Debt Shaming by Online Lending Apps: How to File a Complaint (SEC, NPC, NBI) — Philippine Guide

This is a practical legal explainer for borrowers in the Philippines who have experienced “debt shaming” (harassing calls, messages to family or contacts, public posts, or threats) from online lending apps (OLAs). It outlines your rights, the legal bases, evidence to gather, and step-by-step filing with the Securities and Exchange Commission (SEC), National Privacy Commission (NPC), and National Bureau of Investigation (NBI), plus optional remedies with the PNP-ACG, prosecutors, and courts.

1) What is “debt shaming”?

Debt shaming happens when a lender or its collectors disclose or publicize your alleged debt to third parties (e.g., your phone contacts, employer, family) or use intimidation (e.g., threats of posting you online, defamation, or contacting your “references” repeatedly) to force payment. Common patterns:

Mass-texts or calls to your contacts framing you as a “scammer” or “delinquent”
Use of your phone’s contact list or photos despite never needing them for loan processing
Template threats of criminal cases, arrest, blotter, or public exposure
Edited images of your ID posted in group chats or social media

These are not legitimate collection activities and often violate privacy, consumer protection, and (in some cases) penal laws.

2) Your legal protections (key statutes & theories)

Data Privacy Act of 2012 (DPA; R.A. 10173) and IRR
- Personal data must be collected for declared, specific, and legitimate purposes, and processed proportionately.
- Unauthorized disclosure to your contacts or the public is generally unlawful.
- Consent must be informed, freely given—“take it or leave it” permissions to scrape your contacts or gallery can be invalid if unnecessary or excessive for the loan purpose.
- You have rights to access, object, erasure/blocking, and damages.
Financial Consumer Protection Act of 2022 (FCPA; R.A. 11765)
- Prohibits abusive collection practices and deceptive, unfair, or unconscionable acts by financial service providers and their agents.
- The SEC (for lending/financing companies) may penalize violators.
Lending Company Regulation Act (LCRA; R.A. 9474) & SEC regulations
- Lending/financing companies must be SEC-registered and comply with SEC rules on conduct, disclosure, and collection.
- The SEC may issue show-cause orders, suspend/revoke licenses, and run takedowns of abusive OLAs.
Revised Penal Code & related laws (possible criminal angles)
- Libel (Art. 353 et seq.): malicious imputation damaging reputation (including online).
- Grave Threats/Coercion (Arts. 282–286): intimidation to force you to do something against your will (e.g., pay under threat of public shaming).
- Unjust Vexation (Art. 287): annoying/irritating acts without lawful purpose.
- Cybercrime Prevention Act (R.A. 10175): online versions of libel, threats, or unauthorized access.
Civil Code (Arts. 19, 20, 21)
- Actions for abuse of rights and acts contrary to morals, good customs, or public policy—basis for damages in civil suits.

Bottom line: Using your contacts to shame you, repeated harassment, and public disclosures are typically unlawful even if you owe money.

3) Preserve evidence (before you complain)

Create a secure folder and collect:

Screenshots of messages to you, your contacts, group chats, or social posts (include timestamps and URLs if online).
Call logs/recordings (if recorded, ensure you comply with one-party consent; in PH, you generally may record your own calls).
App permissions granted (screenshots of settings showing access to Contacts, Photos, SMS, Location).
Loan documents (in-app agreements, emails, receipts, payment history).
IDs (government ID), proof of residence, and selfie if regulators request identity validation.
List of affected contacts with samples of what they received and when.

Keep original files. Don’t edit or crop; save separate annotated copies if needed.

4) “Cease & desist” and privacy rights letters (optional but helpful)

Send concise notices to the lender/collector (email and in-app support), and keep proof of sending:

A. Data Privacy Objection / Erasure Request (sample skeleton)

State you are the data subject; cite the DPA.
Object to processing for debt shaming, demand erasure/blocking of scraped contacts/photos, and request processing limitation to legitimate billing channels only.
Demand a written response within a reasonable period (e.g., 10–15 days).
Note that continued harassment will be reported to SEC, NPC, and NBI.

B. Cease & Desist on Abusive Collection

Invoke the FCPA and SEC rules; demand cessation of threats, contact to third parties, or defamatory publications.
Request the name of the collection agency and their SEC registration.

These letters both document your assertion of rights and strengthen your complaints if abuse continues.

