A comprehensive, step-by-step guide for borrowers, counsel, and regulators-facing teams

I. Snapshot: what counts as “harassment” by online lenders

In Philippine practice, harassment by digital/online lending apps (OLAs) typically includes:

Threats, intimidation, shaming, or doxxing (e.g., texting your contacts, posting on social media, threatening arrest).
Persistent, abusive collection (profane language, repeated calls, odd hours, workplace calls despite instructions).
Unlawful data practices (contact-list harvesting, unauthorized disclosure of your debt, excessive permissions, retaining or selling your data).
Fake legal claims (e.g., “Warrant of Arrest,” “Blacklist,” “Case filed tomorrow”) and fee padding beyond the contract.

These behaviors implicate securities/financing regulations, the Data Privacy Act (DPA), consumer protection, cybercrime laws, and the Revised Penal Code (threats, libel). You can—and should—run parallel remedies.

II. Your rights (anchor points)

To fair, non-abusive collection. Unfair collection practices by lending/financing companies and their agents are prohibited.
To data privacy. Processing must be lawful, proportional, and purpose-bound; disclosure to your phone contacts or employer without a valid basis is generally unlawful.
To truthful information. Collectors may not misrepresent legal processes or amounts due.
To complain and obtain redress from regulators and courts without retaliation.
To due process on the debt (accurate statement of account; dispute mechanisms).
If harassment is gender-based, you are protected by the Safe Spaces Act for online harassment.

III. Evidence kit (build this first)

Collect and preserve before confronting the lender:

Screenshots/recordings of messages, calls (show numbers, dates, times), app dashboards, threats, and “case files” sent to you or your contacts.
Contact-list proof: app permission prompts, Play/App Store listings, privacy policy pages, and any “consent” screens.
Identity trail of the lender: trade name, corporate name (if shown), email, in-app help desk, bank/e-wallet recipients, payment references.
Your loan papers: application, T&Cs, amounts disbursed, fees/interest, payments made, and a ledger of what you actually received vs. what was charged.
Third-party complaints: texts sent to your boss, co-workers, or relatives (ask them to forward and keep originals).
Call logs & device data: date/time/number; for recordings, note that secretly recording private conversations can trigger the Anti-Wiretapping Law—prefer open, announced recording or rely on messages and screenshots.

Maintain a timeline (date-by-date) of incidents. Hash or export files where possible and keep a backup.

IV. Immediate containment (what to do today)

Revoke abusive access. In phone settings, disable the app’s Contacts, SMS, Storage, Camera, and Microphone permissions. Remove the app after you’ve captured evidence.
Channel the communication. Send a short email/message to the lender stating you will accept written communications only via email/post and that third-party contacts are off-limits.
Protect your circle. Inform your contacts that any debt-shaming messages about you may be illegal; ask them to screenshot and block the sender.
Secure your accounts. Change passwords; enable 2FA on email/e-wallets/exchanges.
If there are credible threats (violence, arrest, site visits), file a police blotter immediately and alert building security/HR.

V. Where and how to report (parallel tracks)

Use all tracks that fit your facts; they complement each other.

A. Securities & lending regulators (collection abuse / licensing)

Submit a complaint against the lending/financing company and its third-party collectors for unfair debt collection practices and any unlicensed operations.
Attach: evidence kit, identity trail (app name vs. bank payees), timeline, and your demand (stop harassment, identify account owner, refund illegal charges, sanction).

B. National Privacy Commission (privacy/data abuses)

File a DPA complaint for: unauthorized disclosure to your contacts/employer, contact-list scraping without valid basis, processing beyond stated purposes, and failure to secure your data.
Relief sought: cease-and-desist, erasure/cease processing, breach notification, and administrative fines. Include identities of recipients and copies of shaming messages.

C. Law enforcement (criminal acts)

PNP-Anti-Cybercrime Group / NBI-Cybercrime: for grave threats, extortion, unjust vexation, cyber libel/defamation, computer-related fraud, identity theft, and stalking. Provide numbers, FB/Telegram profiles, e-wallet details, and the timeline.
If collectors impersonate authorities or issue fake “warrants,” include those artifacts.

D. NTC / Telco / Messaging platforms (stop the spam)

Report sender numbers/SMS headers for blocking; submit screenshots with timestamps. Also report the app to Google Play / Apple App Store for policy violations.

E. Workplace or school protection (if harassed there)

Notify HR/Admin that any collector contact is unauthorized; provide a memo they can use to block and document calls/emails.

VI. Cease-and-desist & preservation letters (ready-to-use skeleton)

Send to the company’s email/in-app support and any collector emails; copy yourself.

