This is general information for consumers in the Philippines. It is not a substitute for personalized legal advice.

1) The problem at a glance

Online lending apps (often called “OLAs”) promise quick cash but some use abusive collection tactics: message-blasting your contacts, “shaming” posts, threats of arrest, and nonstop calls or texts. Philippine law protects you from these practices. You can (a) stop the harassment, (b) dispute illegal charges, and (c) seek penalties, damages, or both.

2) Who regulates what (Philippine landscape)

Securities and Exchange Commission (SEC): Registers and supervises lending companies and financing companies, including their online lending platforms. It also penalizes unfair collection practices and can suspend or revoke licenses.
National Privacy Commission (NPC): Enforces the Data Privacy Act of 2012 (RA 10173). It handles complaints about apps scraping your contacts, photos, files, or location without valid consent or using your data for “shaming.”
Bangko Sentral ng Pilipinas (BSP): Regulates banks and sets consumer protection standards in the financial sector. If a bank is involved (e.g., disbursement or repayment rails), you may raise issues through the bank’s consumer assistance channels and BSP’s consumer desk.
Department of Justice (NBI) & PNP Anti-Cybercrime Group: For criminal acts like threats, extortion, or cyber libel.
Courts / Prosecutors: Civil suits for damages (e.g., invasion of privacy, abuse of rights) and criminal complaints (e.g., grave threats, coercion, libel).

3) The legal backbone (key rules you can invoke)

A. Unfair or abusive debt collection

Philippine regulators prohibit harassment, intimidation, false representations, and shaming in collections by lending/financing companies and their agents (including third-party collectors and online platforms).
Typical prohibited acts include:
- Threats of arrest, imprisonment, or police reports for mere nonpayment of a loan (debt is generally a civil matter unless accompanied by fraud or other crimes).
- Disclosing or discussing your debt with third parties (family, employer, friends, or your phone contacts) without lawful basis.
- “Shaming” tactics: mass texts to contacts, social media posts with your face/data, defamatory group chats, or edited images.
- Profane, abusive, or defamatory language; repeated, excessive calls designed to annoy or alarm.
- Misrepresenting as a lawyer, court officer, or public official; sending documents that simulate legal forms (fake “subpoenas,” “warrants,” or “court notices”).
- Charging undisclosed or unconscionable fees, penalties, or “processing” charges beyond allowed caps or without proper disclosure.

B. Truth in pricing and interest limits

Truth in Lending: Lenders must clearly disclose the total cost of credit (interest, fees, penalties, and the computation method) before you borrow.
Philippine jurisprudence allows courts to strike down unconscionable interest or penalty rates and reduce them to reasonable levels. Even if you signed, extreme rates or hidden charges can be invalidated.

C. Data privacy and consent boundaries

Under the Data Privacy Act (RA 10173), your data must be processed with valid, informed, freely given, specific consent—and only for legitimate, proportional purposes.
Red flags:
- Apps requiring excessive permissions (contacts, photos, call logs) that are not necessary to provide the loan.
- Using your data to threaten or shame you, or to contact people in your phonebook.
- Failing to provide an accessible privacy notice, or denying your rights (to access, correct, withdraw consent, object, or delete, where applicable).

D. Criminal laws that may apply

Grave threats / coercion / unjust vexation (Revised Penal Code).
Libel or cyber libel (Revised Penal Code and Cybercrime law) for defamatory posts or messages.
Violations of the Data Privacy Act (criminal and administrative liabilities) for unauthorized processing or disclosure of personal data.

4) What collectors may legally do (so expectations are realistic)

Remind you of due amounts through reasonable calls, texts, emails, in-app notifications, or formal demand letters.
Impose disclosed interest, fees, and penalties within legal limits.
Assign your account to a legitimate third-party collector (who must still follow all rules).
Sue in court (civil action) to collect, or pursue available legal remedies if there is fraud.

They may not harass, shame, defame, threaten arrest, impersonate authorities, or disclose your debt to others.

