Complaints Against Harassment by Online Lending Companies in the Philippines

A practitioner's guide to your rights, the rules lenders must follow, and how to fight back—step by step.

1) Snapshot: What counts as “harassment” in online lending

Common abusive practices include:

“Debt shaming.” Text blasts to your contacts, employer, or family; group chats; social-media posts.
Threats and intimidation. Menacing messages, “warrant of arrest” scare tactics, threats of physical harm or doxxing.
Excessive or odd-hour calls. Repeated calls/messages, including outside reasonable hours.
False representations. Pretending to be from a government agency, law firm, police, or court.
Unfair data grabs. Apps demanding contact list, gallery, microphone, location—far beyond what’s needed to process a loan.

Important: Harassment does not erase a valid debt. But non-payment of a loan is not a crime by itself. Threats of jail for mere non-payment are misleading (criminal liability can arise only in specific, separate offenses like BP 22, estafa, etc., which have their own elements).

2) The legal framework (Philippine context)

A. Consumer-protection & sector rules

Financial Products and Services Consumer Protection Act (RA 11765). Prohibits abusive debt-collection and unfair, deceptive, or abusive acts or practices (UDAAP) by entities under the SEC, BSP, and IC. Regulators may impose fines, restitution, and cease-and-desist orders.
SEC rules for Lending/Financing Companies. The SEC has long banned unfair collection practices such as debt shaming; contacting persons not the borrower; profane language; threats; and false representations. Repeated violations can mean suspension/revocation of authority to operate and administrative fines.
Truth in Lending (RA 3765) & related rules. Requires clear disclosure of finance charges; hidden fees and opaque pricing may be actionable.

B. Privacy & data-protection

Data Privacy Act of 2012 (RA 10173). You have rights to be informed, object, access, rectify, delete, and damages. Lenders and their service providers are personal information controllers/processors and must meet the principles of transparency, legitimate purpose, and proportionality.
- Unlawful processing (e.g., scraping your contact list without valid basis), unauthorized disclosure, and malicious disclosure can carry criminal penalties and/or administrative sanctions.
- The National Privacy Commission (NPC) can order compliance, takedowns, or bans on abusive data practices.

C. Penal and special laws often triggered by harassment

Revised Penal Code: Grave threats, grave coercion, libel/slander (including online), unjust vexation, intriguing against honor—depending on the content and conduct.
Cybercrime Prevention Act (RA 10175): Online versions of libel/illegal access; use this when the medium is digital.
Anti-Photo and Video Voyeurism, Anti-Wiretapping, and related laws may apply when lenders misuse images/audio.

D. Jurisdiction & registration

Lending Company Regulation Act (RA 9474) and Financing Company Act: Entities lending “as a business” must be registered with the SEC. If the app or collector is unregistered, report it as illegal lending—a separate violation.

3) Your rights vs. a lender’s rights

Topic	Your Rights	Lender’s Limits
Contact	Be contacted in reasonable ways/hours	No threats, no obscene language, no misrepresentation, no contacting third parties (except your authorized representatives)
Privacy	Control over your personal data, including your contacts	No harvesting/using your contacts/photos for shaming; data must be necessary and proportionate
Information	Clear disclosure of interest, fees, penalties	No hidden charges; must provide statements and computation upon request
Redress	File with SEC, NPC, BSP/IC (if applicable), NBI/PNP/DOJ for crimes	Lenders must maintain complaint channels and cooperate with regulators

4) Evidence: what to keep and how to preserve it

Save everything:

Screenshots of messages, caller ID, chat threads, app permission requests, in-app notices.
Audio recordings of calls (if you legally can capture them—avoid wiretapping issues by using device features that notify or by contemporaneous notes).
Proof of relationship to your contacts who received shaming messages (and their screenshots).
Loan documents: e-mails, app screens showing interest/fees, payment history/receipts.
Tech artifacts: App version, device model, dates/times (use phone settings to display seconds if needed).
Regulatory status: Any proof the lender claims registration or uses a business name.

Chain of custody tips:

Export images with metadata (don’t crop out timestamps).
Back up to a cloud drive and one offline device.
Keep a timeline (date/time + short description for each incident).

