How to File a Complaint Against Online Lending App Harassment (Philippines)

Updated for the Philippine legal framework. This is practical information, not a substitute for tailored legal advice.

Overview

“Online lending app” (OLA) harassment typically involves aggressive or abusive collection tactics after you borrow—or even if you never completed a loan. Common behaviors:

Threats, insults, or shaming messages
Contacting your family, employer, or phone contacts
Unauthorized harvesting of your contacts, photos, or files
Spam calls/texts from multiple numbers
Public posts disclosing your debt

In the Philippines, several agencies and laws can protect you:

Securities and Exchange Commission (SEC) — regulates lending and financing companies and bans unfair collection practices.
National Privacy Commission (NPC) — enforces the Data Privacy Act of 2012 (RA 10173) against unlawful data scraping, “contact harvesting,” and doxxing.
Bangko Sentral ng Pilipinas (BSP) — oversees banks and select non-bank financial institutions; implements the Financial Consumer Protection Act (FCPA, RA 11765) across supervised entities.
Law enforcement (PNP-ACG/NBI-CCD) — for threats, extortion, libel, grave coercion, and other crimes (including cybercrime under RA 10175).
Courts — civil damages; criminal cases.
Telcos/NTC — spam, spoofing, SIM misuse.

Your path depends on who the lender is (SEC-registered lending/financing company? bank? unregistered operator?) and what they did (privacy violations, criminal threats, unfair collection).

Key Laws & What They Forbid

Data Privacy Act (RA 10173)
- Your rights: to be informed, to object, to access, to delete/erasure, and to damages (Sec. 16).
- Unlawful processing, unauthorized access, and improper disposal are penalized. Mass-messaging your contacts and “name-and-shame” tactics often violate purpose limitation and proportionality.
Financial Consumer Protection Act (RA 11765)
- Prohibits abusive collection and unfair, misleading, or deceptive acts/practices by financial service providers (FSPs). Requires complaint handling, redress, and fair treatment.
Lending Company Regulation Act (RA 9474) and Financing Company Act (RA 8556)
- Lending/financing companies must be SEC-registered and comply with SEC rules.
SEC rules on unfair debt collection (e.g., Prohibition on Unfair Debt Collection Practices applicable to lending/financing companies)
- Typically prohibits threats, profanity, shaming, and contacting persons other than the borrower—except to obtain location/contact information and subject to strict limits.
Revised Penal Code & Cybercrime Prevention Act (RA 10175)
- Grave threats (Art. 282), grave coercion (Art. 286), unjust vexation, libel/slander (Arts. 353/355/358)—online acts may be charged as cybercrimes.
SIM Registration Act (RA 11934)
- Supports tracing persistent harassing numbers and penalizes misuse.

Principle to remember: Collectors may verify your whereabouts, but harassment, public shaming, and mass disclosure of your alleged debt are not allowed.

Evidence First: Build a Strong File

Create a case folder (physical or digital). Include:

Screenshots of all messages/chats (showing timestamps, sender IDs, app names).
Call logs/recordings (announce recording if required by policy; keep metadata).
Proof of identity ownership of the SIM/account; loan documents (if any).
Proof they scraped/used your contacts (e.g., messages to your colleagues/family).
Your written demands asking them to stop, delete data, and communicate only via lawful channels; proof of receipt.
Financial harm & emotional distress records (HR memos, medical notes, time off, receipts).
Entity details: app name, developer/company name, addresses, website, social pages, payment channels used.

Decide Where to File (Routing Matrix)

Scenario	Primary Venue	Also Consider
Registered lending/financing company harassing you	SEC (unfair debt collection)	NPC (privacy), PNP-ACG/NBI (threats/libel), civil action
Bank/e-money issuer or BSP-supervised entity	BSP (FCPA complaints)	NPC (privacy), law enforcement
Unregistered/fly-by-night OLA	SEC (unregistered operations)	Law enforcement; app stores; telco spam reporting; NPC
Privacy violations (contact scraping, doxxing, shaming blasts)	NPC	SEC/BSP depending on entity
Criminal threats/extortion/libel	PNP-ACG or NBI-Cybercrime	SEC/BSP/NPC for regulatory angles
Spam/SIM misuse	Telco complaint channels; NTC	Law enforcement if threats present

You may file in parallel (e.g., NPC + SEC), and cite each case number across filings.

Step-by-Step: Filing With Each Forum

A. NPC (Data Privacy)

Send a Data Subject Request (DSR) to the company:
- Object to processing; demand cessation of harassment and erasure of your personal and contact data.
- Ask for the lawful basis for processing your data and any disclosures to third parties (your contacts).
If ignored or the violation is serious, file a Complaint with NPC:
- Attach evidence + your DSR + proof of receipt/inaction.
- Remedies may include compliance orders, fines, and referral for prosecution for criminal privacy offenses.
Interim relief: Ask NPC to order the company to stop contacting third parties and to secure/erase unlawfully collected data.

What to highlight:

Contact harvesting from your phone address book without clear, specific, and freely given consent.
Messages to third parties disclosing your alleged debt.
Excessive, frequent, or threatening communications (lack of proportionality).

B. SEC (Lending/Financing Companies)

Check the entity type (lending company vs. financing company; registered or not).
File a complaint for:
- Unfair debt collection practices (threats, shaming, contacting third parties).
- Operating without registration (if applicable).
What to attach:
- Screenshots, recordings, witness affidavits (contacts/employers who received shaming messages), app profile info.
Relief sought:
- Sanctions, fines, suspension/revocation of authority, and cease-and-desist actions.
- Coordination with app stores and platforms to remove the abusive app.

