This article explains, from a Philippine law perspective, what counts as unlawful collection harassment (including online abuse and death threats), what statutes may apply, what evidence to gather, and the exact pathways to press criminal, civil, and regulatory cases.

1) First Principles: You still owe only what the contract says—nothing authorizes abuse

Even if a borrower is in default, collectors have no legal right to threaten, intimidate, shame, or dox you (e.g., messaging your contacts, posting your photos). Philippine law protects financial consumers from abusive or harassing debt-collection practices, both offline and online. Any “you deserve this for not paying” argument has no legal basis.

2) What conduct is illegal?

Below are common abusive tactics used by some financing/lending companies and third-party collectors, and the legal hooks typically used against them.

A. Threats and intimidation

Death threats / threats of harm (e.g., “papatayin ka namin,” “we’ll hurt your family”) → Grave Threats or Other Threats under the Revised Penal Code (RPC); if sent online, they may fall under cybercrime modality (computer system used).
Extortionist threats (e.g., “Pay now or we’ll post your nudes / spread lies”) → Grave Coercion, Robbery/Extortion concepts, and/or cybercrime modality.

B. Online shaming, stalking, doxxing

Group chats/Facebook posts naming and shaming borrowers; sending messages to your employer or family; mass texts to your contacts; posting edited photos. → Possible Unjust Vexation, Libel (if defamatory and public), Gender-Based Online Sexual Harassment (if gender-based), Data Privacy violations (unlawful processing/disclosure), and unfair debt-collection practices.

C. Obscene, sexually harassing, or misogynistic messages

Lewd messages / threats of sexual violence posted or DM’d online. → Safe Spaces Act (RA 11313) on gender-based online sexual harassment; RPC offenses (e.g., acts of lasciviousness if elements concur).

D. Excessive contact / harassment patterns

Bombarding calls at odd hours, spoofing caller IDs, calling from multiple numbers → Unjust Vexation, unfair collection practices; consumer-protection violations.

E. Misuse of your phone data/contacts

Loan app scraping contacts/photos, then contacting those people → Data Privacy Act (RA 10173) issues (lack of valid consent, unauthorized processing), and unfair collection prohibitions; potential regulatory sanctions.

3) Key statutes and rules usually invoked

You can mix and match these depending on the facts; many cases are filed in parallel (criminal + regulatory + data-privacy + civil).

Revised Penal Code (RPC)
- Grave Threats / Other Threats: death/serious harm threats, conditional or not.
- Grave Coercion: compelling you to do or not do something through intimidation.
- Libel or Slander: defamatory statements; cyber libel if committed online.
- Unjust Vexation: annoying/irritating acts without lawful purpose (often used for harassment that doesn’t fit elsewhere).
Cybercrime Prevention Act (RA 10175)
- Makes certain RPC offenses qualified when done “through a computer system” (e.g., threats, libel, coercion online), usually resulting in higher penalties.
Data Privacy Act (RA 10173)
- Prohibits unauthorized collection/processing/disclosure of personal data (e.g., scraping contacts, broadcasting borrower info). Complaints go to the National Privacy Commission (NPC).
Safe Spaces Act (RA 11313)
- Penalizes gender-based online sexual harassment (unwanted sexual remarks, threats of sexual violence, etc.).
Financial Consumer Protection Act (RA 11765) and sector rules
- Guarantees fair treatment of financial consumers; prohibits abusive collection practices. Regulators can order refunds, restitution, and impose fines.
- Regulator depends on who lent you money:
  - SEC (financing/lending companies, most online lending apps): also issues rules banning unfair collection (e.g., threats, shaming, contacting contacts, profane language).
  - BSP (banks, e-money issuers, credit card issuers): has circulars against harassing collection practices; mandates complaint-handling.
  - Insurance Commission (IC): for premium-financing/insurance-adjacent credit.
Special laws sometimes relevant
- Anti-Violence Against Women and Their Children Act (RA 9262) if the harasser is a former/current intimate partner or someone within the law’s coverage.
- Anti-Photo and Video Voyeurism Act (RA 9995) if intimate images are used as leverage.

4) Evidence to preserve (digital forensics basics)

Create a case file. Do not rely on screenshots alone when better, richer proofs are available.

