive personal information. They may request app permissions only when suitable, necessary, and not excessive for purposes such as know-your-customer checks, creditworthiness assessment, fraud prevention, payment verification, or lawful debt collection.

The circulars also specifically address contact lists and photos. Apps should not engage in unbridled processing of a borrower’s contact list. They should not harvest contacts for harassment or unfair collection practices. If the borrower needs to provide a character reference, guarantor, or co-maker, the app should use a separate interface that lets the borrower provide those persons, instead of copying the entire phonebook.

SEC rules on abusive debt collection

Lending companies and financing companies are regulated by the Securities and Exchange Commission, or SEC, under laws such as the Lending Company Regulation Act of 2007, or Republic Act No. 9474.

The SEC issued Memorandum Circular No. 18, series of 2019, which prohibits unfair debt collection practices by financing companies, lending companies, and their third-party service providers.

Under this SEC circular, collectors must not use unfair, abusive, unethical, or unreasonable practices, including:

• Threats of violence or criminal means to harm a person, reputation, or property
• Obscene, insulting, or profane language
• False representations or deceptive means to collect a debt
• False threats of legal action
• Publication or disclosure of borrower names and personal information, except in legally allowed situations
• Contacting the borrower at unreasonable or inconvenient times, generally before 6:00 a.m. or after 10:00 p.m., subject to the circular’s exceptions
• Contacting persons in the borrower’s contact list other than guarantors or co-makers, even if the borrower gave general consent

This is crucial: even when the borrower owes money, the lender still cannot use public shaming, threats, or mass contact-list harassment as a collection strategy.

Consumer protection and cybercrime laws may also apply

The Financial Products and Services Consumer Protection Act, or Republic Act No. 11765, strengthens consumer protection in financial products and services. It supports the right of financial consumers to clear, complete, and accurate information about financial products, charges, fees, and services.

If the online abuse involves threats, fake posts, identity theft, hacked accounts, or defamatory online content, the Cybercrime Prevention Act of 2012, or Republic Act No. 10175, may also be relevant. This law covers offenses such as illegal access, computer-related identity theft, cyberlibel, and crimes committed through information and communications technology.

The Revised Penal Code may also apply in serious cases involving grave threats, coercion, unjust vexation, libel, or other criminal acts.

What online lending apps may and may not do with your data

Data or practice	When it may be allowed	Red flags
Selfie, ID, or camera access	For know-your-customer checks, fraud prevention, or payment verification at the relevant stage	Using your photo to shame you, threaten you, or create humiliating posts
Contact references	When you manually provide a character reference, guarantor, or co-maker	Copying your entire phonebook or messaging people who did not sign the loan
Contact list access	Only if limited, necessary, proportional, and compliant with NPC rules	“Allow contacts” before you can apply, mass harvesting, or contacting friends/employers for collection
Location, storage, gallery, SMS, or social media data	Only when suitable, necessary, and not excessive for a legitimate loan purpose	Blanket permissions unrelated to the loan, hidden access, or continued access after the purpose ends
Marketing or cross-selling	With a separate lawful basis, such as valid consent	Sharing your data with partner lenders or marketers without clear consent
Data retention	For a lawful and stated retention period	Keeping data forever after denial, cancellation, or full payment without a valid reason
Debt collection	Through lawful, fair, and reasonable collection methods	Threats, insults, fake legal claims, public shaming, late-night harassment, or contacting non-guarantors

Step-by-step: how to protect your personal data before using an online lending app

1. Check if the lender is legitimate

Before installing or borrowing, check whether the lender is registered and authorized by the SEC. Do not rely only on the app name. Many apps use brand names that are different from the corporate name.

Look for:

• SEC registration name
• Certificate of Authority to operate as a lending or financing company
• Official website or published contact details
• Privacy notice
• Customer service channel
• Data Protection Officer or privacy contact
• Physical office address
• Clear loan terms, interest, fees, penalties, and repayment schedule

If the app hides the corporate name or gives only a mobile number or chat account, treat that as a serious warning sign.

2. Read the permission prompts before tapping “Allow”

Do not automatically approve permissions. Ask yourself:

• Why does this loan app need my contacts?
• Why does it need my gallery or storage?
• Why does it need my location?
• Can I continue the application without granting that permission?
• Does the app explain when the permission will be turned off or how I can revoke it?

Under NPC rules, access should be limited to what is suitable, necessary, and not excessive. A loan app should not force broad permissions that are unrelated to the loan.

3. Provide references manually

If a lender requires a character reference, provide the specific person manually. Avoid apps that require full phonebook access just to select a reference.

Before naming someone as a reference, inform them that:

• You are applying for a loan
• You may list them as a reference
• The lender may contact them to verify your details
• They are not a guarantor or co-maker unless they separately agree and sign

A reference is not automatically liable for your loan. A guarantor or co-maker is different because that person may become legally responsible depending on the contract signed.

4. Use strong account security

Protect your phone and accounts before applying:

• Use a strong phone passcode
• Enable two-factor authentication on your email
• Do not share OTPs
• Do not save passwords in unsecured notes
• Avoid installing APK files sent through links or chat messages
• Download only from official app stores
• Keep screenshots of the app’s privacy notice, loan disclosure, and permissions

If you are sending ID photos, consider adding a watermark such as: “For KYC with [lender name] only — [date].” Make sure the watermark does not cover important ID details if the lender legitimately needs to verify the document.

5. Keep complete loan records

From day one, save:

• Loan agreement
• Disclosure statement
• Interest, service fee, processing fee, and penalty terms
• Repayment schedule
• Receipts
• In-app messages
• Customer service messages
• Screenshots of any permission request
• Privacy policy or privacy notice

These records help if you later need to dispute charges, prove payment, or file a complaint.

What to do if the app already accessed your contacts or is harassing you

1. Preserve evidence before deleting anything

Do not immediately uninstall the app if doing so will erase useful evidence. First, collect and save:

• Screenshots of threats, insults, or shaming messages
• Call logs showing date, time, and number
• Screen recordings of in-app messages
• Screenshots from relatives, friends, employers, or co-workers who were contacted
• Social media posts, URLs, usernames, and timestamps
• Copies of edited photos, fake posts, or public accusations
• Loan agreement, payment receipts, and account statement
• Privacy notice and permission prompts
• Name of the app, developer, and corporate lender
• App version and package name, if visible

Ask affected contacts to send screenshots to you. If the matter becomes serious, their affidavits may help.

2. Revoke app permissions

After preserving evidence, lock down your phone.

For Android, check:

1. Settings
2. Apps
3. Select the lending app
4. Permissions
5. Deny contacts, camera, location, SMS, phone, microphone, photos, and files if not necessary

For iPhone, check:

1. Settings
2. Privacy & Security
3. Contacts, Photos, Camera, Location Services, Microphone
4. Remove or limit access for the lending app

Also check whether the app has access to your email, social media, cloud storage, or payment accounts. Change passwords if you suspect unauthorized access.

3. Send a written data privacy request

Before filing a formal NPC complaint, you usually need to show that you informed the company in writing and gave it a chance to respond. The NPC’s complaint mechanics require complainants to show that they notified the respondent of the privacy violation or breach, and that the respondent did not act on it or failed to respond within 15 calendar days from receipt.

Send your request to the lender’s customer service, Data Protection Officer, official email, in-app support, or other published channel. Keep proof of sending.

Use clear language. For example:

Subject: Data Privacy Request and Notice to Stop Unauthorized Processing

I am writing regarding my loan account with [name of app/lender], registered under [mobile number/email].

Under the Data Privacy Act of 2012 and NPC Circulars on loan-related transactions, I request that you:

1. Stop processing any personal data obtained from my contact list, gallery, photos, or device permissions that is not necessary for my loan.
2. Stop contacting persons who are not my guarantors, co-makers, or validly provided references.
3. Provide the categories of personal data you collected from my device.
4. Identify the recipients or third parties to whom my personal data was disclosed.
5. Explain the purpose and legal basis for such processing.
6. Block, delete, or destroy unlawfully obtained or unnecessary personal data, including contact-list data and photos used for harassment or collection.
7. Confirm your data retention period for denied, cancelled, fully paid, or closed accounts.
8. Provide the name and contact details of your Data Protection Officer or privacy contact.

Please respond in writing within 15 calendar days from receipt.

4. Tell your contacts not to engage with collectors

If your family, employer, or friends receive messages:

• Ask them to screenshot everything
• Tell them not to confirm your personal details
• Tell them not to pay on your behalf unless they knowingly choose to
• Ask them to request the collector’s full name, company, and authority
• Remind them they may also object to the use of their personal data

A collector cannot make a random contact person liable for your loan unless that person legally agreed to be a guarantor, co-maker, or other liable party.

5. Separate the privacy issue from the debt issue

Protecting your personal data does not automatically erase a valid loan. If the loan is legitimate, the lender may still collect through lawful means. But the lender must not use threats, public shaming, harassment, or unlawful data processing.

If you decide to pay, pay only through verified channels. Avoid sending money to personal wallets or personal bank accounts unless the lender officially confirms the channel in writing. Always ask for a receipt, updated statement of account, and confirmation of full settlement.

Where to complain in the Philippines

Office	Best for	What to prepare
National Privacy Commission	Unauthorized access to contacts, misuse of photos, unlawful disclosure, refusal to delete unnecessary data, privacy rights violations	Notarized complaint-affidavit or verified complaint, evidence, proof you first notified the lender, screenshots, IDs
Securities and Exchange Commission	Abusive debt collection, unfair practices by lending/financing companies, unregistered or suspicious lenders	App name, corporate name, SEC registration details if known, loan agreement, messages, call logs, screenshots
PNP Anti-Cybercrime Group or NBI Cybercrime Division	Threats, fake posts, identity theft, hacked accounts, cyberlibel, online harassment, fraud	Device, screenshots, URLs, usernames, call logs, message headers, affidavits, IDs
DOJ Office of Cybercrime	Cybercrime-related concerns and coordination	Evidence of online threats, identity theft, hacking, or cyber-related offenses
Barangay	Local, identifiable individuals in the same city or municipality	Useful only for certain local disputes; less suitable for corporate, app-based, privacy, SEC, or cybercrime issues

Filing with the National Privacy Commission

For privacy violations, the NPC is the main agency. The NPC provides guidance on filing a formal complaint and its mechanics for complaints.

In practice, prepare:

• Completed NPC complaint form or complaint-affidavit
• Notarization, when required
• Valid ID
• Evidence screenshots and files
• Proof of your written complaint to the lender
• Proof that the lender failed to respond or act within 15 calendar days from receipt
• Witness affidavits, if available
• A clear timeline of what happened

The NPC may dismiss complaints that are incomplete, unsupported by evidence, outside the Data Privacy Act, or filed without first giving the respondent a chance to address the issue. If the complaint is sufficient, it may proceed to investigation. Possible outcomes may include orders, administrative sanctions, fines, damages, or referral for criminal prosecution when warranted.

Filing with the SEC

For unfair debt collection or problems involving lending and financing companies, you can submit a complaint through the SEC iMessage complaint portal.

The SEC complaint should be as specific as possible. Include:

• App name
• Corporate name of the lender, if known
• Screenshots of the app page or website
• Loan agreement or disclosure statement
• Collection messages
• Call logs
• Names or numbers used by collectors
• Screenshots from contacts who were harassed
• Proof of payment, if any

If the lender is unregistered, hiding its identity, or using multiple app names, say so clearly and attach screenshots.

Filing with cybercrime authorities

Go to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or appropriate law enforcement office if the conduct includes:

• Threats of harm
• Fake criminal accusations posted online
• Use of your photo or ID in defamatory posts
• Identity theft
• Hacked accounts
• Fake profiles
• Unauthorized access to accounts or devices
• Extortion or demands using threats

Bring the device if possible. Do not rely only on cropped screenshots. Preserve URLs, usernames, timestamps, phone numbers, and original messages.

Evidence checklist before filing a complaint

Prepare one organized folder with:

• App name, app store link, developer name, and app version
• Corporate name, address, email, and Data Protection Officer details, if available
• Loan agreement and disclosure statement
• Privacy notice and screenshots of permission prompts
• Screenshots of messages, threats, insults, or shaming posts
• Call logs showing dates and times
• Screenshots from contacted relatives, employers, friends, or co-workers
• Proof that contacts were not guarantors or co-makers
• Copies of edited photos, public posts, or fake accusations
• Payment receipts and statement of account
• Written privacy request sent to the lender
• Proof of receipt by the lender, or proof of no response after 15 calendar days
• Valid government ID
• Timeline of events

For OFWs or foreigners abroad, documents signed outside the Philippines may need notarization, consular acknowledgment, or apostille depending on the receiving agency and document type. When filing electronically, keep scanned PDF copies, but also preserve original files and the original device where possible.

Common mistakes to avoid

Deleting the app before saving evidence

Uninstalling may remove in-app notices, messages, account information, or proof of permissions. Save evidence first.

Paying a random collector without verification

Some borrowers panic and pay to personal e-wallets or personal bank accounts. This can create a second problem: you may still be marked unpaid. Always verify the payment channel and ask for a receipt.

Assuming “I clicked agree” means the app can do anything

Consent under Philippine data privacy law must be freely given, specific, and informed. A broad consent clause buried in small print does not automatically justify excessive, unnecessary, or unlawful processing.

Ignoring the corporate name

The app brand may be different from the lending company. For complaints, identify both if possible.

Posting angry accusations online

It is understandable to feel angry, but public accusations can create separate legal risks. Preserve evidence and file with the proper agency instead of escalating the issue on social media.

Treating a reference like a guarantor

A character reference is not automatically liable for the loan. A guarantor or co-maker usually has a stronger legal obligation because they agreed to answer for the debt. If collectors threaten ordinary references, document it.

Not sending a written privacy request before filing with the NPC

For many NPC complaints, you should show that you first informed the lender of the privacy violation and gave it a chance to respond. Keep proof of sending and count 15 calendar days from receipt.

Special notes for OFWs and foreigners

OFWs are common targets of online loan harassment because collectors may pressure family members in the Philippines. If you are abroad, you can still preserve evidence, send a written privacy request, and explore filing with the NPC or SEC through available channels.

If you need affidavits while abroad, check whether the receiving office requires Philippine consular acknowledgment, local notarization, or apostille. Requirements can vary depending on how the document will be used.

Foreigners dealing with Philippine online lending apps also have privacy rights when the processing has a Philippine connection, such as a lender operating in the Philippines, data processed in the Philippines, or a loan transaction governed by Philippine law. Avoid sending unnecessary passport, visa, or ACR I-Card information unless the lender clearly explains why it is needed for legitimate verification.

Frequently Asked Questions

Can an online lending app access all my contacts in the Philippines?

Not freely. NPC rules prohibit unnecessary and excessive processing of contact lists. A lending app should not harvest your entire phonebook for debt collection or harassment. If references are needed, the app should use a limited method, such as a separate interface where you provide specific references or guarantors.

Is it legal for a lending app to message my family, employer, or Facebook friends?

It is a red flag if those people are not your guarantors, co-makers, or validly provided references. SEC rules prohibit contacting persons in the borrower’s contact list other than guarantors or co-makers as an unfair collection practice. NPC rules also restrict excessive and unlawful processing of contact data.

Can a lender use my selfie or ID photo to shame me?

No. Camera access and ID photos may be used for legitimate verification, fraud prevention, or payment verification. They should not be used to harass, embarrass, threaten, or publicly shame a borrower.

Can I ask an online lending app to delete my data after I paid?

Yes, you may request deletion, blocking, or destruction of data that is no longer necessary, unlawfully obtained, outdated, false, or used without authority. The lender may still retain certain records when required by law, regulation, accounting, audit, fraud prevention, or legitimate legal purposes, but it should not keep data forever for vague future use.

What if I really owe the money? Can I still complain about harassment?

Yes. A valid debt does not legalize harassment, threats, public shaming, contact-list abuse, or unlawful data processing. The lender may pursue lawful collection, but it must follow data privacy and fair collection rules.

Where should I file a complaint: NPC, SEC, PNP, or NBI?

File with the NPC for data privacy violations, such as unauthorized contact-list access, misuse of photos, unlawful disclosure, or refusal to honor privacy rights. File with the SEC for unfair debt collection or lending company issues. Go to PNP or NBI cybercrime units for threats, fake posts, identity theft, hacking, cyberlibel, or online extortion.

Do I need a notarized complaint for the NPC?

For a formal NPC complaint, the NPC generally requires a specific complaint format, often a notarized complaint-affidavit or verified complaint, plus evidence. Check the NPC’s current complaint instructions before filing because forms and submission rules may change.

What evidence should I collect before uninstalling the app?

Save screenshots, call logs, in-app messages, privacy notices, permission prompts, loan agreements, receipts, app details, and screenshots from contacts who were messaged. Also save URLs, usernames, phone numbers, dates, and times.

Can an OFW file a complaint against a Philippine online lending app?

Yes, if the app or lender has a Philippine connection and the issue involves Philippine data privacy, lending, collection, or cybercrime rules. OFWs should organize digital evidence carefully and check notarization, consular, or apostille requirements for affidavits signed abroad.

Will filing a privacy complaint cancel my loan?

Not automatically. A privacy or harassment complaint addresses unlawful processing, abusive collection, or related violations. It does not automatically erase a legitimate loan. Debt disputes, payment issues, and privacy violations should be documented separately.

Key Takeaways

• Online lending apps in the Philippines must follow the Data Privacy Act, NPC circulars, SEC debt collection rules, and consumer protection laws.
• Loan apps cannot freely harvest your contacts, use your selfie for shaming, or contact everyone in your phonebook to collect a debt.
• A valid debt does not give collectors the right to threaten, insult, publicly shame, or harass you or your contacts.
• Preserve evidence before deleting the app or blocking collectors.
• Revoke unnecessary app permissions through your phone settings.
• Send a written data privacy request to the lender and keep proof of receipt.
• File with the NPC for privacy violations, the SEC for unfair lending or collection practices, and cybercrime authorities for threats, fake posts, identity theft, or hacking.
• Keep loan records, payment receipts, screenshots, and a clear timeline so your complaint is easier to evaluate.

How to Protect Your Personal Data from Online Lending Apps in the Philippines

Online lending apps can be useful in an emergency, but they become dangerous when they demand excessive phone permissions, harvest your contacts, shame you on Facebook or Messenger, call your employer, or threaten your family over a loan. In the Philippines, you have legal rights over your personal data even if you borrowed money, even if you are delayed in payment, and even if you clicked “I agree” in the app. This article explains what online lending apps may and may not do, how to protect your phone and contacts, how to document harassment, and where to complain in the Philippines.

What personal data do online lending apps usually collect?

An online lending app may collect basic information needed to assess and process a loan, such as your name, mobile number, address, selfie, ID, income details, bank or e-wallet information, and loan history. Some apps also ask for access to your contacts, photos, location, camera, microphone, SMS, social media accounts, or installed apps.

The legal issue is not simply whether the app collected data. The bigger questions are:

• Was the data collection lawful, fair, and transparent?
• Was the data necessary for the loan?
• Were you clearly told what data would be collected and why?
• Did the app use your data only for the purpose disclosed?
• Did it disclose your loan information to people who had no legal need to know?
• Did it use your contacts or photos to pressure, shame, or threaten you?

Under the Philippine Data Privacy Act, “consent” must be freely given, specific, and informed, and it may be shown through written, electronic, or recorded means. The Act also defines a “data subject” as the individual whose personal information is processed. (National Privacy Commission)

Your legal rights under Philippine law

1. Your data privacy rights under RA 10173

The main law is Republic Act No. 10173, or the Data Privacy Act of 2012. If an online lending app processes your personal information, you are a data subject and you have enforceable rights.

Important rights include the right to be informed whether your personal information is being processed, the right to know the purpose, scope, method, recipients, controller identity, retention period, and available remedies, and the right to access information about what data was processed, where it came from, who received it, and why it was disclosed. (National Privacy Commission)

You also have the right to correct inaccurate data and, upon substantial proof, to suspend, withdraw, block, remove, or destroy personal information that is incomplete, outdated, false, unlawfully obtained, used for unauthorized purposes, or no longer necessary. The law also recognizes a right to damages for inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal information. (National Privacy Commission)

In simple terms: being in debt does not erase your privacy rights. A lender may collect a legitimate debt, but it may not treat your phonebook, photos, workplace, or family as collection tools.

2. SEC rules on unfair debt collection

Most lending companies and financing companies in the Philippines are regulated by the Securities and Exchange Commission (SEC) under laws such as RA 9474, the Lending Company Regulation Act of 2007, and RA 8556, the Financing Company Act of 1998, as amended.

SEC Memorandum Circular No. 18, Series of 2019 specifically prohibits unfair debt collection practices by financing companies, lending companies, and third-party service providers hired by them. The circular covers abusive acts such as threats of violence or criminal means, threats to take action that cannot legally be taken, insults or profane language intended to abuse the borrower, and publication of names or personal information of borrowers who allegedly refuse to pay.

The same SEC circular treats as unfair the act of communicating or threatening to communicate false loan information, including a false claim that a debt is being disputed, and contacting borrowers at unreasonable hours, generally before 6:00 a.m. or after 10:00 p.m., subject to the circular’s stated exceptions. It also states that contacting people in the borrower’s contact list other than those named as guarantors or co-makers is an unfair debt collection practice, notwithstanding the borrower’s consent.

This is one of the most important protections for borrowers. If the app calls your mother, officemate, barangay captain, HR manager, or Facebook friend just because their number was in your phone contacts, that may be a serious red flag unless that person was actually named as a guarantor or co-maker.

3. Truth in Lending Act disclosures

RA 3765, the Truth in Lending Act, requires disclosure of finance charges and credit costs so borrowers can understand the true cost of credit before entering into a loan transaction. The SEC also lists Memorandum Circular No. 7, Series of 2011 as an issuance implementing the Truth in Lending Act for transaction transparency among financing and lending companies. (Lawphil)

Before borrowing, you should be able to see the loan amount, interest, processing fees, penalties, net proceeds, due date, and total amount payable. If an app advertises “0% interest” but deducts hidden fees or makes the repayment amount unclear, keep screenshots.

4. Civil Code protection against privacy invasion and humiliation

Even outside the Data Privacy Act, the Civil Code of the Philippines may apply. Articles 19, 20, and 21 require every person to act with justice, give everyone his due, observe honesty and good faith, and compensate another person for damage caused contrary to law, morals, good customs, or public policy. (Lawphil)

Article 26 also protects a person’s dignity, personality, privacy, and peace of mind. It recognizes civil actions for acts such as meddling with private life or humiliating another person because of personal condition. This can matter where debt collectors publicly shame a borrower or drag family and workplace relationships into a private loan dispute. (AMSLAW)

5. Possible criminal issues: threats, coercion, libel, and cybercrime

Depending on the facts, abusive collection may also involve criminal laws. Examples include:

• Grave threats under Article 282 of the Revised Penal Code, if a collector threatens harm that amounts to a crime.
• Coercion under Articles 286 or 287, if intimidation is used to force a person to do something against their will.
• Libel or cyberlibel, if defamatory statements are published online.
• Identity-related cybercrime or unauthorized access issues under RA 10175, the Cybercrime Prevention Act of 2012, depending on the conduct.

The Supreme Court in Disini v. Secretary of Justice, G.R. No. 203335 (2014) dealt with the constitutionality of the Cybercrime Prevention Act, including online libel issues. (Lawphil) For repeated harassment that causes distress but may not fit a heavier offense, Philippine jurisprudence on unjust vexation is also relevant; in Maderazo v. People, G.R. No. 165065 (2006), the Court discussed unjust vexation as conduct causing annoyance, irritation, or vexation. (Supreme Court E-Library)

How to protect your personal data before using an online lending app

1. Check if the lender is legitimate

Do not rely on Google Play, the App Store, Facebook ads, TikTok videos, or professional-looking websites. App-store availability is not the same as SEC authority.

Before applying, check:

What to verify	Why it matters
Corporate name	The app name may be only a brand; you need the actual company behind it.
SEC registration number	Shows the entity is registered, but this alone is not enough.
Certificate of Authority number	Lending and financing companies need authority to operate.
Whether the online lending platform is recorded with SEC	An app may be connected to a company but still not properly recorded as an online platform.
Office address, customer service channel, and privacy notice	Legitimate lenders should be traceable and responsive.

SEC Memorandum Circular No. 19, Series of 2019 covers disclosure requirements in advertisements of financing and lending companies and reporting of online lending platforms; the SEC lists it under financing and lending company issuances. (SEC Appointment System) Professional summaries of the circular state that financing and lending companies are required to disclose their corporate name, SEC registration number, Certificate of Authority number, and an advisory for borrowers to study the disclosure statement before proceeding. (PwC)

2. Read the permissions before installing

Be careful if the app asks for access to:

• Your full contacts list
• Photos and videos
• SMS messages
• Call logs
• Microphone
• Precise location
• Social media accounts
• Files unrelated to loan processing

A lending app may need your camera to capture an ID or selfie, but it usually should not need broad access to your entire phonebook, private gallery, messages, or social media. If the app refuses to proceed unless you allow excessive permissions, consider that a warning sign.

3. Use privacy settings immediately

On Android or iPhone, review app permissions after installation. Turn off anything not needed.

Common privacy steps:

1. Go to Settings.
2. Open Apps or Privacy & Security.
3. Select the lending app.
4. Disable access to contacts, photos, location, microphone, and SMS unless truly necessary.
5. Disable background activity if available.
6. Keep screenshots of the permissions requested.

If you already granted access before, disabling permissions later may not erase data already copied by the app. That is why early caution matters.

4. Do not upload unnecessary documents

Many borrowers panic and upload extra documents to “increase approval chances.” Avoid sending unnecessary files such as:

• Family members’ IDs
• Employer documents not required for the loan
• Children’s school records
• Utility bills under another person’s name
• Screenshots of private conversations
• Full bank statements when a limited proof of income would do

If the app requires a reference person, do not list someone without telling them. Do not list a person as guarantor or co-maker unless that person actually agreed to be legally bound.

What to do if an online lending app is already harassing you

Step 1: Secure evidence before blocking

Do not delete messages right away. First, collect proof.

Save:

• Screenshots of texts, chats, push notifications, emails, and Facebook messages
• Call logs showing date, time, and number
• Recordings, if available and lawfully obtained
• Screenshots of threats to contact your family, employer, or social media contacts
• Screenshots of posts publicly shaming you
• App permissions and privacy policy
• Loan disclosure statement, repayment schedule, and proof of payments
• Names, phone numbers, email addresses, and account names of collectors
• Screenshots from relatives or coworkers who were contacted

Make a simple timeline:

Date and time	What happened	Evidence
Jan. 3, 9:15 p.m.	Collector threatened to message employer	Screenshot of SMS
Jan. 4, 7:30 a.m.	Mother received call about loan	Mother’s screenshot and statement
Jan. 5, 11:45 p.m.	Collector called after 10 p.m.	Call log
Jan. 6	Facebook post with borrower’s photo	Screenshot and URL

This timeline helps SEC, NPC, police, prosecutors, and courts understand the pattern quickly.

