Quick answer

Report abusive collection practices by an online lending company to the Securities and Exchange Commission (SEC), and report misuse of personal data to the National Privacy Commission (NPC). If the conduct involves threats, blackmail, fraud, or immediate danger, seek police or cybercrime assistance promptly. One incident may require more than one reporting route.

For complaints against lending and financing companies and their apps, use the SEC iMessage portal. For privacy complaints, follow the NPC’s formal complaint procedure and use its current complaint-affidavit form. Preserve evidence before deleting messages or uninstalling the app. These reporting routes are reflected in current SEC guidance and the joint government advisory on online lending platforms. Securities and Exchange Commission

An overdue loan does not give a collector permission to threaten or shame you. At the same time, filing a harassment complaint does not automatically cancel a valid debt.

What conduct should you report?

A lender may pursue payment through lawful means. The problem is how it collects, accesses information, or discloses your debt.

Report conduct such as:

Threatening violence or other criminal harm against you, your family, your reputation, or your property.
Threatening action that cannot legally be taken.
Publishing your personal information to shame you into paying.
Using deception to collect payment or obtain information about you.
Messaging people in your phone contacts to pressure you to pay.
Accessing or using contacts, photographs, or other personal data excessively or for an unauthorized purpose.

The government’s 18 March 2026 joint advisory reiterates restrictions on threats, unfair collection, unnecessary app permissions, and disproportionate processing of borrowers’ data. privacy.gov.ph

Can the app contact your references, relatives, or employer?

A character reference is not automatically a guarantor. A reference helps verify an applicant’s identity or information. A guarantor expressly agrees to answer for the borrower’s obligation under the applicable rules on guaranty; the lender must obtain the guarantor’s separate consent.

The NPC’s amended loan-data rules prohibit contacting people in a borrower’s contact list for debt collection other than those declared as guarantors. A relative, coworker, or employer does not become responsible for your debt simply because their number appears in your phone.

A character reference must also be informed about their designation and how their contact details were obtained, and must have an option to have their data removed as a reference. If someone allegedly signed as a co-borrower, co-maker, or guarantor, their actual documents and obligations need separate examination. privacy.gov.ph

Does allowing app permissions make everything lawful?

No. Under Sections 11–13 of the Data Privacy Act of 2012, processing must satisfy the applicable lawful basis and privacy requirements, including transparency, legitimate purpose, and proportionality.

Consent is not unlimited permission to shame you or use everyone in your address book for collection. However, not every use of loan information requires fresh consent: processing may have another lawful basis, such as contractual necessity or a legal obligation. Whether a particular disclosure is lawful depends on its purpose, scope, and circumstances. officialgazette.gov.ph

Step 1: Preserve evidence and protect your accounts

Create a folder containing:

Messages and call logs: Complete conversations, sender numbers or account names, dates, times, and call frequency.
Posts and disclosures: Screenshots showing the full post, profile, URL, date, and comments where relevant.
Messages sent to other people: Ask recipients to preserve the original messages and explain when and how they received them.
Loan records: The agreement, disclosure statement, amount actually received, repayment schedule, account statement, and payment receipts.
App information: App name, store listing, developer, operating company, privacy notice, permission screens, and customer-service details.
Your complaints: Emails, support tickets, delivery acknowledgments, replies, and reference numbers.

Keep original files and unedited copies. Screenshots should show enough context to identify the sender and the incident. Prepare a dated timeline linking each event to its supporting attachment.

Then review app permissions and revoke unnecessary access. Save your records before uninstalling the app. Uninstalling does not retrieve data already copied by the operator. Change compromised passwords, secure your email and e-wallet accounts, and never disclose an OTP to a collector.

After preserving a harmful post, report it through the platform’s reporting tools. Platform removal and a government complaint serve different purposes; keep proof even if the post disappears.

Step 2: Identify the company behind the app

Use the loan agreement, disclosure statement, app listing, privacy notice, and payment instructions to identify the actual lender. Record the app name and the collector’s details separately.

For an SEC complaint, check whether the company has a Certificate of Authority to operate as a lending or financing company. Ordinary corporate registration alone does not establish that authority.

The SEC’s published procedure distinguishes between:

Situation	Reporting route
Complaint against a lending or financing company with a Certificate of Authority	SEC iMessage
Lending activity by an individual or company without that authority	SEC Enforcement and Investor Protection Department, at epd@sec.gov.ph
Unauthorized access, disclosure, or other misuse of personal data	NPC
Threats, suspected blackmail, fraud, or other possible crimes	Police, PNP Anti-Cybercrime Group, or NBI Cybercrime Division

If the operator is unclear, provide the identifying information you have rather than guessing a company name. Securities and Exchange Commission

Step 3: Send a written complaint to the lender

Send your complaint to the company’s official customer-service channel and, for privacy issues, its data protection officer or published privacy contact. Do not rely only on a conversation with the collection agent.

Include:

Your loan or account reference, using only the information necessary to identify it.
The specific acts complained of, with dates and supporting evidence.
The collector’s number, account, or claimed identity.
The action requested—for example, stopping third-party collection messages, removing a shaming post, investigating the collector, or correcting inaccurate information.
A request for a written response.

For privacy concerns, ask what information was accessed, where it came from, to whom it was disclosed, and the basis for using it. Request preservation of relevant records.

Keep proof that the company received your complaint. This matters for formal filing: the SEC asks for proof that remedies with the company have been exhausted, while the NPC has a specific prior-notice rule. Securities and Exchange Commission

Step 4: File the appropriate formal complaint

Reporting unfair collection to the SEC

The SEC states that, since 4 November 2024, inquiries and complaints against lending and financing companies and their online lending platforms must be filed through SEC iMessage.

