A full-spectrum legal playbook for borrowers, advocates, HR, and counsel

I. What counts as “harassment” by online lending apps

In practice, abusive online lenders and their third-party collectors use tactics that violate multiple Philippine laws:

Debt shaming: texting/calling your contacts or employer; posting on social media about your debt.
Threats and intimidation: “warrant of arrest,” “subpoena tomorrow,” “NBI search,” “padlocking your house,” “work blacklist.”
Coercive collection: repeated calls at odd hours, profane language, doxxing, fabricated “case files.”
Privacy abuses: scraping your contact list, accessing photos/files, disclosing health or financial info without legal basis.
Fraud and padding: fabricated fees, “processing charges,” or penalties never agreed or unconscionable.

These behaviors can breach the Data Privacy Act (DPA), consumer finance rules for lending/financing companies, the Cybercrime statute, the Revised Penal Code (threats, coercion, libel), and telco/messaging policies.

II. Your rights in a nutshell

Fair collection only — no shaming, no threats, no misrepresentation of legal processes.
Data privacy — your contacts/employer cannot be used as collection leverage absent a lawful, proportionate basis.
Truthful accounting — only contractually agreed, lawful charges may be collected; unconscionable interest/penalties may be struck down by courts.
Access and correction — you can demand a statement of account and dispute entries.
Redress — you may complain to regulators, law enforcement, and courts without retaliation.

III. Build your evidence pack first (before confronting them)

Capture and preserve:

Screenshots of messages (showing numbers/handles and timestamps), in-app notices, “case files,” and call logs.
Any posts or messages sent to your contacts: ask them to forward copies and keep originals.
App permission screens, privacy policy pages, and Play/App Store listings showing what the app claims to access.
Loan file: application, T&Cs, disbursement proof (net of fees), payment receipts/transaction refs, and your running ledger.
Identity trail: corporate/trade name, website, email, bank/e-wallet recipients, reference numbers.
Timeline: a dated list of each abusive contact (who, when, what was said).

Security note: Avoid illegal secret recording of voice calls. Prefer written/visual evidence or announced recordings.

IV. Contain the harm today (same day actions)

Revoke permissions on your phone (Contacts, SMS, Storage, Camera, Microphone, Location). Screenshot first; then uninstall after evidence capture.
Designate a single channel: Email the company that you will only receive communications via one email address and that third-party contacts are off-limits.
Warn your contacts to block/report any messages about you and to preserve screenshots for your case.
Change passwords & enable 2FA for email, e-wallets, bank, and social accounts.
If there are credible threats (violence, “arrest,” office visits), file an immediate police blotter and alert security/HR.

V. Where to report (run these tracks in parallel)

A. Securities/Lending regulator (licensing & abusive collection)

File a complaint against the lending/financing company and its third-party collectors for unfair collection practices and possible unlicensed operations. Attach your evidence pack, the identity trail, and a clear demand (cease harassment, correct account, refund unlawful charges, sanction).

B. National Privacy Commission (privacy/data abuses)

Complain for unauthorized processing and unlawful disclosure: contact-list harvesting, messages to your employer, bulk SMS to your friends, excessive data collection. Ask for cease-and-desist, erasure, and administrative fines.

C. Law enforcement (criminal conduct)

Report to PNP Anti-Cybercrime or NBI Cybercrime for: grave threats, coercion, cyber libel/defamation, identity theft, computer-related fraud, or usurpation of authority (fake “warrants”). Provide numbers/handles, e-wallet details, and your timeline.

D. Financial regulators & dispute desks

Banks/e-wallets: file disputes/abuse reports against collection accounts used to harass or collect illegitimately. Request account flagging/freeze where appropriate.
Card issuers: if applicable, initiate chargeback for fraudulent/unauthorized charges.

E. Telco/NTC & platforms

Report sender numbers/SMS headers to telcos for blocking; flag accounts/URLs to platforms (Facebook, TikTok, Telegram, WhatsApp) for policy violations and takedowns.

F. Workplace & school

Give HR/Admin a one-page memo: all collector calls/emails are unauthorized; ask them to document and block and to provide logs upon your request.

VI. Model letters you can use (short forms)

1) Cease-and-Desist / Privacy Demand (send to lender & collectors)

Subject: Unfair Collection & Unlawful Data Disclosure — Cease and Desist I dispute/acknowledge Account No. ______. Regardless, you and your agents must cease (a) contacting my contacts/employer, (b) making threats/misrepresentations (e.g., “warrant,” “arrest,” public shaming), and (c) calling or texting at unreasonable hours. Under the Data Privacy Act, you have no lawful basis to process or disclose my contacts’ data. Erase any scraped contacts and limit processing to my account. Use email at ______ for all notices. Preserve all records of communications. This demand accompanies complaints to regulators and law enforcement. — [Name / ID / Date]

2) Statement-of-Account & Corrections Request

Please furnish a complete statement of account showing principal disbursed (net of fees), interest, penalties, and all payments posted. Identify legal/contractual bases for each charge. Unconscionable or unagreed fees are disputed.