5) Immediate steps if you’re being harassed

Preserve evidence. Take screenshots of messages, caller IDs, voicemail/audio, chat threads, social posts, group chats, in-app notices, and payment history. Export app permissions and privacy settings. Keep loan agreements and receipts.
Document the timeline. Create a simple log: date–time–who contacted–how–what was said/done–witnesses–screenshot filename.
Audit the lender. Identify the legal entity name (not just the app name), SEC registration or evidence it is unregistered, and the collector’s name (if any). Note any undisclosed or excessive fees.
Lock down your data. Revoke app permissions (contacts, storage, camera, location). Change passwords/PINs. Enable two-factor authentication on email and social accounts.
Send a “cease harassment / data privacy objection” notice. A short written notice can (a) revoke consent to use your contacts or data for collection beyond lawful purposes, (b) demand deletion of unlawfully obtained data, and (c) require written confirmation. A template appears below.
Inform your contacts (if they were messaged). Tell them you did not authorize the disclosure; ask them to keep any messages as evidence. This defuses reputational harm and helps build your case.
Pay only what’s lawful and documented. If you can pay the principal and lawful charges, do so through traceable channels. If charges are illegal or unclear, dispute in writing and keep funds ready while you seek clarification or file complaints.

6) Where and how to file complaints (step-by-step)

A) SEC (for lending/financing companies & online lending platforms)

Use when: A lending/financing company (or its agents) engaged in harassment, shaming, false threats, or imposed undisclosed/illegal charges; an unregistered lender is operating; or the app/platform itself is abusive.

What to prepare:

Your complaint-affidavit (see template below).
Proof of identity.
Evidence pack (screenshots, call logs, demand letters, app permissions, loan agreement, payment records).
Details of the company: name used in the app, formal corporate name if known, addresses shown in the app/store listing, and any SEC registration details you captured.

What SEC can do: Investigate, order corrective measures, fine, or suspend/revoke licenses; order platforms to take down non-compliant apps; coordinate with other agencies for enforcement.

B) NPC (for data privacy violations)

Use when: The app scraped or used contacts, photos, or other data beyond what is necessary; engaged in doxxing/shaming; failed to honor data subject rights; or lacks meaningful consent and disclosure.

What to prepare:

Data Privacy complaint narrative (who processed data, what data, how acquired, specific unlawful uses).
Proof of identity and data subject authorization if you’re filing for someone else.
Evidence of harm (e.g., messages to contacts, reputational injury).
Copy of your cease-and-desist / withdrawal of consent notice and any response.

What NPC can do: Order compliance, penalties, and corrective actions; refer criminal violations.

C) BSP consumer assistance (if a bank is involved)

Use when: Disbursement or repayment used a bank product or partner, or you were mistreated by a bank’s collection unit.

What to prepare:

Complaint summary, account references, bank channel used, and evidence of abusive conduct.

What BSP can do: Direct banks to correct practices, provide redress, or escalate for enforcement.

D) Law enforcement (NBI/PNP) & Prosecutors (for crimes)

Use when: There are threats, extortion, defamation, identity misuse, or other crimes.

What to prepare:

Sworn statement, evidence bundle, and any witness statements.
For online libel: copies/links of defamatory posts or mass messages.

E) Civil actions and small claims

Use when: You seek damages for harassment, privacy invasion, or you want the court to declare illegal interest/penalties void and fix the amount due.

You may file in the proper trial court. For modest amounts, consider Small Claims (within the latest jurisdictional threshold). Filing is streamlined, no lawyer required, but check current limits and rules before filing.

7) Evidence checklist

Identity and contact details of complainant.
Loan details: app name, legal entity, dates, principal, interest, fees, penalties, due dates, payment history.
App store listing screenshots (publisher name, developer contact, permissions requested).
Privacy notice or terms of service (screenshots or saved copy).
Harassing content: messages, calls, group chats, social posts, display photos, edited images.
Call logs and voicemail/audio files (keep originals).
List of third parties contacted by collector, with timestamps and their statements if possible.
Your written disputes, cease-and-desist letters, and any replies.

8) Practical defenses and smart negotiation

Do not be bullied by threats of arrest. Nonpayment alone is not a crime. If they mention “warrants,” “subpoenas,” or “police blotter” for mere debt, treat this as evidence of unfair collection.
Ask for a breakdown: principal, interest, penalties, and the legal basis for each. Request the effective interest rate (EIR) and all fees disclosed at onboarding.
Offer settlement on lawful terms (principal + allowable charges). Put it in writing and pay through traceable channels only after getting a written acknowledgment that it’s full and final.
Block abusive numbers/accounts after you’ve gathered evidence; keep at least one open channel for formal communications (e.g., email).
Keep your employer informed (as needed). If collectors contact your workplace, HR can help document and refuse unauthorized communications.