Subject: Cease and Desist from Unfair Collection & Unlawful Data Disclosure

I dispute/acknowledge the account number ______. Regardless, you and your agents must cease:
- Contacting my contacts/employer;
- Making threats/misrepresentations (e.g., “warrant,” “arrest,” public shaming);
- Calling/texting outside reasonable hours or with abusive/obscene language.
Data privacy: You do not have my consent to process or disclose my contacts or any third party’s data. Erase any scraped contacts and limit processing to my account only.
Communications channel: Use email at ______ for all notices.
Preservation notice: Preserve all records relating to my account and the numbers/emails used to contact me; do not delete.
Regulatory notice: This letter will accompany complaints to regulators and law enforcement.

[Name / ID / Date]

VII. Managing the debt while fighting the abuse

Separate the issues. You can dispute abusive practices while still paying legitimate, agreed charges to avoid ballooning exposure.
Ask for a statement of account detailing: principal received (net of upfront fees), interest, penalties, and payments posted.
Challenge unconscionable charges. Philippine jurisprudence allows courts to strike down unconscionable interest/penalties even if usury ceilings were lifted. Keep paying what you admit is due under protest and document your dispute.
Use official channels only (bank account in the company’s name or verifiable payment gateway). Avoid paying to personal e-wallets or unknown accounts.

VIII. Civil, criminal, and administrative remedies (menu)

1) Administrative sanctions

Against the company/collectors: fines, suspension/revocation, take-down of apps, and orders to stop contact-list harassment and shaming.

2) Criminal liability (fact-dependent)

Grave threats / coercion / unjust vexation;
Libel / cyber libel for defamatory posts/shaming messages;
Computer-related offenses (unauthorized access, data interference);
Falsification or usurpation of authority (fake court/police papers).
DPA offenses: unauthorized processing or malicious/unauthorized disclosure of personal data.

3) Civil damages

Under Civil Code Arts. 19–21 (abuse of right, acts contrary to morals), defamation, privacy intrusion, and tort.
Seek injunction (to stop harassment), actual, moral, exemplary damages, and attorney’s fees.
For smaller money claims (e.g., refund of illegal charges), consider Small Claims procedure (no lawyers required), noting that injunctive relief is not available there.

IX. Special notes (recurring pitfalls)

“Consent” in the app is not a free pass. Consent must be freely given, specific, informed, and proportionate to the purpose (loan processing). Harvesting entire contact lists to shame borrowers generally fails these tests.
No one can lawfully “issue a warrant.” Only a judge can; collectors waving “warrants” are almost certainly misrepresenting.
Calling your employer or contacts to disclose your debt is typically unlawful data disclosure and an unfair collection practice.
Do not pay via personal accounts sent by collectors on chat; insist on official receipts and proper posting.
Secretly recording calls can raise wiretapping issues. Prefer screenshots/texts and announced recordings if you must record.

X. Checklists

A. Filing pack (attach to all complaints)

Timeline of harassment (dates/times/numbers/handles).
Screenshots/PDFs of messages, posts, and app permissions.
Proof of loan disbursement and payments; latest statement of account requested.
List of third parties contacted (names/numbers) + their screenshots.
Your cease-and-desist/preservation letter and proof of sending.
Valid ID and your contact email (for regulator replies).

B. Workplace protection pack (for HR/security)

One-page memo stating: (i) no third-party disclosures authorized, (ii) direct any calls/emails to Legal/HR, (iii) document and block numbers, (iv) provide CCTV/call logs upon your written request.

XI. Frequently asked questions

Q1: Can the lender sue me for defamation if I post about their harassment? Truthful reports made in good faith to authorities and platforms are privileged. Public posts should be factual, avoid naming private individuals, and include evidence.

Q2: They messaged my boss and clients. What can I do for them? Give them a short advisory that the disclosure is unlawful and ask them to block and preserve messages for evidence. Third parties can also file privacy complaints for misuse of their data.

Q3: The app threatens home/office visits. Demand appointments in writing at reasonable times and with identification—and report threats. Surprise visits meant to shame can support criminal and administrative cases.

Q4: They added huge “processing fees” and penalties. Dispute unconscionable charges in writing. Keep paying what you concede is due; challenge the rest in civil/Small Claims and with regulators.

Q5: Will reporting stop the shaming fast? Regulator action can be swift when evidence is strong. Speed comes from complete filings, clear timelines, and parallel complaints (regulator + law enforcement + telco).

XII. One-page action plan (pin this)

Capture evidence → 2) Revoke app permissions → 3) Send cease-and-desist + preservation →
File complaints (lending regulator, NPC, PNP/NBI, NTC) → 5) Notify HR/contacts →
Pay legitimately due amounts via official channels only → 7) Pursue civil/criminal remedies if harassment continues.

XIII. Closing note

You do not waive your debt by invoking your rights—but nobody gets a license to harass, shame, or misuse data to collect it. Build your evidence, file on all fronts, and keep communications in writing. That combination is what stops abusive OLAs, protects your circle, and preserves your claims for compensation.