Harassment by Online Lending Apps and Usurious Interest in the Philippines
A comprehensive legal overview (updated to June 2025)
1. Introduction
In barely a decade, hundreds of mobile “instant-cash” apps have sprung up in the Philippines. Their pitch is seductive—paper-free approval in minutes and cash in hours—but many borrowers soon discover hidden charges, punitive interest, and relentless collection tactics that border on blackmail. This article pulls together all the key Philippine statutes, regulations, case law, and enforcement trends that govern (and attempt to restrain) those practices. It is meant for lawyers, compliance officers, policy-makers, and consumers alike; citations are to Philippine laws and Supreme Court decisions that remain good doctrine as of 19 June 2025.
2. Core Legal Framework
| Area | Source | Salient Rules |
|---|---|---|
| Interest & Usury | • Usury Law (Act 2655) as amended, but ceilings lifted by Central Bank Circ. 905-82 | |
| • Art. 1956, Civil Code (interest must be in writing) | ||
| • SEC Mem. Circ. No. 3-2022 (rate cap for “small” loans) • BSP Circ. 1165-21 (24 % p.a. cap on credit-card receivables) |
Courts may still strike down “unconscionable” or “iniquitous” rates even after Circ. 905: see Medel v. CA (G.R. 131622, 27 Nov 1998), DBP v. CA (G.R. 193419, 5 Mar 2013), etc. SEC caps loans ≤ ₱10 000 (≤120 days) at 6 % per month interest and 5 % per month penalty. | |
| Lending-App Registration | • Lending Company Regulation Act (LCRA), R.A. 9474 | |
| • Financing Company Act, R.A. 8556 | Lending or financing companies must be SEC-licensed. Marketing an unregistered app or brand is ground for cease-and-desist and criminal prosecution (₱50 000–₱100 000 fine + 6 mos–10 yrs imprisonment). | |
| Collection & Harassment | • LCRA, §19(j) (unfair collection “any conduct that harasses, oppresses or abuses”) | |
| • SEC Mem. Circ. 18-2019 (Unfair Collection Practices Rules) | Prohibits public shaming, contacting persons in borrower’s phonebook, profane or threatening language, misrepresentation of authority, simulating court or police documents, etc. | |
| Privacy & Data | • Data Privacy Act, R.A. 10173 + NPC Circular 16-01 (rules on consent) | Scraping a borrower’s entire contact list without freely given, specific consent ≠ “proportionate” to the loan purpose → illegal processing (up to ₱5 million + 1–6 yrs). Malicious disclosure adds another offense. |
| Cyber Offenses | • R.A. 10175 (Cybercrime Prevention Act) | “Doxxing,” cyber-libel, grave threats, and illegal access committed through an app or SMS are cybercrimes (penalties one degree higher than offline counterparts). |
| Consumer Protection | • Consumer Act, R.A. 7394 | |
| • BSP/SEC joint issuances on financial consumer protection (FCP), culminating in Republic Act 11765 (Financial Products and Services Consumer Protection Act, 2022) | FCP Act gives BSP, SEC, IC explicit rule-making plus adjudicative power to award actual, moral & exemplary damages and impose fines up to ₱10 million and disgorgement. |
3. Interest-Rate Regulation After the Demise of the Usury Law
Circular 905 (1982) did not repeal the Usury Law; it merely lifted ceilings, leaving courts free to police rates for unconscionability.
Judicial yardsticks—The Supreme Court has repeatedly voided or reduced interest at 48 %–120 % p.a., e.g.:
- 66 % p.a. (Medel),
- 5 % per month (Spouses Abella v. Apolinario, G.R. 164484, 27 Apr 2007),
- 3 % per month compounded (Castro v. Tan, G.R. 168940, 15 Jun 2015).
Courts typically reset to 12 % p.a. (pre-July 2013) or 6 % p.a. (post-July 1 2013 per Nacar v. Gallery Frames, G.R. 189871).
Regulator-imposed caps—Responding to mounting complaints, the SEC in 2022 invoked §4(c), LCRA to cap “small loans” (≤ ₱10 000, ≤ 120 days):
• Interest/mark-up: 0.15 % per day (≈ 4.5 % per month / 54 % p.a.) • Penalty: 0.5 % per day (≈ 15 % per month)
- BSP for credit cards—Circular 1165-21 fixed a 24 % p.a. ceiling on interest/finance charges and ₱200 max late-payment penalty for cards and revolving lines.
4. Harassment & Unfair Collection: What Counts and What Is Punishable?
| Conduct by App Collectors | Legal Hooks | Possible Sanctions |
|---|---|---|
| Sending “blast” messages to all phonebook contacts calling the borrower a thief | §19(j), LCRA; Cyber-libel (Art. 355, RPC + R.A. 10175) | SEC CDO; ₱50 000–₱100 000 fine; 6 mos–10 yrs jail; prison correccional for libel |
| Threatening to post nude deep-fakes unless loan is paid | Grave threats (Art. 282, RPC); Safe Spaces Act (if gender-based) | 6 mos–6 yrs; additional damages under VAWC if the borrower is female/intimate partner |
| Repeated 2 a.m. calls / spam despite request to cease | Unjust vexation (Art. 287, RPC); SEC MC 18-2019 §3(a) | Arresto menor + fine up to ₱40 000; SEC administrative penalties |
| Misrepresenting as “Sheriff / NCIP / CIDG” to coerce payment | Art. 177, RPC (Usurpation of Authority); MC 18-2019 §3(b) | 6 mos–6 yrs; SEC revocation; NPC penalty if ID used carries personal data |
| Accessing camera/microphone remotely | Illegal access (§4(a)(1), R.A. 10175); Wiretapping Act if audio | 6 yrs–12 yrs; damages under DPA |
The SEC’s Unfair Collection Practices Rules provide an enumerated blacklist. A single confirmed violation can trigger: (a) suspension of lending authority, (b) ₱25 000–₱1 million fine, and (c) permanent app delisting from Google Play / Apple App Store through coordinated takedown requests.