5) Where to file complaints (and how)

A) Securities and Exchange Commission (SEC) — for abusive lending/collection & unregistered apps

Who falls under SEC? Lending and financing companies (non-bank). If it’s a bank/e-money issuer supervised by the BSP, use the BSP Consumer Assistance Mechanism—but most abusive OLAs are SEC-regulated or unregistered (also actionable by SEC).

What to prepare:

Filled-out complaint/incident narrative (who, what, when, where, how).
Evidence bundle (see Section 3).
Loan details: app name, developer/publisher, platform link, transaction IDs, amounts, due dates.
Identity: government ID; contact info.
Your demands: stop harassment, delete unlawfully processed data, correct records, etc.

How to file:

File with the SEC Enforcement/Investor Protection or the Financing and Lending unit handling OLAs.
Provide digital copies (PDF/ZIP) with clear filenames and an index of evidence.
If you suspect the lender is unregistered or using shell entities, state this explicitly and include screenshots of the app store listing.

What SEC can do:

Summon the company, require explanations, order takedown of abusive features, suspend/revoke certificates, impose administrative fines, and refer matters to other agencies (NPC for privacy violations; NBI/PNP for criminal acts).
SEC action is administrative; it can complement your privacy/criminal complaints.

B) National Privacy Commission (NPC) — for privacy violations (contact scraping and disclosure)

When to go to NPC: If the app/collectors accessed your contacts/photos without a valid basis, or disclosed your personal data to third parties (your contacts, employer, public pages), or ignored your privacy rights requests.

Prerequisites & best practice:

It’s good practice to first notify the company (Section 4) and allow a reasonable period for response. Attach that notice and proof they ignored or rejected it.

What to file:

Complaint form/letter stating: (1) you are the data subject; (2) unlawful/unauthorized processing or disclosure; (3) harms (distress, reputational damage, workplace risk); (4) reliefs sought (erasure, restriction, sanction, damages).
Evidence: messages sent to contacts, app permission logs, screenshots of threats, copy of your rights-request and the company’s reply (or lack of).
IDs and contact info; if represented by counsel, attach SPA/authorization.

Reliefs the NPC may grant:

Orders to cease processing, delete unlawfully collected data (e.g., your contact list copies), notify affected third parties, and administrative fines.
NPC resolutions can be powerful leverage; attach them to SEC/NBI matters if parallel.

C) National Bureau of Investigation (NBI) — for criminal acts (libel, threats, coercion, cybercrime)

When to go to NBI:

You suffered criminal harassment, e.g., threats of harm/arrest, defamatory posts, doxxing, impersonation, or extortionate demands.
The acts were done online (chat apps, social media, SMS) or through phone calls.

What you need:

Affidavit-Complaint (see template outline below).
Digital evidence with hashes if possible (NBI can help preserve metadata).
IDs and contact details; list of witnesses (e.g., contacts who received messages).

Process & outcome:

NBI Cybercrime Division can investigate, subpoena, and perform digital forensics, then refer to the prosecutor for filing of Information in court.
Possible charges: Libel (and Cyber Libel), Grave Threats, Unjust Vexation, Coercion, Violation of the DPA, among others.

6) Optional parallel routes

PNP Anti-Cybercrime Group (ACG): similar intake to NBI; useful if geographically closer.
BSP Consumer Protection (if the entity is a bank/EMI/supervised financial institution).
Small Claims / Civil suit: recover amounts, moral/exemplary damages, and attorney’s fees based on Civil Code (Arts. 19–21). Small claims rules allow faster recovery up to the prevailing ceiling.
Labor recourse (if your employer received shaming messages): ask HR to document incidents (valuable evidence); consider workplace policy violations by the sender if they contacted corporate channels.

7) How to write your Affidavit-Complaint (criminal/NBI or prosecutor)

Structure (concise, factual, dated):

Parties: Your full name, address, ID; respondents’ names (or “John Doe Collectors” if unknown) and the company/app.
Jurisdiction/Venue: Where the acts occurred or where you are located (online offenses may be filed where any element occurred or where the libelous post was accessed).
Narrative of Facts:
- Your loan (date, amount, app).
- How the app/collectors obtained data (permissions you recall, or none).
- Specific incidents: On 15 June 2025 at 2:14 p.m., Collector X messaged my sister, calling me a “scammer,” attaching my ID photo (Annex “B–1”).
- Number of contacts harassed, frequency, and any threats.
Legal Violations: Cite DPA (unauthorized disclosure), RPC (libel/threats), Cybercrime Act (online commission).
Evidence List (Annexes): numbered screenshots/files with short descriptions.
Prayer: Request investigation, filing of appropriate charges, and protection orders if needed.
Verification/Jurat: Sworn before a notary or administering officer.

