Quick answer

Report abusive collection by an online lending app to the Securities and Exchange Commission (SEC), and report misuse of your personal information to the National Privacy Commission (NPC). If there are threats of violence, suspected extortion, identity misuse, or fraud, also seek assistance from the police or the National Bureau of Investigation (NBI).

For complaints against lending and financing companies, use the SEC iMessage portal. For privacy complaints, follow the NPC’s formal complaint instructions and submit the required notarized form and evidence. A social-media post or an email copying several agencies does not necessarily constitute a properly filed complaint. Securities and Exchange Commission

An unpaid loan does not give a lender permission to threaten you, shame you publicly, or misuse your contacts and photos. At the same time, reporting harassment does not automatically cancel a valid debt.

What conduct should you report?

A lender may demand payment and pursue lawful collection remedies. The problem is how it collects and how it handles personal information.

Warning signs include:

Threatening physical harm or damage to your reputation or property.
Using your photo, selfie, or identification document to embarrass you into paying.
Contacting people from your phone directory to pressure them about your debt.
Publishing your loan details in social-media posts or group chats.
Requiring access to personal information that is unnecessary or excessive for the loan transaction.

The 18 March 2026 joint advisory of the DICT, NPC, and SEC reiterates the prohibitions on harassment, public shaming, and disproportionate use of borrowers’ personal data. privacy.gov.ph

Character references are different from guarantors

A character reference helps verify a borrower’s identity or information during the loan application. Being listed as a reference does not, by itself, mean that person agreed to pay the loan.

A guarantor must have expressly consented to assume responsibility in case of default. Under the NPC’s loan-processing rules, character references and guarantors must be identified separately. Contact-list processing for collection outside the borrower’s designated guarantors is prohibited.

Accordingly, a borrower’s permission to access contacts is not a blanket authorization to collect from relatives, coworkers, or friends. If the lender claims someone is a guarantor or co-maker, preserve the relevant agreement and consent records; the person’s actual obligations depend on those documents. privacy.gov.ph

Some data processing remains lawful

The Data Privacy Act of 2012, Republic Act No. 10173, requires transparency, a legitimate purpose, and proportionality. Consent is one possible legal basis for processing ordinary personal information, but it is not the only one: necessary contractual processing, legal obligations, and other statutory grounds may apply.

This means that withdrawing consent or paying the loan does not necessarily require immediate deletion of every record. Retention may remain justified for legal obligations or legal claims. It does not justify using those records for unauthorized shaming or harassment. privacy.gov.ph

Where to report the problem

Problem	Reporting route
Abusive collection by a lending or financing company	SEC, through iMessage
Unauthorized disclosure, contact-list misuse, or misuse of photos and IDs	NPC, through its formal complaint process
Lending activities by an individual or company without an SEC Certificate of Authority	SEC Enforcement and Investor Protection Department, at epd@sec.gov.ph
Threats, suspected extortion, fraud, or other potentially criminal conduct online	PNP Anti-Cybercrime Group or NBI Cybercrime Division
A loan provided by a BSP-supervised financial institution	Complain to the institution first, then escalate unresolved concerns through the BSP Consumer Assistance Mechanism

The SEC’s published instructions distinguish complaints against authorized lending and financing companies from reports about unauthorized lending. For bank or other BSP-supervised products, follow the BSP’s consumer assistance channels. Identify the actual creditor rather than relying solely on the app’s name or the e-wallet used to receive payment. Securities and Exchange Commission

Step 1: Preserve evidence before blocking or uninstalling

Create a folder containing the loan documents and a dated record of each incident.

Preserve:

Messages: Full conversations showing the sender’s number or account, dates, times, and exact threats.
Calls: Call logs, numbers used, and contemporaneous notes of what was said.
Public posts: Screenshots, profile names, direct URLs, dates, and the surrounding context.
Messages sent to other people: Ask recipients to keep the originals and explain when and how they received them.
App information: App name, developer, store listing, website, privacy notice, permissions, and company details.
Loan records: Agreement, disclosure statement, account number, disbursement record, repayment receipts, and balance statements.
Earlier complaints: Your written notices, delivery or receipt evidence, ticket numbers, and the lender’s replies.

