Quick answer
Report abusive collection by a Philippine lending or financing company to the Securities and Exchange Commission (SEC), and report unlawful use or disclosure of personal data to the National Privacy Commission (NPC). Threats, extortion, impersonation, or other suspected crimes may also require a report to the Philippine National Police Anti-Cybercrime Group (PNP-ACG) or the National Bureau of Investigation (NBI). The same incident can involve more than one agency’s jurisdiction. Securities and Exchange Commission
Preserve the evidence, identify the company behind the app, and ordinarily send it a written complaint before escalating. For an NPC complaint, the usual requirement is proof that the company failed to take timely or appropriate action, or did not respond within 15 calendar days after receiving your written notice. The NPC can waive that requirement in justified cases; an immediate safety threat should be reported to law enforcement without waiting. privacy.gov.ph
An overdue loan does not remove your protection against abusive collection. Republic Act No. 11765, the Financial Products and Services Consumer Protection Act, expressly prohibits abusive collection or debt recovery practices. elibrary.judiciary.gov.ph
What conduct can you report?
Threats, public shaming, and deceptive collection
Under SEC Memorandum Circular No. 18, series of 2019, prohibited practices include:
Violence or threats of criminal harm against a person, reputation, or property.
Threats to take action that cannot legally be taken.
Abusive obscenities, insults, or profane language.
Improper disclosure or publication of borrowers’ names and personal information.
False representations or deceptive collection methods.
Contacting people in a borrower’s contact list who were not named as guarantors or co-makers, even if the borrower consented.
The circular also addresses contact before 6 a.m. or after 10 p.m., but contains exceptions where the account is more than 15 days overdue or the borrower expressly consented because those are the only reasonable opportunities for contact. Those exceptions do not authorize threats, shaming, or other abuse.
Outsourcing collection does not let a lender avoid responsibility: the circular treats third-party collectors as its agents and preserves the lender’s ultimate responsibility for collection compliance. lpr.adb.org
A truthful payment reminder, demand letter, or notice that a lender may pursue a lawful court action is not automatically harassment. Assess the actual words, frequency, recipients, timing, and surrounding circumstances.
Misuse of contacts, photographs, IDs, or loan information
The Data Privacy Act requires lawful processing and observance of transparency, legitimate purpose, and proportionality. Consent is one lawful basis for processing, but it is not the only one: necessary processing for a contract or legal obligation may also be permitted. That does not authorize using information for an unrelated or unlawful purpose. lawphil.net
Under NPC Circular No. 2020-01, as amended by NPC Circular No. 2022-02:
A borrower’s photograph cannot be used to harass or embarrass them into paying.
Unconstrained, excessive, or disproportionate processing of contact lists is prohibited.
Limited contact access may be allowed for selecting references or guarantors, or deriving proportionate metadata for legitimate purposes.
These limited permissions do not authorize harvesting contacts for harassment or collecting from unrelated people.
Clicking “Allow contacts” therefore does not give a lender unlimited permission to message your phonebook or shame you online. privacy.gov.ph
A character reference is not automatically a guarantor
A character reference helps verify a borrower’s identity or information. A guarantor expressly undertakes an obligation to the creditor if the borrower defaults.
The NPC’s amended rules require the guarantor’s separate consent. They also require lenders to inform character references how their details were obtained and provide an option to have their data removed as a reference. Simply naming someone in an application does not automatically make that person liable for the loan. privacy.gov.ph
If a collector claims you are a guarantor or co-maker, ask for the document or electronic record establishing that obligation. Whether you are liable depends on what you actually agreed to and the applicable law.
Where should you file?
ProblemAppropriate starting pointAbusive collection by a lending or financing company or its collectorSEC iMessageMisuse of contacts, unauthorized disclosure, excessive collection of data, or other privacy violationsNPC formal-complaint processThreats, extortion, impersonation, or suspected online crimesPNP-ACG, NBI, or the nearest police station for immediate assistanceComplaint against a bank or another BSP-supervised institutionThe institution’s complaint mechanism first, then BSP Consumer Assistance if unresolved
The SEC regulates lending and financing companies; the BSP’s consumer-assistance mechanism covers institutions under BSP supervision. Check the actual creditor named in the loan agreement, especially when a loan is offered inside an e-wallet or another company’s app. Securities and Exchange Commission
Step 1: Preserve evidence before blocking or uninstalling
Create a dated folder containing:
Messages: complete SMS, email, and chat conversations showing sender details, dates, and times.
Calls: call logs, numbers, frequency, duration, and notes written immediately after abusive calls.
Online posts: screenshots, exact URLs, account names, dates, and the surrounding conversation.
Loan records: the agreement, disclosure statement, repayment schedule, account number, actual amount received, and payment receipts.
App details: app-store listing, developer name, website, privacy notice, permissions requested, and customer-service or data-protection contact details.