Step 2: Send a short written objection to the lender

Before filing with the NPC, it is usually helpful to show that you informed the personal information controller or lender and gave them a chance to act, unless the situation is urgent or dangerous.

Use a short message like this:

I object to the unauthorized use and disclosure of my personal data. I do not consent to your collectors contacting persons in my phone contacts, employer, relatives, friends, or social media connections who are not guarantors or co-makers. Please stop processing my personal data for harassment, public shaming, or disclosure of my loan information to unauthorized persons. Please also provide the identity and contact details of your Data Protection Officer, the source of the data used, the recipients of my data, and the legal basis for your processing.

Send it by email, in-app support, registered mail, or any channel that creates a record. Keep proof of sending.

Step 3: Revoke unnecessary app permissions and preserve your accounts

After saving evidence:

1. Turn off the app’s access to contacts, photos, location, SMS, and microphone.
2. Change passwords for email, e-wallets, social media, and banking apps.
3. Enable two-factor authentication.
4. Warn close contacts not to respond to collectors or send money to unknown accounts.
5. Report fake profiles or public shaming posts to the platform.
6. Avoid sending more IDs or selfies to “settle” harassment.

Deleting the app may reduce access going forward, but it does not cancel the debt and does not erase data already copied. Treat deletion as a privacy step, not a legal solution.

Step 4: File the right complaint with the right office

Different offices handle different issues.

Problem	Where to report	What to prepare
Unauthorized use, disclosure, or harvesting of personal data	National Privacy Commission	Notarized complaint or assisted complaint form, evidence, timeline, proof you contacted the lender if available
Unfair debt collection by lending or financing company	SEC	Complaint, screenshots, loan details, company/app name, collector details
Threats, extortion, identity misuse, hacking, cyberlibel, fake posts	PNP Anti-Cybercrime Group or NBI Cybercrime Division	Screenshots with URLs, call logs, account names, device details, IDs
Local in-person harassment by an identifiable collector	Police station; barangay blotter may help document the incident	Name/description, video/CCTV, witnesses
Bank or credit card issue, not a lending app	BSP consumer assistance channels	Bank name, account details, complaint history
Credit report dispute	Credit Information Corporation or relevant credit bureau	Credit report, disputed entry, proof of payment or correction request

The Credit Information Corporation itself notes that concerns involving lending and financing companies, online lending apps, and microfinance institutions should be directed to the SEC, while banks and credit card companies fall under the BSP. (Credit Information Corporation (CIC))

SEC also has the iMessage SEC platform for public complaints, inquiries, incidents, and requests, with ticket tracking. (Securities and Exchange Commission)

Step 5: File a privacy complaint with the NPC when data misuse is involved

For privacy violations, the National Privacy Commission is the main agency. The NPC states that a formal complaint must be in the required format, printed and filled out, notarized, and submitted personally, by courier, or by scanned email. (National Privacy Commission) The NPC also states that a complaint may be filed by the data subject, or by a representative authorized by a special power of attorney. (National Privacy Commission)

The NPC’s complaint guidance says a complainant should file a filled-out and notarized complaint-assisted form or verified complaint together with copies of evidence and witness affidavits, through personal filing, registered mail, courier, or authorized email filing. (National Privacy Commission)

Practical documents to prepare:

• Government ID
• Loan agreement, disclosure statement, or screenshots of loan details
• App name and company name
• Privacy policy and terms of service
• Screenshots of permissions requested
• Screenshots of harassment or disclosure
• Call logs and messages
• Statements from contacted relatives, coworkers, or friends
• Proof you asked the lender to stop, if available
• Notarized complaint form
• Special Power of Attorney, if someone else files for you

If you are abroad, check whether the NPC will accept scanned notarized submissions for your situation. For documents signed abroad and used in the Philippines, notarization before a Philippine Embassy or Consulate, or local notarization plus apostille depending on the country and document, may be required. The Philippine Embassy in Washington, D.C., for example, explains the general process for private documents as local notarization, apostille by the competent authority, then use in the Philippines. (Philippine Embassy)

Common real-life scenarios

“The app messaged my contacts even though they are not guarantors.”

Save screenshots from each contacted person. Ask them to send you the date, time, number or account used, and exact message received. Under SEC MC No. 18, contacting people in your contact list other than guarantors or co-makers may be an unfair collection practice. It may also support a privacy complaint if your loan information or personal data was disclosed without a lawful basis.

“They posted my photo and called me a scammer.”

Take screenshots showing the full post, URL, account name, date, time, reactions, and comments. Ask friends not to argue online because arguments can make the post spread further. Report the post to the platform, but preserve evidence first. Depending on the wording and facts, this may raise issues under data privacy law, SEC debt collection rules, Civil Code damages, and possibly cyberlibel.

“They said I will be arrested if I do not pay today.”

A simple unpaid private debt is generally a civil matter. There is no automatic arrest merely because you failed to pay a loan. However, fraud, falsified documents, bouncing checks, or other separate criminal acts may create different issues. If a collector falsely threatens arrest, jail, or police action to force payment, keep the message and include it in your SEC complaint.

“They keep calling late at night.”

Save call logs. SEC MC No. 18 treats contact before 6:00 a.m. or after 10:00 p.m. as unreasonable or inconvenient, subject to its stated exceptions. Repeated late-night calls may also support a complaint for harassment or unfair collection.

“I paid, but they still threaten me.”

Keep proof of payment: screenshots, reference numbers, receipts, bank or e-wallet confirmations, and any settlement agreement. Send a written demand for account reconciliation and correction of records. If the lender continues to disclose that you are unpaid despite proof, that can strengthen a privacy and regulatory complaint.

Practical timelines, fees, and bottlenecks

Process	Typical timing in practice	Common bottlenecks
App customer service complaint	A few days to 2 weeks	No response, generic replies, app disappears
SEC ticket or complaint intake	Days to several weeks	Incomplete company details, missing screenshots, wrong app name
NPC complaint preparation	1–7 days if evidence is complete	Notarization, lack of proof, failure to identify respondent
NPC proceedings	Often months, depending on complexity	Need for comments, mediation, investigation, volume of cases
Police/NBI cyber complaint	Same day intake possible, investigation varies	Need for original device, URLs, account identifiers, technical tracing
Platform takedown request	Hours to weeks	Post already shared, fake accounts, incomplete reporting

The biggest bottleneck is usually not the law. It is evidence. Many borrowers delete the app, erase messages, change phones, or block everyone before saving proof. Preserve evidence first, then secure your accounts.

What not to do

Avoid these common mistakes:

• Do not ignore serious threats involving violence, stalking, or identity misuse.
• Do not post the collector’s personal information publicly in revenge.
• Do not send more IDs, selfies, or passwords to stop harassment.
• Do not pay a random GCash number unless you can verify it is an official payment channel.
• Do not sign a settlement admitting false facts just to stop calls.
• Do not assume a Facebook page, Telegram group, or app-store listing proves legitimacy.
• Do not rely only on a barangay complaint if the issue is data misuse by a regulated company.
• Do not delete evidence before filing with SEC, NPC, PNP, or NBI.

Frequently Asked Questions

Can online lending apps access my contacts in the Philippines?

They may ask for permission, but asking does not automatically make broad access lawful. The lender must still comply with the Data Privacy Act’s principles of lawful, fair, transparent, necessary, and proportionate processing. Under SEC MC No. 18, contacting people in your contact list other than guarantors or co-makers is treated as an unfair debt collection practice.

Can an online lending app post my name and photo online if I do not pay?

No lender should use public shaming as a collection method. Publication of names and personal information of borrowers who allegedly refuse to pay is identified in SEC MC No. 18 as an unfair collection practice, subject to the circular’s rules. It may also create data privacy, civil, or criminal issues depending on the facts.

Can I file a complaint even if I really owe money?

Yes. Your obligation to pay a lawful debt is separate from your right to privacy and protection from abusive collection. A lender can pursue lawful collection, but it cannot threaten, shame, deceive, or misuse your personal data.

Where do I report online lending app harassment in the Philippines?

Report privacy violations to the National Privacy Commission, unfair debt collection by lending or financing companies to the SEC, and threats, hacking, identity misuse, or cyberlibel to the PNP Anti-Cybercrime Group or NBI Cybercrime Division. Use the office that matches the conduct, and file with more than one office if the facts involve multiple violations.

Do I need a lawyer to file with the NPC or SEC?

Not always. Many complaints can be filed personally if your evidence is organized and your complaint is clear. A lawyer becomes more important if there are large damages, criminal accusations, settlement negotiations, identity theft, employer involvement, or court action.

Is deleting the lending app enough to protect my data?

No. Deleting the app may stop future access, but it may not erase data already collected or shared. Before deleting, save evidence, revoke permissions, secure your accounts, and send a written request or objection if appropriate.

Can foreigners file privacy complaints in the Philippines?

Yes, if their personal data is processed in a way covered by Philippine law, especially by an entity operating in the Philippines. Practical issues may include notarization, identity documents, and special powers of attorney if someone in the Philippines will file or follow up for them.

Can a lending app call my employer?

A lender should not disclose your loan information to your employer unless there is a lawful basis and the employer is genuinely involved, such as where the employer was properly authorized for verification or the person contacted is a guarantor or co-maker. Calling HR or your boss simply to shame you or pressure payment can be evidence of unfair collection and unauthorized disclosure.

Can I demand deletion of my data after paying the loan?

You may request blocking, removal, or destruction of personal information if it is unlawfully obtained, used for unauthorized purposes, no longer necessary, or falls under the grounds recognized by the Data Privacy Act. The lender may still retain some records required by law, regulation, accounting, tax, anti-fraud, or legitimate claims purposes, but it should not keep or use your data without a lawful basis.

What if the online lending app is unregistered?

Document everything and report it to the SEC. If there are threats, fake posts, identity misuse, or hacking, report those facts to cybercrime authorities as well. Do not assume that an unregistered app will respond to ordinary customer service complaints; prioritize evidence preservation and official reporting.

Key Takeaways

• Debt does not cancel privacy rights. Borrowers still have rights under the Data Privacy Act.
• Contacting your phone contacts is not automatically allowed. SEC rules treat contacting contacts other than guarantors or co-makers as an unfair collection practice.
• Public shaming, threats, insults, false statements, and late-night harassment can be reportable.
• Check the lender’s corporate name, SEC registration, Certificate of Authority, and recorded online lending platform status before borrowing.
• Save evidence before deleting messages or blocking collectors.
• File with the right office: NPC for data privacy, SEC for lending company abuse, and PNP/NBI for cybercrime or threats.
• If you are abroad, prepare for notarization, apostille, or a Special Power of Attorney if someone will file for you in the Philippines.

How to Report an Unauthorized Loan Application in the Philippines

An unauthorized loan application can feel frightening because it usually means one of three things: someone used your name or ID to apply for a loan, a lender is treating you as a borrower or guarantor without your consent, or your personal data was pulled from a phone contact list and used in collection messages. In the Philippines, you do not have to simply ignore it or pay just to make the harassment stop. The right response is to preserve evidence, dispute the loan in writing, report to the correct regulator, and correct any credit record before the false loan damages your financial history.

What Counts as an Unauthorized Loan Application?

An unauthorized loan application happens when a person or company uses your personal information for a loan without your valid consent. Common examples include:

• Someone used your government ID, selfie, mobile number, or e-wallet account to apply for a loan.
• A loan app texted you saying your application was approved even though you never applied.
• A collector claims you are a co-maker or guarantor even though you never agreed to guarantee the loan.
• A lending app contacted your employer, relatives, or friends about a loan you did not take.
• A loan appears in your credit report even though you never signed, clicked, confirmed, or received the loan proceeds.
• A scammer used your identity to open or use a bank, credit, or e-wallet account connected to a loan.

A key point: being listed as a character reference is not the same as being a guarantor. A guarantor is someone who expressly agrees to answer for another person’s debt if that person defaults. Government guidance on online lending platforms emphasizes that guarantors must give separate consent before being bound, and lending or financing companies may contact only the guarantor for debt collection—not random people from the borrower’s contact list.

Your Legal Rights Under Philippine Law

Several Philippine laws may apply at the same time. The correct report depends on what happened.

Situation	Main legal basis	Where to report
Loan app or lending company used your data without consent	Data Privacy Act, RA 10173	National Privacy Commission
Lending/financing company or online lending platform used unfair collection practices	RA 9474, RA 11765, SEC rules	Securities and Exchange Commission
Bank, e-wallet, credit card issuer, or BSP-supervised entity allowed an unauthorized transaction	RA 11765, RA 12010	Provider first, then BSP
Someone used your identity online	Cybercrime Prevention Act, RA 10175	NBI Cybercrime Division or PNP Anti-Cybercrime Group
False loan appears in your credit report	Credit Information System Act, RA 9510	Credit Information Corporation dispute process
Forged documents, fake signatures, deception, or falsified loan papers	Revised Penal Code, especially falsification or estafa provisions	Prosecutor, NBI, PNP, or court process
You suffered damage, shame, job problems, or financial loss	Civil Code Articles 19, 20, and 21	Civil action or related claims

Under the Financial Products and Services Consumer Protection Act or RA 11765, financial consumers have rights to fair treatment, disclosure and transparency, protection from fraud and misuse, data privacy, and timely complaint handling. The same law requires financial service providers to maintain a consumer assistance mechanism and allows dissatisfied consumers to elevate complaints to the proper financial regulator. (Supreme Court E-Library)

For lending companies, RA 9474 requires a lending company to be a corporation and prohibits it from conducting lending business unless it has authority to operate from the SEC. It also gives the SEC power to supervise lending companies, require reports, and impose administrative sanctions, including suspension or revocation of authority to operate. (Supreme Court E-Library)

For data privacy, RA 10173 protects personal information and sensitive personal information, including government-issued identifiers. It gives data subjects rights such as access, correction, blocking or removal of unlawfully obtained or outdated data, damages, and the right to file a complaint. Unauthorized processing of personal or sensitive personal information can also carry criminal penalties. (National Privacy Commission)

For online identity misuse, RA 10175 punishes computer-related identity theft, including the unauthorized acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another person. (Supreme Court E-Library)

For bank, e-wallet, or financial account scams, RA 12010, the Anti-Financial Account Scamming Act, covers financial accounts such as deposit accounts, credit card accounts, transaction accounts, and e-wallets. It treats using another person’s identity or identification documents to open a financial account as an offense, and it allows institutions to temporarily hold funds in disputed transactions subject to the law and BSP rules. (Lawphil)

First Things to Do Within the First 24 Hours

Do not delete messages, uninstall the app, or block every number immediately. You need evidence.

1. Take screenshots with timestamps. Capture the app name, sender number, email address, collection message, loan reference number, amount, payment channel, and any threat or demand.

2. Save the original SMS, email, chat, or call log. Screenshots help, but original messages are better because they show metadata.

3. Write down a timeline. Include when you first received the notice, whether you ever downloaded the app, whether you submitted any ID, whether money was disbursed, and whether collectors contacted third parties.

4. Check your bank and e-wallet accounts. Look for unexplained deposits. Some abusive lenders release a smaller amount than advertised and then claim a much larger repayment.

5. Secure your accounts. Change passwords, activate multi-factor authentication, and report compromised SIMs, email accounts, or e-wallets to the service provider.

6. Do not admit the debt. Avoid saying “I will pay” or “I borrowed” if you did not. Use clear wording: “I dispute this loan. I did not apply for it, authorize it, receive it, or agree to guarantee it.”

7. Ask the lender for proof. Request a copy of the loan application, loan agreement, disclosure statement, ID used, selfie or KYC record, consent logs, disbursement account, IP/device record if available, and the basis for treating you as borrower or guarantor.

A simple written dispute can say:

I formally dispute this loan/application. I did not apply for, authorize, receive, or guarantee this loan. Please stop collection activity while this is investigated, provide proof of application and consent, preserve all records, and correct any report made to credit bureaus or the Credit Information Corporation.

Step-by-Step: How to Report an Unauthorized Loan Application

1. Identify the Type of Lender or Platform

Before filing, determine who is behind the loan.

Look for:

• exact company name, not just app name;
• SEC registration number or Certificate of Authority number;
• app developer name in Google Play, App Store, or website;
• privacy policy and terms of service;
• loan agreement or disclosure statement;
• collector phone numbers and email domains;
• payment recipient name, GCash/Maya number, bank account, or QR code.

This matters because the SEC handles lending and financing companies, the BSP handles BSP-supervised financial institutions such as banks and e-money issuers, the NPC handles personal data misuse, and law enforcement handles cybercrime and fraud.

2. File a Written Dispute With the Lender or Financial Institution

Under RA 11765, financial service providers must have a financial consumer protection assistance mechanism. If the complaint involves a bank, e-wallet, credit card issuer, or other BSP-supervised financial institution, report first to that provider’s consumer assistance channel. The BSP expects consumers to raise the concern with the institution first before escalating through the BSP Consumer Assistance Mechanism. (Bureau of Small and Medium Enterprises)

Ask for:

• confirmation that the loan is under dispute;
• suspension of collection, interest, fees, and adverse reporting while investigated;
• copies of the application and KYC documents;
• deletion or correction of wrong data;
• written outcome of the investigation.

RA 11765 specifically provides that, for alleged disputed amounts or unauthorized transactions, a financial service provider should suspend interest, fees, charges, or provide similar reasonable accommodations while its final investigation is pending. (Supreme Court E-Library)

3. Report Lending or Financing Company Abuse to the SEC

Report to the Securities and Exchange Commission if the issue involves:

• an online lending platform;
• a lending company;
• a financing company;
• unfair collection practices;
• harassment, threats, public shaming, or contacting your employer or relatives;
• a company using a loan app without proper SEC recording or authority.

The DICT, NPC, and SEC advisory on online lending platforms directs the public to report unfair debt collection practices to the SEC Financing and Lending Companies Department through the SEC iMessage portal and the 1-4SEC hotline.

Prepare these before filing:

• valid government ID;
• screenshots of messages, threats, calls, and app pages;
• disputed loan reference number;
• proof you disputed directly with the lender, if available;
• proof you did not receive proceeds, or proof that proceeds went to another account;
• names and numbers of collectors;
• list of third parties contacted;
• any loan agreement, disclosure statement, or collection notice sent to you.

For online filing, use the SEC’s iMessage portal, which allows users to open a ticket and check ticket status. (Securities and Exchange Commission)

4. File a Data Privacy Complaint With the NPC

Report to the National Privacy Commission if the lender, app, collector, or unknown person:

• processed your ID, selfie, contact number, address, employer, or references without authority;
• accessed your contact list unnecessarily;
• messaged your relatives, friends, workmates, or employer;
• falsely told others you were a borrower, co-maker, or guarantor;
• refused to correct or delete false personal data;
• used your personal information for harassment or public shaming.

The NPC complaint process requires a complaint in the proper format; the NPC page instructs complainants to download the form, fill it out, have it notarized, and submit it in person, by courier, or by scanned email to the NPC complaints address. (National Privacy Commission)

The NPC has also publicly acted against online lending practices involving phonebook access, third-party disclosure, harassment, and public shaming. In one decision involving an online lending app, the NPC found criminal liability for unauthorized processing under Section 25 of the Data Privacy Act and referred the matter to the Department of Justice. (National Privacy Commission)

5. Report Identity Theft, Threats, or Fraud to NBI or PNP

Go to cybercrime authorities if there is identity theft, hacking, phishing, fake accounts, forged online applications, threats, extortion, or use of your bank/e-wallet account.

The official 2026 advisory lists the NBI Cybercrime Division, PNP Anti-Cybercrime Group, and DICT Cyber Hotline as reporting channels for harassment, threats, frauds, and scams connected to online lending platforms.

For NBI Cybercrime Division complaints, the NBI Citizen’s Charter describes a process where the complainant proceeds to the Cybercrime Division, undergoes preliminary interview, fills out a complaint sheet, executes sworn statements or submits prepared affidavits, and may submit devices relevant to the probe. The listed processing time for the initial process is about one hour and ten minutes, with no fee stated in the charter. (National Bureau of Investigation)

Bring:

• your ID;
• phone containing the original messages;
• screenshots and printed copies;
• URL, app link, email address, or social media account used;
• bank/e-wallet account details involved;
• notarized affidavit if already prepared;
• names and contact details of witnesses or third parties contacted.

6. Escalate Bank, Credit Card, or E-Wallet Issues to the BSP

If the unauthorized loan application involved a bank, credit card, e-wallet, or BSP-supervised financial institution, escalate to the Bangko Sentral ng Pilipinas only after reporting first to the institution.

The BSP Consumer Assistance page says complaints may be filed through BSP Online Buddy, and alternatives include the Complaints, Inquiries and Requests form sent to the BSP consumer affairs email. It also lists the details to include: summary of complaint, requested resolution, contact details, copy of the complaint filed with the institution, the institution’s reply if any, and supporting documents. (Bureau of Small and Medium Enterprises)

BSP escalation is especially important if:

• the loan proceeds were sent to an account you do not own;
• an e-wallet under your name was used without your consent;
• a bank or wallet refuses to investigate;
• the institution keeps charging interest after you reported an unauthorized transaction;
• a credit card or credit line was opened or used fraudulently.

7. Check and Dispute Your Credit Report

Even if collectors stop, a false loan may still damage your credit record.

The Credit Information Corporation operates an Online Dispute Resolution System for discrepancies in a CIC credit report. The CIC explains that a dispute is meant to resolve erroneous, misleading, incomplete, or outdated credit data appearing in a credit report, and that a person must first acquire a credit report before filing a dispute. The CIC also states that it cannot unilaterally change data and relies on evidence and the concerned submitting entity during the dispute process. (Credit Information Corporation (CIC))

Use the CIC dispute process when:

• a loan you did not take appears in your credit report;
• the amount, status, or payment history is wrong;
• the reporting entity refuses to correct the record;
• a rejected loan or unauthorized application affected your credit standing.

Attach your police/NBI/PNP report, lender dispute, SEC/NPC complaint, and proof that the account or disbursement was not yours.

Documents to Prepare

Document	Why it matters
Valid government ID or passport	Proves your identity as complainant
Screenshots with timestamps	Shows collection messages, threats, app notices, or false claims
Original SMS, emails, chats, call logs	Helps investigators verify source and chronology
Loan reference number or account number	Helps the lender/regulator locate the account
Bank or e-wallet transaction history	Shows whether proceeds were received or sent elsewhere
Written dispute to lender/provider	Shows you attempted first-level resolution
Complaint-affidavit or sworn statement	Often needed for NPC, NBI, PNP, or prosecutor action
Credit report	Needed if you are asking CIC to correct a false record
Authority document, if represented by another person	Needed if an OFW, foreigner abroad, or elderly relative asks someone in the Philippines to file

For Filipinos abroad and foreigners dealing with Philippine agencies, affidavits and Special Powers of Attorney may need consular notarization or apostille depending on where the document is executed and where it will be used. Philippine consulates commonly notarize affidavits and powers of attorney for use in the Philippines, while the DFA Apostille system covers authentication of eligible documents. (Philippine Embassy)

Practical Timelines and Bottlenecks

Process	Practical timeline	Common bottleneck
Lender/provider internal dispute	A few days to several weeks	Generic replies or refusal to provide application records
SEC complaint	Varies depending on completeness and respondent	Unknown corporate name behind the app
NPC complaint	Varies; formal complaint must follow required format	Unnotarized or incomplete complaint-affidavit
NBI/PNP cybercrime report	Same-day intake possible; investigation takes longer	No original device, deleted messages, or unclear account trail
BSP escalation	Initial acknowledgment may be quick; referral depends on facts	Consumer did not complain to the financial institution first
CIC dispute	Requires credit report first	Error cannot be corrected without submitting entity response or proof

The biggest mistake is filing vague complaints such as “this app is a scam” without proof. Regulators need names, dates, screenshots, account numbers, app links, phone numbers, and a clear explanation of what was unauthorized.

Common Mistakes to Avoid

Paying a Small Amount “Just to Stop the Calls”

If you did not borrow, paying may be interpreted by the company as recognition of the loan. If you decide to pay for practical reasons, clearly label the payment in writing as under protest and continue disputing the unauthorized account.

Ignoring a False Credit Record

Collectors may disappear, but credit reports can affect later applications for housing loans, car loans, credit cards, or employment-related financial checks. Pull your credit report and dispute the false item through the CIC if it appears.

Filing Only With the Barangay

A barangay blotter may help document harassment by a known person in your area, but it will not usually resolve a corporate lending app, credit reporting error, data privacy violation, or cybercrime. For online lending and identity theft, use SEC, NPC, BSP, CIC, NBI, or PNP as appropriate.

Sending Your ID Again Without Conditions

Many victims send more IDs to “verify” the dispute. If you must submit ID, send it only through official channels, watermark the copy, and state that it is submitted solely for identity verification in the complaint.

Forgetting About Third Parties

If collectors contacted your employer, relatives, or friends, ask those persons to save screenshots and write short statements describing what they received. This helps prove unauthorized disclosure, harassment, and reputational harm.

Frequently Asked Questions

Can I be forced to pay a loan I never applied for?

A person generally cannot be forced to pay a loan merely because a lender says their name or number appears in an application. The lender must prove a valid obligation, consent, identity verification, and release of proceeds. If you did not apply, did not receive proceeds, and did not authorize anyone, dispute the account immediately and ask for proof.

What if I was listed as a guarantor without consent?

Being named in an app is not enough. A guarantor must separately agree to assume responsibility for the debt. The 2026 DICT-NPC-SEC advisory specifically reminds online lending platforms that guarantors must give separate consent before being bound.

Where do I report an online lending app that used my contacts?

Report unfair debt collection to the SEC, personal data misuse to the NPC, and threats or fraud to NBI or PNP. If the app accessed your contact list or messaged people who were not guarantors, that may involve both SEC collection rules and Data Privacy Act issues.

Should I report to the SEC or NPC first?

File with the agency that matches the harm. If the main issue is abusive collection by a lending or financing company, file with the SEC. If the issue is unlawful processing, disclosure, or misuse of your personal data, file with the NPC. Many serious online lending cases justify filing with both.

What if the lender is a bank, credit card company, or e-wallet provider?

Complain first to the bank, card issuer, or e-wallet provider. If unresolved or mishandled, escalate to the BSP Consumer Assistance Mechanism. BSP guidance says consumers may file through BSP Online Buddy or submit the BSP CIR form with the complaint summary, requested resolution, provider complaint, provider reply, and supporting documents. (Bureau of Small and Medium Enterprises)

Can I file a cybercrime case for unauthorized loan applications?

Yes, when the facts show online identity theft, phishing, hacking, fake accounts, fraudulent use of IDs, or electronic threats. RA 10175 covers computer-related identity theft, and NBI/PNP cybercrime units can receive complaints involving digital evidence. (Supreme Court E-Library)

What if a loan appears in my CIC credit report?