VII. Managing the debt while fighting the abuse

Separate the harassment from the debt. Keep paying legitimate amounts via official channels (company bank account, verified payment gateways) to prevent ballooning exposure.
Challenge unconscionable interest/penalties in writing; courts may reduce or strike them.
Never pay to personal e-wallets or accounts sent via chat unless confirmed in writing by the company on official letterhead or domain.

VIII. Legal hooks you may invoke (at a glance)

Data Privacy Act: unauthorized processing; unlawful disclosure to contacts/employers; excessive collection; security failures.
Consumer finance rules: unfair or abusive collection practices; unlicensed lending/financing operations; misleading ads.
Revised Penal Code: grave threats, coercion, libel; falsification/usurpation if fake “legal” papers are used.
Cybercrime: computer-related identity theft/fraud; unlawful access or data interference.
Safe Spaces Act: gender-based online harassment.
Civil Code: abuse of rights and tort damages (actual, moral, exemplary) for shaming and privacy invasion.

IX. Evidentiary best practices (so your case sticks)

Keep originals; export chats as PDF with metadata if possible; save media to read-only storage.
Hash key files (optional but powerful for authenticity).
Maintain a communications log (date/time/sender/summary).
For each abusive message to your contacts, secure: (1) screenshot, (2) their affidavit or brief note confirming receipt, and (3) the number/handle used.
Preserve app versions and permission screens (screen-record the flows).

X. Civil and criminal remedies (what outcomes look like)

Administrative orders: cease-and-desist, app takedown, fines, and licensing sanctions.
Criminal complaints: penalties for threats, libel, cyber offenses, or DPA crimes.
Civil actions: injunction to stop harassment; damages for defamation, privacy invasion, emotional distress; recovery of illegal charges; attorney’s fees.
Small Claims: quick route for money refunds (no injunctive relief).

XI. Special situations & defenses (and how to counter)

“You consented when you installed the app.” Consent must be freely given, specific, informed, and proportionate. Blanket access to all contacts to shame borrowers is not a valid basis.
“We’re just reminding.” Repeated calls to third parties, late-night bombardment, or false legal threats go beyond reminders—unfair collection.
“Public post only shared facts.” Shaming posts are defamatory and violate privacy; truth is not a defense to unlawful processing of personal data.
“Fees are per policy.” Unconscionable penalties and surprise fees can be void; demand the legal clause and computation.

XII. Checklists you can follow

A. 24-Hour Action List

☐ Screenshot messages/calls; export loan docs.
☐ Revoke app permissions; change passwords; enable 2FA.
☐ Send Cease-and-Desist/Privacy Demand.
☐ File complaints: lending regulator, NPC, PNP/NBI, telco/platform.
☐ Notify HR/Admin (if workplace was contacted).
☐ Keep paying legitimate amounts through official channels only.

B. Complaint Attachments

Timeline table; screenshots (with timestamps); loan proof; list of third-party recipients + their screenshots; copy of your demand letters + proof of sending; valid ID and contact email.

XIII. FAQs

Can they have me arrested for unpaid debt? No. Non-payment of a loan is not a criminal offense by itself. Threats of arrest for civil debt are baseless and may be criminal themselves.

They messaged my boss and clients—what do I tell them? Provide a short memo that such disclosure is unlawful; ask them to block, preserve evidence, and avoid replying. They may file their own privacy complaints for misuse of their data.

Is a waiver or NDA they sent me safe to sign? Not without legal review. Many “settlements” are waivers of rights for a small discount and can impair criminal/regulatory cases.

Will reporting stop the harassment quickly? Complete filings with clear evidence often trigger prompt regulator or platform action. Parallel complaints (regulator + NPC + law enforcement + telco) increase speed.

What if I really owe money? You can acknowledge or dispute the debt and stop harassment. Keep paying what is legitimately due, dispute the rest, and insist on lawful collection.

XIV. One-page template: Regulator complaint (key points)

Parties & app identity (trade name, links, bank/e-wallet accounts used).
Narrative timeline (dates, channels, recipients).
Legal bases violated (unfair collection, DPA breaches, threats/misrepresentation).
Relief sought: cease-and-desist, identification of third-party collectors, restitution of illegal fees, sanctions, and coordination with platforms/telcos.
Attachments list (A–F).

XV. Employer/School protection memo (for HR/Admin to post)

All collector calls/emails regarding [Employee/Student Name] are unauthorized disclosures.
Direct such contacts to Legal/HR; do not confirm employment, schedule, or contact info.
Document date/time/number and block the sender.
Provide logs/screenshots upon the data subject’s written request.

XVI. Key takeaways

Document first, then demand.
Use parallel tracks: lending regulator, NPC, PNP/NBI, telco/platform—each closes a different valve.
Keep debt and abuse separate: pay only through official channels, dispute illegal fees, and never to personal wallets.
Privacy is your shield: contact-list shaming is typically unlawful.
A firm paper trail—evidence, letters, complaints—is the fastest way to stop harassment and recover what’s unlawful.