5) Immediate self-help (do these now)

Revoke app permissions (Contacts, Photos, Location, SMS, Phone, Microphone). On Android/iOS, you can also disable background data or uninstall the app after capturing proof.
Change passwords/PINs used within the app; enable 2FA for your e-mail and e-wallets.
Notify your contacts briefly: “My number may be used for scam/harassing messages by a lender; please ignore and forward any screenshots to me.”
Stop engaging with harassers except to capture proof. Never send IDs or selfies to random “agents.”
If you can, pay only through official channels and keep receipts; do not pay under threat to personal accounts of collectors.

6) Formal complaint routes (where and how)

A. Securities and Exchange Commission (SEC) – Lending/Financing Companies

Who to report: Registered or unregistered online lenders and their collectors engaging in unfair collection.
What to allege: Unfair debt-collection practices (e.g., debt shaming, threats, misrepresentation), lack of registration, hidden fees.
What to attach: Government ID, loan docs, screenshots, contact list evidence, timeline.
Outcomes: Administrative fines; cease-and-desist; revocation/suspension of authority; referral for criminal action (for illegal lending or other offenses).

B. National Privacy Commission (NPC) – Data Privacy Act

Who to report: Any lender/collector/app that misuses your data—e.g., accessing/using your contacts to shame you, or disclosing your debt to third parties without lawful basis.
What to allege: Unlawful/unauthorized processing, malicious disclosure, failure of security measures, lack of lawful basis/consent, violation of data-subject rights.
What to attach: Proof of disclosures to third parties, app permission prompts, privacy notices (if any), your data-subject request and their response/inaction.
Outcomes: Compliance orders, takedowns, administrative fines; referral for criminal prosecution for DPA offenses.

C. BSP / IC – If the lender is a bank/quasi-bank or insurer product

Use the internal complaints channel first, then escalate to the sector regulator.

D. Law enforcement / prosecution

NBI Cybercrime Division / PNP Anti-Cybercrime Group: For grave threats, doxxing, extortion, cyber-libel, identity theft, or other cyber-enabled crimes.
DOJ: For inquest or preliminary investigation of applicable crimes.

Practical tip: You can dual-file (e.g., SEC for unfair collection and NPC for privacy violations) using the same evidence bundle, tailoring each cover letter to the specific law breached.

7) Step-by-step playbook (with templates)

Step 1 — Send a Cease & Desist + Data-Subject Rights notice (optional but helpful)

Use this when you want a paper trail before filing:

Subject: Cease and Desist from Unfair Collection & Unlawful Processing of Personal Data To: Compliance/Legal Department, [Lender/App Name]

I am [Name], borrower under Account/Loan No. [_____]. Your agents have engaged in unfair collection practices (threats/debt shaming/misrepresentation) and unlawful processing of my personal data (accessing/using my contacts and disclosing my alleged debt).

I hereby demand that you:

Cease all harassment and contact only me via [email/number] within reasonable hours;

Delete any copies of my contact list/photos obtained without lawful basis and certify deletion within 10 days;

Provide me within 10 days: (a) the specific lawful basis for processing; (b) categories of personal data processed; (c) list of recipients of any disclosures; and (d) data-retention schedule;

Provide a complete statement of account showing principal, interest, fees, and the legal basis for each charge.

Failure to comply will leave me no choice but to file complaints with the SEC and NPC, and to pursue criminal/civil remedies.

Sincerely, [Name, Address, ID No., Date]

Step 2 — File with the SEC (unfair collection / illegal lending)

Cover letter/complaint-affidavit stating facts, attach evidence (Annexes A–H).
Identify collectors, phone numbers, pages, and app names; include computation of charges as presented to you vs. what was actually deducted/collected.

Step 3 — File with the NPC (privacy/data abuse)

Include your Step-1 notice and their reply/inaction.
Ask for compliance orders, takedown, and administrative sanctions.

Step 4 — Consider criminal complaints (if threats/doxxing/libel occurred)

Prepare a jurat/acknowledged affidavit with screenshots and a chronological Annex Index.

8) Defenses and common lender arguments—how to respond

“You consented when you installed the app.” Consent must be informed, specific, and freely given. Bundled permissions (e.g., contact list for “verification”) are often disproportionate to the purpose. You can withdraw consent, and processing must then stop unless there’s another lawful basis strictly necessary.
“We can contact your employer/family to collect.” Generally no. Disclosing your alleged debt to third parties is an unfair collection practice and likely a privacy violation, absent a clear lawful basis or your specific authorization.
“Non-payment is a crime; we’ll send police.” False. Non-payment alone is civil, not criminal. Police don’t serve “arrest warrants” for private debts.
“We’ll post your photos if you don’t pay.” This can be extortion, grave threats, and malicious disclosure—strong grounds for criminal and privacy actions.