Get a copy of your credit report and file a dispute through the CIC Online Dispute Resolution System. The CIC process is for erroneous, misleading, incomplete, or outdated credit data, but the CIC cannot simply change the record on its own without going through the dispute process and the submitting entity. (Credit Information Corporation (CIC))

Do foreigners have remedies in the Philippines?

Yes, if the lender, app, financial institution, transaction, or data processing has a Philippine connection. Foreigners should use their passport, ACR I-Card if available, Philippine address or contact details if relevant, and properly notarized or authenticated documents if filing from abroad.

Can I demand deletion of my data?

You may request correction, blocking, removal, or destruction of personal data that is false, unlawfully obtained, used for unauthorized purposes, outdated, or no longer necessary. The Data Privacy Act recognizes these rights, subject to lawful exceptions such as investigations and legal claims. (National Privacy Commission)

Can I sue for damages?

Possible claims may arise if the unauthorized loan application, data misuse, harassment, or false credit reporting caused actual loss, reputational injury, emotional distress, or financial harm. Civil Code Articles 19, 20, and 21 are commonly relevant because they require people to act with justice, honesty, and good faith and provide liability for wrongful acts causing damage. (Lawphil)

Key Takeaways

• Dispute the loan in writing immediately; do not admit the debt if you did not apply or consent.
• Save original messages, screenshots, app details, call logs, transaction records, and names of people contacted.
• Report lending and collection abuse to the SEC, data privacy violations to the NPC, bank/e-wallet issues to the provider and BSP, cybercrime to NBI or PNP, and false credit records to the CIC.
• A character reference is not automatically a guarantor; a guarantor must separately consent to be bound.
• Unauthorized use of your ID, selfie, phone number, contact list, bank account, or e-wallet may involve data privacy, cybercrime, financial consumer protection, and civil liability issues.
• Correct the credit report, not just the harassment, because a false loan can affect future borrowing and financial reputation.

What to Do If Your Identity Is Stolen Through a Lending App Account

If someone used your name, ID, selfie, phone number, or contacts to open a lending app account in the Philippines, treat it as both a financial fraud problem and a data privacy/cybercrime problem. The goal is not just to stop the collectors. You also need to preserve evidence, dispute the debt in writing, report the identity theft to the proper agencies, protect your bank/e-wallet accounts, and prevent the fake loan from damaging your credit record.

What identity theft through a lending app usually looks like

In Philippine online lending cases, identity theft often happens in one of these ways:

• Someone uses your lost ID, passport, driver’s license, UMID, PhilID, or company ID to pass “Know Your Customer” or KYC checks.
• A scammer gets access to your phone, SIM, email, or e-wallet and opens a loan account.
• Your face, selfie, or video verification is copied, manipulated, or taken under false pretenses.
• A lending app accesses your contact list, gallery, SMS, or device data beyond what is necessary.
• A person you know uses your personal details and lists your relatives or friends as “references.”
• A fake or unlicensed lending app collects personal data, then uses threats, public shaming, or fake debt notices to pressure payment.

The legal issue is not simply “utang.” If you did not apply for the loan, did not receive the money, and did not consent to the transaction, the case may involve computer-related identity theft, access device fraud, data privacy violations, falsification, estafa, or unfair debt collection practices, depending on the facts.

Are you liable for a lending app loan you did not apply for?

Generally, a person should not be treated as liable for a loan they did not authorize. A loan contract requires consent. Under the Civil Code of the Philippines, contracts require consent, object, and cause. If your identity was stolen, the central issue is that your supposed consent was fake.

That does not mean you can ignore the problem. In practice, lending apps and collection agents may continue sending messages unless you create a clear paper trail showing that:

1. you deny applying for the loan;
2. you deny receiving the loan proceeds;
3. your identity documents or personal data were misused;
4. you reported the incident to the proper authorities; and
5. you demanded that the lender investigate, freeze collection, stop reporting the account as yours, and preserve evidence.

If the lending company later files a collection case, your written dispute, police/NBI report, screenshots, and credit report dispute records may become important evidence.

Key Philippine laws that protect you

Data Privacy Act of 2012: your personal data cannot be used freely

The Data Privacy Act of 2012, Republic Act No. 10173, protects personal information and sensitive personal information such as names, addresses, contact numbers, government IDs, financial details, biometrics, and other identifying data.

For lending app cases, this matters because lenders and lending platforms must follow data privacy principles such as:

• transparency — you should know what data is collected and why;
• legitimate purpose — data should be used only for a lawful and declared purpose;
• proportionality — the app should not collect more data than necessary;
• security — the company must protect your data from unauthorized access or misuse.

The National Privacy Commission also issued specific rules on loan-related data processing through NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02. These rules are especially relevant when a lending app accesses contact lists, uses character references improperly, or contacts people who never agreed to be guarantors.

In a 2026 joint public advisory, the DICT, NPC, and SEC reminded online lending platforms that unnecessary app permissions, excessive contact-list processing, harassment, public shaming, and contacting people other than actual guarantors for debt collection are prohibited. The advisory also says a guarantor must have separately consented to be bound as a guarantor; being named as a contact or character reference is not the same thing as guaranteeing the loan. See the official DICT-NPC-SEC advisory on online lending platforms.

Cybercrime Prevention Act: using your identity online may be a crime

The Cybercrime Prevention Act of 2012, Republic Act No. 10175, penalizes computer-related identity theft. This covers the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another person without right.

In a lending app situation, this may apply when someone uses your personal information, ID, selfie, login credentials, or device-linked data to create or control an online loan account.

Access Devices Regulation Act: fraudulent access to apps, banking, cards, and accounts

The Access Devices Regulation Act of 1998, Republic Act No. 8484, as amended by Republic Act No. 11449, may apply when the fraud involves online banking, e-wallets, cards, account numbers, PINs, codes, apps, or other means of account access.

RA 11449 specifically expanded the law to cover acts such as accessing an application, online banking account, credit card account, ATM account, or debit card account in a fraudulent manner, even if no monetary loss results.

This matters if the stolen lending app identity was connected to:

• a bank account;
• e-wallet account;
• debit card;
• credit card;
• OTP;
• SIM-linked financial account;
• app login credentials; or
• payment channel used to receive or move loan proceeds.

Financial Products and Services Consumer Protection Act

The Financial Products and Services Consumer Protection Act, Republic Act No. 11765, protects consumers of financial products and services, including digital financial products. It recognizes rights such as fair treatment, disclosure and transparency, data privacy, protection against fraud and misuse, and timely handling of complaints.

For lending apps, the relevant regulator is often the Securities and Exchange Commission, because lending companies and financing companies are generally regulated by the SEC.

SEC rules on unfair debt collection

The SEC issued Memorandum Circular No. 18, series of 2019, prohibiting unfair debt collection practices by financing companies, lending companies, and their service providers.

Collectors should not use threats, insults, obscenities, violence, false representations, public shaming, or illegal pressure tactics. A collector also cannot lawfully threaten imprisonment for a mere unpaid civil debt. Article III, Section 20 of the 1987 Philippine Constitution states that no person shall be imprisoned for debt.

This protection does not excuse fraud. But if you are a victim whose identity was used without permission, the lender or collector should not treat you as a criminal just to force payment.

Civil Code remedies for abuse, privacy invasion, and damages

The Civil Code of the Philippines may also matter. Articles 19, 20, and 21 require people to act with justice, honesty, good faith, and respect for rights; a person who willfully or negligently causes damage contrary to law may be liable. Article 26 protects a person’s dignity, personality, privacy, and peace of mind.

These provisions may support claims for damages in serious cases involving public shaming, false accusations, harassment of family members, reputational injury, or misuse of personal information.

What to do immediately if your identity was stolen through a lending app

1. Secure your phone, SIM, email, e-wallets, and bank accounts

Do this first because identity theft often continues after the fake loan account is opened.

• Change passwords for your email, lending apps, e-wallets, online banking, and social media.
• Turn on two-factor authentication using an authenticator app where possible.
• Remove unknown devices from your email, Google, Apple, e-wallet, and banking accounts.
• Call your bank or e-wallet provider if loan proceeds or suspicious transfers touched your account.
• Ask your telco to check if your SIM was replaced, duplicated, or registered suspiciously.
• If your phone was stolen, request SIM blocking or replacement and report the device loss.
• Revoke unnecessary app permissions for contacts, camera, SMS, files, microphone, and location.

If your National ID, passport, driver’s license, or other government ID was used, keep a written record of when you discovered the misuse. If the physical ID was lost or stolen, report that separately to the issuing agency or appropriate authority.

2. Preserve evidence before deleting anything

Do not rely on memory. Save evidence in a way that shows dates, numbers, names, and account details.

Collect:

• screenshots of loan app messages, SMS, emails, and in-app notices;
• screenshots of threats, public posts, group chats, or messages to your contacts;
• call logs showing collector numbers and dates;
• the app name, website, package name, app store link, and company name;
• loan account number, reference number, due date, amount, interest, penalties, and disbursement details;
• the name of the lending company or financing company, if shown;
• proof that the receiving bank/e-wallet account was not yours;
• copies of IDs that may have been misused;
• proof that you were abroad, at work, hospitalized, or otherwise unable to apply, if relevant;
• affidavits or screenshots from relatives or friends who were contacted.

For important screenshots, include the full screen with the date/time if possible. Export chats instead of sending only cropped images. If a collector calls, write a short incident log immediately after the call: date, time, number, name used, exact threats, and witnesses nearby.

3. Send a written dispute to the lending app or lending company

Report the account as fraudulent in writing. Use the official email, in-app support, website complaint form, or registered business contact. Avoid relying only on phone calls.

Your message should be short but complete:

I am disputing this loan/account because I did not apply for it, did not authorize it, and did not receive the proceeds. I believe my identity and personal data were used without my consent. Please immediately freeze collection activity, stop contacting my contacts, stop reporting this as my debt, preserve all KYC documents, device logs, IP logs, disbursement records, consent records, call recordings, and collection records, and provide me the result of your fraud investigation in writing.

Ask for the following:

• copy of the loan application;
• KYC documents allegedly submitted;
• selfie/video verification records;
• IP address, device ID, phone number, email, and SIM used for registration;
• bank/e-wallet account where loan proceeds were released;
• consent logs and privacy notice accepted;
• list of third-party collectors handling the account;
• confirmation that collection and credit reporting are suspended while under fraud investigation.

Do not sign a “settlement,” “restructuring,” “promise to pay,” or “acknowledgment of debt” unless the document clearly states that you are not admitting the loan and are only resolving a disputed identity theft matter.

4. File a cybercrime report with PNP ACG or NBI Cybercrime

For identity theft, fake online accounts, unauthorized app access, e-wallet misuse, or hacking, report to:

• PNP Anti-Cybercrime Group (PNP ACG)
• NBI Cybercrime Division

The 2026 DICT-NPC-SEC advisory lists the PNP ACG email as acg@pnp.gov.ph and the NBI Cybercrime Division email as ccd@nbi.gov.ph, with other official contact channels in the advisory.

A cybercrime report usually requires:

• valid government ID;
• complaint-affidavit or written narration;
• screenshots and digital evidence;
• links, URLs, phone numbers, emails, account names, and reference numbers;
• proof of ownership of the phone number, email, bank account, or e-wallet involved;
• proof that the loan account is fraudulent;
• names or details of suspects, if known.

A police blotter is useful, but for online identity theft, a more detailed cybercrime complaint is usually stronger. In serious cases, investigators may ask for original devices, email headers, transaction records, or certifications from banks, e-wallets, telcos, or platforms.

5. File an SEC complaint if the lender is a lending or financing company

If the issue involves a lending company, financing company, or online lending platform, file with the SEC through SEC iMessage. The SEC’s 2026 advisory identifies the Financing and Lending Companies Department or FINLEND as the office for unfair debt collection complaints involving lending and financing companies.

Include:

• company name and app name;
• SEC registration or certificate of authority details, if known;
• screenshots of collection messages;
• proof that the account is disputed as identity theft;
• police/NBI report, if already available;
• names and numbers of collectors;
• explanation of any contact-list harassment or public shaming.

The SEC complaint is especially relevant for:

• harassment;
• threats;
• public shaming;
• abusive collection;
• unregistered lending operations;
• failure to investigate identity theft;
• loan app ads or disclosures that appear misleading;
• online lending platforms not properly reported or recorded.

SEC action can lead to regulatory consequences such as fines, suspension, revocation, or other sanctions, but criminal prosecution is handled through law enforcement and prosecutors.

6. File with the National Privacy Commission for misuse of personal data

If your personal data, ID, selfie, contacts, or messages were collected, shared, retained, or used without proper authority, the National Privacy Commission may be the correct agency.

The NPC’s official page on filing formal complaints says a formal complaint must be in a specific format, printed, filled out, notarized, and submitted in person, by courier, or by scanned email to the NPC.

This route is important when:

• the app accessed your contacts unnecessarily;
• collectors contacted relatives, coworkers, or friends who were not guarantors;
• your photo or personal details were posted or sent to others;
• the company refuses to correct or erase wrong data;
• the lender keeps processing your data after you disputed identity theft;
• your data was used for harassment or public shaming.

A strong NPC complaint should explain what data was used, who used it, when it happened, how it harmed you, and what action you requested from the company before going to the NPC.

7. Check and dispute your credit record

A fake loan can later appear in credit reports and affect legitimate loan, credit card, housing, business, or employment-related checks.

The Credit Information Corporation maintains credit information submitted by covered financial institutions. If you obtain a CIC credit report and see an account that is not yours, use the CIC’s Online Dispute Resolution Process. CIC states that you need your credit report’s 14-digit Transaction Reference Number, and the report should generally be not more than 30 days old from issuance.

When disputing, attach:

• the credit report page showing the suspicious account;
• identity theft complaint or blotter;
• dispute letter to the lender;
• lender’s response or failure to respond;
• proof that you did not receive the proceeds;
• proof of wrong phone, email, address, or bank/e-wallet account used.

Do not wait until a bank rejects your loan application. Credit correction is often slower than filing the initial complaint.

8. Escalate to BSP if a bank or e-wallet is involved

If the fraud involves a bank, e-wallet, remittance company, or other BSP-supervised financial institution, first report through that provider’s fraud or consumer assistance channel. If unresolved, escalate through the BSP Consumer Assistance Mechanism, including the BSP Online Buddy or BOB.

This is relevant when:

• loan proceeds were sent to a bank or e-wallet account opened using your identity;
• your e-wallet was used to receive or move funds;
• an unauthorized transfer occurred;
• a bank or e-money issuer refuses to investigate;
• your SIM, OTP, or account access was compromised.

Where to report: quick reference table

Problem	Main office or platform	What to prepare	Practical notes
Fake loan account using your identity	Lending app/company fraud or customer support	Written dispute, ID, screenshots, account number	Demand freeze of collection and preservation of KYC/device/disbursement records
Abusive collection by lending app	SEC iMessage / SEC FINLEND	Screenshots, collector numbers, app/company details	Best for threats, public shaming, unfair collection, unregistered lending activity
Misuse of ID, contacts, selfies, personal data	National Privacy Commission	Notarized complaint form, evidence, prior demand if available	Strongest for contact-list abuse, unauthorized processing, refusal to correct/delete data
Online identity theft, hacking, fake account	PNP ACG or NBI Cybercrime	Complaint-affidavit, screenshots, digital identifiers, transaction records	Needed for criminal investigation and possible prosecutor action
Suspicious bank/e-wallet movement	Bank/e-wallet first, then BSP if unresolved	Account records, transaction IDs, fraud report	Report fast because providers may have internal fraud deadlines
Fake loan appearing in credit report	Credit Information Corporation ODRS	CIC credit report with TRN, dispute documents	Report should generally be recent; preserve all lender replies
Court summons for alleged loan	First-level court handling the case	Verified Response, affidavits, evidence	Small claims response is usually due within 10 calendar days from summons

If collectors are harassing your family, employer, or contacts

Being in your phonebook does not make someone a guarantor. A guarantor is a person who separately and clearly agrees to answer for the loan if the borrower defaults.

If collectors message your contacts, employer, neighbors, or relatives, save screenshots showing:

• the sender’s number or account;
• the exact message;
• the date and time;
• the recipient’s name;
• whether the message includes your photo, ID, debt amount, insults, threats, or accusations.

Then send a written demand to the lender:

This account is disputed as identity theft. Your collectors are contacting persons who are not guarantors and are disclosing or using my personal data. Immediately stop all third-party contact, preserve all collection records, identify the collection agency involved, and confirm in writing that the account is under fraud investigation.

If the harassment continues, include the new evidence in your SEC and NPC complaints. If the messages contain threats of violence, extortion, sexualized insults, fake criminal accusations, or doctored images, include them in the PNP/NBI cybercrime report as well.

If the lending app is unregistered, fake, or no longer on the app store

Many victims discover that the app has disappeared, changed names, or used several brands. Still gather what you can:

• app name and screenshots;
• Google Play/App Store URL or APK source;
• website and privacy policy;
• business name shown in text messages;
• bank/e-wallet accounts used for collection;
• collector phone numbers;
• Facebook, Viber, Telegram, WhatsApp, or email accounts used;
• payment instructions sent to you.

Report the app to SEC for possible unauthorized lending activity and to PNP/NBI for cybercrime or fraud. If the app processed personal data, the NPC may still be relevant even if the operator is hard to trace.

What if you receive a demand letter or court summons?

Do not ignore a real court summons. Many lending-related collection cases are filed in first-level courts such as the Metropolitan Trial Court, Municipal Trial Court in Cities, Municipal Trial Court, or Municipal Circuit Trial Court.

Under the Supreme Court’s Rules on Expedited Procedures in the First Level Courts, small claims cases may cover money claims up to ₱1,000,000.00. In small claims, the defendant is required to file a verified Response within the period stated in the summons, commonly 10 calendar days from receipt, together with supporting evidence.

If the loan is fraudulent, your Response should clearly say:

• you deny applying for the loan;
• you deny receiving the proceeds;
• your identity was stolen or misused;
• the lender failed to verify your identity properly;
• the account is under dispute with the lender, SEC, NPC, PNP/NBI, CIC, or BSP, as applicable;
• the plaintiff should produce the KYC records, disbursement records, device logs, and consent records.

Attach your evidence immediately. In small claims, evidence not attached to the Response may be difficult to present later unless the court allows it for good cause.

Special notes for OFWs, Filipinos abroad, and foreigners

Identity theft through Philippine lending apps can affect people outside the Philippines, especially if a Philippine SIM, e-wallet, old ID, passport scan, or local contact number was used.

If you are abroad:

• file initial reports by email or official online portals where accepted;
• execute a Special Power of Attorney if someone in the Philippines will obtain records or file documents for you;
• have foreign documents apostilled if issued in a country covered by the Apostille Convention, or authenticated through the proper consular process if not;
• report lost or misused passports to the issuing government;
• keep travel records, immigration stamps, employment certificates, or residence documents showing you were outside the Philippines when the account was opened;
• use one consistent Philippine mailing address and email address for agency replies.

The DFA’s Apostille information portal is useful when documents executed abroad must be used in Philippine proceedings.

Foreigners should also consider whether a copied passport, Alien Certificate of Registration card, work permit, or visa document was used. Report the compromised document to the issuing authority or embassy as appropriate, and preserve proof of the report.

Common mistakes that make identity theft cases harder

Deleting messages too early

Victims understandably want to delete threats and abusive messages. But screenshots, call logs, and chat exports are often the evidence that agencies need. Save first, then block if necessary.

Only calling the lender

Phone calls are hard to prove. Always follow up in writing. Use email, ticket numbers, or in-app reference numbers.

Paying a small amount to “make it stop”

Payment may not stop harassment. It may also confuse the record if the lender later argues that payment shows acknowledgment. If money is paid under pressure, document clearly that it was paid under protest because of harassment or identity theft.

Not checking credit records

Some victims stop after the collectors disappear. Months later, the fake account may affect a credit application. Check and dispute early.

Treating all collectors as law enforcement

Collectors are not police, prosecutors, or judges. They cannot order your arrest. They cannot declare you guilty of estafa. They cannot legally shame you online to force payment.

Waiting for the app to “investigate” indefinitely

Give the lender a reasonable written deadline to acknowledge and investigate the fraud. If there is no meaningful response, escalate to SEC, NPC, PNP/NBI, CIC, or BSP depending on the issue.

Frequently Asked Questions

Someone used my name in a lending app. Do I have to pay?

If you did not apply, did not authorize the loan, and did not receive the money, you should dispute liability in writing. The lender should investigate and produce proof of the alleged application, KYC, consent, and disbursement. Do not ignore demand letters or court papers, because silence can make the situation worse.

Can a lending app contact my relatives or employer?

A lending app should not freely contact everyone in your phonebook. Under NPC and SEC guidance, contacting persons on a borrower’s contact list other than actual guarantors for debt collection is prohibited. A character reference is not automatically a guarantor.

Can I go to jail for not paying a lending app loan?

A person cannot be imprisoned for mere debt under Article III, Section 20 of the 1987 Constitution. However, fraud, falsification, cybercrime, or access device fraud can be criminal. If you are the identity theft victim, your focus should be proving that the application and account were unauthorized.

Should I file with the barangay first?

For online identity theft, unknown suspects, corporations, cybercrime, or offenses outside barangay conciliation, going to the barangay is often not enough. A barangay blotter may help document harassment, but cybercrime and identity theft should be reported to PNP ACG or NBI Cybercrime, and regulatory complaints should go to SEC or NPC where applicable.

What if I accidentally gave my ID and selfie to a fake lending app?

Report it as a data compromise. Preserve the app link, screenshots, privacy notice, chat messages, and upload confirmations. Secure your accounts, notify banks/e-wallets, and monitor credit records. If the app later uses your data for a fake loan or harassment, file with PNP/NBI, SEC, and NPC as appropriate.

Can I demand deletion of my data?

Under the Data Privacy Act, data subjects have rights involving access, correction, objection, blocking, erasure, and damages, subject to legal exceptions. If a lender needs certain records for fraud investigation, legal claims, or regulatory retention, immediate deletion may not be automatic. But the company should not continue unnecessary or abusive processing, especially after the account is disputed as identity theft.

What if the fake loan appears in my credit report?

Get a copy of the report, identify the account, and file a dispute through the CIC Online Dispute Resolution System if it is in the CIC database. Attach your police/NBI report, lender dispute, screenshots, and proof that the loan was not yours. Also demand that the lender correct or withdraw the erroneous submission.

What if the lending app says my selfie proves I borrowed?

A selfie alone does not settle the issue. Ask for the full KYC file, liveness verification result, device details, phone number, email, IP logs, disbursement account, and consent records. If the selfie was manipulated, taken from another source, or submitted by someone else, that supports an identity theft complaint.

What if I am an OFW or foreigner outside the Philippines?

You can start by sending written disputes and reports through official online channels. For Philippine filings that require a representative, execute a Special Power of Attorney and prepare properly authenticated or apostilled documents when needed. Keep proof that you were abroad when the account was opened or when the alleged loan was released.

What if the lender files a small claims case?

File a verified Response within the deadline stated in the summons, commonly 10 calendar days from receipt. Attach your identity theft evidence, dispute letters, police/NBI reports, and affidavits. Do not wait for the hearing date before preparing your documents.

Key Takeaways

• A fake lending app account in your name is not just a debt issue; it may involve cybercrime, data privacy violations, access device fraud, and unfair collection.
• Dispute the loan in writing immediately and demand preservation of KYC, device, consent, and disbursement records.
• Report cyber identity theft to PNP ACG or NBI Cybercrime, abusive lending practices to SEC, and data misuse to the National Privacy Commission.
• Check your CIC credit report and dispute any fake loan before it affects future credit applications.
• Collectors cannot lawfully threaten jail for mere debt or harass your contacts, employer, or relatives to force payment.
• If you receive a real court summons, respond on time and attach evidence immediately.

How to Request Takedown of Defamatory Posts in the Philippines

A defamatory post can feel urgent because every share, comment, screenshot, or search result can make the damage spread faster. In the Philippines, the fastest practical move is usually evidence preservation plus platform reporting, while the stronger legal remedies may involve a demand letter, a complaint for cyberlibel, a civil action for damages, or a privacy complaint if personal data was exposed. This guide explains when a post may be legally defamatory, how to request takedown from platforms, what evidence to save, which Philippine laws apply, and what to expect if you escalate the matter to authorities or court.

What Counts as a Defamatory Online Post in the Philippines?

In simple terms, a post is defamatory when it publicly harms a person’s reputation by making a damaging accusation or statement about them.

Under Article 353 of the Revised Penal Code, libel is a public and malicious imputation of a crime, vice, defect, act, omission, condition, status, or circumstance that tends to dishonor, discredit, or cause contempt against a person or juridical entity. You can read the relevant provisions in the Revised Penal Code provisions on libel and slander.

For online posts, the usual legal issue is cyberlibel under Section 4(c)(4) of Republic Act No. 10175, the Cybercrime Prevention Act of 2012, which covers libel committed through a computer system or similar means. The law is available through the Cybercrime Prevention Act of 2012.

A post may be actionable when these elements are present:

1. There is a defamatory imputation. Example: “She stole company funds,” “He is a scammer,” “This doctor is fake,” or “That business sells illegal products.”

2. The statement was published. Online publication includes Facebook posts, TikTok videos, YouTube videos, X posts, blog articles, group posts, comments, livestream captions, and other content visible to at least one third person.

3. The person is identifiable. The post does not always need to use your full legal name. You may still be identifiable through your photo, nickname, business name, workplace, address, relatives, or surrounding details.

4. There is malice. Under Article 354 of the Revised Penal Code, defamatory imputations are generally presumed malicious unless good intention and justifiable motive are shown. However, if the complainant is a public officer or public figure and the post concerns public duties or public issues, courts apply a stricter actual malice standard. In cases such as Borjal v. Court of Appeals, Tulfo v. People, and later Supreme Court decisions, actual malice means the statement was made with knowledge that it was false or with reckless disregard of whether it was false.

Not every insulting post is libel. Pure opinion, fair comment on public issues, truthful statements made for justifiable reasons, satire, and privileged communications may be protected depending on the facts. But posts that present false factual accusations as truth are riskier for the poster and stronger for the person requesting takedown.

Takedown Is Different From Filing a Case

Many people assume that once something is defamatory, the police, NBI, barangay, or court can immediately force Facebook, YouTube, TikTok, or X to delete it. In practice, takedown and legal liability are separate.