Keep original files and unedited screenshots. If you prepare cropped or highlighted copies for readability, retain the originals too. Back up the material somewhere you can still access if your phone is lost or the app stops working.

Witness affidavits can help establish messages received by relatives or coworkers. The NPC requires supporting documents and relevant affidavits; unsupported allegations may lead to dismissal. privacy.gov.ph

Step 2: Identify the company behind the app

Check the agreement, disclosure statement, privacy notice, and app listing for the lender’s legal name and contact details. Note any collection agency and the numbers or accounts its agents use.

For SEC complaints, distinguish corporate registration from a Certificate of Authority to operate as a lending or financing company. The SEC’s complaint instructions require one complaint form per respondent company. Securities and Exchange Commission

If you cannot identify the operator, do not invent a company name. Provide the app listing, developer name, website, payment instructions, messages, and other identifying clues. The NPC rules allow a complainant who does not know the respondent’s identity to state circumstances that may lead to identification. privacy.gov.ph

Step 3: Send a written complaint to the lender

Send the complaint through a verified company email address, customer-support channel, or data protection officer’s contact details. Preserve proof of submission and receipt.

State:

Your account reference and the app involved.
The dates and specific conduct complained of.
Which information was used or disclosed, and to whom.
What you want stopped, corrected, removed, or explained.
Your request that the company preserve relevant records.

For example, request an end to third-party collection messages, removal of a shaming post, an explanation of how contacts were obtained, and confirmation of corrective action. Discuss repayment separately and request an itemized balance if the amount is disputed.

The NPC’s 15-day rule—and its exceptions

Ordinarily, you must first notify the lender or other concerned entity in writing about the privacy violation. The NPC requires proof that the entity failed to take timely or appropriate action, or did not respond within 15 calendar days from receiving the notice.

The NPC may waive this requirement for demonstrated good cause or serious violations, including grave and irreparable harm, the absence of an adequate remedy, or patently illegal action. Explain and document why a waiver is needed; it is discretionary.

Do not delay seeking police assistance over an immediate threat because of this NPC requirement. It governs the privacy complaint’s exhaustion of remedies. privacy.gov.ph

Step 4: File the SEC complaint

Use the SEC iMessage portal. The SEC’s published instructions direct lending and financing company complaints to this portal beginning 4 November 2024.

Prepare a clear factual account, the loan documents available to you, screenshots and other evidence, and proof of your efforts to resolve the issue with the company. Follow the portal’s current form and attachment requirements, and submit one complaint form for each respondent company.

If the concern involves lending without a Certificate of Authority, use the separate enforcement route identified above. Keep your submission acknowledgment and reference number. Securities and Exchange Commission

The relevant collection regulation is SEC Memorandum Circular No. 18, series of 2019, on unfair debt collection practices. Describe what happened instead of merely listing circular numbers.

Step 5: File the NPC privacy complaint

Use the downloadable form on the NPC’s formal complaint page. Its instructions require you to complete the form, have it notarized, and submit it with evidence—in person, by courier, or through the email route specified on that page. Check the NPC contact page for current office and complaint contact details.

Include the lender correspondence, relevant screenshots, loan documents, and witness affidavits where appropriate. Follow the current checklist and any instructions about copies or electronic submissions. privacy.gov.ph

The complaint also requires a certification against forum shopping. Disclose related proceedings and their status accurately. If you have already approached the SEC, police, or another body, explain the different issues raised rather than concealing those reports. A representative generally needs a special power of attorney. privacy.gov.ph

Fees and assistance if you cannot afford them

Under NPC Circular No. 2023-01, the complaint filing fee is ₱500, with a legal research fee of 1% of the filing fee, subject to a ₱10 minimum. Additional fees apply to damages claims and some other requests. Obtain the NPC’s assessment before paying.

