I. Overview

The rise of mobile apps and digital finance has made it extremely easy for Filipinos to access short-term credit. In minutes, a borrower can download an app, upload an ID and a selfie, and receive funds in their e-wallet or bank account.

Alongside this convenience, however, has come a wave of abusive collection practices by some online lending companies (“OLCs”) and their third-party collectors. These include:

Flooding borrowers and their contacts with threatening messages
Publicly shaming debtors on social media
Illegally accessing and misusing contact lists and photos
Sending fake “subpoenas” or “court orders” to pressure payment

This article explains, in the Philippine context:

What harassment by online lenders looks like
The laws and regulations that apply
The civil, criminal, and administrative liability that may arise
The remedies and practical steps available to borrowers

II. Legal and Regulatory Framework

Harassment by online lending companies does not fall under a single “Anti-Harassment by Lenders Act.” Instead, several laws work together to regulate their conduct.

1. The 1987 Constitution

The Constitution protects:

Right to privacy (in one’s persons, houses, papers, effects, and communications)
Right to due process
Right to dignity and reputation

While these rights are primarily enforceable against the State, they shape how courts interpret statutes and the seriousness of privacy and reputational harm caused by private entities.

2. Civil Code: Human Relations and Damages

Key Civil Code provisions often invoked against abusive collectors include:

Article 19 – one must, in the exercise of rights and in performance of duties, act with justice, give everyone his due, and observe honesty and good faith.
Article 20 – a person who, contrary to law, willfully or negligently causes damage to another shall indemnify the latter.
Article 21 – a person who willfully causes loss or injury to another in a manner contrary to morals, good customs, or public policy shall compensate the victim.
Article 26 – protects dignity and privacy, including acts such as:
- Prying into private life
- Vexing or humiliating another on account of their position or circumstances
- Similar acts that cause moral or mental suffering

Through these, a borrower may sue for moral and exemplary damages when harassment is extreme, intentionally humiliating, or clearly abusive.

3. Data Privacy Act of 2012 (RA 10173)

The Data Privacy Act (DPA) is crucial in dealing with lending apps that:

Access mobile phone contact lists, photos, SMS, or call logs
Threaten to contact all contacts if a loan is unpaid
Actually send mass messages to friends, family, and co-workers

The DPA requires that personal information be processed:

With valid consent
For specific, legitimate purposes
In a proportionate and transparent manner

Misuses of data (e.g., accessing all your contacts to shame you) can be unlawful even if the borrower “clicked agree,” especially when:

Consent is bundled (take-it-or-leave-it),
Data collected is excessive and not necessary to provide the loan, or
The data is then used in ways unrelated to the original purpose.

Violations of the DPA can lead to:

Administrative sanctions (compliance orders, cease-and-desist orders)
Criminal liability (imprisonment and substantial fines)

4. Cybercrime Prevention Act (RA 10175)

The Cybercrime Prevention Act elevates crimes like libel, threats, or illegal access when committed through a computer system or similar technology (e.g., through online platforms, messaging apps, mass texts).

Online lending harassment frequently involves:

Defamatory posts in group chats or social media
Threatening or extortionate messages sent via messaging apps
Misuse of digital accounts

These may qualify as cyber-libel, cyber-threats, or other cybercrimes.

5. Revised Penal Code (RPC)

Depending on the facts, abusive collection can constitute:

Libel (Art. 353) – public and malicious imputation of a crime, vice, defect, or any act that tends to cause dishonor, discredit, or contempt.
Slander / Oral Defamation – if statements are made verbally.
Grave or Light Threats – threatening a person with a wrong that may be punishable by law or other harm, to compel payment or any act.
Grave Coercion – using violence, threat, or intimidation to compel a person to do something against their will and not required by law.
Unjust vexation – any act that unjustly annoys, irritates, or vexes another, often used as a catch-all for harassment-type behavior.

6. Lending Company Regulation Act & Related Laws

Lending Company Regulation Act of 2007 (RA 9474) – requires lending companies to be registered with the SEC and comply with its rules and regulations.
Financing Company Act (RA 8556) – regulates financing companies offering credit.
Truth in Lending Act (RA 3765) – requires disclosure of finance charges and ensures transparency of loan terms.

The Securities and Exchange Commission (SEC) is the primary regulator for non-bank lending companies and has issued rules specifically targeting:

Abusive, unfair, and unconscionable debt collection practices
Registration and conduct of online lending platforms

Violations can result in:

Fines
Suspension or revocation of registration or license
Blacklisting of company officers from future registration

7. Consumer Protection and Other Rules

Consumer Act (RA 7394) – protects consumers from deceptive, unfair, and unconscionable sales or credit practices.
Bangko Sentral ng Pilipinas (BSP) – regulates banks and certain non-bank financial institutions, including rules prescribing fair collection practices for supervised entities.
National Telecommunications Commission (NTC) – issues rules on spam, nuisance calls, and texts; relevant when harassment involves excessive or fraudulent communications.

III. What Harassment by Online Lending Companies Looks Like

Harassment can take many forms. Some are clearly unlawful; others may be borderline but become unlawful due to intensity, frequency, or context.