Goal	Usual route	What it can achieve
Fast removal from a platform	Report to Facebook, Instagram, TikTok, YouTube, X, Google, or website host	Removal, restriction, demonetization, warning, or account action if the platform agrees
Preserve evidence before deletion	Screenshots, screen recordings, URL capture, affidavits, device preservation	Proof for platform appeal, demand letter, complaint, or court case
Stop the poster directly	Demand letter or settlement communication	Voluntary deletion, apology, retraction, undertaking not to repost
Identify an anonymous account	NBI, PNP Anti-Cybercrime Group, prosecutor, court processes	Possible preservation or disclosure of account data, subject to legal process
Punish cyberlibel	Criminal complaint before proper authorities	Preliminary investigation, possible court case, conviction or acquittal
Recover damages	Civil action or civil aspect of criminal case	Moral damages, actual damages, exemplary damages, attorney’s fees when proven
Remove privacy-violating content	National Privacy Commission or platform privacy form	Privacy enforcement, takedown pressure, administrative or criminal consequences where applicable

The most effective strategy is usually layered: save evidence first, report the content, send a carefully worded request, then escalate legally if needed.

Step 1: Preserve Evidence Before Reporting the Post

Do not rely on a single screenshot. Defamatory posts are often edited, deleted, hidden, or moved to private groups after the poster receives notice.

Save evidence in a way that shows the post existed, who posted it, when it appeared, and how it identified you.

What to capture

For each post, comment, video, story, or message, save:

• The full URL or share link
• The account name, handle, profile URL, and visible profile details
• The date and time shown on the post
• The full text of the post, including captions and comments
• Photos, videos, thumbnails, hashtags, and tags
• The number of reactions, comments, shares, views, or reposts
• Comments showing that other people understood the post to refer to you
• Search results if the defamatory page appears on Google
• Messages from customers, employers, family members, or friends who saw the post
• Proof of damage, such as cancelled bookings, lost clients, termination notices, business reviews, or threats

Better evidence practices

Use several formats:

1. Screenshots for quick preservation.
2. Screen recordings showing you opening the URL from the browser or app.
3. PDF printouts of the page where possible.
4. A written evidence log listing each URL, date captured, platform, account, and short description.
5. Affidavits from witnesses who saw the post and understood it to refer to you.
6. The original device used to access or receive the post, especially for private group posts or messages.

If you plan to file a complaint, a notarized affidavit can help organize the facts. The notary does not magically prove that the internet post is true or false, but your sworn statement can identify how and when you personally accessed, captured, and preserved the content.

Step 2: Report the Post Through the Platform

Platform reporting is usually the fastest takedown route because platforms control their own systems. The legal standard for libel is different from a platform’s community rules, so it is often better to report all applicable violations, not just “defamation.”

Depending on the content, choose categories such as:

• Defamation
• Harassment or bullying
• Impersonation
• Hate speech
• Threats or violence
• Privacy violation or doxxing
• Non-consensual intimate content
• Scam or fraud
• Intellectual property infringement, if your copyrighted photo, logo, video, or written content was used

Useful official reporting links

Platform or service	Where to report
Facebook	Facebook defamation reporting form and in-app report button
Instagram / Threads	Instagram defamation reporting form and in-app report button
Google Search / Google products	Google legal removal request page
YouTube	YouTube harassment and cyberbullying policy
X / Twitter	X report a post, List, or Direct Message
TikTok	TikTok report a problem page
Reddit	Reddit submit a request page

What to write in the platform report

Keep the report factual and specific. Avoid emotional arguments. A good report usually includes:

• The exact URL of the post
• The exact words that are false and defamatory
• A short explanation of why the post identifies you
• A short explanation of why the statement is false
• Any proof, such as IDs, business registration, official records, screenshots, or previous messages
• Whether the post includes threats, private information, altered images, or impersonation
• Whether you are requesting removal, restriction, or disabling of the account

Example wording:

The post falsely accuses me of stealing money from customers. It identifies me by my full name, photo, business name, and location. The accusation is false and is damaging my reputation and business. The post has been shared publicly and has led to messages from customers asking if I committed fraud. I request removal under your defamation, harassment, and harmful content policies.

For Google, remember that removal from search results is different from deletion of the original page. If Google de-indexes a result, the underlying Facebook post, blog article, or website page may still exist.

Step 3: Send a Takedown Demand to the Poster or Page Admin

A demand letter is often effective when the poster is known, the page is a local business, or the defamatory post came from an identifiable person, employee, influencer, vlogger, or competitor.

A good takedown demand should be firm but not reckless. It should usually ask for:

1. Immediate deletion or restriction of the post
2. A written undertaking not to repost the same or similar accusation
3. A correction, clarification, or apology if appropriate
4. Preservation of account records and communications
5. Confirmation within a stated period, often 24 to 72 hours for urgent online content

The letter should identify the defamatory statements exactly. Do not simply say “your post is libelous.” Quote or describe the specific words, attach screenshots, and explain why they are false.

Avoid threats that sound like extortion. A proper demand may mention available legal remedies, but it should not say or imply: “Pay me money or I will file a criminal case.” Settlement discussions should be handled carefully, especially when criminal accusations are involved.

Step 4: Consider a Cyberlibel Complaint

If voluntary takedown fails, or if the post caused serious damage, the victim may consider filing a criminal complaint for cyberlibel.

Cyberlibel is based on Article 353 and Article 355 of the Revised Penal Code, as applied online through RA 10175. The Supreme Court in Disini v. Secretary of Justice upheld cyberlibel as constitutional as to the original author of the libelous statement, but it also recognized the special free-speech issues raised by online expression. The decision is available at Disini v. Secretary of Justice.

Where complaints are commonly brought

Depending on the facts and location, a complainant may approach:

• NBI Cybercrime Division
• PNP Anti-Cybercrime Group
• The Office of the City or Provincial Prosecutor
• The Department of Justice, especially for more complex or nationally significant cybercrime matters

The NBI’s citizen’s charter for computer crime assistance describes steps such as preliminary interview, complaint sheet, sworn statements, supporting documents, and device examination. See the NBI Cybercrime Division investigative assistance page.

Common documents for a cyberlibel complaint

Document or evidence	Why it matters
Complaint-affidavit	Narrates the facts under oath
Valid government ID	Confirms identity of complainant
Screenshots and URLs	Shows the defamatory content
Screen recordings	Helps prove context and accessibility
Witness affidavits	Shows publication and identification
Proof of falsity	Counters the defamatory accusation
Proof of damage	Supports civil liability and urgency
Demand letter and proof of receipt	Shows prior notice and refusal, if any
Device used to access the post	May help authentication or forensic review
Business records, employment records, or official certifications	Useful if the accusation concerns work, credentials, money, or business conduct

Time limits matter

Cyberlibel is time-sensitive. In Causing v. People, the Supreme Court held that cyberlibel prescribes in one year from discovery by the offended party, authorities, or their agents, applying Article 90 and Article 91 of the Revised Penal Code. The 2026 Supreme Court resolution discussing this issue is available at G.R. No. 258524.

This does not mean you should wait. In online defamation cases, delay creates practical problems: accounts disappear, posts are edited, witnesses forget, URLs break, and platforms may no longer retain useful data.

Step 5: Consider Civil Remedies for Damages and Removal

A criminal cyberlibel case focuses on penal liability. A civil case focuses on compensation, correction, and other relief.

Under Article 33 of the Civil Code, a civil action for damages in cases of defamation may proceed independently of the criminal case and requires only preponderance of evidence, which is a lower standard than proof beyond reasonable doubt. The Civil Code also recognizes rights relating to dignity, privacy, peace of mind, and damages under Articles 19, 20, 21, 26, 2217, and 2219. See the Civil Code provisions on human relations and damages.

Possible civil remedies include:

• Moral damages for mental anguish, social humiliation, wounded feelings, or besmirched reputation
• Actual damages for provable financial loss
• Exemplary damages in appropriate cases
• Attorney’s fees and costs when allowed
• Injunctive relief in narrow cases, subject to constitutional limits on free speech

Courts are careful with orders that restrain speech, especially before a full hearing. A takedown order is more realistic when the content is clearly unlawful, private, threatening, fraudulent, impersonating, or already adjudged defamatory. For public-interest speech, courts are more cautious because prior restraint is constitutionally sensitive.

If the Post Includes Private Information, Use Privacy Remedies Too

Some harmful posts are not only defamatory. They may also expose personal information such as:

• Home address
• Phone number
• Government IDs
• Medical records
• School records
• Bank or e-wallet details
• Private messages
• Intimate photos or videos
• Children’s information

If the post involves personal data misuse, the Data Privacy Act of 2012, or Republic Act No. 10173, may also apply. The National Privacy Commission allows complaints for privacy violations, including misuse or malicious disclosure of personal information. See the National Privacy Commission complaint mechanics and the Data Privacy Act of 2012.

For NPC complaints, expect to prepare a verified or notarized complaint, supporting evidence, witness affidavits, and proof of identity. The NPC route is especially relevant when the harm is doxxing, unauthorized posting of personal data, debt-shaming, publication of private records, or misuse of photos and videos containing personal information.

Special Situations

Anonymous or fake accounts

Anonymous accounts are common in online defamation. Save the profile URL, username changes, profile photo, posts, comments, and any clues linking the account to a real person.

Do not assume that a platform will disclose user identity just because you ask. Foreign-based platforms usually require formal legal process. NBI, PNP, prosecutors, and courts may pursue preservation or disclosure through proper procedures, but this can take time.

Posts in private Facebook groups or group chats

A “private” group post may still be published if third persons saw it. The challenge is proof. Screenshots from a member may help, but preserve context showing group name, date, poster, comments, and membership visibility.

If you obtained screenshots from someone else, ask that person to execute a witness affidavit explaining how they accessed and captured the post.

Reviews against businesses or professionals

Bad reviews are not automatically defamatory. A customer may share an honest negative experience. But a review may cross the line when it falsely accuses a business or professional of a crime, fraud, fake licensing, disease, sexual misconduct, or other damaging facts.

For businesses, useful evidence includes DTI or SEC registration, permits, invoices, chat records, refund records, professional licenses, and customer service logs.

Public officials, influencers, and public figures

If you are a public officer, candidate, celebrity, influencer, or public-facing business owner, expect stronger free-speech defenses from the poster, especially if the post concerns public conduct or a matter of public interest.

Philippine jurisprudence gives more breathing room to criticism of public officers and public figures. A takedown request should focus on provably false factual statements, not mere insults, opinions, or criticism.

Filipinos abroad and foreigners

A Filipino abroad or a foreigner affected by defamatory posts connected to the Philippines can still preserve evidence and submit platform reports online.

For Philippine legal proceedings, documents executed abroad may need proper formalities. In many cases, affidavits signed abroad are executed before a Philippine Embassy or Consulate, or notarized locally and authenticated or apostilled depending on the country and intended use. The DFA explains apostille processes through its official Apostille information site.

Foreign complainants should also prepare proof of identity, immigration status if relevant, Philippine address for service if available, and evidence connecting the post, poster, audience, harm, or platform activity to the Philippines.

Practical Timeline

Stage	Typical timing	Common bottlenecks
Evidence capture	Same day	Deleted posts, disappearing stories, edited captions
Platform report	Same day to several weeks	Automated denials, wrong report category, lack of proof
Demand letter	24 hours to 7 days for response	Unknown poster, refusal, escalation by poster
NBI/PNP complaint intake	Same day to several weeks depending on office and completeness	Missing affidavits, weak screenshots, anonymous accounts
Prosecutor preliminary investigation	Several months or longer	Counter-affidavits, venue issues, docket congestion
Court case	Often years if contested	Hearings, motions, appeals, witness availability
NPC privacy complaint	Months or longer	Incomplete complaint, jurisdiction issues, settlement discussions

Fast takedown usually comes from the platform or voluntary deletion. Legal cases are important for accountability, but they are not always fast enough to stop immediate reputational harm.

Common Mistakes That Weaken a Takedown Request

Avoid these mistakes:

• Reporting the post before saving complete evidence
• Sending angry replies that can be used against you
• Posting your own accusations in retaliation
• Asking friends to mass-report without clear evidence
• Using only cropped screenshots with no URL or date
• Failing to show why the post refers to you
• Treating opinion as if it were automatically libel
• Ignoring privacy, impersonation, harassment, or copyright grounds that may be easier for platforms to act on
• Waiting too long before filing a cyberlibel complaint
• Demanding money in a way that appears coercive
• Assuming barangay officials can order a platform to delete content

Frequently Asked Questions

Can I force Facebook or Instagram to remove a defamatory post in the Philippines?

You can request removal through Facebook or Instagram’s reporting tools, including their defamation forms, but the platform decides whether the content violates its rules or applicable law. A Philippine court order or legal process may carry more weight, but it is not instant and usually requires proper proceedings.

Is cyberlibel different from ordinary libel?

Cyberlibel is essentially libel committed through a computer system or online means. The Supreme Court has treated cyberlibel as libel under the Revised Penal Code committed through information and communications technology, with consequences under the Cybercrime Prevention Act.

Should I message the person who posted the defamatory content?

A calm takedown request or formal demand letter can help, especially if the person is known. Avoid insults, threats, or admissions. If the poster is hostile, anonymous, or likely to delete evidence, preserve everything first before sending any message.

What if the post is true but embarrassing?

Truth can be a defense in libel, but truth alone is not always enough in criminal libel. Article 361 of the Revised Penal Code requires truth plus good motives and justifiable ends in certain cases. For privacy-related posts, even true information may create legal issues if it involves unlawful disclosure of personal data, intimate content, private records, or harassment.

Can I file a cyberlibel case if the post was made abroad?

Possibly, if there is a sufficient connection to the Philippines, such as the complainant, audience, harm, access, publication effects, or offender being in the Philippines. Cross-border cases are more complex because identification, subpoenas, and enforcement may depend on foreign platform policies and international cooperation.

Can the barangay order someone to delete a defamatory post?

The barangay can help mediate some local disputes and may help parties agree to delete a post, apologize, or stop reposting. But barangay officials cannot directly compel Facebook, TikTok, YouTube, Google, or X to remove content from their platforms.

What if the post uses my photo but the caption is the defamatory part?

Report both defamation and unauthorized use of your image. If the photo is yours, copyright or intellectual property reporting may also help. If the photo reveals personal data or was used to harass, shame, impersonate, or endanger you, include privacy and harassment grounds.

Can sharing or reposting a defamatory post also be cyberlibel?

It depends on the facts. The Supreme Court in Disini was careful about cyberlibel liability for people who merely receive and react to posts. But a person who adds defamatory captions, republishes the accusation as their own, or amplifies it with malicious statements may face risk. Each repost must be evaluated based on authorship, context, words used, and intent.

How long do I have to file a cyberlibel complaint?

The current Supreme Court rule from Causing v. People is that cyberlibel prescribes in one year from discovery by the offended party, authorities, or their agents. Because online evidence can disappear quickly, practical action should be taken much earlier.

What is the fastest way to remove a defamatory post?

Usually, the fastest path is: preserve evidence, report the post under the strongest platform categories, submit a clear legal or defamation report with proof, and send a focused takedown demand to the poster or page admin. Court or law enforcement escalation may be necessary for serious cases, anonymous posters, repeated reposting, or major reputational damage.

Key Takeaways

• Save evidence before reporting or confronting the poster.
• A defamatory online post may fall under cyberlibel if it falsely harms reputation, identifies the victim, is published to others, and is malicious.
• Platform reporting is usually the fastest takedown route, but legal escalation may be needed for serious harm or repeated posting.
• Use all applicable grounds: defamation, harassment, impersonation, privacy violation, threats, scams, or intellectual property infringement.
• Cyberlibel complaints may be filed through proper authorities such as the NBI, PNP Anti-Cybercrime Group, prosecutors, or DOJ, depending on the case.
• Civil remedies may allow damages and, in appropriate cases, other relief.
• Privacy violations involving personal data may also be brought to the National Privacy Commission.
• Cyberlibel is time-sensitive; current Supreme Court doctrine applies a one-year prescriptive period from discovery.

Can Lending Apps Contact Your Family for Debt Collection in the Philippines?

A lending app may demand payment from you, but it generally cannot contact your family, friends, workmates, or phone contacts to collect your debt in the Philippines. The key exception is when that person is a true guarantor, co-maker, or co-borrower who expressly agreed to be responsible for the loan. A person listed only as a “reference,” “emergency contact,” or someone saved in your phone book is not automatically liable. This article explains what lending apps can and cannot do, the Philippine laws that protect borrowers and third parties, and the practical steps to take if a collector has already messaged your family.

Direct Answer: Can Lending Apps Contact Your Family?

In most cases, no. A lending app, financing company, lending company, or collection agent may not contact people in your phone contacts just to pressure you to pay.

Under SEC Memorandum Circular No. 18, Series of 2019, contacting people in the borrower’s contact list other than those named as guarantors or co-makers is an unfair debt collection practice. The rule even says this is prohibited notwithstanding the borrower’s consent, meaning the app cannot justify harassment by saying you clicked “allow contacts” or accepted its terms.

The 2026 joint public advisory of the DICT, National Privacy Commission, and SEC is even clearer: for debt collection, lending companies, financing companies, and online lending platforms may only contact the guarantor. It also reminds online lending platforms that character references and guarantors must be treated separately; a reference is not the same as a guarantor.

So the practical rule is:

Person contacted by lending app	Is it usually allowed for debt collection?	Why
Borrower	Yes	The borrower is the person who owes the debt.
Co-borrower or co-maker	Yes	They signed or agreed to be jointly liable.
Guarantor	Yes, within legal limits	They expressly agreed to answer if the borrower defaults.
Character reference	Usually no for collection	They may be contacted only for limited verification purposes, not pressured to pay.
Parent, spouse, sibling, child, friend, workmate, or neighbor saved in your phone	No, unless they are a real guarantor/co-maker	Being family or being in your contacts does not make them liable.
Employer or HR department	Generally no for collection pressure	They are not part of the loan unless legally involved, and workplace shaming may create separate legal issues.

The Debt Is Yours, Not Automatically Your Family’s

Under the Civil Code, an obligation is a juridical necessity to give, to do, or not to do, and obligations may arise from law, contracts, quasi-contracts, acts or omissions punished by law, and quasi-delicts. In a loan app situation, the obligation usually comes from a contract between the borrower and the lending company.

The Civil Code rule on contracts is important: contracts generally take effect only between the parties, their assigns, and heirs, except in legally recognized situations. This means your mother, spouse, sibling, or friend does not become liable simply because the lending app found their number in your phone.

There are limited exceptions. A family member may become liable if:

1. They signed as a co-borrower, co-maker, or guarantor.
2. They separately agreed, in a legally binding way, to answer for the loan.
3. In the case of spouses, the loan is properly chargeable against the applicable marital property regime under the Family Code, such as when the obligation was contracted for the benefit of the family. This is fact-specific and does not mean every personal app loan binds the other spouse.

A common abusive tactic is to message parents or siblings saying, “Bayaran ninyo utang niya” or “Kayo ang mananagot.” Unless that relative legally bound themselves, the collector is usually bluffing.

What Lending Apps Are Prohibited From Doing

SEC Memorandum Circular No. 18 applies to financing companies, lending companies, and third-party service providers or collection agents hired by them. It allows lawful collection, but it requires good faith, reasonable conduct, and respect for borrowers’ rights.

The following are examples of unfair debt collection practices under the SEC rule:

• Using or threatening violence or other criminal means to harm a person, reputation, or property.
• Threatening legal action that cannot legally be taken.
• Using obscenities, insults, or profane language meant to abuse the borrower.
• Publishing or disclosing the names and personal information of borrowers who allegedly refuse to pay.
• Telling other people loan information that is false, or failing to disclose that the debt is disputed.
• Using false representations or deceptive means to collect.
• Contacting the borrower at unreasonable or inconvenient times, generally before 6:00 a.m. or after 10:00 p.m., subject to the rule’s stated exceptions.
• Contacting persons in the borrower’s contact list other than guarantors or co-makers.

The same circular also requires lending and financing companies to keep borrower data confidential, subject only to specific exceptions such as written or recorded consent, lawful exchange with financial institutions or credit bureaus, court or government orders, collection agencies and counsel engaged to enforce rights, and service providers assisting the lending business.

Data Privacy Rules for Online Lending Apps

The Data Privacy Act of 2012, Republic Act No. 10173, protects personal information in both government and private-sector systems. It defines consent as a freely given, specific, informed indication of will, and it recognizes rights such as access, correction, blocking, removal, and destruction of personal information in proper cases. (National Privacy Commission)

For loan apps, the most relevant issuance is NPC Circular No. 20-01 on personal data processing for loan-related transactions. It applies to lending and financing companies, persons acting as such, and third-party processors engaged in loan processing activities, including debt collection.

The NPC rules require lenders to:

• Tell borrowers clearly how personal data will be processed throughout the loan cycle, including debt collection.
• Limit collection of personal data to what is adequate, relevant, suitable, necessary, and not excessive.
• Avoid unnecessary app permissions involving personal and sensitive personal information.
• Use personal data only for legitimate and disclosed purposes.

NPC Circular No. 2022-02 strengthened these rules for online applications. It requires “just-in-time” notices before consent is obtained and says mobile apps may require access only when suitable, necessary, and not excessive. Access to contacts, camera, or similar phone resources should start only when the information is actually necessary. Once the purpose is achieved, the app should prompt the user to turn off, disallow, or revoke the permission.

The 2026 DICT-NPC-SEC advisory specifically warns against unauthorized, excessive, or disproportionate access to borrowers’ contact lists, including processing that leads to harassment or collection outside the guarantors provided by the borrower. It also states that unbridled processing of contact lists is prohibited.

“I Clicked Allow Contacts.” Did I Consent?

Not necessarily.

Many borrowers panic because they clicked “Allow Contacts” when installing the app. But in Philippine data privacy law, valid consent must be specific, informed, and freely given. A vague blanket permission hidden in an app screen is not a magic pass to shame you before your family.

Also, SEC MC No. 18 separately says that contacting persons in your contact list other than guarantors or co-makers is an unfair collection practice even if the borrower supposedly consented. This is why a lending app cannot simply say, “You allowed access, so we can text everyone.”

A lawful app permission might allow a borrower to select a character reference, verify identity, upload a selfie for KYC, or submit a guarantor’s information. It does not allow unlimited harvesting of contacts for threats, public shaming, or pressure campaigns.

Can They Post You on Facebook or Message Group Chats?

No, not for debt shaming.

Publishing your name, photo, loan balance, alleged “scammer” status, ID, address, or private messages on Facebook, Messenger groups, Telegram, Viber, TikTok, or other platforms may violate SEC debt collection rules, data privacy rules, and possibly criminal laws.

Depending on the facts, abusive online posts or messages may involve:

• Libel or cyberlibel, if the post publicly and maliciously imputes a crime, vice, defect, condition, or circumstance that dishonors or discredits a person. The Revised Penal Code defines libel under Article 353, and RA 10175, the Cybercrime Prevention Act of 2012, covers libel committed through a computer system. (Lawphil)
• Grave threats, if the collector threatens harm to a person, honor, or property amounting to a crime under Article 282 of the Revised Penal Code. (Lawphil)
• Coercion or unjust vexation, depending on the acts, under Articles 286 and 287 of the Revised Penal Code. (Lawphil)
• Data privacy violations, if personal information is processed, disclosed, or used for unauthorized purposes under the Data Privacy Act.

The Supreme Court, in Disini v. Secretary of Justice, upheld cyberlibel as a punishable offense, explaining that online defamation is covered as a similar means of committing libel. (Supreme Court E-Library)

Can You Be Jailed for Not Paying a Lending App?

For a simple unpaid debt, no. Article III, Section 20 of the 1987 Constitution states that no person shall be imprisoned for debt or non-payment of a poll tax. (Supreme Court E-Library)

This means a collector’s message saying “ipapakulong ka namin dahil hindi ka nagbayad” is usually misleading if the issue is only non-payment of a civil loan.

However, this does not erase the debt. A valid lender may still use lawful remedies, such as:

• Sending proper demand letters.
• Reporting lawful credit information to authorized credit channels.
• Referring the account to a legitimate collection agency or counsel.
• Filing a civil collection case or small claims case in court.

If there was separate fraud, falsification, identity theft, or use of fake documents, that is a different issue from mere inability to pay.

What If the Lending App Is Illegal or Unregistered?

Even if a lending app is unregistered, that does not automatically mean every peso borrowed becomes free. But an unregistered or abusive lender may face regulatory action, penalties, takedown efforts, and enforcement by the SEC, NPC, DICT, NBI, or PNP depending on the acts involved.

Before borrowing or when checking an existing app, look for:

• The registered corporate name, not just the app brand.
• SEC registration number.
• Certificate of Authority to operate as a lending or financing company.
• Whether the online lending platform is recorded or authorized.
• Complete office address, privacy notice, customer service contact, and grievance channel.
• Clear disclosure of interest, fees, penalties, and total amount due.

The SEC iMessage system is the official web-based platform for public inquiries and complaints, and the SEC site lists “Check with SEC” among its online services. (Securities and Exchange Commission)

What to Do If a Lending App Contacts Your Family

Act quickly, but keep the evidence organized. Emotional replies can make the situation harder to prove later.

1. Tell your family not to engage emotionally. Ask them not to argue, insult, or threaten back. They should save the messages, phone numbers, usernames, screenshots, call logs, and timestamps.

2. Document every contact. Keep screenshots showing:

   • app name;
   • company name, if visible;
   • phone number or account used by the collector;
   • exact message;
   • date and time;
   • name of the family member contacted;
   • whether the message disclosed your loan, threatened you, or demanded payment from the family member.

3. Save the loan documents. Download or screenshot:

   • loan agreement;
   • disclosure statement;
   • privacy notice;
   • repayment schedule;
   • proof of amounts received;
   • proof of payments;
   • interest, penalty, and service fee breakdown.

4. Revoke unnecessary app permissions. On your phone settings, remove access to contacts, photos, camera, SMS, location, and storage if they are no longer needed. The NPC’s 2026 advisory reminds borrowers to review app permissions and notes that unnecessary permissions should not be requested or retained.

5. Send a written dispute or cease-contact request to the company. Keep it short and factual. State that contacting family members who are not guarantors or co-makers is prohibited, identify the contact incidents, and demand that collection be directed only to you or to any lawful guarantor.

6. File with the proper agency. Use the table below to decide where the complaint fits.

Where to File a Complaint

Situation	Main office or agency	Useful evidence	Practical notes
Lending company or online lending platform contacted family, references, employer, or phone contacts for collection	SEC, especially for lending/financing company violations	Screenshots, call logs, app name, company name, loan account, messages to family, proof the person contacted is not a guarantor	The 2026 advisory lists SEC FINLEND, iMessage, and hotline 1-4732 (1-4SEC) for unfair debt collection practices.
Contact list harvesting, misuse of personal data, disclosure of loan details to others	National Privacy Commission	Complaint form, valid ID, screenshots, privacy notice, permission screenshots, witness affidavits if available	NPC complaints generally require a filled-out and notarized complaint-assisted form or verified complaint with evidence. NPC states that it has 30 calendar days to give due course or dismiss without prejudice, and full adjudication may take around 10 to 12 months. (National Privacy Commission)
Threats, scams, impersonation, hacking, cyber harassment, fake public posts	PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT Cyber Hotline	Threat messages, URLs, account links, phone numbers, payment wallet details, screenshots with timestamps	The 2026 advisory lists contact channels for DICT, NBI Cybercrime Division, and PNP Anti-Cybercrime Group for harassment, threats, frauds, or scams.
Lender files a case against you for unpaid debt	First-level court small claims process, if within threshold	Loan contract, payment receipts, disputed charges, demand letters, proof of abusive collection if relevant	Small claims cover money claims not exceeding ₱1,000,000, including loans and credit accommodations; one hearing day is contemplated, and judgment is rendered within 24 hours from termination. (Supreme Court of the Philippines)

Sample Message to Send the Lending App

Use calm wording. Do not admit incorrect amounts if you dispute the balance.

