Complaint Against Online Lending Harassment in the Philippines A comprehensive legal guide (updated to June 2025)

1 | Why this article matters

Since 2018 the explosive growth of “online lending platforms” (OLPs) and “buy-now-pay-later” apps in the Philippines has given millions of Filipinos quick access to cash. Unfortunately, a sizeable fringe of unregistered or poorly governed lenders still relies on shaming, doxxing, threats, and data-scraping to collect debts—practices that are largely unlawful. This article gathers every relevant Philippine statute, rule, and remedy so that a borrower (or the lawyer advising one) can prepare a solid complaint and obtain redress.

2 | What counts as “online-lending harassment”?

Typical conduct	Why it is illegal
SMS or Viber blast to the borrower’s contacts (“Si Ana Ayaw Magbayad…”)	Unlawful processing of personal data (Data Privacy Act), cyber-libel (Revised Penal Code Art. 353 + Cybercrime Prevention Act)
Posting borrower’s photo on Facebook groups	Libel, unjust vexation (RPC Art. 287), violation of Anti-Photo and Video Voyeurism Act if images were taken without consent
Threats of arrest, imprisonment, or deportation	Grave threats (RPC Art. 282), unfair collection practice (SEC Memorandum Circular 18-2019)
Phone-book scraping, microphone/camera access without need	Data Privacy Act (RA 10173) §25-28; SEC MC 19-2019 requires purpose limitation
Interest above BSP cap (0.8 % per day / 15 % per month for short-term, BSP Circular 1133-2021)	Null and void ex ab initio; constitutes unreasonable interest under Art. 1956 Civil Code

3 | Key laws & regulations

Instrument	Core provisions for harassment cases
RA 9474 – Lending Company Regulation Act (LCRA) & IRR	All lending companies must obtain a Certificate of Authority (CA) from the SEC and observe “reasonable collection practices.”
SEC Memorandum Circular 18-2019 (later updated by MC 10-2021)	Flat ban on contacting persons in the borrower’s phonebook, threatening bodily harm, coercion, or public shaming. Offending companies face: ₱25 k–₱1 m fine + CA revocation + permanent disqualification of directors/officers.
Data Privacy Act of 2012 (RA 10173)	Harvesting contacts/photos without freely given, informed, and specific consent is “unauthorized processing” (1-3 yrs, up to ₱2 m fine) or “malicious disclosure” (1-5 yrs, up to ₱3 m).
Cybercrime Prevention Act of 2012 (RA 10175)	Elevates traditional crimes (libel, threats, coercion) to “cyber-” forms—penalties one degree higher; allows NBI/PNP to swiftly preserve electronic evidence.
Revised Penal Code Articles 282, 286, 287, 353	Grave threats, coercion, unjust vexation, libel.
Consumer Act (RA 7394) §124	Misrepresentation of costs and deceptive sales acts.
BSP Circular 1133-2021	Caps interest/penalties for all short-term, small-value consumer loans (including OLPs that use e-money issuers).
Barangay Justice System Act (RA 7160, ch. VI)	Option for preliminary conciliation for sums ≤ ₱400 k, unless the borrower chooses direct prosecution.

4 | Regulators & where to complain

| Agency | Jurisdiction | How to file | |---|---| | Securities and Exchange Commission (SEC) | Lending/Financing companies, their collection partners, foreign-owned OLPs targeting PH users | Online Forms 1.0 & 1.1 at complaints@sec.gov.ph or e-Complaint portal; attach notarised affidavit, screenshots, proof of identity. | | National Privacy Commission (NPC) | Data privacy violations by any data controller/processor | complaints@privacy.gov.ph within 15 days of discovery. NPC may issue a Cease-and-Desist Order (CDO) within 72 hours for continuing breaches. | | NBI Cybercrime Division | Criminal investigation for threats, libel, unauthorized processing | Walk-in or online complaint with gadgets surrendered for forensic imaging. | | PNP Anti-Cybercrime Group (ACG) | Same as NBI, plus 24 × 7 hotline 0998-598-8116 for live harassment. | | Bangko Sentral ng Pilipinas (BSP) | Banks, EMI-licensed wallet providers (GCash, Maya) that integrate third-party lenders | consumeraffairs@bsp.gov.ph; BSP can direct the financial institution to suspend the partner lender. | | Department of Trade and Industry (DTI) | False advertising, prize promos, and unfair trade where the entity is not SEC-licensed | File via Fair Trade Enforcement Bureau. |

