A practical legal guide for borrowers, families, and employers

Disclaimer: This is general information for the Philippine context. It is not legal advice and does not create a lawyer–client relationship.

1) The Problem in a Nutshell

Online lending platforms (often called “OLPs”) and app-based lenders sometimes resort to abusive collection methods: repeated calls or messages at odd hours, threats, “contact-list harvesting” and shaming borrowers by texting friends, co-workers, or family. Philippine law and regulations prohibit these tactics. You can stop them, gather evidence, and pursue remedies—even if you legitimately owe money.

2) Know the Regulators and the Laws

Primary regulators

Securities and Exchange Commission (SEC) – regulates lending and financing companies and their collection practices.
National Privacy Commission (NPC) – enforces the Data Privacy Act of 2012 (DPA, R.A. 10173) against unlawful use and disclosure of personal data (including scraping your contacts and “debt shaming”).
Bangko Sentral ng Pilipinas (BSP) – supervises banks and certain financial service providers; its consumer-protection rules apply if the lender is bank-supervised.
Department of Justice / NBI-Cybercrime Division and PNP-Anti-Cybercrime Group (PNP-ACG) – investigate cyber-libel, threats, extortion, and other crimes.
DTI – some consumer protection aspects (advertising, unfair trade) for non-financial products/services.
Telcos/NTC – number blocking and spam reporting (e.g., forwarding spam texts to 7726).

Key legal bases you can cite

SEC rules on unfair debt collection for lending/financing companies (e.g., bans on harassment, public shaming, contacting your contacts, and calling at unreasonable hours).
Data Privacy Act (R.A. 10173) and NPC issuances: prohibits processing personal data beyond authorized purposes; penalizes disclosure to third parties (your contacts) without legal basis or consent.
Financial Products and Services Consumer Protection Act (R.A. 11765): market-conduct standards; prohibits abusive collection acts and misleading representations; empowers financial regulators to sanction entities.
Lending Company Regulation Act (R.A. 9474) and Financing Company Act (R.A. 8556): registration and conduct requirements for lenders.
Revised Penal Code & Cybercrime Prevention Act (R.A. 10175):
- Grave threats, grave coercion, unjust vexation
- Libel / cyber-libel for online defamation and “debt shaming”
- Extortion and other relevant offenses
Civil Code Articles 19, 20, 21: abuse of rights and damages for acts contrary to morals, good customs, or public policy.
Truth in Lending Act (R.A. 3765): disclosure of true cost of credit.

3) What Counts as Harassment or Unfair Collection?

While exact wording differs across issuances, the following are commonly prohibited for lending/financing companies and their collectors:

Contacting third parties (your employer, co-workers, relatives, friends, or people in your phonebook) to disclose or insinuate your debt without lawful basis.
Shaming or threatening you (e.g., “we will post you online,” “we’ll send a tarpaulin to your house,” “we’ll email your HR”).
Obscene, profane, or insulting language; slurs or humiliation.
Threats of violence, arrest, criminal record, or barangay blotter when not legally warranted.
Excessive or untimely contact (e.g., before 6:00 AM or after 10:00 PM, Sundays/holidays, or continuous calling).
False representations (pretending to be a lawyer/police/official; claiming a court case exists when it doesn’t).
Unauthorized data collection (requiring full access to contacts, gallery, or location not necessary to provide the loan).
Posting or sharing your photos, IDs, or debt status online or to group chats.

Even if you borrowed money and are in default, harassment and privacy violations are unlawful. Lawful collection ≠ abuse.

4) Immediate Steps to Protect Yourself

A) Secure evidence (Day 0–1)

Screenshots of messages, caller IDs, in-app notices, social posts. Include timestamps and visible numbers/usernames.
Call logs/voicemails and any audio recordings (if you recorded calls).
App permissions: Take screenshots of granted permissions (contacts, SMS, storage, location).
Witness statements: Ask colleagues/friends who were contacted to screenshot and send you the messages.