I acknowledge your message regarding the account. However, your collectors have contacted my family members/contacts who are not my guarantors, co-makers, or co-borrowers. This is prohibited under SEC Memorandum Circular No. 18, Series of 2019, and may also involve unauthorized processing of personal data under the Data Privacy Act and NPC rules on loan-related transactions.

Please direct all lawful collection communications only to me through this number/email. Please also provide a complete statement of account showing principal, interest, penalties, service fees, payments applied, and the legal basis for each charge. I am preserving all screenshots, call logs, and messages for reporting to the proper agencies.

Common Scenarios

The app messaged my mother and said I am a scammer

That is not normal collection. It may be unfair debt collection, unauthorized disclosure of personal data, and possibly defamatory depending on the wording, platform, and audience. Save the message exactly as received.

My sister was listed as a reference. Can they demand payment from her?

No, not merely because she was a reference. A character reference is usually for identification or verification. To be liable, she must have clearly agreed to be a guarantor, co-maker, or co-borrower.

My spouse is being forced to pay my app loan

Marriage alone does not automatically make every personal app loan collectible from the other spouse. Liability may depend on who borrowed, who signed, the property regime, and whether the debt benefited the family. A collector should not shame or threaten your spouse if your spouse did not legally undertake the obligation.

The collector called my office

A lender may have legitimate reasons to verify employment during loan processing if properly disclosed and limited. But calling HR or co-workers to embarrass you, disclose your debt, or pressure your employer is another matter. If they demand salary deduction, remember that wage deductions are strictly regulated under the Labor Code and cannot simply be imposed by a private collector without lawful basis or proper authorization.

The app says they will file a barangay complaint

Unpaid app loans are usually civil money claims, not a barangay tool for public shaming. Barangay conciliation may apply only in certain disputes between qualified parties under the Katarungang Pambarangay system, usually involving individuals in the same city or municipality. A corporate lending company collecting through a mobile app normally proceeds through lawful demand and court remedies, not threats to humiliate you at the barangay.

Frequently Asked Questions

Can online lending apps access my contacts in the Philippines?

They should not have unbridled or unnecessary access. NPC rules require app permissions to be suitable, necessary, and not excessive. The 2026 advisory states that online lending platforms may only access contacts for limited purposes such as allowing the borrower to select references or guarantors, or to derive proportionate metadata when necessary for legitimate purposes.

Can a lending app call my parents about my debt?

Generally no, unless your parent is a guarantor, co-maker, or co-borrower. If your parent is only a reference or merely appears in your contact list, contacting them for debt collection is prohibited.

Can a lending app contact my spouse?

Only if your spouse is legally involved in the loan, such as by signing as co-borrower, co-maker, or guarantor, or in a legally valid situation where the debt is chargeable to the marital property regime. The app cannot simply contact your spouse to shame you.

Can a lending app post my picture or ID online?

No. Posting your face, ID, address, loan details, or “wanted” style graphics for debt shaming may violate SEC collection rules, data privacy rules, and possibly criminal laws on libel, cyberlibel, threats, or unjust vexation depending on the facts.

Can I ignore the debt because the collector harassed me?

No. Illegal collection does not automatically cancel a valid loan. But you may dispute unlawful charges, demand a proper statement of account, report the abusive collection, and raise appropriate defenses if the lender files a case.

Can they file a criminal case if I do not pay?

For ordinary non-payment of debt, you cannot be imprisoned. The Constitution prohibits imprisonment for debt. Criminal issues arise only when there are separate criminal acts, such as fraud, falsification, identity theft, or cybercrime.

What if the app contacts my friends using different numbers?

Take screenshots and keep call logs. Record the number, date, time, message, and the name of the person contacted. Pattern evidence is useful because abusive collectors often rotate numbers, usernames, or messaging accounts.

Should I delete the lending app?

Do not delete it until you have saved the loan details, screenshots, privacy notice, account number, statement of account, and payment history. After preserving evidence, revoke unnecessary permissions through your phone settings.

How long does an NPC complaint take?

NPC states that its Complaints and Investigation Division has 30 calendar days from receipt to give due course or dismiss a complaint without prejudice. It also states that the full process up to final adjudication may take about 10 to 12 months. (National Privacy Commission)

What is the fastest way to stop family harassment?

The fastest practical steps are to preserve evidence, revoke app permissions, send a written cease-contact/dispute message, and file with the SEC or NPC depending on whether the main issue is unfair collection, data privacy misuse, or both. If threats or cyber harassment are involved, report to cybercrime authorities as well.

Key Takeaways

• Lending apps generally cannot contact your family for debt collection unless that family member is a real guarantor, co-maker, or co-borrower.
• Clicking “allow contacts” does not authorize public shaming, harassment, or collection through your phone book.
• A reference is not automatically a guarantor.
• Your family is not automatically liable for your app loan.
• Illegal collection does not erase a valid debt, but it can expose the lender or collector to SEC, NPC, civil, administrative, or criminal consequences.
• Save screenshots, call logs, app permissions, loan documents, and messages before filing a complaint.
• For ordinary unpaid debt, you cannot be jailed simply for non-payment.

How to Report an Online Lending App Scam to DICT in the Philippines

If an online lending app tricked you into paying fees, stole your personal data, accessed your contacts, threatened to shame you, or used fake collection tactics, you can report it to the DICT through the government cyber-scam reporting channels handled with the Cybercrime Investigation and Coordinating Center (CICC). The fastest route is usually the 1326 hotline, the eGovPH app’s eReport feature, and the DICT cyber hotline email, while related complaints may also need to go to the SEC, National Privacy Commission, NBI, PNP Anti-Cybercrime Group, or your bank or e-wallet provider depending on what happened. (Philippine News Agency)

Online lending app scams are stressful because they often combine money problems, data privacy abuse, and threats. Some victims are told they owe money they never received. Others borrowed a small amount but later face public shaming, contact-list harassment, fake legal threats, or demands sent to relatives, employers, and co-workers. This guide explains what DICT can do, what evidence to preserve, how to file the report step by step, and which other Philippine agencies should receive a parallel complaint.

What Counts as an Online Lending App Scam in the Philippines?

An online lending app scam is not limited to a fake loan app that disappears after collecting “processing fees.” In practice, complaints often fall into several patterns:

Situation	What usually happened	Where to report
Fake loan approval scam	The app or agent asks for advance fees, “unlocking fees,” verification deposits, tax, insurance, or wallet top-ups before releasing the loan	DICT/CICC, PNP-ACG, NBI, bank/e-wallet
Data harvesting	The app accesses contacts, photos, SMS, or social media data beyond what is needed for the loan	DICT/CICC, NPC, SEC
Harassment and public shaming	Collectors message your contacts, post edited photos, create group chats, or threaten to label you a scammer	DICT/CICC, SEC, NPC, PNP-ACG/NBI
Identity theft	Someone used your name, ID, phone number, or face verification to borrow money	DICT/CICC, PNP-ACG/NBI, NPC, SEC
Fake legal threats	Collectors claim there is already a warrant, hold-departure order, barangay case, or cybercrime case to force payment	DICT/CICC, SEC, PNP-ACG/NBI
Unauthorized bank or e-wallet transfer	You clicked a loan link and your financial account was accessed or money was transferred	Bank/e-wallet first, then DICT/CICC, BSP, PNP-ACG/NBI

The March 2026 joint advisory of DICT, the National Privacy Commission, and the Securities and Exchange Commission specifically warns against online lending platforms engaging in harassment, intimidation, public shaming, and unlawful use of personal data in collection practices. It also states that unnecessary app permissions, excessive access to contact lists, and contacting people in the borrower’s contact list other than guarantors are prohibited.

What DICT and CICC Can Do

The DICT is the government department responsible for information and communications technology policy and programs. For online scams, the relevant DICT-linked office is the CICC, which coordinates cybercrime response and works with other agencies.

For scam reporting, the government promotes the Inter-Agency Response Center hotline 1326. The Philippine Information Agency described 1326 as a 24/7 central number for reporting online selling scams, deceitful messages, emails, romance scams, impersonation, investment fraud, cybercrimes, and phishing. It also noted that enforcement is handled by agencies such as the PNP Anti-Cybercrime Group and the NBI Cybercrime Division. (Philippine Information Agency)

DICT/CICC reporting is useful because it can:

• record the scam and provide a reporting trail;
• help triage whether the matter should go to the PNP, NBI, SEC, NPC, NTC, or another agency;
• support blocking or takedown action for scam numbers or channels when applicable;
• help authorities detect repeated scam patterns involving the same app, number, wallet, or platform;
• guide victims on the proper next office for formal investigation.

It is important to understand the limitation: a DICT report is not the same as a court case, and it does not automatically erase a debt, recover money, or stop all messages overnight. For money recovery, you usually need to report immediately to your bank, e-wallet, or payment provider. For criminal prosecution, you may need a formal sworn complaint with the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or prosecutor.

Legal Basis: Your Rights Against Online Lending App Scams

Cybercrime Prevention Act: RA 10175

Republic Act No. 10175, the Cybercrime Prevention Act of 2012, defines and penalizes cybercrime offenses and provides the framework for cybercrime prevention, investigation, suppression, and penalties in the Philippines. Online lending app scams may involve computer-related fraud, identity theft, cyberlibel, illegal access, or other offenses committed through information and communications technology. (Lawphil)

The Supreme Court discussed RA 10175 in Disini v. Secretary of Justice, where it reviewed the constitutionality of several provisions of the Cybercrime Prevention Act. The case is often cited because it confirms that cybercrime enforcement must still respect constitutional rights such as privacy, due process, and free speech. (Supreme Court E-Library)

Revised Penal Code: Estafa, Threats, Coercion, and Libel

Many online lending app scams still fall under traditional crimes in the Revised Penal Code. The most common is estafa under Article 315, which generally involves deceit or abuse of confidence causing damage to another person. For example, if an app deceives you into paying “release fees” for a loan that never existed, estafa may be considered.

Depending on the exact messages and conduct, other possible offenses may include:

• grave threats under Article 282, if there are serious threats to harm you, your family, reputation, or property;
• grave coercions under Article 286, if force, violence, or intimidation is used to compel you to do something against your will;
• unjust vexation, if the conduct is oppressive and harassing but does not fit a more specific offense;
• libel under Articles 353 and 355, or cyberlibel under RA 10175, if defamatory accusations are published online or sent through digital means.

Data Privacy Act: RA 10173

Republic Act No. 10173, the Data Privacy Act of 2012, protects personal information in government and private information systems. It recognizes privacy as a fundamental right and requires lawful, fair, and proportionate processing of personal data. (Lawphil)

This matters because many abusive lending apps collect more data than necessary. The NPC has previously warned that online lenders are prohibited from harvesting phone and social media contact lists for harassment, and the DICT-NPC-SEC advisory reiterates that excessive contact-list processing, harassment, and contacting non-guarantors are prohibited. (National Privacy Commission)

Lending Company Regulation Act: RA 9474 and SEC Rules

Republic Act No. 9474, the Lending Company Regulation Act of 2007, regulates lending companies in the Philippines and places them under SEC supervision. Lending companies are not supposed to operate casually as anonymous mobile apps; they must comply with legal and regulatory requirements. (Lawphil)

The SEC also issued Memorandum Circular No. 18, Series of 2019, on the prohibition of unfair debt collection practices of financing companies and lending companies. This is the key SEC rule usually cited in complaints involving threats, harassment, public shaming, misrepresentation, and abusive collection tactics. (SEC Appointment System)

Financial Consumer Protection and Financial Account Scams

Republic Act No. 11765, the Financial Products and Services Consumer Protection Act, strengthens protection for consumers of financial products and services. It gives financial regulators such as the BSP and SEC stronger authority over covered institutions and consumer protection issues. (Lawphil)

Republic Act No. 12010, the Anti-Financial Account Scamming Act, is especially relevant when a lending scam involves e-wallets, bank accounts, phishing, mule accounts, or social engineering. It covers financial accounts including bank accounts and e-wallets, penalizes money muling and social engineering schemes, and allows temporary holding and coordinated verification of disputed transactions under BSP rules. (Lawphil)

Before You Report: Preserve Evidence Properly

Your report is only as strong as your evidence. Do not rely on memory. Do not delete the app, messages, call logs, or emails until you have secured copies.

Save these immediately:

1. Screenshots of the app

   • App name
   • Developer name
   • Google Play or App Store listing
   • Website or download link
   • Loan dashboard
   • Claimed amount borrowed
   • Fees, interest, due date, and penalties

2. Screenshots of conversations

   • SMS
   • Messenger, Viber, Telegram, WhatsApp, email, or in-app chat
   • Threats, insults, fake legal notices, or public shaming threats
   • Messages sent to your contacts

3. Payment records

   • GCash, Maya, bank transfer, remittance, QR payment, or payment center receipt
   • Reference numbers
   • Sender and receiver names
   • Mobile number, account number, or wallet ID
   • Date, time, and amount

4. Caller and sender details

   • Phone numbers
   • Sender names
   • Email addresses
   • Social media profiles
   • Links and URLs

5. Proof of identity theft or data misuse

   • Contacts who received messages
   • Group chats created by collectors
   • Edited photos or posts
   • Loan applications you did not make
   • Notices for loans you never received

6. Device information

   • Phone model
   • SIM number used
   • App permissions granted
   • Whether you allowed contacts, camera, location, SMS, or storage access

Under the Philippine Rules on Electronic Evidence, the person presenting an electronic document has the burden of proving its authenticity. That is why it is better to keep the original messages on the device, export copies when possible, and make a clear timeline of events. (Lawphil)

How to Report an Online Lending App Scam to DICT

1. If money was transferred, report to your bank or e-wallet first

If you paid through a bank or e-wallet, time matters. Report the transaction immediately to the customer service or fraud channel of the bank, e-money issuer, or payment platform. Ask for:

• a fraud ticket or complaint reference number;
• temporary hold or freezing of the recipient account if still possible;
• written confirmation of your report;
• reversal or dispute process;
• the full transaction details available to you.

This step is separate from DICT reporting. DICT/CICC may help coordinate cyber-scam response, but the bank or e-wallet is usually the first party that can act on the movement of funds. If the bank or e-wallet does not resolve the matter, the BSP Consumer Assistance Mechanism allows escalation through BSP Online Buddy or by email using the required complaint details and supporting documents. (Bureau of Small and Medium Enterprises)

2. Call the 1326 hotline for urgent cyber-scam reporting

For urgent online scam reporting, call 1326, the Inter-Agency Response Center hotline. Be ready to explain the incident clearly:

• “I am reporting an online lending app scam.”
• “The app name is ____.”
• “I paid through ____ on this date and time.”
• “The collector is threatening to message my contacts.”
• “The numbers used are ____.”
• “I have screenshots and transaction records.”

Ask for a reference number or instructions on how to submit supporting evidence. If you are emotionally shaken, write a short script before calling so you can give complete details.

3. Submit details through the eGovPH app eReport feature

The eGovPH app has an eReport feature for reporting scams and suspicious messages. The CICC has encouraged the public to use eGovPH eReport aside from calling 1326, and the Philippine News Agency reported that scam data submitted through the app may be sent to the NTC for blocking of numbers. (Philippine News Agency)

A practical filing flow is:

1. Open the eGovPH app.
2. Go to the reporting or eReport section.
3. Choose the scam-related category.
4. Upload screenshots of the lending app, messages, payment proof, and sender numbers.
5. Describe the incident in chronological order.
6. Submit and save the ticket or confirmation.

Use a short but complete description. Example:

“I am reporting an online lending app scam involving [app name]. On [date], I applied for a loan and was asked to pay [amount] to [wallet/account]. No loan was released. The persons using [numbers/accounts] are now threatening to message my contacts and post my photo. Attached are screenshots of the app, payment proof, messages, and numbers used.”

4. Email the DICT cyber hotline if you need to attach a full evidence packet

The 2026 DICT-NPC-SEC advisory lists the DICT Cyber Hotline email as 1326@dict.gov.ph for other forms of harassment, threats, frauds, and scams.

For email reports, use a clear subject line:

Subject: Online Lending App Scam Report — [App Name] — [Your Name or Initials]

Attach files in organized form:

• 01_Timeline.pdf
• 02_App_Screenshots.pdf
• 03_Threat_Messages.pdf
• 04_Payment_Receipts.pdf
• 05_Numbers_and_Accounts.pdf
• 06_ID_Proof_if_required.pdf

Keep the body short and structured:

Detail	What to include
Your name and contact details	Mobile number, email, city/province, whether you are in the Philippines or abroad
App details	App name, developer, link, website, package name if available
Incident type	Advance fee scam, unauthorized loan, harassment, contact-list abuse, phishing, identity theft
Money involved	Amount paid, date/time, receiver account or wallet, reference number
Numbers/accounts used	Phone numbers, emails, social media links, bank/e-wallet recipient details
Immediate risk	Threats, public shaming, access to contacts, account compromise
Action requested	Recording of report, referral to proper agency, blocking/takedown coordination, guidance for formal complaint

5. Keep all reference numbers and follow up in writing

After filing through 1326, eGovPH, or email, save:

• hotline reference number;
• eReport ticket number;
• email sent copy;
• automated acknowledgments;
• names or offices of personnel who contacted you;
• instructions given by DICT/CICC.

If the scam continues, file a supplemental report instead of starting over. Use your previous reference number and add new evidence.

When to Report to Other Agencies Too

Online lending app scams often require parallel reporting. DICT is a strong starting point for cyber-scam triage, but it is not the only agency involved.

Problem	Agency	Why it matters
Abusive collection by lending or financing company	SEC Financing and Lending Companies Department through SEC iMessage	SEC regulates lending and financing companies and receives complaints through its ticketing system (Securities and Exchange Commission)
Contact-list harvesting, privacy abuse, unlawful use of photos or personal data	National Privacy Commission	NPC formal complaints require a specific form, notarization, and submission in person, by courier, or by scanned email as allowed (National Privacy Commission)
Criminal scam, threats, identity theft, cyber harassment	PNP Anti-Cybercrime Group or NBI Cybercrime Division	These agencies handle investigation and formal criminal complaint processing; the NBI Cybercrime Division citizen’s charter describes filing, interview, sworn statements, and evidence submission (National Bureau of Investigation)
Bank or e-wallet fraud	Bank/e-wallet first, then BSP if unresolved	BSP allows escalation through its consumer assistance channels after the financial institution’s complaint mechanism is used (Bureau of Small and Medium Enterprises)
Scam SMS numbers	DICT/CICC through eGovPH and 1326, with possible NTC blocking	CICC has encouraged reporting scam SMS and suspicious messages through eGovPH and 1326 (Philippine News Agency)

How to File a Related SEC Complaint Against the Lending App

Use the SEC route when the app appears to be a lending or financing company, or when the main issue is unfair debt collection.

Prepare:

• borrower’s name and contact details;
• name of lending company, financing company, app, or collector;
• SEC registration number or Certificate of Authority if known;
• screenshots of threats and collection messages;
• loan disclosure, repayment schedule, or in-app loan page;
• proof that collectors contacted third parties;
• proof of payments;
• explanation of the relief requested.

The DICT-NPC-SEC advisory directs complaints on unfair debt collection practices to the SEC Financing and Lending Companies Department through SEC iMessage and the SEC hotline 1-4732.

A good SEC complaint does not just say “harassment.” It should identify the exact acts:

• “They contacted my employer even though my employer is not a guarantor.”
• “They sent my photo to a group chat and called me a scammer.”
• “They threatened arrest for a civil debt.”
• “They used obscene language.”
• “They demanded payment from relatives who did not consent to be guarantors.”
• “They accessed my contact list without a legitimate purpose.”

How to File a Related NPC Complaint for Data Privacy Abuse

Use the NPC route when the lending app accessed or used personal data improperly. Examples include:

• harvesting your contact list;
• messaging people who are not guarantors;
• posting your photo or ID;
• using your personal information for public shaming;
• storing or processing your data after the legitimate purpose ended;
• making withdrawal of consent difficult or deceptive.

NPC formal complaints require a specific process: download the complaint form, print and fill it out, have it notarized, and submit it in person, by courier, or by scanned email as authorized by the Commission. (National Privacy Commission)

For overseas Filipinos and foreigners abroad, ask the receiving agency whether it will accept a notarized affidavit signed abroad, a consular notarization, or an apostilled document. Requirements can differ depending on whether the filing is administrative, criminal, or for court use.

Practical Timelines and Bottlenecks

Step	Usual timing	Common bottleneck
Calling 1326	Same day	High call volume; incomplete facts
eGovPH eReport	Same day if app access works	Upload limits, unclear screenshots
DICT email submission	Same day to a few days for acknowledgment	Large attachments, missing timeline
Bank/e-wallet fraud report	Immediately; hours matter	Funds already withdrawn or transferred
SEC complaint	Weeks to months depending on docket and evidence	App uses different trade name from registered company
NPC formal complaint	Weeks to months	Notarization, incomplete proof of personal data misuse
NBI/PNP criminal complaint	Initial filing may be same day; investigation can take weeks or months	Need sworn statements, device review, account tracing, coordination with platforms
Prosecutor’s office	Often months	Backlog, need for complete affidavits and evidence

A common mistake is filing only one report and waiting. If there is money loss, privacy abuse, and threats, file with the proper agencies in parallel and keep the reference numbers organized.

Common Mistakes That Hurt Online Lending App Scam Reports

Deleting the app too early

Uninstalling the app may remove useful screens, loan details, permissions, notifications, and transaction logs. First, screenshot the app pages, record the app version if visible, and save the download link.

Paying more because of threats

Scammers often escalate fear: “Pay now or we will file a cybercrime case,” “You will be arrested today,” or “We will send police to your house.” A private collector cannot issue a warrant. Warrants come from courts. Debts generally do not become criminal cases simply because payment is delayed, although fraud or deceit can create separate criminal exposure depending on facts.

Ignoring your bank or e-wallet

If you sent money, report to the financial provider immediately. DICT reporting helps cyber-scam response, but your bank or e-wallet is the channel that can act fastest on disputed transfers.

Reporting without a timeline

Authorities handle many complaints. A clear timeline makes your report easier to act on:

• Date and time you downloaded the app
• Date and time you applied
• Amount supposedly approved
• Fees demanded
• Payment sent
• Whether loan was released
• When threats began
• Who was contacted
• What you want investigated

Naming the wrong respondent

Online lending apps often use one public app name, another developer name, another corporate name, and several collection numbers. Include all names and identifiers instead of guessing which one is “official.”

Relying only on screenshots from contacts

If collectors messaged your relatives or employer, ask those persons to preserve the original messages on their own phones. Their screenshots are useful, but original messages and sworn statements may be needed later.

Special Notes for OFWs and Foreigners

Filipinos abroad can still report through online channels such as eGovPH, email, and the hotline if accessible. If a formal sworn complaint is needed, expect that you may later be asked for a notarized affidavit, consular notarization, or documents authenticated for Philippine use.

Foreigners in the Philippines can report online lending app scams too. Bring your passport, ACR I-Card if applicable, local address, Philippine contact number, payment records, and copies of messages. If the scam involves a Philippine app, Philippine phone number, Philippine bank or e-wallet, or conduct affecting you while in the Philippines, local agencies may still be relevant.

If you are a foreigner outside the Philippines dealing with a Philippine lending app, focus your first report on objective evidence: app link, Philippine numbers used, payment channel, names of Filipino contacts harassed, and any Philippine bank or e-wallet accounts involved.

Frequently Asked Questions

Can I report an online lending app scam directly to DICT?

Yes. For scam-related reports, you can use the 1326 hotline, eGovPH eReport, and the DICT cyber hotline email listed in the DICT-NPC-SEC advisory. If the case involves unfair debt collection, data privacy abuse, or criminal threats, also file with the SEC, NPC, PNP-ACG, or NBI as appropriate. (Philippine News Agency)

Is 1326 for online lending app harassment?

1326 is used for cyber-scam and online harm reporting. If the lending app harassment includes threats, fraud, impersonation, phishing, public shaming, or suspicious messages, it is appropriate to report it through 1326. For unfair debt collection practices, also report to the SEC.

Can DICT make the lending app stop messaging my contacts?

DICT/CICC can receive and coordinate cyber-scam reports, and reports may support blocking, referral, or enforcement action. However, if the issue is contact-list misuse or abusive collection, an SEC and NPC complaint is usually needed too. For threats or identity theft, report to PNP-ACG or NBI.

Can I get my money back after reporting to DICT?

A DICT report does not guarantee a refund. If you paid through a bank, e-wallet, or payment provider, report immediately to that provider and ask for a fraud ticket, temporary hold, reversal, or dispute review. If unresolved, escalate through BSP consumer assistance channels. (Bureau of Small and Medium Enterprises)

What if the lending app is registered with the SEC?

Registration does not give a lending company permission to harass, threaten, publicly shame, or misuse personal data. SEC Memorandum Circular No. 18, Series of 2019, prohibits unfair debt collection practices, and the 2026 DICT-NPC-SEC advisory reiterates that excessive data processing and contacting non-guarantor contacts are prohibited. (SEC Appointment System)

What if I really borrowed money but the collector is abusive?

A legitimate debt does not justify illegal collection methods. You may still dispute harassment, threats, public shaming, or contact-list abuse. Keep records of what you received, what you paid, the remaining balance claimed, and the abusive messages.

Should I go to the barangay first?

For cyber scams, identity theft, online harassment, and financial fraud, go directly to DICT/CICC, PNP-ACG, NBI, SEC, NPC, or your financial provider. A barangay blotter can help document local harassment, but the barangay cannot trace cyber offenders, freeze accounts, or investigate app operators.

What if collectors threaten me with arrest?

Do not panic. A private collector cannot order your arrest. Save the threat and report it. Arrest warrants are issued by courts, not by lending apps, collectors, or barangay officials. Fake warrant threats may support complaints for unfair collection, harassment, coercion, or fraud depending on the facts.

What if the app messaged my employer or relatives?

Save screenshots from your employer or relatives and ask them not to delete the original messages. The 2026 advisory states that contacting persons in the borrower’s contact list other than guarantors is prohibited for debt collection purposes.

Do I need a lawyer to report an online lending app scam?