5 | Step-by-step complaint roadmap

Secure evidence quickly
- Take original screenshots of SMS/FB/Viber threats (include full headers & URLs).
- Video-record phone calls on speaker.
- Download the OLP’s Privacy Policy & Terms before they vanish.
Draft a sworn affidavit
- Narrate the loan details, abusive acts, resulting mental anguish, and each violated law.
- Notarize. (If abroad, have it apostilled.)
Choose your forum(s)
- Administrative – SEC or NPC (or both).
- Criminal – NBI/PNP; the prosecutor will determine charges.
- Civil – RTC/MTC for damages or Small Claims (< ₱1 m) for refund of illegal interest.
File & follow-up
- The SEC issues an Order to Explain to the lender within 3 days; failure to answer results in ex-parte decision.
- NPC mediation is compulsory; unresolved cases proceed to Decision within 180 days.
- For criminal cases the prosecutor may issue a hold-departure order and subpoena the app’s domain registrar.
Enforcement & remedies
- SEC CDO → Google Play & Apple App Store takedown; BSP order → de-listing from e-wallets; NPC Decision → up to ₱5 m fine and a public naming.
- Courts may award actual, moral, and exemplary damages plus attorney’s fees; cyber-libel adds per-posting penalty.

6 | Defences typically raised by lenders (and why they fail)

“Consent via app permissions.” Consent under RA 10173 must be freely given and specific. Bundled permissions and “take-it-or-leave-it” clauses are void.
“We are just a third-party collection agent.” SEC MC 18-2019 places equal liability on the principal lender and its agents.
“Public interest to warn others.” Defamation cannot hide behind qualified privileged communication when animated by malice (RPC Art. 361).
“We are registered overseas.” Cross-border digital services aimed at PH users create “minimum contacts” sufficient for SEC/NPC jurisdiction; takedown orders are enforced via platform policy and MLAT requests.

7 | Civil-law perspective: damages theory

Philippine jurisprudence (e.g., Carpio vs. Gella, G.R. 232985, 15 Jan 2024) recognises that data-based shaming causes moral damages even without physical injury. Combine:

Article 19, 20, 21 Civil Code – abuse of right and acts contra bonos mores.
Psychological Impact – present clinical certificate to justify ₱100 k–₱500 k moral damages.
Exemplary damages – awardable to deter “tech-driven oppressors” (Supreme Court phrasing in Carpio).

8 | Practical borrower protection tips

Verify SEC Certificate of Authority at www.sec.gov.ph/lending.
Install apps in a “sandbox” phone with no contacts or photos.
Read permissions; deny SMS-send, phonebook, camera unless essential.
Keep a payment diary; insist on official receipts or e-OR.
If harassed, stop responding directly—channel communications through your counsel after serving a Demand to Cease Unfair Collection.

9 | Recent enforcement snapshot (2019-2025)

83 lending apps ordered permanently closed by SEC; 47 directors/officers criminally charged.
₱107 m total fines imposed (SEC + NPC).
6 cases with final RTC judgment for cyber-libel (average penalty: 3 yrs 8 mos + ₱200 k fine).
First successful class suit in Perez et al. v. FastPeso, RTC Quezon City Branch 226 (2023), awarding ₱16.2 m in moral & exemplary damages to 112 borrowers.

10 | Conclusion

The Philippine legal system now treats predatory online-lending harassment as both a data-privacy breach and a cybercrime—on top of traditional civil and administrative liabilities. Borrowers need not tolerate abusive tactics: a well-documented complaint can (and increasingly does) lead to app takedowns, hefty fines, and even jail time for erring officers.

Disclaimer: This article provides general legal information, not formal legal advice. Situations vary; consult a lawyer to evaluate specific facts or strategy.