B) Lock down access (Day 0–2)

Revoke app permissions (Contacts, Storage/Photos, SMS, Location).
Change passwords/PINs associated with the app or your registered email.
Uninstall the app after you have exported or saved your loan records, OR keep it installed but with permissions off if you still need statements.
Block numbers/IDs; on SMS, report spam to 7726; use your phone’s spam filters.

C) Stop the harassment in writing (Day 1–3)

Send a formal cease-and-desist (C&D) by email and in-app message to the lender and (if known) its third-party collector. Keep it short and firm:

“I am asserting my rights under the Data Privacy Act and applicable SEC rules prohibiting unfair debt collection. You are ordered to CEASE AND DESIST from contacting third parties, making threats, or sending harassing messages. All communications must be in writing to this email only. Further violations will be reported to the SEC, NPC, and law-enforcement and used as evidence for damages.”

Include your full name, reference/account number, and authorized contact channel (one email). Do not admit wrongdoing or agree to any new terms in the C&D.

5) If They Contact Your Family, Friends, or Employer

Third parties have rights. Ask them to:

Save screenshots and avoid replying (or reply only once: “Stop contacting me. I’m not the borrower. Do not message again.”).
Forward copies to you and, if necessary, HR or legal.
Employers: do not relay private debt information at work and instruct security/IT to block spam senders.

6) How to Complain (Administrative, Criminal, Civil)

You can pursue multiple tracks at the same time.

A) SEC complaint (lending/financing company conduct)

Use when: harassment, unfair collection, misrepresentation, unregistered/rogue OLPs, or failure to observe SEC rules.
Prepare:
1. Your ID and contact details
2. Loan details (contract, screenshots, payment history)
3. Evidence of harassment (messages, call logs, third-party screenshots)
4. Your C&D letter and proof of sending
Remedies: administrative penalties, suspension/revocation of license/app, directives to cease abusive practices.

B) NPC complaint (data-privacy violations)

Use when: access to your contacts/photos, debt shaming, disclosures to third parties, or processing beyond consent.
Prepare:
- Data-flow narrative (how they got your data), screenshots of app permission requests, the privacy notice (if available), and evidence of disclosure to third parties.
Remedies: compliance orders, fines, criminal referral; damages may be pursued separately in civil court.

C) Criminal complaint (PNP-ACG / NBI-Cybercrime)

Use when: threats, extortion, cyber-libel, grave coercion, identity fraud, or doxxing.
Prepare: Affidavit with verbatim quotes and links; identify accounts/numbers; attach metadata if available.

D) Civil action for damages

Base: Civil Code Arts. 19/20/21, Data Privacy Act damages, and any breach of contract or tort.
Remedies: moral, exemplary, and actual damages; injunctions and temporary restraining orders.

7) Payment, Negotiation, and Your Credit Record

You still owe legitimate debt. Stopping harassment doesn’t erase principal and lawfully-chargeable fees.
Ask for a Statement of Account (SOA): principal, interest, fees, payments applied, and the basis of each charge.
Negotiate in writing only. Propose a reasonable repayment plan you can actually meet. Avoid sending IDs/selfies beyond what is legally necessary; never send nude or compromising photos (red flag for later blackmail).
Keep proof of payments (receipts, bank confirmations).
Refuse illegal penalties or “collection fees” not in the contract or not allowed by law.
Credit bureaus: Banks typically report to accredited bureaus; many OLPs do not. Demand correction if false negative data is furnished.

8) Special Situations & Defenses

You didn’t borrow / you were identity-frauded: File a dispute with the lender and a police blotter; submit IDs and proofs of non-involvement; ask the lender to freeze the account pending investigation.
Employer pressure: HR should not discipline you for a private civil debt. Harassing calls to the office can be documented and blocked.
Guarantor/co-maker: Lender may contact you as a party to the contract, but harassment and data-privacy violations are still unlawful.
Paid already: Send proof and demand closure letter and deletion of residual data not required to be retained.

