This article explains your rights, the laws that protect you, and the practical steps to stop abusive collection practices by online lending apps and their agents. It’s written for borrowers in the Philippines and focuses on lending and financing companies, as well as collectors engaged by them.

1) What counts as “harassment”?

Abusive collection behavior typically includes any of the following:

Threats of harm, shaming, or jail; cursing and insults; contacting you at odd hours (e.g., very late at night/very early morning); incessant calling or messaging.
Contacting your family, friends, employer, or people in your contact list to reveal your debt or coerce payment (“contact harvesting/shaming”).
Posting or threatening to post your photos, IDs, or messages on social media; creating group chats to shame you.
Using fake legal documents, forged “subpoenas,” or pretending to be government or law-enforcement.
Misrepresenting the amount due; adding usurious, undisclosed, or unlawful charges; threatening “blacklist” or credit‐ban with no legal basis.

Note: Lawful collection includes reasonable reminders and demand letters, accurate statements of account, and formal legal notices sent to your proper address or email during business hours without abuse.

2) The key Philippine laws and rules

Financial Products and Services Consumer Protection Act (RA 11765). Prohibits abusive collection, unfair/deceptive acts, and harassment by entities regulated by the Bangko Sentral ng Pilipinas (BSP), the Securities and Exchange Commission (SEC), and the Insurance Commission. Regulators may issue compliance orders, restitution, and administrative fines.
SEC rules for Lending and Financing Companies. SEC memoranda require registered lending/financing companies and their online platforms to follow fair collection standards, including no threats, no public shaming, no contact harassment, and no misrepresentation. SEC can issue cease-and-desist orders, revoke licenses, and penalize violators.
Data Privacy Act of 2012 (RA 10173). Protects personal data. Common violations by abusive apps include unauthorized access to contact lists, over-collection, processing beyond stated purposes, and disclosure to third parties without lawful basis. The National Privacy Commission (NPC) can order cease processing, erasure, and penalties.
Revised Penal Code and special laws. Depending on facts: Grave threats, grave coercion, unjust vexation, libel/cyberlibel (RA 10175), Anti-Photo and Video Voyeurism (RA 9995) (if intimate images are used), Safe Spaces Act (RA 11313) (online gender-based harassment), and Anti-VAWC (RA 9262) (if within intimate partner context).
Usury cap context. Formal usury ceilings are lifted, but interest and charges must still be reasonable and disclosed; unconscionable interest, hidden fees, or penalties can be voided by courts under Civil Code principles (abuse of rights; public policy).
Civil Code remedies (Arts. 19, 20, 21). Harassment and privacy invasions can support damages claims for abuse of rights, torts, and moral/exemplary damages.

3) Immediate steps to stop the harassment

A. Secure evidence

Screenshot calls, texts, chat threads, group chats, caller IDs, social-media posts, and app screens (include timestamps and URLs).
Keep originals of demand letters and envelopes; save audio voicemails.
Create a timeline (dates, numbers, accounts used, statements made).

B. Lock down your devices and data

Revoke app permissions (Contacts, SMS, Storage, Camera, Microphone, Location) in your phone settings.
Change passwords for email/social apps; enable two-factor authentication.
Uninstall abusive apps after documenting evidence.
If they phoned your workplace, notify HR/IT that any third-party collector should be directed to you only and that employee data must not be shared without legal compulsion.

C. Send a formal cease-and-desist (C&D) and privacy demand

Deliver by email and in-app channel (if any). Keep proof of sending. A concise template you can adapt:

Subject: Cease and Desist from Harassing Collection & Unlawful Processing of Personal Data I am the account holder of [Full Name], Mobile No. [xxx], Reference/Loan No. [xxx]. Your agents have engaged in harassing collection (including [brief examples]) and unauthorized processing/disclosure of my personal data (including [brief examples such as contacting my contacts/employer]). Under RA 11765, SEC rules on fair collection, and the Data Privacy Act (RA 10173), you are directed to:

Cease all harassing, threatening, shaming, or deceptive practices;

Limit communications to written messages to my email between 9:00 AM–5:00 PM, weekdays;

Stop processing data from my contact list and delete any copies obtained;

Provide a full and accurate statement of account (principal, interest, penalties, fees) and your complaints contact within 3 business days. Continued violations will be reported to the SEC, NPC, BSP (if applicable), and law enforcement, and I will pursue civil and criminal remedies. Sincerely, [Name, address, email, mobile] [Date]

D. Control the communication channel

Reply once, in writing, with your terms (business hours, email only).
Block abusive numbers/handles after you’ve sent the C&D, but keep at least one documented, controlled channel (email) to avoid claims you’re evading legitimate notices.

E. If threats escalate

For threats of harm, extortion, identity theft, or explicit images: report to local police (with evidence). You may also explore cybercrime units for online threats and barangay protection if needed.