5. Data-Privacy Pitfalls Unique to Lending Apps
- Over-collection of contacts, gallery, or location fails the “proportionality” test under NPC Circular 16-01 §18.
- Lack of “granular” consent—bundled permissions (“I agree to all”) are invalid (NPC Advisory Opinion 2018-054).
- Cloud storage abroad—transborder transfer requires informing the data subject of the name and location of the foreign processor (§21, DPA IRR).
- Security breaches—Apps must notify NPC and affected borrowers within 72 hours of knowledge (§38, DPA). Failure is a separate punishable act (₱500 000–₱5 million).
6. Key Enforcement Milestones (2019 – 2025)
| Year | Regulator Action | Highlights |
|---|---|---|
| 2019 | SEC EIPD blitz on 48 apps | First mass Cease-and-Desist Orders; revocation of Fynamics Lending Inc. (CashLending, CashBorrow) |
| 2020 | Surge of pandemic borrowing | NPC confirms contact-list scraping is illegal; BSP consults on “Buy-Now-Pay-Later” |
| 2021 | BSP Circular 1165-21 | Credit-card rate cap (24 % p.a.) formally begins 3 Nov 2021 |
| 2022 | SEC MC 3-2022 | First statutory interest-rate ceiling since 1982 |
| 2023 | FCP Act (R.A. 11765) IRR | Single-portal complaints; regulators may award damages up to ₱2 million |
| 2024 | Google Play policy update | Proof of SEC/BSP license now prerequisite to list PH lending apps |
| 2025 | SEC & FBI joint takedown | Cross-border servers of two Chinese-run “ghost” apps seized; first extradition request for cyber-harassment |
7. Remedies for Aggrieved Borrowers
File with SEC (Enforcement and Investor Protection Dept.)
- Electronic complaint form + screenshots of chats/calls.
- Relief: CDO, refund of illegal charges, app delisting.
File with NPC for privacy violations.
- Proof of unauthorized processing/disclosure.
- Relief: ₱1 000–₱5 000 per affected data subject, stop-processing order.
Criminal complaint with PNP-ACG or NBI-Cybercrime for threats, libel, illegal access.
Civil suit / Small-claims (≤ ₱400 000) to nullify unconscionable interest under Art. 1409 (void stipulation) or reduce to legal interest under Nacar.
Class suit under Rule 3 §12 or via FCP Act for systemic abusive practice.
8. Compliance Checklist for Legitimate FinTech Lenders
| Compliance Item | Minimum Philippine Requirement |
|---|---|
| SEC/BSP license & app name exactly matching certificate | Sec. 4, LCRA; MC 19-2019 |
| Privacy notice in Filipino & English | §16, DPA; “plain language” rule |
| Granular permissions (contacts optional) | NPC Advisory 2017-01 |
| Rate computation: APR + disclosed peso-value example | §17, Truth in Lending Act; BSP FCP regulations |
| Collection script & staff training against MC 18-2019 blacklist | Mandatory; keep call logs 24 mos |
| Customer-service channel (toll-free or in-app) | FCP Act IRR §13 |
| Periodic reporting of interest & penalty averages to SEC | MC 3-2022 §6 |
| Exit plan / data-retention policy | BSP Cir. 1105-20 on Operational Resilience |
9. Emerging Policy Questions
- Should the SEC cap all loan sizes? Congress is studying amendments to delegate dynamic rate-setting to the Monetary Board.
- Algorithmic credit scoring & discrimination—pending National AI Strategy guidelines (Draft 2025-02) will require explainability for denial/approval decisions.
- Cross-border enforcement—ASEAN regulators preparing a mutual assistance MOU to block unlicensed lending IP addresses region-wide.
- Debt-shaming on social media—House Bill 8655 seeks to make it a distinct cyber-harassment offense with higher penalties.
10. Conclusion
The Philippine legal arsenal against abusive online lending is steadily thickening: interest-rate ceilings have returned, unfair-collection rules are now codified, and multi-agency enforcement—SEC for licensing, NPC for privacy, BSP for banks and e-money issuers—has produced genuine wins for consumers. Yet gaps remain: caps apply only to small-ticket loans; criminal prosecutions are few; offshore operators re-spawn under new brands. For borrowers, vigilance begins before downloading—check the SEC certificate, read the privacy notice, and walk away from any app that demands your entire contact list. For lenders, compliance is no longer optional: harassment and usury are not just bad optics—they are illegal, punishable, and increasingly expensive.
This article does not constitute legal advice. For specific cases, consult counsel or the appropriate Philippine regulator.