Third-party evidence: messages received by relatives, colleagues, employers, or references, together with their own account of what happened.
Your complaint history: written notices, delivery acknowledgments, ticket numbers, replies, and follow-ups.
Keep original files and the device where practicable. Use separate copies for highlighting or redaction. A cropped screenshot may omit information needed to identify the sender or explain the exchange.
Write a short timeline linking each incident to an attachment. For example: “On 12 October, this number sent my loan balance to my colleague; see Attachment B.” Separate what you personally witnessed from what someone else reported.
Do not assume you may secretly record a private call because you are participating in it. In Ramirez v. Court of Appeals, G.R. No. 93833, 28 September 1995, the Supreme Court held that the Anti-Wiretapping Act can apply to a participant who secretly records a private conversation without the required authorization. Preserve messages and call logs, and obtain legal advice before making covert recordings. lawphil.net
Step 2: Identify the lender and collector
Look for the company’s legal name in the contract, privacy notice, disbursement record, and payment instructions. Record the collection agency’s name separately.
Check the SEC’s list of recorded online lending platforms and Check with SEC. Match the app to the company and its authority; a familiar brand name or registration screenshot alone is insufficient to establish who contacted you. Securities and Exchange Commission
If you cannot identify the operator, preserve every available clue: app URL, developer details, email addresses, phone numbers, payment recipients, and transaction references. Explain what you checked instead of guessing a company name.
The NPC’s loan-processing circular covers persons acting as lenders or financing companies even without the required SEC authority. Lack of registration does not eliminate privacy obligations. privacy.gov.ph
Step 3: Send a specific written complaint
Ordinarily, write to the lender’s official complaint channel and its data protection officer or privacy contact. Include the collector where identifiable.
Your notice should:
Identify the account and the incidents, using dates and supporting evidence.
Describe the conduct you want stopped, such as threats, public posts, or collection messages to unrelated contacts.
Identify the personal data involved and ask how it was obtained, used, and disclosed.
Request appropriate correction, blocking, removal, or deletion of unlawfully processed data.
Ask the company to preserve relevant collection and processing records.
Request a written response and provide a reliable contact channel.
Keep proof of receipt. A sent email, delivery acknowledgment, support ticket, and subsequent response can help establish your efforts to resolve the matter.
The SEC’s complaint guidance asks for evidence that remedies with the company were exhausted. The NPC separately requires written notice and failure to take timely or appropriate action, or no response within 15 calendar days from receipt. That 15-day period is not a universal deadline for filing every complaint. Securities and Exchange Commission
If there is grave or irreparable harm, no adequate remedy from the company, or other grounds for urgent intervention, expressly request an NPC waiver of the prior-notice requirement and support it with evidence. The waiver is discretionary, not automatic. privacy.gov.ph
Step 4: File the SEC complaint through iMessage
The SEC’s published notice directs complaints and inquiries about financing companies, lending companies, and their online platforms to SEC iMessage beginning 4 November 2024. Use this current instruction instead of relying solely on email addresses copied from older posts. Securities and Exchange Commission
To file:
Open the portal and follow its sign-in instructions.
Choose the service for “Complaints on Financing and Lending Companies” under the Financing and Lending Companies Department.
Complete the required complaint details and upload the requested documents.
Save the ticket number and submission acknowledgment.
Monitor the ticket and respond to requests for missing information.
The SEC’s current iMessage manual identifies that complaint service. imessage.sec.gov.ph
Prepare the loan agreement, relevant messages and other evidence, valid government-issued ID, and proof of your complaint to the company. SEC guidance calls for one complaint form per respondent company. If the operator appears unauthorized, state that clearly and request appropriate enforcement routing; do not invent a registration or Certificate of Authority number. Securities and Exchange Commission
Step 5: File a formal privacy complaint with the NPC
Use the current complaint-affidavit
Download the form from the NPC’s formal-complaint page. The form available on the source-check date is a March 2026 complaint-affidavit with an accompanying questionnaire.
Complete the applicable sections, including:
Your identity and contact details.
The respondent’s identity and available contact information.
The personal data processed and the specific acts complained of.
A chronological factual account.
Your prior written notice, the response, or the reason you seek a waiver.
Supporting documents and relevant witness affidavits.
The remedies requested.
The verification and certification against forum shopping.
The form also requests identification and supporting evidence. Follow its instructions rather than submitting only an informal message saying “the app harassed me.” privacy.gov.ph
Notarize and submit through an authorized channel
The NPC’s published instructions require notarization and permit personal filing, courier submission, or submission of a scanned notarized complaint by email. Registered mail is also recognized in its procedural guidance.
For email filing, use complaints@privacy.gov.ph and follow the NPC’s document-format and subsequent filing instructions. Keep the originals, sent email, attachments, and acknowledgment. For physical submission, check the NPC’s current address and receiving arrangements before travelling. privacy.gov.ph
Account for filing fees or apply for exemption
Under NPC Circular No. 2023-01, the basic complaint filing fee is ₱500, with a legal research fee of 1% of the filing fee, but not less than ₱10. Additional fees apply to damages claims and certain applications.