Indigent litigants may qualify for exemption. The circular requires both the specified family-income limit and the real-property limit: gross income must not exceed double an employee’s monthly minimum wage, and qualifying real property must not exceed ₱300,000 in fair market value under the current tax declaration. Supporting documents include a barangay indigency certificate and sworn statements. privacy.gov.ph

Step 6: Escalate threats or suspected crimes promptly

Seek urgent assistance if someone threatens to hurt you, approaches your home aggressively, demands money under threats, impersonates authorities, or uses your identity for another transaction.

The 2026 joint advisory identifies these cybercrime contacts:

NBI Cybercrime Division: ccd@nbi.gov.ph
PNP Anti-Cybercrime Group: acg@pnp.gov.ph
DICT cyber hotline email: 1326@dict.gov.ph

For immediate physical danger, seek help from the nearest police station. Bring the original messages and identifying details. Investigators and prosecutors must assess which offense, if any, the evidence supports; “online harassment” alone does not establish every element of a crime. privacy.gov.ph

Protect your accounts while the complaint is pending

After saving evidence, review and revoke unnecessary app permissions. Secure your email, social-media, and financial accounts, particularly if passwords or verification codes may have been exposed.

Tell affected contacts to preserve messages and avoid sharing information or making payments in response to pressure. Report abusive posts to the platform after capturing them.

Revoking permissions or uninstalling the app may limit further access from your device. It does not retrieve data already copied, erase the loan, or replace a complaint.

Common mistakes to avoid

Deleting evidence too early. Save messages and loan records before clearing chats or uninstalling.
Relying on outdated filing instructions. Use current official complaint pages.
Assuming a reference owes the debt. Ask for the actual guarantee or co-maker documents.
Publishing IDs or private details while seeking help. Share necessary evidence through official channels.
Treating every payment demand as unlawful. Explain the threats, disclosures, deception, or other specific abuse.
Ignoring genuine legal papers. Verify court documents directly with the issuing court and obtain help promptly.
Assuming a complaint cancels repayment obligations. Address the debt and the abusive conduct as separate issues.

What can a complaint achieve?

Depending on the evidence and applicable law, a complaint may result in investigation, corrective measures, or sanctions. No particular result or resolution time is guaranteed.

For continuing misuse of personal data, ask whether a temporary ban on processing is appropriate. It requires a separate motion, supporting facts, and procedural requirements, potentially including a bond; filing the complaint alone does not create a ban. privacy.gov.ph

Keep checking the contact channels you supplied and respond to official requests. Seek legal help promptly if you receive a dismissal, adverse decision, or court papers, because response and challenge deadlines can be short.

Frequently asked questions

Can I complain even if my loan is overdue?

Yes. Default does not remove your privacy rights or authorize abusive collection. Whether the balance is valid and whether collection was unlawful are separate questions.

Can I be jailed simply because I cannot pay?

The 1987 Constitution, Article III, Section 20, prohibits imprisonment for debt. Mere inability to repay is different from a separately alleged crime. Have genuine criminal complaints or court documents assessed rather than assuming they are automatically invalid. officialgazette.gov.ph

Can a relative or coworker complain if they never borrowed?

Yes, if their own personal data was affected by a privacy violation. They should preserve the messages and explain their involvement. Character references can also request removal of their information as references under the NPC’s loan-processing rules. privacy.gov.ph

Does agreeing to app permissions allow public shaming?

No. Permissions do not dispense with lawful purpose and proportionality. The NPC rules specifically prohibit using a borrower’s photo to harass or embarrass them into paying. privacy.gov.ph

Should I report to both the SEC and NPC?

Where the facts involve both abusive collection and personal-data misuse, both routes may be relevant. Tailor each complaint to the agency’s role and disclose related proceedings accurately.

Must I pay the loan before filing?

The complaint procedures discussed here do not require prior settlement of the loan. Filing does not itself suspend payment obligations, so continue addressing any valid debt through verified channels.

This article provides general Philippine legal information, not legal advice for a particular case. Liability and remedies depend on the evidence, agreements, and applicable procedures. Official sources checked on 12 October 2026.