You can file initial reports yourself. For serious cases involving large losses, identity theft, public shaming, employer harassment, or a planned criminal complaint, legal help can make the affidavit, evidence packet, and agency filings clearer.

Key Takeaways

• Report online lending app scams to DICT/CICC through 1326, eGovPH eReport, or 1326@dict.gov.ph.
• Preserve evidence before deleting the app: screenshots, messages, payment receipts, app links, sender numbers, and contact-list harassment proof.
• If money moved through a bank or e-wallet, report to the financial provider immediately and escalate to BSP if unresolved.
• File parallel complaints when needed: SEC for unfair debt collection, NPC for data privacy abuse, and PNP-ACG or NBI for criminal investigation.
• A real debt does not allow threats, public shaming, fake arrest warnings, or messaging non-guarantor contacts.
• Keep reference numbers and file supplemental reports when new threats, numbers, accounts, or evidence appear.

How to File a Cybercrime Complaint for Online Shaming in the Philippines

Being publicly humiliated online can feel urgent, personal, and overwhelming. In the Philippines, “online shaming” is not always the name of the offense written in the law, but the act may fall under cyber libel, gender-based online sexual harassment, photo or video voyeurism, data privacy violations, threats, stalking, or other crimes depending on what was posted, who posted it, and what harm was caused. This guide explains how to file a cybercrime complaint for online shaming in the Philippines, what evidence to prepare, where to file, what usually happens at the NBI, PNP Anti-Cybercrime Group, and prosecutor’s office, and what common mistakes can weaken a case.

What Counts as Online Shaming in the Philippines?

Online shaming usually means someone uses the internet to expose, insult, accuse, ridicule, or embarrass another person. It may happen through Facebook posts, TikTok videos, Messenger group chats, X/Twitter threads, Instagram stories, YouTube videos, Reddit posts, online reviews, screenshots, livestreams, fake accounts, or private messages shared publicly.

Common examples include:

• Posting that someone is a “scammer,” “kabitan,” “thief,” “drug user,” “prostitute,” or “cheater” without proof
• Uploading screenshots of private chats to humiliate someone
• Posting a debtor’s photo, address, ID, workplace, or family details to pressure payment
• Sharing intimate photos, videos, or sexual rumors
• Creating fake accounts or edited images to mock a person
• Tagging the person’s employer, school, relatives, or community to ruin reputation
• Encouraging others to bash, threaten, or harass the person
• Publishing personal information such as phone number, address, IDs, or medical details

The key question is not simply, “Was I embarrassed?” The legal question is: What specific unlawful act was committed, and what evidence proves it?

Main Legal Bases for Online Shaming Complaints

Cyber Libel Under RA 10175 and the Revised Penal Code

The most common complaint for online shaming is cyber libel.

Under Article 353 of the Revised Penal Code, libel is a public and malicious imputation of a crime, vice, defect, act, omission, condition, status, or circumstance that tends to dishonor, discredit, or cause contempt against a person. Article 355 punishes libel committed through writing or similar means. (Supreme Court E-Library)

Republic Act No. 10175, or the Cybercrime Prevention Act of 2012, applies libel to acts committed through a computer system or similar means. Section 4(c)(4) covers libel online, while Section 6 provides that crimes under the Revised Penal Code and special laws committed through information and communications technology may carry a penalty one degree higher. (Supreme Court E-Library)

For a cyber libel complaint, you generally need to show:

1. There was a defamatory statement or imputation.
2. It identified you or made you identifiable.
3. It was published online or communicated to another person.
4. It was malicious, meaning it was made with bad motive or without justifiable reason.
5. It caused dishonor, discredit, contempt, or reputational harm.

A post does not have to mention your full legal name if people can identify you from the context, photos, tags, workplace, family references, screenshots, or comments.

Important Update: Cyber Libel Prescription Period

Timing matters. In April 2026, the Supreme Court affirmed in Causing v. People that cyber libel prescribes in one year from discovery, not 12 or 15 years. The Court explained that cyber libel is libel committed through a computer system, and prescription begins when the offended party, authorities, or their agents discover the offense. (Supreme Court of the Philippines)

This means a cyber libel complaint should be acted on quickly. Do not wait months before preserving evidence, identifying witnesses, or filing.

Safe Spaces Act: Online Sexual Harassment

If the online shaming involves sexual comments, sexualized insults, repeated unwanted sexual messages, cyberstalking, threats involving sexual content, or non-consensual sharing of sexual images, the Safe Spaces Act, Republic Act No. 11313, may apply.

The Safe Spaces Act protects individuals, regardless of sex, sexual orientation, gender identity, or gender expression, from gender-based sexual harassment in public spaces, workplaces, educational institutions, and online spaces. (Tourism Promotions)

Examples may include:

• Posting sexual insults about a woman, LGBTQ person, or any person targeted because of sex, gender, or sexuality
• Repeated unwanted sexual messages
• Threatening to expose intimate images
• Sexual rumors posted in group chats or public pages
• Cyberstalking with sexual or gender-based humiliation

Anti-Photo and Video Voyeurism Act

If the online shaming involves intimate photos or videos, consider Republic Act No. 9995, the Anti-Photo and Video Voyeurism Act of 2009.

RA 9995 prohibits taking, copying, selling, distributing, publishing, broadcasting, showing, or exhibiting intimate photos or videos without the required consent, including through the internet, cellular phones, and similar devices. Importantly, the law can apply even if the person originally consented to the recording, because separate consent is required for copying, sharing, publishing, or broadcasting it. (Lawphil)

This is especially relevant in “revenge porn” situations, breakup-related threats, leaked private videos, or intimate images circulated in chat groups.

Data Privacy Act

If the online shaming involves posting your personal information, such as your phone number, address, IDs, medical information, financial details, workplace records, screenshots of accounts, or government-issued numbers, Republic Act No. 10173, the Data Privacy Act of 2012, may also be relevant.

The Data Privacy Act protects personal information and sensitive personal information. It defines personal information as information from which an individual’s identity is apparent or can reasonably be ascertained, and sensitive personal information includes health, education, sexual life, proceedings for offenses, government-issued identifiers, and similar data. (National Privacy Commission)

However, not every embarrassing post is automatically a Data Privacy Act case. The issue is whether there was unlawful processing, disclosure, or misuse of personal data covered by the law.

Civil Code Remedies for Humiliation and Privacy Violations

Even when the act may not result in a criminal conviction, there may be a civil case for damages. Articles 19, 20, and 21 of the Civil Code require people to act with justice, give everyone their due, observe honesty and good faith, and compensate others for damage caused unlawfully or contrary to morals, good customs, or public policy. Article 26 specifically protects dignity, personality, privacy, and peace of mind, including acts that vex or humiliate another person because of personal condition. (Supreme Court E-Library)

A civil case is different from a criminal complaint. A criminal case seeks punishment by the State. A civil case seeks compensation, injunction, or other relief.

Where to File a Cybercrime Complaint for Online Shaming

You may usually start with any of these offices:

Office	Best for	Practical notes
NBI Cybercrime Division / Cybercrime Regional Centers	Cyber libel, online harassment, fake accounts, doxxing, hacking-related evidence, intimate image circulation	The NBI Citizen’s Charter says complainants may proceed to the Cybercrime Division to file a complaint or request investigation; the initial complaint sheet and interview process has no listed fee. (National Bureau of Investigation)
PNP Anti-Cybercrime Group (PNP-ACG)	Online shaming, threats, scams, fake accounts, harassment, cyber-related offenses	The PNP-ACG has regional units and online reporting channels, but serious complaints often still require sworn statements and personal appearance.
City or Provincial Prosecutor’s Office	Filing a criminal complaint directly for preliminary investigation	Best when you already have a complete complaint-affidavit and evidence.
National Privacy Commission	Data privacy violations such as unlawful disclosure or processing of personal information	More appropriate when the heart of the case is misuse of personal data, not just insult or defamation.
Barangay	Minor disputes between residents of the same city/municipality where barangay conciliation applies	Cyber libel and serious cybercrime issues often go beyond barangay settlement, but barangay records may help show prior harassment or attempts to resolve.

The NBI and PNP do not convict anyone. Their role is usually to receive the complaint, preserve or evaluate digital evidence, conduct investigation, identify account users when legally possible, and refer the case to the prosecutor. The prosecutor determines whether there is probable cause to file the criminal case in court.

Step-by-Step Guide to Filing the Complaint

1. Preserve the Evidence Immediately

Online evidence disappears fast. The post may be deleted, edited, hidden, or changed from public to private.

Before confronting the poster, preserve:

• Screenshots of the post, comments, shares, reactions, profile, page, group, URL, date, and time
• Screen recordings showing how you reached the post from the profile or page
• The full URL or link to the post, profile, page, video, or comment
• Names and URLs of accounts that shared or reposted it
• Messages from people who saw the post
• Any threats, private messages, or follow-up harassment
• Proof of your identity and proof that the post refers to you
• Medical, employment, business, school, or family consequences if relevant

Do not rely on cropped screenshots only. Investigators and prosecutors prefer evidence that shows context: account name, profile URL, date, time, full thread, and how the post is connected to you.

2. Make a Simple Timeline

Write down the facts in chronological order:

1. When you discovered the post
2. Who sent it to you or how you found it
3. What exact words, images, or videos were posted
4. Why people would know it refers to you
5. Who posted, shared, or commented
6. What harm happened afterward
7. Whether the post is still online
8. Whether the person has done similar acts before

This timeline will help your complaint-affidavit become clearer and more credible.

3. Identify the Correct Offense

Do not force every online shaming case into cyber libel. Classify it based on the facts:

Situation	Possible legal route
False public accusation of crime, immorality, disease, debt fraud, or misconduct	Cyber libel
Sexualized insults, repeated unwanted sexual comments, cyberstalking	Safe Spaces Act
Intimate photo or video shared or threatened to be shared	RA 9995, Safe Spaces Act, possibly cybercrime-related offenses
Posting address, phone number, IDs, private records, medical details	Data Privacy Act, civil damages, possibly other offenses
Threats to harm, extort, expose, or force payment	Threats, coercion, robbery/extortion-related offenses depending on facts
Edited images, fake accounts, impersonation	Cybercrime offenses, identity-related complaints, possibly libel
Employer/school group chat humiliation	Cyber libel, labor/school disciplinary remedies, civil damages

The complaint can mention several possible offenses, but it should be fact-based. Prosecutors dislike complaints that list many laws without explaining how each law was violated.

4. Prepare a Complaint-Affidavit

A complaint-affidavit is your sworn written statement. It should be signed before a notary public or authorized officer, depending on the filing office’s requirements.

It should include:

• Your full name, address, contact number, and valid ID details
• The respondent’s name, account name, address, and other identifying details, if known
• The facts in chronological order
• The exact defamatory, sexual, private, or harmful statements or materials
• Why the post refers to you
• How and when you discovered it
• Who saw it or sent it to you
• What harm resulted
• A list of attached evidence
• A statement that you are executing the affidavit to support a criminal complaint

If the respondent’s real identity is unknown, describe the account, profile link, phone number, email, payment account, page, group, or any digital identifiers you have. Investigators may need a court process or platform request to obtain subscriber or traffic data.

5. File With the NBI Cybercrime Division or PNP Anti-Cybercrime Group

For NBI cybercrime complaints, the NBI Citizen’s Charter describes an initial process where the complainant proceeds to the Cybercrime Division, fills out a complaint sheet, undergoes preliminary interview and initial investigation, and submits sworn statements, affidavits, devices, and supporting documents. The listed initial processing steps show no fee and an initial processing time of about 1 hour and 10 minutes, though actual investigation time depends heavily on complexity, evidence, workload, and whether platform data must be requested. (National Bureau of Investigation)

Bring:

• Original and photocopy of valid government ID
• Printed screenshots with URLs
• Digital copies saved in USB or phone, if requested
• Your complaint-affidavit
• Witness affidavits, if available
• The device where the messages or posts were received
• Any notarized statements, if already prepared

Expect an interview. Be ready to explain the facts calmly and specifically. Avoid exaggerations. The strongest complaints are usually those that clearly connect the post, the respondent, the victim, the publication, and the harm.

6. Ask About Preservation of Computer Data

Under RA 10175, service providers may be required to preserve traffic data, subscriber information, and content data for specified periods. The law provides for preservation of traffic data and subscriber information for at least six months from the transaction date, while content data may be preserved for six months from receipt of a preservation order; disclosure of computer data generally requires a court warrant. (Supreme Court E-Library)

This is one reason speed matters. If the case requires platform records, IP logs, subscriber information, or preserved content, delay can make the evidence harder to obtain.

7. Prosecutor Review and Preliminary Investigation

After law enforcement evaluation, the complaint may be referred to the prosecutor, or you may file directly with the prosecutor’s office.

The prosecutor may require:

• Complaint-affidavit and attachments
• Counter-affidavit from the respondent
• Reply-affidavit from the complainant
• Clarificatory hearings, if needed
• Additional evidence from investigators

If the prosecutor finds probable cause, an Information may be filed in court. Cybercrime cases under RA 10175 fall within the jurisdiction of Regional Trial Courts, including designated cybercrime courts. RA 10175 states that RTCs have jurisdiction over violations of the Act, including cases where elements were committed in the Philippines or involved computer systems wholly or partly situated in the country. (Supreme Court E-Library)

Evidence Checklist for Online Shaming Complaints

Evidence	Why it matters	Practical tip
Full screenshots	Shows exact words, date, account, and context	Capture the entire thread, not only the insulting line
URL links	Helps investigators locate the post	Copy the post link, profile link, and page/group link
Screen recording	Shows authenticity and navigation path	Record from opening the app/browser to viewing the post
Witness screenshots/messages	Shows publication and third-party viewing	Ask people who saw it to send screenshots and statements
Proof of identity	Shows you are the person referred to	Include ID, profile, employment/school proof if relevant
Proof of respondent identity	Connects account to real person	Save messages, phone numbers, payment details, admissions
Harm evidence	Supports seriousness and damages	Save employer notices, lost clients, medical records, threats
Notarized affidavits	Converts facts into sworn testimony	Include witnesses who saw the post or know it refers to you

Practical Problems That Commonly Delay Cybercrime Complaints

Deleted Posts

A deleted post does not automatically destroy your case, but it makes proof harder. Screenshots, URLs, cached copies, shares, comments, and witness affidavits become more important.

Anonymous or Fake Accounts

A fake account is not a dead end, but it requires more work. Investigators may look at linked phone numbers, emails, payment accounts, repeated language, mutual contacts, admissions, IP or subscriber information, and device evidence. Platform data usually requires proper legal process.

Private Group Chats

A private group chat can still be “published” if a third person saw the defamatory statement. For libel, publication does not always mean public to the whole world; communication to another person may be enough. But you still need credible proof of who posted it and what was said.

Truth Is Not Always a Complete Defense

Many people think, “It is true, so I can post it.” That is risky. Under Article 354 of the Revised Penal Code, defamatory imputations may be presumed malicious even if true, unless good intention and justifiable motive are shown. (Supreme Court E-Library)

For example, reporting suspected fraud to the police is very different from posting someone’s photo online and inviting the public to shame them.

Sharing, Liking, or Commenting

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel but was careful about overbreadth concerns involving online participation such as likes, shares, or comments. The liability of a person who merely reacted to or shared a post depends on the specific act, intent, wording, and applicable offense. (Lawphil)

The original author is usually the clearest respondent. Republishers, page admins, commenters, or sharers may require separate analysis.

Foreigners and Filipinos Abroad

A foreigner may file a complaint in the Philippines if the harmful act has a sufficient Philippine connection, such as the victim being in the Philippines, the respondent being in the Philippines, the post targeting people in the Philippines, or the computer system or damage being connected to the country. RA 10175 recognizes jurisdiction where elements were committed in the Philippines, where a computer system wholly or partly situated in the country was used, or where damage was caused to a person in the Philippines. (Supreme Court E-Library)

If evidence is executed abroad, Philippine authorities may require consular notarization or an apostille, depending on the document, country, and purpose. Foreign-language documents may also need certified English translation.

What Not to Do After Being Shamed Online

Avoid these common mistakes:

• Do not threaten the poster with violence or illegal exposure.
• Do not hack, access, or guess passwords to gather evidence.
• Do not create a fake account to entrap someone without legal guidance.
• Do not post a “counter-shaming” statement that may expose you to a separate complaint.
• Do not edit screenshots in a way that removes context.
• Do not wait too long, especially for cyber libel.
• Do not submit fabricated or exaggerated evidence.
• Do not assume barangay blotter alone is enough for a cybercrime case.

A calm, complete, evidence-based complaint is usually stronger than an emotional but poorly documented one.

Frequently Asked Questions

Can I file cyber libel if someone shamed me on Facebook?

Yes, if the post contains a defamatory imputation, identifies you or makes you identifiable, was published online, and appears malicious. Save the post link, screenshots, profile details, comments, and proof that people understood the post to refer to you.

Is online shaming automatically cybercrime in the Philippines?

No. Online shaming is a description of what happened, not always the legal offense. It may be cyber libel, sexual harassment, voyeurism, data privacy violation, threats, unjust vexation, or only a civil wrong depending on the facts.

Where should I file first, NBI or PNP Anti-Cybercrime Group?

Either may receive cybercrime-related complaints. Many complainants go to the NBI Cybercrime Division or the nearest PNP Anti-Cybercrime Group unit for investigation and evidence handling. If your evidence is already complete, filing directly with the prosecutor may also be possible.

What if the post was already deleted?

You may still file, but you need preserved evidence: screenshots, URLs, screen recordings, witnesses, shares, cached copies, and messages showing the post existed. Deleted content may be harder to authenticate, so act quickly.

Can I sue someone for posting my private chats?

Possibly. It depends on the content and context. If the post defames you, cyber libel may apply. If it exposes personal data, the Data Privacy Act may be relevant. If it involves intimate or sexual content, RA 9995 or the Safe Spaces Act may apply.

Can a debt collector post my photo online to shame me into paying?

That may create legal exposure for the poster or collector, especially if the post contains defamatory statements, threats, harassment, or personal information. Debt collection does not give someone unlimited authority to humiliate a debtor online.

How long does a cybercrime complaint take?

The initial receiving and interview may be done in one visit, but the full investigation can take weeks or months depending on the evidence, identity of the respondent, platform cooperation, prosecutor workload, and whether cyber warrants or data preservation requests are needed.

Can I file even if I do not know the real name of the fake account owner?

Yes. Provide every identifier you have: profile URL, username, screenshots, phone number, email, linked pages, payment accounts, messages, mutual contacts, and any admissions. The case may begin against an unknown account user while investigators work on identification.

Can I ask Facebook, TikTok, or another platform to remove the post?

Yes. Platform reporting is separate from filing a legal complaint. Report the post for harassment, privacy violation, bullying, impersonation, sexual content, or non-consensual intimate content as applicable. Save evidence before requesting takedown.

Can the person who shamed me also be liable for damages?

Yes. Apart from criminal liability, Articles 19, 20, 21, and 26 of the Civil Code may support a civil claim for damages, prevention, or other relief when the act violates dignity, privacy, peace of mind, morals, good customs, or legal duties. (Supreme Court E-Library)

Key Takeaways

• Online shaming is not one single offense; it may be cyber libel, online sexual harassment, photo/video voyeurism, data privacy violation, threats, or a civil wrong.
• Cyber libel is usually the main route when someone publicly posts false or malicious accusations that damage your reputation.
• Act quickly because the Supreme Court has affirmed that cyber libel prescribes in one year from discovery.
• Evidence is everything: save full screenshots, URLs, screen recordings, profile links, comments, shares, witness messages, and proof of harm.
• NBI Cybercrime Division, PNP Anti-Cybercrime Group, and prosecutor’s offices are the usual complaint channels for cybercrime-related online shaming.
• Do not retaliate by shaming back; preserve evidence and file a clear, sworn, fact-based complaint instead.
• Civil damages may still be possible even when the facts do not lead to a criminal conviction.

What to Do If a Lending App Threatens to Shame You on Social Media

A lending app may demand payment, send reminders, and file a proper collection case if the debt is real. But it cannot threaten to post your face, ID, “wanted” poster, private messages, loan balance, or family contacts on Facebook, TikTok, Messenger groups, or your employer’s page just to force you to pay. In the Philippines, this kind of debt-shaming can trigger regulatory, data privacy, criminal, and civil consequences for the lender or collector. The important thing is to preserve evidence, stop further data exposure, report to the right agency, and handle the actual debt separately.

Is It Illegal for a Lending App to Shame You Online?

Usually, yes. The issue is not only “may utang ka ba?” The law looks at how the lender collects.

A lender has a right to collect a valid debt through lawful means. It may send billing notices, call you at reasonable times, negotiate payment, endorse the account to a legitimate collection agent, or sue in court. But it crosses the line when it uses humiliation, threats, personal data misuse, fake criminal accusations, or pressure through your relatives, co-workers, or social media contacts.

In 2026, the DICT, National Privacy Commission (NPC), and Securities and Exchange Commission (SEC) issued a public advisory after receiving reports of online lending platforms engaging in harassment, intimidation, public shaming, and unlawful use of personal data in collection practices. The advisory specifically says excessive processing of personal data, contact-list abuse, harassment, threats to reputation, and contacting persons other than guarantors are prohibited.

The key point: a real debt does not give a lending app permission to destroy your reputation.

Your Key Rights Under Philippine Law

You cannot be jailed just because you failed to pay a loan

Article III, Section 20 of the 1987 Philippine Constitution says that no person shall be imprisoned for debt. This means a collector’s message like “ipapakulong ka namin bukas” is generally a scare tactic when the only issue is non-payment of a civil loan. (Lawphil)

There are exceptions when a separate crime is involved, such as estafa, falsification, identity fraud, or using another person’s ID. But mere inability to pay an online loan is normally a civil matter.

Lending and financing companies are regulated by the SEC

Under Republic Act No. 9474, or the Lending Company Regulation Act of 2007, lending companies are regulated and must operate with proper authority. The law places lending companies under SEC supervision and requires them to be corporations, not random individuals or unregistered app operators pretending to be lenders. (Lawphil)

The SEC’s Memorandum Circular No. 18, Series of 2019 prohibits unfair debt collection practices by financing companies, lending companies, and their third-party collection agents. It covers conduct such as threats, violence or criminal means, deceptive collection methods, and disclosure or publication of borrowers’ personal information to force payment. (SEC Appointment System) (Law and Policy Reform Program)

They cannot freely use your contacts, photos, ID, or social media information

Republic Act No. 10173, or the Data Privacy Act of 2012, requires personal data processing to follow the principles of transparency, legitimate purpose, and proportionality. Processing personal data without authority, for an unauthorized purpose, or in a malicious or excessive way can lead to serious penalties. (Lawphil)

The NPC has already recommended prosecution of an online lending company for alleged harassment and public shaming of delinquent borrowers. In that case, complaints included using phonebook contacts without consent, telling third persons about borrowers’ loans, harassing or coercing borrowers through their contacts, and posting personal or sensitive personal information on social media. (National Privacy Commission)

The 2026 DICT-NPC-SEC advisory also clarifies that lending apps may contact only guarantors for debt collection purposes. A “character reference” is not automatically a guarantor. A guarantor must separately consent to assume responsibility for the loan in case of default.

Public shaming can become cyber libel, threats, or unjust vexation

If a collector posts statements that dishonor or discredit you, the issue may go beyond an SEC or NPC complaint. Article 353 of the Revised Penal Code defines libel as a public and malicious imputation of a crime, vice, defect, act, omission, condition, status, or circumstance that tends to cause dishonor, discredit, or contempt. Article 355 punishes libel committed through writing or similar means. (Lawphil)

Republic Act No. 10175, or the Cybercrime Prevention Act of 2012, covers certain crimes committed through a computer system, including cyber libel. The Supreme Court in Disini v. Secretary of Justice recognized that online defamation may fall under cyber libel, although liability depends on the specific facts and the role of the person who made the post. (Lawphil) (Supreme Court E-Library)

If the collector threatens to harm your body, property, honor, or family, Articles 282 to 287 of the Revised Penal Code may also become relevant. Article 282 covers grave threats; Article 285 covers other light threats; and Article 287 covers unjust vexations or coercive acts. (Lawphil)

You may claim damages if the harassment caused loss or injury

The Civil Code also matters. Articles 19, 20, and 21 require people to act with justice, honesty, and good faith; make a person liable for damage caused contrary to law; and allow compensation for willful acts contrary to morals, good customs, or public policy. These provisions are often relevant when abusive collection causes reputational harm, emotional distress, job problems, or family conflict. (Lawphil)

What to Do Immediately If a Lending App Threatens to Post You Online

1. Do not panic-pay through an unverified channel

Many borrowers pay out of fear when the collector says, “Send now or we will post you.” Before paying, check:

• Is the lender or financing company SEC-registered?
• Is the online lending platform recorded with the SEC?
• Is the payment channel under the company’s official name?
• Did they give you a statement of account showing principal, interest, penalties, and payments already made?
• Are the interest, fees, and penalties the same as what was disclosed when you borrowed?

Republic Act No. 3765, or the Truth in Lending Act, requires disclosure of finance charges in credit transactions so borrowers understand the true cost of credit. (Lawphil)

This does not mean you should ignore a valid debt. It means you should not send money blindly to a personal GCash, Maya, or bank account just because someone threatened to shame you.

2. Preserve evidence before blocking or deleting anything

Evidence disappears quickly. Collect it before the collector unsends messages, changes display names, or deletes posts.

Save:

• Screenshots of threats, including date, time, sender name, number, profile link, and full message thread
• Screen recordings showing the conversation and profile details
• Links to Facebook posts, comments, Messenger group chats, TikTok posts, or other public shaming content
• Copies of the loan agreement, app screenshots, privacy notice, payment schedule, and statement of account
• Proof of payments already made
• App permissions showing access to contacts, photos, camera, microphone, SMS, or location
• Names and numbers of collectors
• Messages sent to your relatives, employer, co-workers, or friends
• Your list of actual guarantors, if any

For calls, write a call log: date, time, number, caller name if given, and exact words used. Be careful with secret recordings of private conversations because the Anti-Wiretapping Act, Republic Act No. 4200, can raise separate issues. When in doubt, rely on call logs, screenshots, text messages, and witnesses.

3. Revoke app permissions and secure your accounts

Threats often come after the app has already accessed your contacts or files. You cannot always undo data already copied, but you can reduce further exposure.

On your phone:

1. Go to app settings.
2. Revoke access to contacts, camera, photos, files, microphone, SMS, and location.
3. Remove the app if you no longer need it, but only after saving evidence.
4. Change passwords for email and social media accounts.
5. Turn on two-factor authentication.
6. Limit who can see your friends list, posts, tagged photos, and workplace details.
7. Warn close contacts not to engage, pay, or give information to collectors.

The 2026 advisory states that unnecessary app permissions and excessive access to contact lists are prohibited. It also says permissions such as camera or gallery access should be limited to legitimate purposes like identity verification and turned off once the purpose has been fulfilled.