1. Excessive or Obscene Calls and Messages

Examples:

Dozens or hundreds of calls per day
Calls at late hours or during work, despite being told to stop
Collectors hurling insults, curses, or slurs
Voice messages threatening harm, job loss, or exposure

Frequent, rude, or obscene contact may give rise to:

Unjust vexation
Grave or light threats
Civil liability for violation of Article 19/20/21 and Article 26 of the Civil Code

2. Contacting and Harassing Third Parties

A typical abusive pattern:

The app harvests your contacts.
When you miss a payment, collectors send texts or messages to your family, co-workers, boss, or even random numbers from that list.
These messages may claim you are a “scammer,” “criminal,” or that a case has been filed.

Legal issues include:

Data privacy violations – using your contacts’ information without their consent or lawful basis.
Defamation – if the lender portrays you as a criminal or a scammer.
Violation of privacy and human relations – humiliating you by spreading your debt status.

Legitimate collection does not justify mass messaging unrelated third parties who have no legal obligation under the loan.

3. Public Shaming and “Doxxing”

Some OLCs or collectors:

Post the borrower’s name, photo, and alleged debt on social media or group chats
Create edited images or memes mocking the borrower
Tag the borrower’s friends and relatives, workplaces, or barangay pages

This is often libelous and violates:

The borrower’s right to reputation and privacy
Data privacy rules on proportionality and lawful processing

Even if the debt exists, the method of collection can still be illegal and actionable.

4. Fake Legal Notices and Misrepresentation

Harassing practices can include:

Sending fake “subpoenas,” “warrants of arrest,” or “court notices” with made-up case numbers
Claiming that police or NBI are on the way to the borrower’s house
Threatening to charge the borrower with estafa solely for non-payment of a loan

Misrepresentation of legal processes may amount to:

Grave coercion (forcing payment by threat of unlawful harm)
Estafa or falsification (if documents are forged)
Unfair and deceptive practices under consumer protection laws

Important note:

Simple failure to pay a loan is generally a civil matter. Criminal liability usually requires fraudulent intent, such as issuing a bouncing check or misrepresenting facts at the time of borrowing. Threatening criminal charges when none realistically apply can be abusive.

5. Unauthorized Access and Overbroad Permissions

Many lending apps request:

Access to contacts
Access to camera/photos
Access to location, and sometimes SMS

Even when granted, they are bound by principles of:

Purpose limitation – data must be used only for clearly stated, lawful purposes.
Data minimization and proportionality – only data needed for the service should be collected and used.

Using this data primarily as leverage for harassment (e.g., “we will message everyone if you don’t pay”) is often disproportionate and unlawful.

IV. Legal Liability of Online Lending Companies and Their Agents

1. Under the Data Privacy Act

Potential violations include:

Unauthorized processing of personal and sensitive information
Processing for unauthorized purposes (e.g., shaming instead of purely assessing creditworthiness or contacting the borrower)
Unauthorized disclosure of personal information (e.g., sending your debt status to contacts)

Consequences:

Administrative:
- Compliance orders
- Cease-and-desist from specific data processing
- Orders to delete or correct data
Criminal:
- Imprisonment and fines (which can reach into the millions of pesos)

Liability can attach to:

The lending company
Its directors, officers, and employees who participated in or allowed the violation
Sometimes third-party service providers (e.g., collection agencies)

2. Civil Liability for Damages

Borrowers can sue for:

Actual damages – if harassment caused quantifiable financial loss (e.g., lost job due to defamatory messages sent to employer).
Moral damages – for anxiety, embarrassment, mental anguish, wounded feelings, social humiliation.
Exemplary damages – to serve as a deterrent and punishment for particularly egregious conduct.
Attorney’s fees and litigation expenses.

The company can be held vicariously liable for its collectors under the rules on employers’ liability and agency.

3. Criminal Liability Under the RPC and Cybercrime Law

Collectors may be criminally liable for:

Libel or cyber-libel – maliciously imputing crimes or shameful conduct in messages or online posts.
Grave threats – e.g., threatening physical harm or death if payment is not made.
Light threats / unjust vexation – persistent annoying calls, messages, or minor threats.
Grave coercion – forcing payment by threats of fabricated criminal cases or illegal acts.

Criminal actions may be pursued against:

Individual collectors
Officers or managers who directed, tolerated, or encouraged unlawful practices

Civil actions for damages may be impliedly instituted together with the criminal case, or filed separately.

4. Regulatory Sanctions by SEC and Others

For SEC-regulated lending and financing companies, violations of SEC rules on:

Registration and licensing
Standards of conduct
Prohibited collection practices

can lead to:

Fines and administrative penalties
Cease-and-desist orders
Suspension or revocation of certificate of authority
Disqualification of directors and officers

If the lender is a bank or BSP-supervised entity, breach of BSP regulations on collection and consumer protection may result in:

Monetary penalties
Corrective action directives
Impact on management’s fitness and propriety assessment

V. Rights and Remedies of Borrowers

1. Document Everything

Evidence is crucial. Borrowers should:

Take screenshots of texts, chat messages, and social media posts
Save audio recordings of calls if allowed by law (in the Philippines, recording your own call is generally treated differently from wiretapping others’ conversations)
Keep copies of loan agreements, app screenshots, and payment records
Note down dates and times of harassing communications

The more detailed the documentation, the stronger the case.