9) Special issues

A. Friends/family received shaming texts—can they complain?

Yes. They are data subjects whose personal data (name/number) was processed without basis. They can file with the NPC and provide their own screenshots.

B. I already paid but they keep harassing me.

Demand a Statement of Account and closure letter/paid-in-full. Include proof of payment. Persistent harassment after full payment strengthens your case.

C. Partial payments and restructuring

If you want to settle: insist on written computation, waiver of harassment, and a release upon payment. Keep evidence of any discount/condonation agreement.

D. Employer involvement

If a collector contacts HR or defames you at work, your employer may:

Issue a trespass/harassment warning to the collector;
Provide you certified incident reports for annexing to complaints.

10) Remedies & outcomes—what to expect

Regulatory: Fines; takedown of abusive apps; suspension/revocation of license or registration; compliance directives (delete data, stop contacting third parties).
Criminal: For threats, extortion, libel, DPA offenses—possible arrest/inquest after proper proceedings.
Civil: Damages for defamation/privacy invasion; moral/exemplary damages where harassment is egregious.
Practical: Many lenders stop harassment once SEC/NPC dockets exist or upon receipt of a formal DPA rights request.

11) Checklist before you file

Timeline + annex list complete
Screenshots show sender, content, date/time
App permissions captured (before uninstall)
Statement of Account / loan terms retained
Cease-and-desist / DPA rights letter sent (optional but helpful)
IDs redacted appropriately in copies (keep unredacted for the authority)
Separate bundles for SEC and NPC (same evidence, tailored cover pages)

12) FAQs

Q: Will filing a complaint hurt my credit score? A: No—complaining is not a default. But defaults or unsettled obligations may be reported to credit bureaus by legitimate lenders following rules; they cannot retaliate with harassment.

Q: Can I sue for damages if my photos were posted? A: Yes—civil damages (privacy and defamation) plus criminal and DPA violations may apply.

Q: The lender is overseas. Can I still complain? A: Yes, if the processing targets data subjects in the Philippines or the business operates here. Regulators can still act (e.g., domain/app takedown, blocking coordination) and pursue local agents.

Q: Do I need a lawyer? A: Not to file with regulators, but legal counsel helps coordinate multi-front actions (SEC, NPC, criminal/civil) and negotiate settlements.

13) Quick resource map (who handles what)

SEC — Lending/Financing entities; unfair collection, illegal lending, pricing/fees disclosures
NPC — Data privacy violations: contact-list abuse, disclosures to third parties, refusal to honor rights requests
BSP/IC — Banks/insurers and their collection arms
NBI/PNP/DOJ — Criminal acts: threats, extortion, cyber-libel, doxxing, identity theft
Courts — Civil damages and criminal cases

14) Final pointers

Document first, act fast, and escalate smartly.
Never concede unlawful data access just because you clicked “allow” once—privacy rights persist.
Be consistent in all filings; regulators appreciate clear timelines and well-labeled annexes.
Protect your mental health. Use call-blocking, mute features, and support from family/employer while the cases proceed.

Appendix: One-page complaint-affidavit skeleton (adapt as needed)

Parties: Your full name, address, ID; Respondent lender/company names, app names, known numbers/accounts.
Jurisdiction/Basis: Cite the laws/rules applicable (consumer protection, unfair collection, DPA).
Facts: Chronological narrative (dates/times, what was said/done, by whom, via which number/account).
Evidence: Annex list (A—Loan app & terms; B—Permission prompts; C—Screenshots to me; D—Screenshots to contacts; E—SOA; F—Settlement attempts; G—Cease-and-desist; H—Contact list impact statements).
Reliefs Sought: Stop harassment; order deletion of unlawfully processed data and certification; administrative fines/sanctions; referral for criminal prosecution; and any other just and equitable relief.
Verification/Jurat: Signed and notarized (or subscribed before the proper officer).

This article is a general guide for the Philippine setting. It is not legal advice for a specific case. For sensitive or urgent situations (e.g., physical threats), prioritize safety and contact law enforcement immediately.