Follow the portal’s current instructions. Prepare a completed complaint form, valid government-issued ID, supporting documents, and proof of your earlier complaint to the company. The SEC directs complainants to submit one complaint form per respondent company.

Explain the conduct precisely. Identify the lender and any outsourced collector, and attach evidence connecting the collection activity to the loan.

Keep your submission acknowledgment and monitor requests for additional documents. Do not assume that a social-media comment or an email to an unrelated SEC address completes formal filing. Securities and Exchange Commission

Reporting privacy violations to the NPC

Ordinarily, notify the company in writing first. Under Rule II, Section 2 of the NPC’s 2021 Rules of Procedure, you must establish that the company did not take timely or appropriate action, or did not respond within 15 calendar days from receipt of your written notice.

That period is not a universal deadline for filing your case. It is part of the requirement to give the company an opportunity to address the complaint.

Exceptions exist. The NPC may waive these requirements for properly alleged and proven good cause or a serious violation, including circumstances involving grave and irreparable damage, lack of an adequate remedy from the respondent, or patently illegal conduct. Explain the urgency and provide supporting evidence; waiver is discretionary. privacy.gov.ph

To file:

Download the current form from the NPC complaint page.
Complete it accurately and have it notarized.
Attach your evidence, valid ID, prior correspondence, and any relevant witness affidavits.
Include the required certification against forum shopping and disclose related proceedings truthfully.
Submit through the NPC’s published channels: in person, by courier, or by scanning and emailing the notarized documents as directed on its complaint page.

Use the current form rather than an old copy circulating online. The form presently linked by the NPC is a March 2026 complaint-affidavit. Check the linked fee schedule and ask about applicable exemptions or waiver if cost is a concern. privacy.gov.ph

A general inquiry is different from a formal complaint. Incomplete allegations, missing supporting information, or unjustified failure to give the respondent an opportunity to act can lead to dismissal without prejudice under the amended rules. Monitor the email address you use: NPC orders may be served electronically. privacy.gov.ph

When help is urgent

Seek immediate police assistance if there is a credible threat of physical harm, someone is approaching your home or workplace to intimidate you, or you face ongoing blackmail.

For suspected cybercrime, the joint government advisory identifies:

PNP Anti-Cybercrime Group: acg@pnp.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph
DICT Cyber Hotline email: 1326@dict.gov.ph

An email report does not guarantee immediate intervention or replace any required sworn complaint. For immediate danger, contact or go to the nearest police station. Preserve threatening messages and payment demands; avoid meeting the sender alone. privacy.gov.ph

Ask a lawyer or the NPC promptly whether urgent relief against continued data processing is appropriate. Do not wait for an ordinary customer-service response before seeking protection from an immediate threat.

What reporting can—and cannot—achieve

Depending on the evidence and applicable law, a complaint may lead to investigation, corrective action, administrative sanctions, or referral for prosecution. No particular result is automatic.

Reporting does not itself settle the loan. The SEC’s complaint guidance expressly states that this process cannot cancel your obligation, change contractual payment terms, or declare the loan or interest void. If you dispute the balance, request an itemized accounting and obtain advice on the appropriate remedy. Securities and Exchange Commission

Keep legitimate repayment discussions documented. Verify payment instructions independently through the lender’s official channel, and obtain receipts.

Common mistakes to avoid

Deleting evidence too soon. Save conversations and loan records before blocking numbers or removing the app.
Reporting only the app’s nickname. Include the operating company and evidence connecting the collector to it.
Assuming permissions authorize harassment. Explain the actual access, disclosure, or misuse.
Sending identical complaints everywhere without explaining jurisdiction. Describe the collection issue to the SEC, the data issue to the NPC, and suspected criminal conduct to investigators.
Hiding related cases. Disclose other proceedings as required.
Ignoring official notices. Follow the deadlines stated in agency orders or court documents.
Expecting automatic debt cancellation or compensation. These require their own legal basis and appropriate process.

Frequently asked questions

Can I complain even if my loan is overdue?

Yes. Being overdue does not remove your protection against unlawful collection or misuse of personal data. Your repayment obligation and the collector’s conduct are separate issues.

Can I report harassment if I never borrowed from the app?

Yes. A person whose own data was affected may file an NPC complaint. Preserve the messages and explain whether you were listed as a reference, contacted through someone else’s address book, or mistakenly identified as the borrower. privacy.gov.ph

Can I file with both the SEC and NPC?

The same incident can involve both unfair collection and privacy violations. Explain the distinct issues to each agency and disclose related proceedings, particularly in the NPC’s certification against forum shopping. Seek advice if the claims substantially overlap.

Can I be jailed simply because I cannot pay?

No person may be imprisoned merely for debt, under Article III, Section 20 of the Constitution. A separate alleged offense requires separate legal analysis. Do not ignore genuine court documents; verify a collector’s claim of a case or warrant independently. The LawPhil Project

Must the lender delete all my data once I repay?

Not necessarily. Lawful retention may remain necessary for legal obligations or the establishment, exercise, or defense of claims. Retention must still be justified; repayment does not authorize continued shaming or unrelated use of your information. officialgazette.gov.ph

Is there one deadline for every complaint?

No. Deadlines depend on the remedy and alleged violation. Do not confuse the NPC’s 15-day response rule with a filing limitation period. Report promptly and obtain advice about prescription, especially for older incidents.

This article provides general Philippine legal information, not advice on a particular case. The proper remedy depends on the evidence, loan documents, and parties involved. Sources checked: 15 October 2026.