9) Templates you can reuse

A) Cease Harassment & Data Privacy Objection (send to the lender/collector)

Subject: Cease and Desist from Harassment; Withdrawal of Consent; Data Privacy Objection

I am [Your Name], borrower under [App/Company], reference [Loan/Account No.].

I dispute your use of my personal data and communications that harass, shame, intimidate, or disclose my debt to third parties. These acts violate Philippine laws on fair collection and data privacy.

I hereby withdraw any consent (if any was given) for you or your agents to access or process my contacts, photos, files, location, or to message third parties about my account.

I object to any further processing of my data for harassment, shaming, or disclosure to third parties.

I demand immediate deletion of any copies of my contact list or files taken from my device, and a written confirmation within 5 working days.

All further communications must be professional and lawful. Calls or messages intended to annoy, alarm, or shame will be recorded and submitted to regulators and law enforcement.

Kindly acknowledge and confirm compliance.

[Your Name] [Mobile/Email] [Date]

B) Complaint-Affidavit core structure (SEC / Law Enforcement)

Affiant’s personal details.
Parties: Lender/app entity, known officers/collectors, and any third-party collector.
Facts: Loan terms, disclosures (or lack thereof), collection timeline, specific harassing acts (quote or screenshot), third-party disclosures.
Violations: Unfair collection, false threats, misrepresentation, illegal or undisclosed fees; data privacy misuse; libel/threats/coercion (as applicable).
Harm: Emotional distress, reputational damage, workplace issues, financial loss.
Reliefs sought: Penalties/sanctions; cessation of harassment; deletion of unlawfully obtained data; correction of charges; damages; take-downs of posts; preservation of evidence.
Annexes: Evidence list (A, B, C …).
Jurat.

C) Data Privacy Complaint (NPC)

Complainant: name, contact, ID.
Respondent: app/lender entity, developer contact, DPO (if any).
Narrative: what data was taken; how (permissions, scraping); how used (messages to contacts, social posts); dates and samples.
Privacy violations: lack of valid consent, purpose creep, disproportionate data collection, unlawful disclosure, failure to honor rights.
Requested actions: order to cease, delete data, notify affected contacts, administrative penalties, and referral for prosecution (if warranted).
Attachments: screenshots, logs, privacy notice copy, your cease-and-desist notice, list of contacts who received messages.

10) Frequently asked questions

Q1: Can they really have me arrested for not paying? No—mere nonpayment is a civil matter. Arrest requires a criminal offense and a warrant issued by a court. Threats of jail for nonpayment are harassment.

Q2: They texted my boss and family. Is that allowed? Disclosing your debt to third parties or pressuring them to collect is generally unlawful and a data privacy violation. Keep all messages and file complaints.

Q3: The interest and penalties doubled my loan. Do I have to pay them? Courts and regulators can strike down undisclosed or unconscionable rates and reduce them to reasonable amounts. You remain liable for lawful principal and charges.

Q4: Should I uninstall the app? First capture evidence and revoke permissions. If you uninstall, ensure you still have account access via web/email and keep copies of your agreement and payment history.

Q5: Will filing a complaint stop the harassment immediately? It often helps. Pair it with a cease-and-desist notice. If threats continue or escalate, report to law enforcement for criminal action and request platform take-downs.

11) Practical filing roadmap (one-pager)

Collect: Evidence pack + timeline + identity docs.
Notify: Send cease-harassment/privacy objection to lender/collector.
Complain:
- SEC for unfair collection / illegal fees / unregistered OLA.
- NPC for data privacy misuse (contacts “shaming,” doxxing).
- BSP if a bank is a party to the collection issue.
- NBI/PNP for threats, extortion, libel, or other crimes.
Coordinate: Ask app stores/social platforms to remove abusive content/apps with your evidence.
Resolve: Offer settlement on lawful terms; otherwise, consider civil or small claims for damages and to correct illegal charges.
Follow through: Track all case numbers, acknowledgments, and deadlines; keep receipts and copies.

12) Final reminders

Your right to privacy and dignity in collections is protected.
Do not ignore legitimate debt—dispute what’s unlawful, and be ready to pay what is truly due.
Keep communications in writing as much as possible.
If the harassment is severe or you feel unsafe, escalate to law enforcement immediately.
Laws and regulatory caps/rules evolve. Before filing, double-check the latest procedures and contact channels of the SEC, NPC, BSP, and law-enforcement offices.

If you’d like, I can tailor the complaint-affidavit and privacy complaint to your specific facts (timeline, screenshots, amounts, app name).