4) Regulatory complaint paths (which one to use)

Use one or several, depending on the entity involved:

Securities and Exchange Commission (SEC) – for lending and financing companies and their online lending platforms (OLPs).
- Grounds: unregistered lending, unfair/deceptive collection, non-compliance with SEC rules, false advertising, abusive agents.
- Relief: cease-and-desist orders, fines, license revocation, referral for prosecution.
National Privacy Commission (NPC) – for Data Privacy Act violations.
- Grounds: unauthorized contact scraping, disclosure to your contacts, over-collection, failure to honor data subject rights (erasure, objection, access).
- Relief: orders to cease processing, delete data, and penalties; the finding can support your civil/criminal case.
Bangko Sentral ng Pilipinas (BSP) – if the lender/collector is a BSP-supervised financial institution (e.g., a bank, EMI, or their outsourced collector).
- Grounds: unfair collection practices, misrepresentation, improper disclosures under the FCPA and BSP consumer-protection standards.
- Relief: supervisory action, directives, and penalties.
Law enforcement / prosecutors – for criminal offenses (threats, coercion, libel/cyberlibel, extortion, identity theft).

Practical tip: In your complaints, attach your C&D letter, evidence bundle, and a concise timeline. Keep a clean archive in cloud storage with file names that include dates.

5) Special scenarios (and how to respond)

They contacted your employer or co-workers. Send a notice to HR that disclosure of your personal information to third parties requires legal basis; request that all future contacts from the collector be referred to you and recorded. Consider a privacy complaint to NPC for unauthorized disclosure, and an SEC complaint for unfair collection.
They accessed your phone contacts. Under the DPA, consent must be informed, specific, and freely given; blanket access is not a license to harass or disclose. Demand erasure of harvested contacts and file with NPC if they refuse.
They claim you’ll be jailed for non-payment. Debtors’ prison does not exist for civil debts. Criminal liability may arise only from separate crimes (e.g., estafa for fraud), not from mere inability to pay.
They threaten to “blacklist” or ruin your credit if you don’t pay today. Credit reporting must follow accurate, lawful, and proportionate reporting rules. Empty threats and shaming remain prohibited.
The amount ballooned with hidden fees. Demand a detailed statement. Unconscionable or undisclosed charges can be challenged; you may pay what is uncontested while disputing the rest (document your position).
They sent a “subpoena” or “warrant” via chat. Those documents do not come from collectors. Treat such behavior as misrepresentation and include it in your complaints.

6) Negotiating and restructuring—without giving up your rights

Ask for a written settlement offer: remaining principal, lawful interest, reasonable penalties, and a payment schedule you can meet.
Request fee/penalty waivers tied to timely installments.
Pay via traceable channels (bank transfer, official app) and keep receipts.
Include a clause that upon completion, the lender will issue a clearance, update credit reports, and cease collection.
Do not admit to inflated charges or agree to blanket waivers of your legal rights.

7) Litigation options if harassment persists

Small Claims (no lawyers required up to the jurisdictional amount): recover sums and possibly damages for certain claims.
Civil action for damages (abuse of rights, privacy invasion, defamation).
Petition for Writ of Habeas Data: to compel a data controller to reveal, correct, or delete unlawfully processed personal data and stop processing.
Seek injunctions against continued harassment where appropriate.

8) Protecting yourself next time

Use only registered lenders with clear disclosures and legitimate customer-service channels.
Before installing any finance app, deny contact-list access; it is rarely necessary for loan servicing.
Read fee schedules and compute total cost (interest + fees + penalties).
Borrow only what you can repay; build a buffer for emergencies.
Keep a private email for financial accounts that isn’t tied to social media.

9) Quick reference: What to keep in your “evidence pack”

Your loan agreement and screenshots of key app pages (pricing, privacy policy, consent screens).
C&D letter and proof of service.
Screenshots/exports of calls, texts, chats, group chats, and posts.
Statement of account and your computations.
Copies of complaints filed with SEC/NPC/BSP and any responses.

10) Frequently asked questions

Q: Can a collector call my references or employer? Not to harass, shame, or disclose your debt. Limited verification may be allowed without disclosure, but using your contacts to coerce payment is prohibited and likely a privacy violation.

Q: I consented to contact access when I installed the app. Am I stuck? No. Consent can be withdrawn, and it never authorizes harassment or disclosure. Overbroad or coerced consent may be invalid. You can exercise your data subject rights under the DPA.

Q: Can I ignore all messages? Don’t ignore legitimate notices. Set one written channel, state your availability, and block abusive numbers after sending your C&D. Keep evidence.

Q: Will filing complaints stop the harassment? Often it does. Regulators can issue cease orders and penalties. Pair complaints with your C&D and device lockdown for best effect.

11) One-page action plan

Document everything (screenshots + timeline).
Revoke permissions / uninstall abusive app (after evidence).
Send C&D (limit contact hours and channel; demand privacy compliance).
File complaints with SEC (unfair collection/OLP issues) and NPC (privacy), and BSP if the entity is BSP-supervised.
Report crimes (threats, coercion, libel) to police/prosecutor if applicable.
Negotiate a realistic, written settlement—or prepare small claims/civil action.
Keep a clean archive and insist on clearance once settled.

Final note

This article provides a practical pathway to stop harassment without surrendering your rights. If your situation is urgent (e.g., threats of harm, doxxing, intimate-image extortion), prioritize law enforcement alongside regulatory complaints. For tailored legal advice, consult a Philippine lawyer and bring your evidence pack.