If relentless calls, shaming messages to your family and friends, or public posts using your personal information from an online lending app have left you anxious, embarrassed, or unable to focus on work and family, you are facing practices that Philippine law explicitly prohibits. These tactics—often called debt shaming or contact harvesting—violate your right to privacy and dignity. You can take concrete steps to stop them by filing complaints with the National Privacy Commission (NPC), the Securities and Exchange Commission (SEC), and, when threats are involved, law enforcement. This guide explains your rights under current law and gives you the exact practical process to file strong, effective complaints.

What Counts as Illegal Harassment by Online Lending Apps

Online lending apps (OLAs) and their collectors commonly cross the line by:

Accessing and using your phone contacts or social media friends without consent to pressure you or shame you to third parties.
Sending repeated threatening, profane, or humiliating messages to you, your relatives, employer, or colleagues.
Posting your photo, debt details, or personal information on social media or public groups to embarrass you.
Making false claims about arrest, lawsuits, or harm if you do not pay immediately.

These actions are not legitimate collection. They constitute unfair debt collection and unauthorized processing of personal data. Even if you owe money, collectors must follow lawful and respectful methods. No one can be jailed simply for unpaid debt.

Legal Protections You Can Rely On

Data Privacy Act of 2012 (Republic Act No. 10173)

This is the strongest and most frequently used law against OLA harassment. It prohibits unauthorized collection, processing, or disclosure of your personal information, including contact lists. The National Privacy Commission enforces it and has sanctioned numerous apps for exactly these practices.

NPC Circular No. 20-01 (2020) specifically bars online lenders from harvesting phone contacts, email lists, or social media contacts for debt collection or harassment. Apps may only request permissions necessary for know-your-customer checks or fraud prevention, and they must stop using or delete the data once that limited purpose ends. Violators face administrative fines, cease-and-desist orders, and possible criminal prosecution under the Data Privacy Act (imprisonment up to six years and fines up to several million pesos for serious violations involving sensitive data).

SEC Memorandum Circular No. 18, Series of 2019

This circular prohibits unfair debt collection practices by all SEC-registered financing and lending companies (and their third-party collectors). It bans:

Contacting anyone in your phonebook except named guarantors or co-makers.
Using insults, threats, profane language, or public humiliation.
Disclosing your debt information to third parties to shame or pressure you.

The SEC has imposed fines ranging from tens of thousands to over a million pesos and has revoked certificates of authority for repeated violations. Even unregistered apps can be targeted for operating without authority and using illegal tactics.

Other Relevant Laws

Revised Penal Code: Grave threats (Article 282) and unjust vexation (Article 287) apply to serious intimidation or persistent annoyance.
Cybercrime Prevention Act (Republic Act No. 10175): Covers cyber libel or online shaming when personal information is posted publicly to harm your reputation.
Consumer Act of the Philippines (Republic Act No. 7394): Prohibits deceptive or unfair acts in commerce, including abusive collection tied to financial products.

These laws work together. Most victims achieve the fastest results by filing with the NPC (privacy violation) and SEC (lending company regulation) at the same time.

Step-by-Step: How to File Complaints Effectively

Step 1: Gather Strong, Organized Evidence

Good evidence is the foundation of a successful complaint. Collect and organize:

Screenshots of every harassing message or post, showing the app name or number, date, time, and full content.
Call logs or screenshots of missed/received calls with timestamps.
Screenshots of any public shaming posts (include the group or page name and date).
Your loan agreement or app transaction history (to show the context without admitting disputed amounts).
Statements or affidavits from family members, friends, or colleagues who were contacted (they can also file their own complaints as affected data subjects).
Any demand letters or responses from the app.

Save everything in a clearly labeled folder with dates. Timestamped screenshots carry more weight than undated ones. If possible, have affected contacts write short sworn statements.

Step 2: Send a Formal Cease-and-Desist Letter (Helpful but Not Mandatory)

Before or while preparing your government complaints, send a clear letter or email to the app’s official support or registered address demanding they immediately stop all contact with you and third parties, delete your data, and cease any shaming. Keep a copy and proof of sending. This creates a paper trail and sometimes prompts quicker compliance, especially if the company fears regulatory scrutiny.

Step 3: File with the National Privacy Commission (Strongly Recommended First for Most Cases)

The NPC specializes in exactly the contact-harvesting and shaming tactics used by many OLAs.

Download the official Complaint Affidavit form from the NPC website (privacy.gov.ph).
Fill it out completely, describing the facts, the specific violations (unauthorized processing of personal data, malicious disclosure, processing for unauthorized purposes), and the relief you want (cease-and-desist order, deletion of data, investigation, and penalties).
Have the form notarized.
Submit by email (scanned copy) to complaints@privacy.gov.ph, by courier, or in person at the NPC office (5th Floor, Delegation Building, PICC Complex, Pasay City).

The NPC can issue immediate cease-and-desist orders in urgent cases and has successfully pursued both administrative sanctions and criminal referrals against offending apps.

Step 4: File with the Securities and Exchange Commission

File simultaneously or shortly after the NPC complaint, especially if you want action against the company’s license or operations.

Use the SEC iMessage portal at imessage.sec.gov.ph to submit a ticket describing the unfair collection practices.
Or email a notarized complaint-affidavit and evidence to the appropriate department (commonly cgfd_md@sec.gov.ph or flcd_complaints@sec.gov.ph for lending company matters).
Clearly state violations of SEC MC No. 18, s. 2019 and request investigation, cease-and-desist order, fines, and possible revocation of authority if the company is registered (or enforcement action if unregistered).

