Last updated: October 24, 2025 (Philippine time)

Online lending apps (OLAs) have made borrowing faster—but some use abusive collection tactics: spam calls and texts, debt-shaming your contacts, threats of arrest, and extortion. This guide explains your legal rights, where to complain, what evidence to gather, and step-by-step actions to stop harassment and hold violators accountable in the Philippines.

1) Your Legal Protections

A. Financial Consumer Protection Act (FCPA) – Republic Act No. 11765

Prohibits abusive debt collection, misleading or oppressive practices.
Requires financial service providers (FSPs)—including SEC-supervised lending/financing companies and BSP-supervised institutions—to have effective complaint-handling and to treat consumers fairly, respectfully, and with confidentiality.
Regulators (SEC, BSP, IC) can investigate, impose penalties, and order restitution.

B. Data Privacy Act (DPA) – Republic Act No. 10173

Your rights include to be informed, to object, to access, and to erasure/blocking of your personal data.
Debt-shaming (e.g., messaging your phone contacts; posting your photo/details on social media) is typically unauthorized processing or improper disclosure of personal data.
Companies must implement reasonable security measures, limit data collection to what is necessary, and obtain valid consent.

C. Securities and Exchange Commission (SEC) Rules

Lending Company Regulation Act (RA 9474) and related SEC rules cover lending/financing companies and their collection practices.
The SEC can suspend/revoke licenses, order app takedowns, and sanction abusive collectors, especially unregistered or “fly-by-night” apps.

D. Bangko Sentral ng Pilipinas (BSP) Rules (if a bank/e-money issuer is involved)

BSP-supervised entities must follow fair debt collection and complaint resolution standards and are covered by the FCPA.

E. Criminal & Civil Liability (selected)

Grave threats/coercion, unjust vexation, extortion under the Revised Penal Code.
Cybercrime Prevention Act (RA 10175) if threats, extortion, or libel are done online.
Anti-Photo and Video Voyeurism (RA 9995) if apps threaten to share intimate images.
Violence Against Women and Their Children (RA 9262) if an intimate partner is involved in the harassment.
Civil damages may be claimed for privacy violations, reputational harm, and emotional distress.

2) What Counts as Harassment or Abusive Collection

Calling/texting you excessively, at odd hours, or using obscene/insulting language.
Threats of arrest, criminal cases, workplace raids, immigration holds, or public shaming.
Contacting your family, employer, or phonebook, or creating group chats to shame you.
Manipulating permissions (e.g., scraping your contacts or gallery) beyond what is necessary for the loan.
Fake legal notices or pretending to be lawyers/police/court sheriffs.
Posting or threatening to post your photos, IDs, or chats on social media.

Note: You still owe legitimate debts—but collectors cannot harass, threaten, or violate privacy to compel payment.

3) Immediate Safety & Evidence Checklist

Preserve evidence
- Screenshots of messages, call logs, voice messages.
- URLs of posts, group chats, and any “debt board” shaming.
- App profile (name, developer), loan contract, payment records.
Record details
- Dates/times, numbers used, agent names, what was said/threatened.
- Names and numbers of third parties they contacted.
Secure your devices
- Revoke permissions: Contacts, SMS, Storage, Camera, Microphone, Location.
- Change passwords; enable 2FA.
- If the app is malicious, uninstall after collecting proof.
Protect contacts
- Warn family/friends that any harassment should be screenshot and saved.
- Ask them not to engage with collectors.
Keep payments transparent
- If you are repaying, use traceable channels and keep receipts.
- Avoid sending money to personal accounts of collectors.

4) Where to File Complaints (and When)

You can pursue parallel routes—start with the most relevant regulator and add others as needed.

A. National Privacy Commission (NPC) – for debt-shaming and data privacy violations

File when: the app contacted your phonebook, posted or threatened to post your data, or processed your data beyond consent.

What to submit

Sworn complaint/affidavit describing facts and privacy rights violated.
Evidence (screenshots, call logs, URLs), copy of ID, and proof you invoked your DPA rights (see Section 5).

Outcome: NPC may order cease-and-desist, app/feature takedown, erasure, and administrative fines; the case record also supports civil/criminal actions.

B. Securities and Exchange Commission (SEC) – for unregistered lenders and abusive collection

File when: the company is a lending/financing entity or OLA using abusive tactics; or you suspect it’s unregistered.

What to submit

App/company name, links to app listing, proof of account/loan, screenshots of harassment, and any proof of registration claims.
If your employer/contacts were harassed, include their statements and screenshots.

Outcome: SEC can order app takedown, fines, and license actions.

C. Bangko Sentral ng Pilipinas (BSP) – if the collector is a bank/e-money or a BSP-supervised partner

File when: harassment traces back to a bank, EMI, or their outsourced collector.

What to submit

Account/loan details, complaint trail with the bank/EMI, evidence of harassment.

Outcome: BSP can order corrective action and impose penalties under the FCPA.

D. Law Enforcement

PNP Anti-Cybercrime Group (ACG) or NBI Cybercrime Division: for threats, extortion, cyber-libel, doxxing.
Bring printed and electronic evidence; get a blotter and request case evaluation.

E. App Stores & Platforms

Report the app (Google Play/App Store) for privacy/harassment violations.
Report social media posts/groups used for debt-shaming to have them removed quickly.

5) Exercise Your Data Privacy Rights (Template Language)

Send the company a Data Subject Request (DSR) via email/in-app support before or alongside formal complaints.