4. Send a short written demand to stop harassment

Keep your message calm and factual. Do not insult the collector, threaten violence, or make public counter-posts that may expose you to a libel complaint.

You can send something like:

I am requesting a written statement of account and official payment channels. I object to any disclosure of my personal information, loan details, photos, ID, contact list, or account status to third persons or on social media. I also demand that you stop contacting anyone who is not a valid guarantor. Your threats to shame me online and contact my relatives/employer are being documented and may be reported to the SEC, NPC, PNP Anti-Cybercrime Group, and NBI Cybercrime Division.

This helps show that you objected clearly and gave them notice.

5. Report the lending app to the SEC

For unfair debt collection practices by lending companies, financing companies, or their collection agents, report to the SEC Financing and Lending Companies Department through the SEC’s iMessage platform. The 2026 DICT-NPC-SEC advisory specifically lists SEC FINLEND for unfair debt collection complaints and identifies SEC iMessage and the 1-4SEC hotline as reporting channels.

Prepare:

What to attach	Why it matters
Screenshots of threats	Shows harassment, intimidation, or public shaming
Name of app and company	Helps SEC identify whether the platform is recorded
Loan agreement and statement	Shows the transaction and charges
Proof of payments	Prevents inflated balance claims
App store link or website	Helps trace the online lending platform
Messages sent to contacts	Shows improper third-party disclosure
Your written demand to stop	Shows you objected and preserved your position

SEC complaints may take weeks or months depending on volume, completeness of documents, whether the company is traceable, and whether the matter requires investigation. The most common bottleneck is incomplete evidence: screenshots without dates, missing company name, or no proof connecting the collector to the app.

6. File a data privacy complaint with the NPC

If the app accessed your contacts, messaged your relatives, posted your personal details, used your ID or face, or disclosed your loan to third persons, the NPC is the right agency for data privacy violations.

The NPC’s formal complaint process requires the complaint to be in a specific format. The NPC says complainants should download the form, print and fill it out, have it notarized, and submit it in person, by courier, or by scanned email. (National Privacy Commission)

Your NPC complaint should focus on personal data misuse:

• What personal information was accessed?
• Was your contact list harvested?
• Were non-guarantors contacted?
• Were your photos, ID, address, workplace, or loan details disclosed?
• Was consent forced through the app interface?
• Did the app require excessive permissions?
• Did you try to withdraw consent or revoke permissions?
• What harm resulted?

If you are abroad, affidavits and complaint documents may need proper notarization or authentication. Philippine embassies and consulates can notarize private documents such as affidavits, and foreign documents for Philippine use may require apostille or consular handling depending on the country and document type. (Philippine Embassy) (Apostille Government)

7. Report threats, scams, and cyber harassment to law enforcement

If the message includes threats of violence, fake arrest warrants, extortion, identity theft, sexualized humiliation, doxxing, or actual social media posting, report to cybercrime authorities.

The 2026 advisory lists the following for harassment, threats, frauds, and scams:

Issue	Where to report
Threats, scams, cyber harassment	PNP Anti-Cybercrime Group
Cybercrime evidence and investigation	NBI Cybercrime Division
Other cyber-related reports	DICT Cyber Hotline
Unfair debt collection by lending/financing companies	SEC FINLEND

The same advisory provides public reporting channels for these agencies.

For practical purposes, bring both printed and digital copies of evidence. Police and cybercrime units often need screenshots, URLs, phone numbers, account names, and the original device where messages were received. If the post is still online, capture the URL and visible timestamp before asking the platform to remove it.

What If They Already Posted You on Social Media?

Act quickly, but do not respond emotionally in the comments.

1. Screenshot everything first. Capture the whole post, comments, profile name, URL, date, time, and number of shares.
2. Ask trusted friends to screenshot what they saw. Their screenshots may help prove publication and damage.
3. Report the post to the platform. Use Facebook, TikTok, Instagram, or X reporting tools for harassment, privacy violation, or doxxing.
4. Send a takedown demand to the collector or company. Keep it short and factual.
5. File with SEC and NPC. Include proof that the threat became actual publication.
6. Consider a cybercrime complaint. If the post falsely accuses you of being a scammer, criminal, prostitute, fraudster, or similar defamatory label, cyber libel may be relevant.
7. Document real-world damage. Save messages from your employer, co-workers, clients, relatives, or friends. Keep proof if you lost work, suffered disciplinary action, or had to change numbers.

Avoid posting the collector’s full name, face, phone number, address, or private details as revenge. That may create a separate defamation or privacy issue. Keep your evidence for agencies and court.

Common Lending App Threats and What They Usually Mean

Threat from collector	Legal reality
“We will post you as scammer on Facebook.”	Public shaming may violate SEC rules, data privacy law, and possibly cyber libel rules.
“We will message all your contacts.”	Contacting non-guarantors for collection is prohibited under the 2026 DICT-NPC-SEC advisory.
“Police will arrest you today.”	Non-payment of a civil debt alone is not punishable by imprisonment under the Constitution.
“Your reference must pay for you.”	A character reference is not automatically liable. A guarantor must separately consent to assume the obligation.
“We will go to your employer.”	Disclosing your debt to your employer may be improper if the employer is not a guarantor and there is no lawful basis.
“Pay through this personal wallet now.”	Verify the official payment channel and demand a statement of account first.
“We can use your ID photo because you uploaded it.”	Consent for identity verification does not automatically allow humiliation or social media posting.

Should You Still Pay the Loan?

If the loan is valid, the debt does not disappear just because the collector behaved illegally. The better approach is to separate two issues:

1. The debt issue: How much is legally due? Are the interest, penalties, and fees valid and disclosed?
2. The harassment issue: Did the lender or collector violate SEC rules, data privacy law, criminal law, or civil law?

Ask for a written statement of account. Compare it with the original loan terms. If the amount is inflated by unexplained penalties, challenge the computation in writing. If you can pay, use only official channels and keep receipts. If you cannot pay in full, propose a realistic payment plan.

Do not sign a new document admitting inflated charges unless you understand it. Some borrowers accidentally convert a disputed balance into a new written acknowledgment.

If the Lender Sues You Instead

A lender may still sue to collect a valid debt. Many small online loan claims may fall under first-level courts and simplified procedures depending on the amount and facts. The Supreme Court’s Rules on Expedited Procedures in First Level Courts took effect in 2022 and were designed to streamline small claims and other first-level court cases. (Supreme Court of the Philippines) (Supreme Court of the Philippines)

If you receive a court summons:

• Do not ignore it.
• Check the court name, case number, plaintiff, and amount claimed.
• Prepare proof of payments.
• Bring the loan agreement, screenshots of charges, and statement of account.
• Raise improper, undisclosed, or excessive charges if supported by documents.
• Keep harassment evidence separate but available, especially if it explains disputed penalties or damages.

A collection case is different from a criminal complaint against collectors. Both can exist at the same time.

Special Notes for OFWs, Foreigners, and Borrowers Outside the Philippines

If you are outside the Philippines but the lending app, borrower, or affected contacts are in the Philippines, you can still preserve evidence and file reports electronically where the agency allows it.

Practical tips:

• Use Philippine time in your timeline.
• Keep the original SIM, phone, app account, email, and screenshots.
• Ask a trusted person in the Philippines to help obtain screenshots from relatives or co-workers who were contacted.
• For notarized affidavits, check whether the Philippine Embassy or Consulate can notarize the document, or whether a locally notarized and apostilled document is acceptable for the intended agency or court.
• If the app targets your Philippine employer or family, document the impact immediately.

Foreigners should also check whether the loan was legally offered in the Philippines and whether the lender is an SEC-regulated lending or financing company. The rules on harassment, privacy, cybercrime, and unlawful debt collection do not protect only Filipino citizens; they protect persons whose rights are violated under Philippine law.

Frequently Asked Questions

Can a lending app post my face or ID on Facebook if I do not pay?

No. Uploading your ID or selfie for verification does not give the lender a free pass to use it for public humiliation. Social media shaming may violate SEC debt collection rules, data privacy principles, and possibly criminal laws depending on the content of the post.

Can a lending app message my contacts?

For debt collection, the 2026 DICT-NPC-SEC advisory says lending and financing companies may only contact the guarantor. Contacting persons in your contact list who are not guarantors is prohibited. A character reference is not automatically a guarantor.

Can I be arrested for not paying an online loan?

Not for mere non-payment of a civil debt. The Constitution prohibits imprisonment for debt. But if there is a separate alleged crime, such as fraud, falsification, identity theft, or use of fake documents, that is a different matter and depends on evidence. (Lawphil)

What if I clicked “allow contacts” when I installed the app?

Consent must still comply with data privacy law. It should be informed, specific, freely given, and limited to a legitimate purpose. Excessive or disproportionate use of your contacts, especially for harassment or public shaming, may still be illegal.

Where should I report a lending app that threatens to shame me?

Report unfair debt collection to the SEC FINLEND through SEC iMessage. Report contact-list misuse or personal data disclosure to the NPC. Report threats, scams, doxxing, fake warrants, or cyber harassment to PNP Anti-Cybercrime Group, NBI Cybercrime Division, or the DICT Cyber Hotline. The 2026 advisory identifies these agencies as reporting channels.

What evidence do I need?

Prepare screenshots, screen recordings, URLs, collector numbers, app name, company name, loan agreement, privacy notice, statement of account, payment receipts, app permissions, and messages sent to your contacts. If the post is public, capture the URL and timestamp before it is deleted.

Should I delete the lending app immediately?

Save evidence first. Then revoke permissions and remove the app if needed. Deleting the app may stop further access on your phone, but it may not erase data already collected by the lender.

Can I sue the lending app for damages?

Yes, depending on proof. Civil Code Articles 19, 20, and 21 may support a damages claim when a person or company causes injury through acts contrary to law, morals, good customs, or public policy. If the post is defamatory, cyber libel or related civil claims may also be considered. (Lawphil)

What if the app is not SEC-registered?

That strengthens the need to report. An unregistered or unrecorded lending platform may face regulatory action, and you should be extra careful about payment channels. Still, preserve evidence and do not ignore a real debt without checking the facts.

Key Takeaways

• A lending app may collect a valid debt, but it cannot use threats, public shaming, contact-list harassment, or personal data abuse.
• You cannot be jailed for mere non-payment of a civil loan.
• Do not panic-pay through personal or unverified accounts; demand a statement of account and official payment channel.
• Preserve screenshots, URLs, app permissions, loan documents, payment receipts, and messages sent to your contacts.
• Revoke app permissions and secure your social media, email, and phone accounts.
• Report unfair debt collection to the SEC, data privacy violations to the NPC, and threats or cyber harassment to PNP ACG, NBI Cybercrime Division, or DICT.
• If the lender already posted you online, screenshot first, report the post, demand takedown, and file with the proper authorities.
• Handle the debt and the harassment separately: a valid loan may still be payable, but illegal collection methods can be reported and penalized.

How to File a Restraining Order for Online Harassment in the Philippines

If someone is harassing you through Facebook, Messenger, TikTok, Instagram, Viber, email, text, anonymous accounts, or repeated online posts, the most important thing to understand is this: in the Philippines, the “restraining order” available to you depends on who the harasser is, what they are doing, and whether the harassment falls under a special protection law. For many online harassment cases involving an abusive spouse, ex-partner, dating partner, or someone with whom the victim has a child, the fastest protective remedy is a Barangay Protection Order, Temporary Protection Order, or Permanent Protection Order under Republic Act No. 9262, the Anti-Violence Against Women and Their Children Act. For other online harassment cases, the remedy may be a cybercrime complaint, a civil injunction, a writ of habeas data, a data privacy complaint, or a combination of these.

What “Restraining Order” Means in the Philippines

Filipinos often use “restraining order” as a general term for any order that stops someone from contacting, threatening, posting about, approaching, or harassing them.

Philippine law uses more specific terms:

Legal remedy	Best for	Where it is usually filed	What it can do
Barangay Protection Order (BPO)	VAWC cases involving a woman or child victim	Barangay where the victim resides	Stop further harassment, threats, or contact for a short emergency period
Temporary Protection Order (TPO)	Urgent VAWC cases	Family Court/RTC, or proper court under RA 9262	Order no-contact, stay-away, custody, support, residence, and other protective relief
Permanent Protection Order (PPO)	Longer-term VAWC protection	Court	Continue protection until modified or revoked by the court
Temporary Restraining Order (TRO) / Preliminary Injunction	Non-VAWC civil cases where a legal right is being violated	Usually RTC, depending on the case	Temporarily stop a specific act while a civil case is pending
Writ of Habeas Data	Doxxing, surveillance, misuse of personal data threatening life, liberty, security, or privacy	RTC, CA, Sandiganbayan, or Supreme Court depending on facts	Require disclosure, correction, deletion, or protection of unlawfully gathered personal data
Cybercrime / criminal complaint	Threats, cyber libel, non-consensual intimate images, identity misuse, gender-based online sexual harassment	NBI Cybercrime Division, PNP Anti-Cybercrime Group, prosecutor’s office	Start investigation and prosecution; may support later court orders

A key practical point: the NBI or PNP cannot simply issue a restraining order by themselves. They investigate and refer cases for prosecution. A restraining or protection order usually comes from the barangay in VAWC cases or from a court.

When Online Harassment Qualifies for a Protection Order Under RA 9262

For many victims, the strongest remedy is under RA 9262, which provides protection orders for violence against women and their children. The law recognizes protection orders such as BPOs, TPOs, and PPOs, and its purpose is to prevent further violence and grant necessary relief to safeguard the victim. (Lawphil)

Online harassment may fall under RA 9262 when the abuser is:

• a husband or former husband;
• a live-in partner or former live-in partner;
• a boyfriend, girlfriend, dating partner, or former dating partner;
• a person with whom the woman has or had a sexual relationship;
• a person with whom the woman has a common child; or
• in child-focused situations, a person whose abusive acts fall within the law’s coverage.

Examples of online harassment that may support a VAWC protection order include:

• repeated abusive messages from an ex-partner;
• threats to post private photos or conversations;
• public shaming meant to control, punish, or intimidate the victim;
• threats to take the child away unless the victim obeys;
• stalking through fake accounts;
• harassment of the victim’s relatives, employer, or friends;
• posting accusations to humiliate the victim;
• controlling access to money, accounts, or devices as part of abuse.

RA 9262 is not limited to physical violence. Psychological violence, threats, intimidation, harassment, and acts causing mental or emotional suffering may be relevant, especially when the online conduct is part of a pattern of control or abuse.

The Supreme Court has also recognized that fathers may file for protection on behalf of abused children under RA 9262, and that even mothers may be offenders when the child is the direct victim of violence. In Knutson v. Sarmiento, the Court emphasized that Section 9(b) allows parents or guardians to file petitions for protection orders on behalf of the offended party. (Supreme Court of the Philippines)

Legal Bases Commonly Used in Online Harassment Cases

RA 9262: Anti-Violence Against Women and Their Children Act

RA 9262 is usually the most direct route when the online harassment is connected to intimate-partner abuse. Protection orders may include no-contact provisions, stay-away provisions, removal from the shared residence, temporary custody, support, firearm surrender, and police assistance.

Barangay officials and courts are required to prioritize protection order applications under RA 9262. The law also provides confidentiality for VAWC records, including barangay records, and gives victims paid leave of up to 10 days, extendible when necessary as specified in the protection order. (Supreme Court E-Library)

Rule on Violence Against Women and Their Children

The Supreme Court’s Rule on Violence Against Women and Their Children, A.M. No. 04-10-11-SC, governs petitions for protection orders under RA 9262. It applies to court petitions for TPOs and PPOs and works together with the Rules of Court. (Lawphil)

Rule 58: TRO and Preliminary Injunction

For online harassment that does not fall under RA 9262, a person may need to file a civil case and ask for a TRO or preliminary injunction under Rule 58 of the Rules of Court. A preliminary injunction is a court order issued before final judgment requiring a person to refrain from certain acts, or in some cases to perform an act. (Lawphil)

This may be relevant when the harassment involves:

• continuing publication of private information;
• misuse of your name, photos, or identity;
• business or reputational harm;
• repeated posting of defamatory or private material;
• refusal to remove content despite demand;
• online conduct tied to a civil wrong.

A TRO or injunction is more technical than a VAWC protection order. The court usually looks for a clear legal right, urgent harm, and a reason why damages alone are not enough.

Civil Code Articles 19, 20, 21, 26, and 32

The Civil Code can support civil actions for damages, prevention, and other relief. Article 26 specifically protects dignity, personality, privacy, and peace of mind, and recognizes causes of action for acts such as meddling with private life, disturbing family relations, or vexing and humiliating another person. Article 32 also provides liability for violations of rights such as privacy of communication and correspondence. (Lawphil)

These provisions are useful when the harasser’s conduct is wrongful but does not neatly fit a special penal law.

Revised Penal Code and RA 10175: Threats, Libel, and Cybercrime

Online harassment may also be criminal.

Under the Revised Penal Code, grave threats may apply when someone threatens another person, their honor, property, or family with a wrong amounting to a crime. Unjust vexation may apply to repeated acts that annoy, irritate, torment, distress, or disturb another person without lawful purpose. Libel may apply to public and malicious imputations that dishonor or discredit a person. (Lawphil)

RA 10175, the Cybercrime Prevention Act of 2012, covers cybercrime and also increases penalties when certain crimes are committed through information and communications technology. (Lawphil)

RA 11313: Safe Spaces Act

RA 11313, also called the Safe Spaces Act or “Bawal Bastos Law,” covers gender-based sexual harassment in public spaces, online spaces, workplaces, and educational institutions. This can apply to online sexual harassment, misogynistic, homophobic, transphobic, or sexist attacks, and other gender-based conduct depending on the facts. (Lawphil)

RA 9995: Anti-Photo and Video Voyeurism Act

If the harassment involves intimate photos or videos, RA 9995 is important. It prohibits taking, copying, reproducing, distributing, publishing, broadcasting, sharing, showing, or exhibiting covered sexual or private images without the required consent, including through the internet, cellular phones, and similar means. Penalties may include imprisonment and fines. (Lawphil)

This law is especially relevant for “revenge porn,” threats to leak intimate videos, or the spread of private sexual images.

RA 10173: Data Privacy Act and NPC Complaints

If the harassment involves doxxing, unauthorized disclosure of personal information, misuse of private data, or personal data breaches, the Data Privacy Act may apply. Complaints may be filed with the National Privacy Commission by the data subject, an authorized representative, or the NPC on its own initiative. The NPC requires a notarized complaint-assisted form or verified complaint with evidence and witness affidavits; it also generally requires exhaustion of remedies, meaning the complainant first informed the respondent in writing and allowed 15 calendar days for action, unless an exception applies. (Lawphil)

Writ of Habeas Data

The writ of habeas data is an extraordinary court remedy for a person whose right to privacy in life, liberty, or security is violated or threatened by unlawful gathering, collecting, or storing of data by a public official, employee, private individual, or entity. (Lawphil)

It may be considered in serious doxxing, surveillance, stalking, coordinated harassment, or data misuse cases where the issue is not just reputation but personal safety, liberty, or security.

RA 11930 for Child Online Sexual Abuse or Exploitation

If the victim is a minor and the harassment involves sexual exploitation, grooming, coercion, child sexual abuse material, or online sexual abuse, RA 11930 may apply. This law is specifically aimed at online sexual abuse or exploitation of children and child sexual abuse or exploitation materials. (Lawphil)

Step-by-Step Guide: How to File for Protection or Restraining Relief

1. Assess whether there is immediate danger

If the online harassment includes threats of physical harm, stalking, blackmail, threats to expose intimate images, threats involving children, or statements showing the person knows your location, treat it as urgent.

Immediate danger matters because it affects the remedy:

• VAWC cases may justify a BPO or urgent TPO.
• Grave threats may justify immediate police reporting.
• Intimate image threats may justify urgent cybercrime reporting.
• Doxxing with safety risk may support habeas data or urgent court relief.

2. Preserve evidence before blocking or deleting

Evidence is often the biggest bottleneck in online harassment cases.

Before deleting anything, preserve:

• screenshots showing the message, username, profile photo, date, and time;
• the URL or profile link;
• message headers, email headers, or account IDs where available;
• screen recordings showing how you reached the profile or post;
• copies of posts, comments, videos, or stories;
• names of witnesses who saw the content;
• proof of relationship if filing under RA 9262;
• proof of identity of the harasser, if known;
• proof of harm, such as anxiety treatment, work impact, school impact, or threats received by family members.

Keep the original device and account if possible. Screenshots are useful, but investigators may still want to inspect the phone, laptop, account, or original message thread.

For intimate photos, child sexual material, or extremely sensitive content, do not forward or spread the material. Preserve it carefully for authorities without creating unnecessary copies.

3. Identify the correct legal track

Use this quick guide:

Situation	Likely route
Ex-boyfriend repeatedly threatens and humiliates a woman online	BPO/TPO/PPO under RA 9262; possible cybercrime complaint
Spouse threatens to post private photos	RA 9262 + RA 9995 + cybercrime complaint
Stranger sends rape threats or death threats online	Criminal complaint for threats, possibly cybercrime-related
Fake account posts defamatory claims	Cyber libel complaint; possible civil action
Someone posts your address, phone number, workplace, and family details	Data privacy complaint, criminal complaint if threats exist, possible habeas data
Classmate or coworker sends sexual comments or gender-based attacks online	Safe Spaces Act complaint; school/workplace procedure; possible criminal complaint
Minor is groomed, blackmailed, or exploited online	RA 11930 / child protection complaint; cybercrime unit involvement
Business competitor runs a smear campaign	Civil action, cyber libel complaint, possible injunction

4. File a Barangay Protection Order if it is a VAWC case

A Barangay Protection Order is often the fastest first layer of protection in VAWC cases.

Go to the barangay where the victim resides and ask for a BPO. The Punong Barangay may issue it. If unavailable, a barangay kagawad may act depending on the circumstances under the law and implementing rules.

Bring:

• valid ID;
• screenshots and printed copies of threats or harassment;
• proof of relationship, such as marriage certificate, child’s birth certificate, photos, messages, or affidavits;
• address or contact details of the respondent, if known;
• a short written timeline of incidents.

A BPO is an emergency remedy. It is not a substitute for a court TPO or PPO if the harassment is serious, continuing, or escalating.

5. File a TPO or PPO in the proper court

For stronger and longer protection, file a petition for a Temporary Protection Order and/or Permanent Protection Order.

In RA 9262 cases, petitions are commonly filed in the Family Court, or if there is no Family Court in the area, in the proper court with territorial jurisdiction under the law. Existing guidance on RA 9262 recognizes that applications may be filed in the court with jurisdiction over the petitioner’s residence, and if a Family Court exists there, the case should be filed there. (Human Rights Library)

A court protection order may ask the respondent to:

• stop contacting the victim directly or indirectly;
• stop posting, messaging, tagging, calling, emailing, or using third parties;
• stay away from the victim’s home, workplace, school, or child’s school;
• stop threatening to release private material;
• leave the shared residence, if applicable;
• surrender firearms;
• provide temporary support;
• follow custody or visitation limits;
• stop harassment through fake accounts or intermediaries.

A TPO may be issued urgently, sometimes even before the respondent is heard, when the facts show immediate risk. Courts may renew or extend temporary protection as needed while the case is pending.

6. File a cybercrime or criminal complaint

For threats, cyber libel, identity misuse, intimate image abuse, sexual harassment, blackmail, or fake-account harassment, file with:

• NBI Cybercrime Division or a Regional Cybercrime Center;
• PNP Anti-Cybercrime Group or regional cybercrime unit;
• the Office of the City or Provincial Prosecutor;
• in some cases, the DOJ Office of Cybercrime for cybercrime reporting and coordination.

The NBI Citizens’ Charter for computer crime victims describes a process where complainants and witnesses execute sworn statements or submit prepared affidavits, supporting documents are collected, and the complaint is forwarded for authority to investigate; the listed frontline processing time for that initial assistance is about 1 hour and 10 minutes, though the full investigation may take much longer. (National Bureau of Investigation)

Prepare:

• notarized affidavit-complaint or sworn statement;
• valid government ID or passport;
• printed screenshots with dates and URLs;
• soft copies in a USB drive or storage device;
• original phone or device, if needed for inspection;
• witness affidavits;
• police blotter or barangay record, if any;
• proof of account ownership or identity of the harasser, if available.

7. Consider a civil injunction or habeas data case if the harasser is not covered by RA 9262

If the harasser is not an intimate partner and no special protection order applies, a court TRO or preliminary injunction may be possible if there is a pending civil case and the requirements under Rule 58 are met.

This route is usually used when you need the court to stop:

• continued posting of private or defamatory content;
• unauthorized use of your name or image;
• disclosure of private data;
• misuse of business, family, or personal information;
• harassment connected to property, employment, business, or privacy rights.

For serious data-related threats, a writ of habeas data may be more appropriate than an ordinary injunction.

8. Enforce the order and document every violation

A protection order is only useful if violations are documented.

Once an order is issued:

• get certified copies;
• give copies to the barangay, police station, workplace security, school, or building admin when relevant;
• do not negotiate privately with the respondent;
• document every new message, fake account, post, tag, call, or third-party contact;
• report violations promptly to the issuing barangay or court and law enforcement.

Violation of a protection order can create separate legal consequences.

Required Documents

Document	Why it matters
Valid ID or passport	Confirms identity of the complainant
Screenshots with date/time	Shows the actual harassment
URLs/profile links/account IDs	Helps investigators trace or verify accounts
Affidavit-complaint	Main sworn narrative of what happened
Witness affidavits	Supports that others saw the posts, threats, or effects
Relationship proof	Needed for RA 9262 cases involving spouses, partners, ex-partners, or common children
Birth certificate of child	Needed if the child is a protected party
Medical, psychological, or counseling records	Helps prove harm, especially psychological violence
Police blotter/barangay record	Shows prior reporting and urgency
Original device/account access	Helps authenticate messages and digital evidence
Demand letter or written notice	Useful in civil, data privacy, or platform-removal contexts

Fees, Timelines, and Practical Bottlenecks

Remedy	Typical upfront cost	Usual timing	Common bottleneck
BPO	Usually none	Same day or urgent barangay action	Barangay familiarity with online VAWC evidence
TPO	May be accepted without payment when indigent or urgent/imminent danger exists	Urgent court action possible	Drafting a clear verified petition with evidence
PPO	Court process	Weeks to months, depending on docket and hearings	Service of summons/order and court calendar
NBI/PNP cybercrime complaint	No complaint filing fee, but printing/notary/storage costs may apply	Intake may be quick; investigation takes longer	Identifying anonymous accounts and preserving metadata
Prosecutor complaint	Usually no filing fee for criminal complaint	Often months	Preliminary investigation delays
Civil TRO/injunction	Docket fees and possible injunction bond	Urgent TRO possible if requirements are met	Need for a strong civil case and proof of irreparable injury
NPC complaint	Usually document preparation, notarization, printing, courier costs	Varies	Exhaustion of remedies and proper formatting
Habeas data	Court filing process	Summary remedy, but timing varies	Showing threat to privacy in life, liberty, or security

In RA 9262 cases, the law and related rules are designed so victims are not blocked by lack of money in urgent or indigent situations. Guidance on protection orders states that if the victim is indigent or immediate action is necessary due to imminent danger, the court should accept the application without payment of filing fees and related fees. (Human Rights Library)

Special Notes for Foreigners and Filipinos Abroad

Foreigners can be victims and complainants in Philippine online harassment cases. Philippine penal laws and public safety laws generally apply to persons who live or sojourn in Philippine territory. The Civil Code also recognizes that penal laws and laws of public security and safety are obligatory upon those within Philippine territory, subject to international law and treaty rules. (Lawphil)

Practical points for foreigners:

• Bring your passport, ACR I-Card if any, and proof of Philippine address or stay.
• If the harasser is in the Philippines, local law enforcement and courts may have a clearer basis to act.
• If the harasser is abroad, Philippine authorities may still receive the complaint, but service of orders, identification, extradition, and enforcement can be slower and more complicated.
• If affidavits or official documents are executed abroad for use in the Philippines, authentication or apostille requirements may apply. DFA apostille services and verification channels are handled through the Philippine apostille system. (Apostille Government)
• If the victim is abroad but the harasser, evidence, child, property, or effects are in the Philippines, the case may still have a Philippine connection that matters.