The SEC maintains lists of authorized and unauthorized online lending platforms and actively acts on complaints of abusive collection.

Step 5: Report Criminal Threats or Extortion to Law Enforcement

If you receive death threats, serious intimidation, extortion demands, or clear cyber libel, file a complaint with:

PNP Anti-Cybercrime Group (ACG) — Camp Crame or regional offices; hotline (02) 723-0401 loc. 7491; email acg@pnp.gov.ph.
NBI Cybercrime Division — NBI Main Office or regional offices.

Bring your evidence and ID. They can investigate under the Revised Penal Code and Cybercrime Prevention Act. A police blotter or formal complaint can strengthen your NPC and SEC cases.

You may file with all three agencies at once. There is no strict rule against it, and each addresses different aspects of the violation.

Documents, Timelines, and Practical Realities

Core documents for NPC and SEC complaints:

Notarized Complaint Affidavit (use the agency’s form where available).
Valid government-issued ID (passport for foreigners or OFWs).
Organized evidence bundle (screenshots, logs, third-party statements).
Loan transaction records (if relevant to context).

Timelines: NPC and SEC aim to act on urgent harassment cases within days or weeks for cease-and-desist orders, though full investigation and penalties can take several months. Criminal cases move through preliminary investigation and may take longer. Consistent follow-up (politely checking status after 2–4 weeks) helps keep your case moving.

Fees: NPC and SEC complaint filing is generally low-cost or free for individuals; any nominal fees are published in their respective schedules of fees. Notarization usually costs a few hundred pesos.

For OFWs, foreigners, and those abroad: The process is the same. File electronically via email with scanned notarized documents. You can have your affidavit notarized at a Philippine embassy or consulate, or (for Hague Apostille Convention countries) apostilled before scanning. Family members in the Philippines who were harassed can file as co-complainants or separately. Many successful cases have been filed by OFWs whose families were targeted.

Common Pitfalls and How to Avoid Them

Weak or undated evidence — Always include visible dates and sender details. Organize files clearly.
Filing only with the app or on social media — These rarely produce results and can alert the company without triggering official action.
Delaying action while hoping it stops — Early, well-documented complaints give regulators stronger grounds for swift orders.
Believing you must settle the debt first — You can (and should) challenge illegal collection methods independently of any legitimate debt. Pay only what you legally owe after verifying the amount and terms.
Assuming unregistered apps are untouchable — The SEC can still investigate and shut down illegal operations; the NPC can sanction any entity processing personal data unlawfully.
Fear of retaliation — Good-faith reports to regulators are protected. Companies that retaliate face additional liability.

Frequently Asked Questions

Can online lending apps legally access and use my phone contacts to collect debts?
No. NPC Circular No. 20-01 and the Data Privacy Act prohibit this unless you gave clear, informed consent for a specific, limited purpose—and even then, they cannot use the contacts to harass you or third parties.

What is the strongest evidence for an NPC or SEC complaint?
Timestamped screenshots showing the app or collector contacting your family or posting your information publicly, combined with proof that the contacts were harvested without consent. Third-party affidavits from affected family members carry significant weight.

Do I need a lawyer to file these complaints?
No. Many people successfully file on their own using the official forms and clear evidence. A lawyer can help if your case involves complex damages claims or criminal prosecution, but it is not required for administrative complaints with the NPC or SEC.

What happens if the lending app is not registered with the SEC?
Report it anyway. The SEC can issue cease-and-desist orders against unregistered operations and coordinate with other agencies for enforcement. The NPC can still act on the privacy violations regardless of registration status.

Will filing a complaint stop the harassment right away?
Often yes for the most aggressive tactics once a cease-and-desist order is issued, but full resolution takes time. Continue documenting any continued contact after you file.

Can I file anonymously?
Generally no—agencies need your details to investigate and protect you. However, your personal information is handled confidentially by the NPC and SEC during proceedings.

What if I already paid or the debt is disputed?
You can still file about the illegal collection methods. Disputed interest or fees can be raised separately, but the focus of these complaints is the harassment and privacy violations.

How long do I have to file a complaint?
There is no strict short deadline for administrative complaints with NPC or SEC, but act as soon as possible while evidence is fresh and the conduct is ongoing. Criminal complaints have prescriptive periods under the Revised Penal Code.

Are there penalties against the companies and collectors?
Yes. The NPC can impose fines and recommend criminal charges. The SEC can fine companies (examples include P50,000 to over P1 million), suspend operations, or revoke authority. Individual collectors can face criminal liability for threats or grave coercion.

Key Takeaways

Harassment through contact harvesting, third-party shaming, and abusive messages violates the Data Privacy Act and SEC MC No. 18, s. 2019.
File with the National Privacy Commission for privacy violations and the Securities and Exchange Commission for unfair collection practices—doing both strengthens your position.
Strong, timestamped evidence (especially screenshots and third-party statements) is the key to fast regulatory action.
You can file electronically even if you are abroad; notarize your complaint affidavit and submit by email.
No one should endure threats or public humiliation to collect a debt. Philippine regulators have the tools and track record of acting against these practices when complaints are properly documented and filed.

Start gathering your evidence today. Clear, well-supported complaints have helped many Filipinos stop the harassment and hold these operators accountable.