Subject: Data Privacy Request – Erasure, Cessation of Processing, and Non-Disclosure Body (sample):

I am exercising my rights under the Data Privacy Act of 2012. Effective immediately, I withdraw consent to process my personal data for debt collection beyond lawful and proportionate means. I demand:

Erasure/Blocking of my contact list, photos, and other data not necessary for contract performance;

Cessation of communications that are threatening, obscene, or directed at my contacts/employer;

A full log of disclosures you made to third parties; and

Written confirmation within 15 days of actions taken.

Take notice that harassment, contact scraping, or disclosure of my data may be reported to the NPC, SEC, BSP, and law enforcement for appropriate action.

Attach a valid ID. Keep proof of transmission and any reply (or non-reply).

6) Step-by-Step Reporting Playbook

Triage & Evidence (Day 0–1)
- Collect screenshots/recordings; export call logs.
- Revoke permissions; warn contacts; uninstall app after evidence capture.
Send DSR / Demand to Stop (Day 1)
- Email the app/company; request erasure and stop processing (template above).
- Note the deadline you gave (e.g., 15 calendar days).
File with the Appropriate Regulator (Day 1–3)
- NPC for privacy breaches/debt-shaming.
- SEC for abusive collectors/unregistered lending apps.
- BSP if a bank/e-money issuer is involved.
Escalate to Enforcement (Anytime there are threats)
- PNP ACG/NBI Cybercrime: bring all evidence and your ID; request blotter.
Civil/Criminal Options (If Needed)
- Consult counsel regarding damages, injunctions, and criminal complaints (threats, coercion, cyber-libel).
Platform Takedowns (Parallel)
- Report offending posts, group chats, and app listings for policy violations.

7) Special Situations & Practical Tips

They messaged your employer or clients. Ask HR/clients to: (a) not respond, (b) provide screenshots, and (c) confirm whether the collector identified you and claimed debts—this supports your NPC/SEC case.
They threaten arrest or “police tomorrow.” Debt is civil; arrest requires a criminal offense and valid warrant (except very limited instances). Document the threat and report it.
They created group chats with your photo/ID. Treat as privacy breach and cyber-libel; capture chat info, member list, and URLs.
They demand payment to personal accounts. Red flag. Pay only to official company channels. Keep ORs/receipts.
You already repaid but they keep harassing. Send proof of payment; include it in your complaints. Demand data erasure and cease-and-desist.
Multiple apps, same collectors. Note names/numbers; patterns help regulators link cases.
SIM/number hygiene. Consider call blocking and SIM registration record updates; do not share new numbers with the collector.

8) Evidence Pack: What Regulators Typically Expect

Affidavit narrating the timeline and specific acts of harassment.
Identity document and contact details.
Loan documents (application, terms, receipts).
Screenshots/recordings of calls, texts, chats; link to posts or group chats.
Device permissions log (Android/iOS screenshots of app permissions).
DSR correspondence (your demand email and any reply).
List of contacts harassed with their short statements and screenshots.

9) If You Still Intend to Repay

Ask for a statement of account, including principal, interest, fees, and computation basis.
Request a reasonable payment plan in writing.
Never concede to harassment; remind them that collection must be lawful regardless of debt status.

10) Frequently Asked Questions

Q: I gave contact permissions during sign-up. Can they message my contacts? A: No. Consent must be informed, specific, and necessary. Blanket access to your entire phonebook for collection is disproportionate and typically violates the DPA and fair collection standards.

Q: Can they expose my photo/ID on Facebook or group chats? A: No. That is unauthorized disclosure and may amount to cyber-libel and other offenses.

Q: I’m late on payment. Does harassment become legal then? A: Never. Debt does not justify threats, shaming, or privacy violations.

Q: Do I need a lawyer to complain? A: Not required for regulatory complaints, but legal advice helps if pursuing damages or criminal cases.

Q: What if the app is unregistered? A: Include that in your SEC complaint. Unregistered lending is itself a serious violation and strengthens enforcement action.

11) Simple Templates

A. Cease-and-Desist (Harassment)

I demand that you and your agents immediately cease all harassing communications, including threats, obscene language, and any contact with my relatives, employer, or phonebook. Continued harassment will be reported to the NPC, SEC/BSP, and law enforcement under RA 11765, RA 10173, and applicable penal laws.

B. Notice to Employer/Contacts

A collector from [App/Company] may contact you regarding my private debt. Please do not engage. If contacted, kindly take screenshots and send them to me for regulatory reporting. Disclosing my debt to you is unlawful, and regulators are investigating such practices.

12) Quick Do’s & Don’ts

Document everything.
Use official channels; keep receipts.
Assert your privacy rights in writing.

Don’t

Pay to personal accounts.
Share new numbers with collectors.
Reply with insults or threats (it can be used against you).

13) Summary (TL;DR)

You are protected by the FCPA (RA 11765), the Data Privacy Act (RA 10173), and various criminal laws against harassment and debt-shaming.
Collect evidence → Send DSR → File with NPC/SEC (and BSP if applicable) → Report criminal threats to PNP/NBI → Seek civil/criminal remedies as needed.
Abusive collection is illegal even if you owe money.

This article is general information for the Philippine context and not a substitute for tailored legal advice. If you need help preparing filings or affidavits, tell me your situation and I can draft the documents based on your facts and evidence.