For Filipinos abroad, screenshots and affidavits can be prepared overseas, but court filings in the Philippines often require proper notarization, apostille or consular documentation when needed, and a representative or counsel who can receive notices.

Common Mistakes That Hurt Online Harassment Cases

Deleting the messages too early

Blocking may be necessary for safety, but deleting the thread can weaken evidence. Save first, then block if needed.

Relying only on screenshots

Screenshots are helpful but not always enough. Keep links, account IDs, original files, and the device.

Filing in the wrong place

A barangay can issue a BPO only in proper VAWC situations. It cannot issue a general restraining order against a random online troll, a foreign fake account, or a platform.

Treating every insult as cyber libel

Not every rude, false, or humiliating post is automatically cyber libel. Prosecutors look at publication, identification, defamatory imputation, malice, and other legal elements.

Ignoring the relationship requirement under RA 9262

RA 9262 is powerful, but it is not for every harassment case. If the harasser is a stranger, coworker, neighbor, classmate, or business rival, another legal route may be needed.

Sharing intimate evidence with too many people

If the case involves intimate images, avoid forwarding them to friends, group chats, or social media. That can create privacy and legal risks. Preserve the material for authorities in the least harmful way possible.

Waiting until the account disappears

Fake accounts, stories, comments, and posts may disappear quickly. Capture evidence as soon as possible.

Frequently Asked Questions

Can I file a restraining order for Facebook harassment in the Philippines?

Yes, but the correct remedy depends on the facts. If the harasser is a spouse, ex, dating partner, or someone covered by RA 9262, you may seek a BPO, TPO, or PPO. If the harasser is not covered by RA 9262, you may need a cybercrime complaint, civil injunction, habeas data petition, data privacy complaint, or another remedy.

Can I get a restraining order against an ex who keeps messaging me online?

If you are a woman, or the protected party is a child, and the ex is covered by RA 9262, repeated threatening, abusive, controlling, or humiliating messages may support a protection order. Save the messages, show the relationship, and file through the barangay for a BPO or through the court for a TPO/PPO.

Is a barangay blotter enough?

A barangay blotter is useful evidence that you reported the incident, but it is not the same as a protection order, criminal complaint, or court case. In VAWC cases, ask specifically about a Barangay Protection Order. For cybercrime, report to NBI, PNP-ACG, or the prosecutor.

What if the harasser is using a fake account?

You can still report the account. Preserve the profile URL, screenshots, messages, dates, mutual contacts, payment records if any, phone numbers, email addresses, and clues connecting the fake account to a real person. NBI or PNP cybercrime investigators may request platform or technical information through proper channels, but identification can take time.

Can a man file a restraining order for online harassment?

A man can file criminal, civil, data privacy, or injunction-related remedies if he is harassed online. However, RA 9262 protection orders are primarily for women and children. A father may file on behalf of an abused child in proper RA 9262 situations, as recognized by the Supreme Court in Knutson v. Sarmiento. (Supreme Court of the Philippines)

Can a foreigner file against a Filipino harasser?

Yes, if the facts give Philippine authorities jurisdiction or a sufficient Philippine connection. Bring your passport, local contact details, evidence, and sworn statement. If documents are executed abroad, apostille or authentication issues may arise.

Can the court order Facebook or TikTok to remove the posts?

A Philippine court can order a respondent before it to stop posting, remove content, or refrain from contacting the victim. Direct enforcement against a foreign platform can be more complicated. In practice, victims often combine legal action with platform reporting, cybercrime reporting, and preservation of evidence.

How fast can I get protection?

A BPO may be issued urgently at the barangay level in VAWC cases. A TPO may be issued quickly by a court when immediate protection is justified. Cybercrime investigations and prosecutor proceedings usually take longer, especially if the account is anonymous or technical data must be requested.

What if the harasser threatens to leak my private photos?

This may involve RA 9995, RA 9262 if the harasser is an intimate partner, and cybercrime-related remedies. Preserve the threats and the context, but do not spread the images. The law penalizes unauthorized sharing, distribution, publication, or broadcasting of covered intimate images, including through internet and cellular means. (Lawphil)

Do I need a lawyer to file?

For a BPO, you generally do not need a lawyer. For a TPO/PPO, civil injunction, habeas data petition, or complex cybercrime complaint, legal help is often useful because the documents must clearly state the facts, legal basis, evidence, and relief requested. The practical risk is not just losing the case, but filing the wrong remedy and losing time.

Key Takeaways

• A “restraining order” for online harassment in the Philippines may mean a BPO, TPO, PPO, TRO, injunction, habeas data writ, or another remedy depending on the facts.
• RA 9262 is usually the strongest and fastest route when the online harassment is connected to intimate-partner violence against a woman or abuse involving a child.
• The barangay can issue a BPO only in proper VAWC cases; it cannot issue a general restraining order for every online harassment situation.
• For strangers, fake accounts, threats, cyber libel, intimate image abuse, or doxxing, the usual route is NBI/PNP cybercrime reporting, prosecutor filing, data privacy remedies, civil injunction, or habeas data.
• Preserve evidence before blocking, deleting, or reporting the account.
• Screenshots should show dates, times, URLs, usernames, profile links, and the full context of the harassment.
• Foreigners and Filipinos abroad can pursue Philippine remedies when there is a sufficient Philippine connection, but documents executed abroad may need apostille or authentication.
• Serious cases often require multiple tracks: protection order for safety, cybercrime complaint for investigation, and civil/data remedies for removal, privacy, or damages.

How to Recover a Hacked Online Lending App Account in the Philippines

A hacked online lending app account can quickly become more than a login problem. Someone may apply for a loan in your name, change your phone number or bank details, withdraw proceeds, harass your contacts, or make it look like you are refusing to pay. In the Philippines, the practical goal is to do four things fast: secure your phone and linked accounts, preserve proof, formally dispute the loan or transaction with the lending company, and report the cybercrime, data privacy, and lending-law violations to the correct government offices.

First, Understand What “Hacked Online Lending App Account” Can Mean

A hacked loan app account usually falls into one of these situations:

Situation	What usually happened	Main risk
Account takeover	Someone accessed your existing loan app account using your OTP, password, SIM, email, or phone	Unauthorized loan, changed payout details, collection demands
Identity theft	Someone used your ID, selfie, phone number, or personal data to open a new account	Fake loan under your name
Device compromise	Malware, fake apps, phishing links, or remote access apps exposed your credentials	Multiple accounts may also be at risk
SIM or email takeover	The hacker controls the OTP channel	They can reset passwords and approve transactions
Data misuse by the app or collector	The lending app or collector contacts your phonebook, employer, relatives, or social media contacts	Harassment, public shaming, privacy violation

Do not treat this as a simple “forgot password” problem. Treat it as a possible cybercrime, privacy incident, and financial consumer complaint.

Your Immediate Priorities in the First 24 Hours

1. Secure your phone, SIM, email, and e-wallets first

Before arguing with the loan app, close the door the hacker used.

Do these immediately:

1. Change your email password connected to the lending app.
2. Enable two-factor authentication on your email, e-wallet, bank, and social media accounts.
3. Check email forwarding rules and recovery email/phone settings.
4. Log out all devices from your email, Facebook, Google, Apple ID, e-wallet, and banking apps.
5. Call your telco if your SIM suddenly lost signal, stopped receiving OTPs, or shows signs of SIM-swap fraud.
6. Call your bank or e-wallet provider if any loan proceeds, cash-ins, transfers, or deductions passed through your account.
7. Remove unknown apps, especially “remote support,” screen-sharing, fake cleaner, fake loan, or APK-installed apps.
8. Update your phone OS and run a security scan.

If your bank or e-wallet is involved, report unauthorized or suspicious transactions to the financial institution immediately. The BSP’s consumer guidance also emphasizes reporting suspicious transactions to the bank or financial institution and escalating unresolved issues through BSP consumer assistance channels. (Bangko Sentral ng Pilipinas)

2. Preserve evidence before deleting anything

Many victims panic and uninstall the app or delete messages. That may make it harder to prove the hacking.

Save:

• Screenshots of the lending app profile, loan history, disbursement details, and changed account information
• SMS OTPs, emails, push notifications, login alerts, and reset notices
• Screenshots of calls, texts, chats, threats, harassment, or public posts
• The app name, developer name, Play Store/App Store link, website, Facebook page, and customer service details
• Loan agreement, disclosure statement, amortization schedule, repayment history, and reference number
• Bank or e-wallet transaction records
• Names, numbers, and scripts used by collectors
• A timeline: when you last used the app, when you noticed the hack, and what happened after

For screenshots, include the date, time, sender, phone number, profile URL, and full conversation thread where possible. For voice calls, write a call log summary immediately after each call, noting the number, time, person’s claimed name, and what was said.

Legal Basis: Your Rights Under Philippine Law

Cybercrime Prevention Act: hacking, fraud, and identity theft

Republic Act No. 10175, the Cybercrime Prevention Act of 2012, covers cybercrimes committed through computer systems, including illegal access, computer-related fraud, computer-related forgery, and computer-related identity theft. These are the usual legal categories when someone enters a lending app account without permission, uses your identity, changes account details, or causes a loan or transfer to be processed electronically. (Supreme Court E-Library)

The Supreme Court decision in Disini v. Secretary of Justice, G.R. No. 203335 (2014) is often cited in Philippine cybercrime discussions because it reviewed the constitutionality of several provisions of RA 10175 and recognized that the law regulates access to and use of cyberspace. (Supreme Court E-Library)

Data Privacy Act: misuse of your personal data

Republic Act No. 10173, the Data Privacy Act of 2012, protects personal information and sensitive personal information processed by private companies and government agencies. A lending app handles highly sensitive data: IDs, selfies, contact details, device information, employment information, bank or e-wallet details, and sometimes contact lists.

Under the Data Privacy Act, data subjects have rights including access, correction of inaccurate personal information, and protection against unauthorized processing. The law also requires notification to the National Privacy Commission and affected data subjects when sensitive personal information, or information that may enable identity fraud, is reasonably believed to have been acquired by an unauthorized person and is likely to create a real risk of serious harm. (National Privacy Commission)

SEC rules on online lending and unfair collection

Lending companies are regulated under Republic Act No. 9474, the Lending Company Regulation Act of 2007, while financing companies are regulated under Republic Act No. 8556, the Financing Company Act of 1998. Online lending platforms are not exempt from these rules merely because they operate through an app.

The SEC has specific rules against abusive collection. SEC Memorandum Circular No. 18, Series of 2019, prohibits unfair debt collection practices by financing companies, lending companies, and their third-party collection agents. It covers threats, obscene or abusive language, false representations, disclosure or publication of borrower information, unreasonable contact hours, and contacting people in the borrower’s contact list other than those named as guarantors or co-makers.

A 2026 joint advisory by the DICT, National Privacy Commission, and SEC also warned the public about online lending platforms engaging in harassment, intimidation, public shaming, and unlawful use of personal data. The advisory states that unnecessary app permissions, excessive contact-list processing, and contacting people in the borrower’s contact list for collection purposes are prohibited except for proper guarantor-related purposes.

Financial consumer protection

Republic Act No. 11765, the Financial Products and Services Consumer Protection Act, applies to financial products and services and strengthens consumer protection against abusive, fraudulent, or unfair practices by financial service providers. (Lawphil)

In practice, this supports your right to clear disclosures, fair treatment, proper complaint handling, and protection from abusive conduct when dealing with lenders and financial institutions.

Civil and criminal remedies may also apply

Depending on the facts, other laws may be relevant:

• Revised Penal Code: estafa, grave threats, unjust vexation, coercion, slander, or libel may apply depending on the conduct.
• Civil Code Articles 19, 20, and 21: abuse of rights and wrongful acts causing damage may support a civil claim.
• Civil Code Article 26: protects against acts that meddle with privacy, vex or humiliate another, or cause mental distress.
• Civil Code Article 2176: quasi-delict may apply when fault or negligence causes damage.
• RA 8484, as amended by RA 11449: may apply if access devices, cards, account credentials, or similar devices are fraudulently used. (Lawphil)

Step-by-Step Guide to Recover and Dispute the Account

Step 1: Contact the lending app through official channels only

Use the app’s official customer service email, in-app support, website, or verified social media page. Avoid links sent by random collectors.

Your message should clearly say:

• Your account was compromised.
• You dispute any loan, transaction, change of details, or disbursement made after the compromise.
• You request temporary account freeze or suspension.
• You request preservation of logs and records.
• You request a copy of the loan documents, IP logs if available, device records if available, disbursement details, and identity verification records.
• You request that collection activity be paused while the dispute is investigated.
• You request that your contacts, employer, relatives, and references not be contacted except as allowed by law.

Use a subject line like:

URGENT: Hacked Account and Disputed Unauthorized Loan – [Your Name] – [Registered Mobile Number]

Keep proof that you sent it. If sent by email, save the sent email and delivery reply. If sent through the app, screenshot the ticket number.

Step 2: Ask the app to freeze the account and preserve records

A useful request is:

Please freeze the account, prevent further changes, preserve login logs, device identifiers, IP addresses, KYC records, disbursement records, collection notes, call logs, and all documents related to this account pending investigation.

This matters because digital evidence can disappear quickly. Customer service agents often say “wait 24 to 72 hours,” but you should still send a written request immediately.

Step 3: Dispute the loan in writing

If a loan was taken without your authorization, do not simply say “I was hacked.” Be specific:

• “I did not apply for this loan.”
• “I did not authorize this disbursement.”
• “The payout account is not mine.”
• “The phone/email/account details were changed without my authority.”
• “I dispute the validity of this obligation pending investigation.”

If you had a real existing loan before the hack, separate the legitimate loan from the unauthorized activity. For example:

Type of amount	How to handle it
Loan you personally applied for before the hack	Ask for a statement of account and continue disputing only illegal charges or harassment
Loan created after hacking	Formally dispute as unauthorized
Penalties caused by app lockout or compromised account	Ask for reversal pending investigation
Payments diverted to wrong wallet or account	Report to the lending app and payment provider immediately

Step 4: Report linked bank or e-wallet transactions

If the hacker changed the disbursement account or used your e-wallet:

1. Report to your bank/e-wallet fraud hotline.
2. Ask for a case number.
3. Ask whether the receiving account can be flagged, frozen, or investigated.
4. Request transaction details for your complaint.
5. If unresolved, escalate through BSP consumer assistance.

For BSP-supervised entities, the usual path is to complain first to the bank or e-money issuer’s own consumer assistance mechanism, then escalate to the BSP if the issue is not resolved. (Bangko Sentral ng Pilipinas)

Step 5: File a cybercrime report with NBI or PNP

For hacking, identity theft, phishing, SIM takeover, fake accounts, or unauthorized loans, report to either:

• NBI Cybercrime Division
• PNP Anti-Cybercrime Group
• CICC / Inter-Agency Response Center hotline 1326 for online scam reporting, especially if the incident is fresh

The NBI Citizens Charter for computer crime complaints states that complainants may proceed to the Cybercrime Division to file a complaint or request investigation, with no fee listed for the initial filing steps, and that complainants and witnesses may execute sworn statements or submit affidavits and supporting documents. (National Bureau of Investigation)

Bring or prepare:

• Valid government ID
• Printed screenshots and digital copies
• Phone used for the app, if available
• SIM card and proof of ownership, if relevant
• Email login alerts and password reset notices
• App profile and loan documents
• Bank/e-wallet transaction records
• Affidavit or sworn statement
• Timeline of events
• Names, numbers, URLs, and account details of suspected hackers or collectors

Practical timeline: intake may be quick, but investigation can take weeks or months depending on the complexity, availability of logs, cooperation of platforms, and whether subpoenas or preservation requests are needed.

Step 6: File a privacy complaint with the National Privacy Commission when personal data is misused

File with the NPC when:

• Your personal data was used to create a loan account.
• The app failed to secure your personal data.
• Your contact list was accessed excessively.
• Collectors contacted your relatives, employer, co-workers, or phonebook contacts.
• Your name, photo, ID, loan details, or alleged debt was posted or shared.
• The app refuses to correct inaccurate data or stop unauthorized processing.

NPC procedure matters. Under the NPC complaint mechanics, data subjects affected by a privacy violation or personal data breach may file a complaint. The NPC requires a filled-out and notarized complaint-assisted form or verified complaint, evidence, and witness affidavits. It also observes exhaustion of remedies, meaning you generally need to inform the respondent in writing and give it a chance to act; lack of timely or appropriate action, or no response within 15 calendar days from receipt, should be attached as proof. (National Privacy Commission)

This is why your written complaint to the lending app is important. It is not just customer service—it may become proof for NPC filing.

Step 7: File an SEC complaint for lending and collection violations

File with the SEC when the issue involves:

• Unauthorized or disputed loan under an online lending platform
• Abusive collection
• Threats or public shaming
• Contacting your phonebook
• False claims that your contacts are guarantors
• Misleading loan terms
• Refusal to identify the lending company
• Unrecorded or suspicious online lending platform

The SEC i-Message portal accepts feedback, reports, issues, and complaints and provides ticket tracking. (Securities and Exchange Commission)

For a stronger SEC complaint, include:

• Name of lending app
• Corporate name of lender, if known
• SEC registration or certificate of authority details, if available
• App store link
• Screenshots of collection messages
• Proof that collectors contacted third parties
• Your dispute letter and their response or non-response
• Loan reference number
• Statement that the account was hacked or loan was unauthorized

Step 8: Warn your contacts calmly

If the app or hacker accessed your contacts, send a short, calm message:

My online lending app account may have been compromised. If anyone contacts you about a loan supposedly under my name, please do not pay, do not give personal information, and please send me screenshots, phone numbers, and messages for my complaint.

Do not accuse a specific person unless you have proof. Your goal is to stop panic, prevent further scams, and collect evidence.

What to Say to Collectors While the Account Is Disputed

Keep it short and written.

You can say:

I dispute this loan/account as unauthorized due to account compromise. I have already requested account freezing and investigation. Please send the loan documents, identity verification records, disbursement details, collector’s full name, company name, and authority to collect. Do not contact my relatives, employer, co-workers, or phone contacts. Further harassment, threats, or disclosure of personal data will be reported to the SEC, NPC, NBI, and PNP.

Avoid long emotional arguments. Collectors may use your statements against you or keep baiting you into calls.

Common Mistakes That Make Recovery Harder

Paying immediately “para tumigil lang”

Paying may stop some collectors temporarily, but it can also make the lender argue that you recognized the loan. If you truly did not apply for the loan, dispute it first in writing.

If you decide to pay a legitimate undisputed amount, write that payment is made only for the admitted portion and not as admission of unauthorized transactions.

Deleting the app too early

You may lose access to loan details, tickets, or in-app messages. Capture evidence first. After preserving evidence, revoke permissions and uninstall if needed for security.

Only reporting on Facebook

Public posts can warn others, but they are not a substitute for formal reports. File through official channels and keep case or ticket numbers.

Ignoring the SIM issue

Many “hacked app” cases are actually SIM-swap, stolen phone, email takeover, or OTP compromise cases. If the attacker still controls your OTP channel, account recovery will fail.

Letting collectors force you into voice calls

Ask for written communications. If they call, note the number, date, time, caller name, company, and exact threats. Written proof is easier to attach to SEC, NPC, NBI, PNP, or court filings.

Documents You Should Prepare

Document or proof	Why it matters
Valid ID	Confirms your identity for the lender and government agencies
Affidavit of hacking/account compromise	Useful for NBI, PNP, NPC, SEC, banks, and e-wallets
Screenshots of app profile and loan history	Shows unauthorized changes or loans
SMS/email OTP and login alerts	Shows account access or reset attempts
Bank/e-wallet records	Shows where money went
Complaint letter to lender	Shows formal dispute and exhaustion of remedies
Lender response or non-response	Supports SEC/NPC escalation
Collection messages and call logs	Supports unfair collection complaint
Contact statements	Helps prove third-party harassment
App store link and developer details	Helps identify the platform

For formal complaints, affidavits are usually notarized in the Philippines. If you are abroad, you may need documents notarized before a Philippine Embassy or Consulate, or notarized locally and apostilled depending on where the document was executed and where it will be used.

What If You Are a Filipino Abroad or a Foreigner?

If you are outside the Philippines:

• You can still email the lending company, bank/e-wallet, SEC, NPC, or relevant complaint channels.
• You may authorize a trusted person in the Philippines through a Special Power of Attorney if physical filing or follow-up is needed.
• Philippine consular notarization is often used for documents executed abroad for use in the Philippines.
• If using foreign notarized documents, an apostille may be required if the country is a member of the Apostille Convention.
• Keep time zone differences in mind when responding to deadlines or verification calls.

Foreigners dealing with a Philippine lending app should also preserve passport, visa, Philippine address, local SIM ownership, e-wallet, and bank records. The Data Privacy Act may apply to entities with a Philippine link, including those processing information in the Philippines or carrying on business in the Philippines. (National Privacy Commission)

Where to File: Quick Reference Table

Problem	Office or channel	What to ask for
Hacked account, identity theft, phishing, unauthorized loan	NBI Cybercrime Division or PNP Anti-Cybercrime Group	Investigation, sworn complaint, preservation of evidence
Fresh online scam or cyber fraud	CICC / I-ARC hotline 1326	Immediate reporting and referral
Personal data misuse, contact-list harassment, public shaming	National Privacy Commission	Privacy complaint, correction, investigation, penalties
Abusive online lending app or collector	Securities and Exchange Commission	Complaint against lending/financing company or OLP
Bank or e-wallet unauthorized transfer	Bank/e-wallet first, then BSP if unresolved	Fraud investigation, reversal request, complaint escalation
Threats, coercion, blackmail, stalking	Police/NBI; prosecutor if case proceeds	Criminal complaint
Civil damages for humiliation or privacy invasion	Proper court, depending on claim and amount	Damages, injunction, other relief

Frequently Asked Questions

Can I refuse to pay a loan made by a hacker using my online lending account?

You can formally dispute an unauthorized loan. Send a written dispute immediately and ask the lender to freeze collection while investigating. If you had a legitimate loan before the hacking, separate that admitted loan from the unauthorized transaction.

What if the lending app says I am liable because the OTP was used?

OTP use is evidence, but it is not always the whole story. OTPs can be compromised through phishing, SIM swap, malware, social engineering, or email takeover. Ask the lender to produce login logs, device data, disbursement details, KYC records, and the account-change history.

Can an online lending app contact my contacts if I do not pay?

Generally, abusive contact-list collection is restricted. SEC rules prohibit contacting persons in the borrower’s contact list other than those named as guarantors or co-makers, and the 2026 DICT-NPC-SEC advisory reiterates that online lending platforms may only access contacts for limited, legitimate purposes and may not use excessive contact-list processing for harassment or unfair collection.

Should I file with the SEC, NPC, NBI, or PNP?

File based on the issue. For hacking and identity theft, go to NBI or PNP cybercrime. For personal data misuse, file with the NPC. For abusive online lending or collection, file with the SEC. If money passed through a bank or e-wallet, report to that institution first and escalate to BSP if unresolved.

Do I need a notarized affidavit?

For serious disputes, yes, it is often useful. NBI, PNP, NPC, SEC, banks, and e-wallets may accept initial reports without one, but a notarized affidavit or sworn statement gives your complaint more weight and is often needed as the case progresses.

How long does recovery take?

Password recovery may take hours or days if the lender cooperates. Disputes over unauthorized loans may take weeks. Cybercrime investigations can take longer, especially if records must be requested from platforms, telcos, banks, e-wallets, or app operators.

What if the app is illegal or not SEC-registered?

Still preserve evidence and file complaints. Unregistered or unrecorded platforms may be harder to chase, but SEC, NBI, PNP, NPC, DICT, app stores, banks, and e-wallets may still act on complaints, takedowns, account freezing, or investigation requests.

Can I ask the lending app to delete my data?

You may request correction, blocking, deletion, or withdrawal of consent where legally appropriate. However, if there is an ongoing dispute, investigation, or legal claim, the company may retain certain records for lawful purposes. The better immediate request is to stop unauthorized processing, correct false records, freeze the disputed account, and preserve evidence.

What if collectors post my photo or call me a scammer online?

Save screenshots with URLs, dates, comments, and account names. Report to the SEC for unfair collection, NPC for unauthorized disclosure or misuse of personal data, and NBI/PNP if threats, blackmail, identity theft, or cyber-libel issues are involved.

Can I recover money already transferred to the hacker?

Possibly, but speed matters. Report to the bank or e-wallet immediately and ask whether the receiving account can be flagged or frozen. Recovery is more difficult once funds are cashed out or moved through multiple accounts.

Key Takeaways

• A hacked online lending app account should be handled as a cybercrime, privacy issue, and financial consumer dispute.
• Secure your SIM, email, phone, bank, and e-wallet before focusing only on the loan app.
• Preserve screenshots, transaction records, messages, call logs, app details, and a clear timeline.
• Send a written dispute to the lending company and ask for account freeze, investigation, record preservation, and suspension of collection.
• Report hacking and identity theft to NBI or PNP cybercrime authorities.
• Report data misuse, contact-list harassment, or public shaming to the National Privacy Commission.
• Report abusive online lending and unfair collection to the SEC.
• If a bank or e-wallet is involved, report to the provider immediately and escalate unresolved complaints to the BSP.
• Do not pay an unauthorized loan just to stop harassment without clearly documenting your dispute.
• If you are abroad, prepare a consularized or apostilled affidavit or Special Power of Attorney when a representative in the Philippines must act for you.