Qualifying indigent litigants are exempt. The schedule requires both an income test and a property test: combined gross income with the immediate family must not exceed twice the applicable monthly minimum wage, and the litigant must not own real property with a declared fair market value above ₱300,000. Supporting documents include a barangay certificate of indigency and the prescribed affidavits.
Use the official fee schedule and obtain the NPC’s assessment or exemption instructions for your particular filing. privacy.gov.ph
Step 6: Seek urgent help when threats or harm are escalating
Contact law enforcement promptly if a collector threatens physical harm, attempts extortion, impersonates an officer, or threatens to release intimate material. Bring your evidence and explain the immediate risk. The DOJ specifically identifies the NBI, PNP-ACG, NPC, and SEC as reporting bodies for unlawful online-lending collection practices. doj.gov.ph
For continuing unlawful processing, ask the NPC or a lawyer about a temporary ban on processing personal data. The NPC rules require a supported application and provide for a summary hearing and, unless exempt, a bond. Filing a complaint alone does not automatically stop the processing. privacy.gov.ph
After preserving evidence, report abusive posts through the platform’s reporting tools and revoke unnecessary app permissions. These protective steps do not replace a formal complaint or erase data already copied by the operator.
Seek legal assistance promptly if you receive a summons, subpoena, prosecutor’s notice, or agency decision. Verify the document through the issuing office’s independently obtained contact details and act within the stated deadline.
What can a complaint achieve?
The outcome depends on the evidence, the applicable rules, and the respondent’s opportunity to answer.
The NPC’s amended rules allow decisions imposing compliance measures, processing restrictions, administrative fines, and appropriate indemnity relating to data-protection rights. The NPC may also recommend prosecution to the Department of Justice. A fine imposed on a company is not automatically compensation payable to you, and a prosecution recommendation is not a criminal conviction. privacy.gov.ph
Describe the remedy you need: removal of a shaming post, cessation of unlawful disclosure, correction of false information, investigation of data misuse, or compensation supported by evidence. Do not assume that reporting harassment automatically cancels the loan, freezes interest, or suspends a court case.
Common mistakes to avoid
Deleting the app before saving records. Preserve agreements, account history, messages, and company details first.
Submitting screenshots without context. Identify the sender, date, recipient, and connection to the lender.
Treating a social-media post as a formal complaint. Complete the agency’s actual filing requirements.
Sending the same attachments indiscriminately to every agency. Follow each agency’s requirements and avoid unnecessary disclosure of IDs or account details.
Paying an unverified collector. Confirm the authorized payment channel independently and keep receipts.
Ignoring genuine legal notices. A harassment complaint does not excuse failure to respond to separate proceedings.
Concealing related filings. The NPC certification requires disclosure of relevant pending cases and an update within five calendar days after learning of a same or similar action. privacy.gov.ph
Frequently asked questions
Can I complain even if my loan is overdue?
Yes. The prohibition against abusive collection applies to financial consumers, including those from whom payment is being collected. Address any valid repayment obligation separately from the complaint about the collection method. elibrary.judiciary.gov.ph
Can I be jailed simply for failing to pay an online loan?
No. Article III, Section 20 of the 1987 Constitution prohibits imprisonment for debt. A separate allegation of criminal conduct must be assessed on its own elements; nonpayment alone does not establish such an offense. elibrary.judiciary.gov.ph
Can I complain if I never borrowed but the app keeps contacting me?
Yes, if your own personal data or privacy rights are affected. Preserve the messages, state that you dispute being a borrower or guarantor, and ask for the basis of the contact. Being listed as a character reference does not automatically make you a guarantor. privacy.gov.ph
Does uninstalling the app or paying the loan require deletion of every record?
No. Uninstalling does not establish that previously collected data was erased. Some records may lawfully be retained for legal obligations, legitimate business purposes, or legal claims. Retention must remain justified; it does not permit continued shaming or unrelated use. privacy.gov.ph
Can I report the same incident to both the SEC and NPC?
Potentially, yes: unfair collection and unlawful data processing are different regulatory concerns. Explain the issues raised in each filing and disclose related proceedings accurately. Obtain legal advice where claims or requested remedies overlap. doj.gov.ph
Is there one filing deadline for all lending-app complaints?
No. Applicable periods depend on the violation and remedy. The NPC rules refer penal violations of the Data Privacy Act to the prescription periods under Act No. 3326. The 15-day prior-notice rule is not the limitation period for all claims. Preserve evidence and seek advice promptly, particularly for older incidents. privacy.gov.ph
This article provides general Philippine legal information, not advice on a particular case. The appropriate complaint, remedy, and deadline depend on the facts and documents. Official sources checked on 23 October 2026.
Double-click to edit...