9) Evidence Checklist (Print or Save)

Borrower’s full name, app username/email, phone numbers used
Lender/entity name, app name, links, SEC registration details (if available)
Loan contract/terms, screenshots of disclosures/consents
SOA or ledger; proof of payments
Harassment log: date/time, number/account, what was said/sent
Screenshots of messages to contacts/co-workers
App permission screenshots; privacy policy copy
Your C&D letter; courier/email proof
Any replies from lender/collector
Police blotter / incident reports (if filed)

10) Template: Cease-and-Desist (Borrower)

Subject: CEASE AND DESIST – Unfair Collection & Data Privacy Violations (Account No. ______)

To: [Lender/Collector Name]
I assert my rights under the Data Privacy Act and applicable SEC rules on unfair debt collection. Effective immediately:

1) Stop contacting any third party regarding my debt (family, friends, employer, contacts).
2) Stop threats, shaming, profane language, and calls outside reasonable hours.
3) Limit all communications to written email sent to: [your email].

Further violations will be reported to the SEC, NPC, and law enforcement and used as evidence for damages.
[Full Name]
[Mobile]
[Address]
[Date]

11) Template: Third-Party Response (For Friends/Co-Workers)

Subject: Unlawful Contact About Another Person’s Debt

I am not the borrower or his/her authorized representative. Do not contact or disclose any information to me again.
Any further messages will be treated as harassment and reported to authorities.

[Name]
[Position/Relationship]
[Date]

12) Frequently Asked Questions

Q1: Can a lender threaten to sue me or report me to the barangay? A: They can file a proper case or make a lawful demand, but threats, fake legal letters, or public shaming are not allowed.

Q2: They say they’ll post my photo on Facebook if I don’t pay today. A: That is a privacy and possibly criminal violation (cyber-libel/coercion). Preserve evidence and file with NPC/SEC and cybercrime units.

Q3: Is it legal for the app to require access to my contacts/gallery? A: No, not for collection/shaming. Access must be necessary, proportionate, and consent-based. Using contacts to shame you is unlawful processing.

Q4: Can collectors call me at work? A: They must respect reasonable hours and cannot harass or disclose your debt to your employer or co-workers.

Q5: If I pay, will the harassment stop? A: Often yes, but you should still report violations so regulators can sanction abusive entities.

13) Practical Scripts

Phone script (if you must pick up): “You may email me at [email]. Calls are inconvenient. Do not contact any third parties. Any further harassment will be reported. Goodbye.”
Negotiation script (email): “Attached is my proposed repayment plan of ₱____ per [week/month], starting [date]. Please confirm the updated SOA reflecting waived unlawful penalties.”

14) Employer Playbook (HR/Legal)

Create an internal memo: staff are not to disclose employee information to unknown callers; route all suspicious debt-related calls to HR/legal.
Keep a logbook of incoming harassment calls/emails; preserve CCTV/phone system logs where possible.
If harassment persists, issue a formal notice to the lender/collector and consider a company-side complaint to SEC/NPC.

15) When to Seek a Lawyer

Continued harassment after C&D
Publication of your images/IDs or mass texting to your contacts
Threats of harm, extortion, or workplace interference
Large disputed balances, illegal fees, or identity fraud

Ask counsel about injunctions (to immediately stop further disclosure) and damages (moral/exemplary) under the Civil Code and DPA.

16) Quick Reference: Do’s and Don’ts

Centralize communications to one email.
Keep meticulous records.
Report to SEC/NPC/PNP-ACG/NBI as appropriate.
Negotiate only in writing and insist on a clear SOA.

Don’t

Share additional personal data or new selfies under pressure.
Agree to “collection fees” or “penalties” not in your contract.
Ignore threats—document and report them.
Allow access to your contacts/gallery.

17) One-Page Action Plan

Document everything (screenshots, logs).
Lock down permissions; block/report numbers (7726).
Send C&D; route all contact to email.
File complaints: SEC (unfair collection), NPC (privacy), PNP-ACG/NBI (criminal).
Arrange repayment you can meet; get an SOA; keep receipts.
Escalate with counsel if harassment continues or data was published.

Staying calm, controlling the channel of communication, and leveraging the SEC rules, the Data Privacy Act, and criminal/civil remedies will let you stop harassment and put repayment on a lawful, manageable track.