Threat messages: export full chat with timestamps; capture URLs, message IDs, and handles. Use native “export chat” or “download data” features where possible.
Screenshots: capture the entire thread, not just single bubbles; include profile and date/time bars. Save as PNG/PDF, label files chronologically.
Call logs / voicemails: save telco logs, voicemail files.
- ⚠️ Call recording in the Philippines is restricted by the Anti-Wiretapping Act (RA 4200). Secretly recording a private conversation can expose you to liability. When in doubt, avoid recording calls without proper legal advice or explicit consent.
Web copies: use “Save page as PDF” for posts, archive URLs, and keep hashes or metadata if you can.
Witness statements: brief written statements from co-workers/friends who received harassment messages.
Loan documents: application, disclosure statements, ledger, demand letters.
Proof of identity misuse: screenshots of your image/name being posted, messages to your employer/contacts.

Keep an evidence index (date, time, platform, description, filename). Back up to two locations.

5) Where to file — and what each pathway achieves

You can pursue multiple tracks at once.

A. Criminal complaint (threats, coercion, libel, cyber offenses)

Where: NBI-Cybercrime Division or PNP-Anti-Cybercrime Group (for investigation); then Office of the City/Provincial Prosecutor for filing a criminal complaint-affidavit.
Goal: Prosecution and penal sanctions; protective law-enforcement action (e.g., case build-up, preservation requests to platforms).
Venue notes: For online offenses, venue can be where elements occurred (e.g., where messages were sent/received). Prosecutor staff will guide venue technicalities.
Output: If probable cause is found, an Information is filed in court for trial.

B. Regulatory/administrative complaint (fast relief against lenders/collectors)

SEC (financing/lending companies, most lending apps): file an unfair collection practices complaint with evidence (screenshots, numbers used, sample messages). The SEC can penalize, suspend, or revoke licenses and order compliance.
BSP (banks/EMIs/credit cards): escalate via the provider’s Consumer Assistance/Dispute Resolution channel; if unresolved, file with BSP’s Financial Consumer Protection unit. BSP can sanction, require corrective action, and order redress.
IC (insurance-related credit): similar complaint handling and sanctions.
Why this matters: Regulators can move even if harassing messages came from a third-party collection agency hired by the lender; the principal can be held to account.

C. Data Privacy complaint (NPC)

Grounds: Unlawful processing of your data, unauthorized disclosure, insufficient security, contacting your contacts without valid consent, etc.
Relief: NPC can order cease & desist, data-deletion, penalties, and prescriptive guidance to the entity. Useful if the abuse involves contact-scraping or doxxing.

D. Civil action for damages (Regional Trial Court)

Basis: Civil Code Articles 19, 20, 21 (abuse of rights, acts contrary to morals/good customs, fault or negligence causing damage); plus specific torts (defamation, invasion of privacy).
Relief: Actual, moral, exemplary damages, attorney’s fees, and injunctions (to restrain continuing harassment).

Barangay conciliation? Many criminal cases (e.g., threats with higher penalties) and cases involving juridical entities (e.g., corporations) are exempt from barangay conciliation. If the respondent is a company/collector agency, you typically go straight to the prosecutor/regulator. When unsure, ask the prosecutor’s front desk; they’ll confirm if conciliation is required.

6) Step-by-step: Filing a criminal case for cyber harassment/death threats

Secure your safety
- Block numbers/accounts; adjust privacy settings; inform building security/employer if threats reference your location. If threats are credible/imminent, go to the nearest police station for an immediate blotter and request patrol visibility.
Assemble your evidence file
- Finalize your evidence index; printouts + digital copies; keep originals unaltered.
Go to NBI-Cybercrime or PNP-ACG
- Submit a complaint intake with your evidence. They may issue data preservation requests to platforms/telcos.
Execute a Complaint-Affidavit
- Contents: your identity, loan background, chronology of harassment, exact quotes of threats (with dates/times/URLs), identification of perpetrators (if known), legal offenses you believe were committed, and a prayer for prosecution. Attach Annexes (screenshots, logs).
- Have it sworn before a prosecutor or authorized officer.
Prosecutor’s Office filing
- File the complaint with the Office of the City/Provincial Prosecutor (venue based on where any element occurred or as guided). Include your IDs and contact for notices.
Preliminary Investigation
- The respondent gets a chance to submit a Counter-Affidavit. You may be asked for a Reply. Prosecutor then issues a Resolution (dismissal or finding of probable cause).
If probable cause is found
- An Information is filed in court; a warrant may issue (for arrestable offenses); case proceeds to arraignment and trial. Coordinate with the prosecutor for testimonies and witness scheduling.