2. Demand to Stop Harassment

Borrowers may:

Send a written demand (via email or formal letter) asking the company to:
- Cease contacting third parties
- Limit communication to reasonable times and channels
- Stop using defamatory or threatening language

While an abusive lender may ignore this, such letters:

Help establish good faith on the part of the borrower
Show that the borrower has expressly withdrawn consent to certain uses of data or modes of communication

3. Complaints to the National Privacy Commission (NPC)

If harassment involves misuse of personal data (contacts, photos, etc.), borrowers and affected third parties can:

File a complaint with the NPC, narrating:
- How data was collected
- How it was misused
- The resulting harm
Attach evidence (screenshots, app permissions, privacy policies, etc.)

The NPC can:

Order the company to stop unlawful processing
Direct the company to delete certain data
Impose penalties and corrective measures
Coordinate with other agencies (e.g., SEC, law enforcement)

4. Complaints to the SEC (for Lending/Financing Companies)

For harassment by an SEC-registered or unregistered online lending company, a borrower may:

Lodge a complaint with the SEC Enforcement or related department
Provide:
- Name of app / company
- SEC registration details, if known
- Detailed chronology of harassment
- Evidence (messages, screenshots, call logs, etc.)

SEC can:

Investigate the lending app
Sanction or shut down erring entities
Issue public advisories warning the public

5. Criminal Complaints (PNP / NBI / Prosecutor)

Where harassment qualifies as a crime (libel, threats, unjust vexation, coercion, etc.), the borrower can:

Report to PNP (e.g., Anti-Cybercrime Group) or NBI (Cybercrime Division).
Execute a sworn statement / affidavit, attaching all evidence.
Law enforcement may conduct further investigation and then file a complaint with the Office of the Prosecutor.

If the prosecutor finds probable cause, a criminal case may be filed in court.

6. Civil Actions for Damages

Separately or in addition, the borrower may file:

A regular civil action for damages
Or, depending on the amount claimed, a small claims case (simple procedure, no lawyer required for certain amounts, though thresholds change over time)

These suits rely on:

Articles 19, 20, 21, and 26 of the Civil Code
Breach of contractual obligations or torts (quasi-delicts)
Data privacy violations as a factual basis for moral damages

VI. Legitimate Collection vs. Harassment: Where Is the Line?

Not all firm or persistent collection is illegal. The law recognizes that creditors have the right to demand payment of valid debts. The question is how they do it.

Generally Acceptable Practices

Reasonable reminders via SMS, calls, or email about due dates or overdue accounts
Calls during normal business hours and at a reasonable frequency
Polite and factual communication:
- Amount due
- Payment options
- Consequences clearly grounded in the contract and law (e.g., late payment fees, reporting to legitimate credit bureaus)

Practices That Tend to Cross the Line

Insults, slurs, and name-calling
Threats of harm, arrest, or fabricated cases
Contacting your employer, colleagues, or extended family to shame you
Posting your information in public or private online communities with defamatory remarks
Sending fake legal documents or misrepresenting themselves as police, lawyers, or court officials
Excessive calls or messages that clearly disturb your peace

Courts and regulators often look at:

The frequency and timing of communications
The tone and content (rude vs. professional; threats vs. reminders)
Whether third parties were involved unnecessarily
Whether the collector’s methods are disproportionate to the legitimate objective of collecting a debt

VII. Preventive Measures for Borrowers

While the burden of compliance lies on lenders and regulators, borrowers can minimize risk by:

Evaluating apps before use
- Check permissions: Does this app really need access to your entire contact list?
- Read (or at least skim) the privacy policy.
Avoiding over-sharing data
- Provide only what is reasonably required (ID, basic contact details, proof of income).
- Be wary of apps that insist on full contact list access as a condition for small, short-term loans.
Using reputable lenders
- Prefer banks or lenders with clear physical addresses, proper registration, and a track record.
Keeping records of all transactions
- Save contracts, receipts, and screenshots of app details to protect yourself in case of dispute.

VIII. Conclusion

In the Philippines, harassment by online lending companies is not a legal vacuum. A web of laws—the Data Privacy Act, Cybercrime Prevention Act, Revised Penal Code, Civil Code, consumer and lending regulations—collectively restricts abusive practices.

Key points:

Lenders may remind you and demand payment; they may not terrorize, shame, defame, or misuse your personal data.
Acts like public shaming, mass messaging of your contacts, fake subpoenas, and threats of violence or fabricated criminal cases can carry civil, criminal, and regulatory consequences.
Borrowers are not powerless: they can document abuses, demand that they stop, and bring complaints before the NPC, SEC, law enforcement, and courts.

For anyone facing harassment, it is important to understand both your obligation to pay valid debts and your right to be treated with dignity and in accordance with law. For tailored advice and case strategy, consulting a Philippine lawyer or legal aid group is strongly recommended, especially if the harassment is intense or already impacting your employment, family life, or mental health.