Tip: Keep a clean Annex Index (Annex “A” = App profile; “B–1” to “B–12” = messages to contacts; etc.).

8) Practical tips to strengthen your case

Do not pay under threat. Payment made under intimidation can still be disputed; keep proof of any coerced payments.
Secure your accounts. Change device permissions; remove the app’s access to Contacts/Photos; consider a new SIM if harassment is severe.
Tell affected contacts to keep the messages and avoid responding (or to reply only to confirm receipt for documentation).
Document emotional distress (medical or counseling notes) if you plan to seek moral damages.
Coordinate filings. It’s fine to file with SEC, NPC, and NBI simultaneously; attach proof of each filing to the others.
Check the lender’s status. If you later confirm it’s unregistered, emphasize this in your SEC complaint; unregistered lending is itself sanctionable.
Mind prescription periods. Don’t sit on the case—libel and related offenses have time limits for filing.

9) Filing checklists (print-friendly)

SEC Checklist

Narrative complaint
Your ID
Loan details & app info (links, screenshots)
Evidence of harassment
Proof you asked them to stop (if any)

NPC Checklist

Complaint letter/form citing DPA rights violated
Evidence of unauthorized disclosure/overcollection
Copy of your privacy notice/erasure objection to the company
Company’s reply or proof of non-response
IDs / authority if represented

NBI (Cybercrime) Checklist

Notarized Affidavit-Complaint
Raw evidence files + screenshots (with dates/URLs)
List of witnesses/affected contacts
Your IDs
Evidence index (USB/drive if requested)

10) Template language you can reuse

A. Privacy Erasure/Objection (email body)

Subject: Objection to Processing and Request for Erasure — [Your Full Name] / [App Name / Account No.]

I am the data subject in your records. I object to your processing of my personal data for debt shaming, including contacting my phone contacts and disclosing my alleged debt to third parties. Such processing is unnecessary and disproportionate to loan servicing under the Data Privacy Act and must cease immediately.

I demand (1) cessation of all third-party contacts, (2) deletion of any copies of my Contacts/Photos/SMS harvested from my device, and (3) confirmation in writing within 10 days of the actions taken. Continued harassment will be reported to the SEC, NPC, and NBI.

Sincerely, [Name, Mobile, Email, ID No.]

B. Cease & Desist (abusive collection)

Your agents have issued threats and defamatory statements to me and my contacts. These are abusive collection practices prohibited by the Financial Consumer Protection Act and SEC regulations. Cease these acts immediately. Provide your business name, SEC registration number, and collection agency details within 5 days.

11) Frequently asked questions

Q: I really borrowed money—can I still complain? Yes. Owing money does not waive your rights. Collections must be lawful and respectful.

Q: They say I “consented” by granting contacts permission. Consent must be informed, specific, and proportional to a legitimate purpose. Mass-messaging your contacts to shame you is not a legitimate or proportional purpose for loan servicing.

Q: Can they have me arrested for unpaid debt? No arrest for mere nonpayment of a civil debt. Arrest requires a criminal case and a warrant from a judge (or inquest for a crime committed in flagrante). Threatening arrest for nonpayment is a red flag.

Q: Should I delete the app? First revoke permissions and export any needed records (payments, history). Then you may uninstall. Keep evidence.

12) Final strategy: a coherent, multi-track approach

Secure evidence and send rights letters (Sections 3–4).
File in parallel:
- SEC for abusive/unregistered lending and collection practices.
- NPC for privacy violations (contact scraping, disclosures).
- NBI/PNP-ACG for criminal harassment (libel/threats/coercion/cybercrime).
If losses or reputational harm occurred, consider civil damages or small claims for amounts recoverable.
Keep an incident log with dates, who you filed with, and reference numbers.

Short disclaimer

This article is legal information for the Philippine context, not individualized legal advice. For complex or high-stakes situations, consult a Philippine lawyer or accredited data privacy professional, and bring your evidence bundle for targeted guidance.