C. BSP (Banks, EMIs, and Other Supervised FSPs)

Trigger the Provider’s Internal Complaint Process (required under FCPA):
- File through the bank/app’s Consumer Assistance Mechanism; obtain a ticket/reference number.
If unresolved, escalate to BSP Consumer Protection:
- Submit your narrative, evidence, and the provider’s final response (or non-response) after the prescribed resolution period.
Relief: Direction to rectify practices, refund improper charges/fees, corrective measures.

D. Law Enforcement (Criminal Angles)

Grave threats/coercion, libel, extortion, doxxing: Execute a sworn complaint before PNP Anti-Cybercrime Group or NBI-Cybercrime Division.
Include: numbers used, links to profiles, device info, and any monetary demands.
Ask for preservation of electronic evidence and subpoena of subscriber information if needed.

E. Telcos / NTC (Spam & Number Blocking)

Report spam/harassing texts and request blocking and trace (provide screenshots and timestamps).
If calls/texts persist from rotating numbers, continue documenting; ask telco how to bundle reports to aid pattern detection.
Consider a SIM change only after securing two-factor logins and updating trusted contacts.

Civil Remedies

Damages (actual, moral, exemplary) for harassment, reputational harm, lost wages.
Injunction to stop contact with you and third parties.
Small Claims for certain monetary disputes (if within jurisdictional amount; check current thresholds).
Data privacy damages under RA 10173 (Sec. 16(f)).

Practical Playbook (Do This Now)

Stop the data leak
- Revoke the app’s permissions on your phone (Contacts, SMS, Storage). Uninstall only after exporting logs/screens.
Write a Cease-and-Desist + DSR (template below). Send via email and any official channel; keep proof.
Notify your employer/family (briefly explain it’s an unlawful collection tactic; provide a one-liner script for receptionists/HR).
File parallel complaints: NPC (privacy), SEC/BSP (regulatory), PNP-ACG/NBI (criminal if threats), telco (spam).
Preserve evidence: Back up your phone; export chats; keep a timeline.
Mind repayments: If you have a legitimate loan, separate the obligation to repay from the illegality of harassment. Pay via traceable channels; avoid cash pickups.

Red Flags That Strengthen Your Case

Messages to your entire contact list or work chat.
Threats of arrest or public posting of your ID/selfies.
Demands for more fees to “extend” or “delete your data.”
No SEC/BSP registration; shell website; no Philippine address.
Permission creep (app requires contacts/photos for a simple loan).

Templates

1) Cease-and-Desist + Data Subject Request (DSR)

Subject: Cease-and-Desist & Data Subject Request – [Your Name], [Mobile No.] To: [Company Legal/Compliance Email]

I am asserting my rights under the Data Privacy Act of 2012 and applicable consumer protection rules. You (and your agents) must immediately cease the following unlawful acts:

Harassing communications to me; and

Disclosure of my alleged debt or personal data to any third party, including my contacts and employer.

I hereby object to any further processing of my personal data and demand erasure of all data collected beyond what is strictly necessary to perform a lawful contract. Provide within ten (10) days:

Your lawful basis for processing my data;

A list of third parties to whom my data was disclosed; and

Confirmation of erasure and steps taken to prevent further disclosure.

Future communications must be in writing to this email only. Sincerely, [Name, Address, ID No., Date]

2) Sworn Statement (Attach to NPC/SEC/Police Complaints)

Your identity and contact details
Entity/app name, dates installed/used
Exact words used in threats/shaming, with timestamps
Names of third parties contacted (attach screenshots)
Specific requests you previously sent and the responses (or non-response)
Statement that the facts are true and correct, signed and notarized (or executed before an authorized officer)

Frequently Asked Questions

1) I never took a loan. Can I still complain? Yes. Unsolicited harassment and unlawful processing (e.g., scraping your contacts) are actionable even without a loan.

2) They say they’ll post my photos/ID if I don’t pay. That’s a threat and a privacy violation. Preserve evidence and file with NPC and PNP-ACG/NBI.

3) They contacted my boss and coworkers. That strongly supports an unfair collection and privacy case. Get brief written statements from colleagues (or screenshots forwarded by them).

4) Will uninstalling the app stop the harassment? Not necessarily. Revoke permissions and send a DSR demanding erasure. Continue filing complaints so regulators can sanction the practice.

5) What if I actually owe money? You may still complain about illegal tactics. You can pay what’s due via official channels while pursuing complaints for the abuse.

6) How long do cases take? Timelines vary. Filing complete, well-organized evidence and citing the correct forum speeds things up.

Pro Tips for a Cleaner Digital Footprint

Use a separate email/number for loan apps; never grant Contacts or Storage access unless essential.
Read privacy notices and permissions prompts; take screenshots.
Keep two-factor authentication and recovery numbers updated before changing SIMs.
Warn close contacts not to engage with shaming messages; ask them to screenshot and forward instead.

Quick Filing Checklist

Screenshots, call logs, audio (if any), and a dated timeline
Cease-and-Desist + DSR sent (keep proof)
NPC complaint (privacy)
SEC or BSP complaint (depending on entity)
PNP-ACG/NBI (criminal threats/libel/extortion)
Telco spam reports/number blocking
Employer/family briefed; witness statements secured

When to Seek Counsel

If harassment is impacting your job, mental health, or involves large sums or organized extortion, consult a lawyer for potential civil damages and injunctions. Bring your evidence folder and any case numbers already issued by NPC/SEC/BSP/police.

Stay calm, document everything, and file in parallel with the right forum. Harassment and shaming are not the price of borrowing—they are violations you can fight.