7) Step-by-step: Filing a regulatory complaint (SEC/BSP) for unfair collection

Identify the regulator
- SEC: lending/financing companies and most loan apps.
- BSP: banks, credit card issuers, e-money issuers, and their collectors.
Prepare your packet
- Cover letter; ID; loan agreement or app screenshots; complete evidence of harassment; dates/times; all numbers/accounts used; any prior attempts to resolve.
File the complaint
- Through the regulator’s consumer assistance portal or enforcement unit (email/online forms/office). Keep acknowledgment receipts.
Follow through
- Respond to clarifications quickly; regulators may coordinate with law enforcement where criminal conduct is involved. Administrative sanctions against the company do not bar your separate criminal or civil actions.

8) Step-by-step: Filing a Data Privacy complaint (NPC)

Document the privacy breach
- Show how the app scraped contacts/photos or disclosed your data without valid consent; include privacy policy screenshots and the messages your contacts received.
Send an initial complaint to the company
- Briefly demand cessation and deletion, citing the Data Privacy Act; keep proof of sending.
File with the NPC
- Provide your evidence package and proof of your initial complaint (or explain if urgent/unsafe to notify). NPC may issue C&D, require remedial actions, and impose penalties.

9) Damages and penalties: What outcomes are realistic?

Criminal: Fines and imprisonment vary by offense; cyber-qualified versions often carry higher penalties. Courts may award civil damages within the criminal case.
Regulatory: Fines, license suspension/revocation, public advisories against the erring lender/collector, and redress orders.
Civil: Actual damages (receipts), moral and exemplary damages (for harassment/shame), attorney’s fees, and injunctions (to stop continuing acts).

10) Practical defenses you may hear (and why they usually fail)

“You consented when you installed the app.” → Consent must be informed, specific, freely given, and not overly broad. Harassing third parties or public shaming is not justified by generic consent.
“We only used lawful pressure to collect.” → Threats, obscenities, and shaming are not “lawful pressure.” Sector rules and consumer law explicitly prohibit harassment.
“It’s just freedom of speech.” → Speech that is threatening, defamatory, or harassing is not protected.

11) Special situations

If you’re a minor or a student: Report also to your school administration; special child-protection policies and the Anti-Bullying Act ecosystem may apply.
If the harasser is an ex/partner: Consider RA 9262 protection orders (Barangay/RTC) in addition to criminal actions.
If your employer was contacted: You may ask HR to preserve any messages received and prepare a memo confirming the harassment—useful for damages.

12) Affidavit structure (quick template you can adapt)

Introduction (Name, age, address; capacity to testify).
Loan background (date, lender/app, amount, account number).
Chronology of harassment (dated entries: platform, handle/number, exact words of threats, links).
Effects (anxiety, work disruption, family impact).
Law invoked (threats/libel/coercion; cybercrime modality; data-privacy; gender-based OH, as applicable).
Attachments (Annex “A” – chat export; “B” – screenshots; “C” – call logs; etc.).
Prayer (investigate, file charges, request preservation orders).
Jurat (sworn before authorized officer).

13) Timelines, prescription, and strategy tips

Do not delay. Some offenses have shorter prescriptive periods. Early reporting also helps preserve telecom/platform data.
File in parallel: Regulatory and NPC complaints can produce fast administrative action while the criminal case moves.
Don’t engage: After your demand to stop, stop replying; continue collecting evidence passively (block or mute as needed).
Consider counsel: A lawyer can refine the charge-sheet, ensure venue is correct, and coordinate parallel filings efficiently.

14) Quick checklist (print this)

Safety first; police blotter if threats are credible.
Evidence file: exports, full-thread screenshots, logs, witnesses, loan docs.
Criminal track: NBI-Cybercrime/PNP-ACG → Prosecutor (complaint-affidavit).
Regulatory track: SEC or BSP complaint with annexes.
NPC complaint if contacts/data were misused.
Consider civil action for damages/injunction.
Avoid unlawful call recording; ask counsel about options.
Keep a communications log (dates, times, numbers, actions taken).

Final note

Abusive collection is not a bargaining chip. When collectors cross the line—especially with death threats—you have criminal, regulatory, privacy, and civil remedies. Use them in combination, move quickly, and document everything.