How to Stop Harassing Calls from Lending Apps: Legal Remedies in the Philippines

This guide is for informational purposes only and is not a substitute for legal advice. If you face imminent threats or intimidation, contact the PNP, NBI, or a lawyer immediately.

I. The Problem: “Debt-Shaming” and Aggressive Collection

Harassing collection practices by some lending apps (OLPs/“online lending platforms”) commonly include:

Bombarding borrowers and their contacts with calls or messages
Publishing or threatening to publish a borrower’s photos, chats, or debt status (“debt-shaming”)
Using insults, slurs, intimidation, or threats of arrest, “case filing,” or workplace exposure
Contact scraping (accessing your phonebook), social-media stalking, and messaging co-workers or relatives
Calling outside reasonable hours, or using auto-dialers to spam-call you

Many of these acts are unlawful, even if you genuinely owe money. Philippine law protects borrowers from harassment and abusive collection practices.

II. Your Legal Shields (Philippine Law Overview)

1) Data Privacy Act of 2012 (DPA)

Key ideas: Personal data (name, number, photo, contacts) may only be collected and processed with valid, informed, and freely given consent and for a declared, legitimate purpose.
Common violations by abusive collectors:
- Accessing your contacts or messaging them about your debt absent their consent and a lawful basis
- Using your photos or ID scans to shame or threaten you
- Retaining data beyond necessity; sharing your data with third parties or the public
Remedies: You can withdraw consent, demand erasure or restriction of processing, and file a complaint with the National Privacy Commission (NPC). Unauthorized processing and malicious disclosure can lead to civil, administrative, and criminal liabilities.

2) Financial Consumer Protection (FCP) Framework

Lending and financing companies, banks, and their collection agents must treat clients fairly, use reasonable collection methods, and have internal complaint handling.
Abusive collection (threats, humiliation, deception) can trigger administrative sanctions, fines, or suspension by the appropriate regulator (e.g., SEC for lending/financing companies and OLPs; BSP for banks and their outsourced collectors; IC for insurers).

3) Revised Penal Code (RPC) & Related Criminal Laws

Grave threats, grave coercion, unjust vexation, alarm and scandal, and libel/slander may apply to harassing calls and posts.
Extortion or threats to publish intimate or personal data to force payment can also be criminal.
Cybercrime provisions can aggravate penalties for acts done through ICT (e.g., online posts, mass texts, or messaging apps).

4) Civil Code (Abuse of Rights & Damages)

Articles 19, 20, and 21 penalize acts contrary to justice, good faith, and morals and allow victims to claim moral and exemplary damages for abusive collection and debt-shaming, even aside from criminal and regulatory actions.

III. What Collectors May Not Do

Even with a valid debt, collectors generally cannot:

Threaten arrest, criminal charges, or “blotter” for a purely civil debt
Contact your employer, co-workers, or contacts to shame or pressure you (absent a lawful, proportionate basis)
Post or threaten to post your photos, IDs, messages, or personal data publicly
Call at unreasonable hours (e.g., late night/early morning) or repeatedly to annoy or intimidate
Use insults, profanity, or degrading language
Misrepresent themselves as law enforcement, court personnel, or public officials
Disclose your debt to people who are not parties to the transaction

IV. Immediate Practical Steps (Do These Now)

1) Preserve Evidence

Screenshots/recordings: calls, voicemails, texts, chat threads, caller IDs, and social posts
Headers/metadata (if available), loan agreement, app permissions you granted, and payment records
Witness statements if your contacts or HR received calls or messages

2) Lock Down Your Data

In your phone settings, revoke the app’s permissions (contacts, photos, storage, microphone, location).
Change passwords for email and social media; enable 2FA.
Consider a separate number for future financial apps.

3) Send a “Cease-and-Desist + DPA Notice”

Formally withdraw consent to contact you beyond reasonable channels, restrict processing, and demand erasure of unlawfully obtained data (e.g., your contacts list).
Send by email and in-app chat, and (if possible) to the company’s registered address. Keep proof of sending.

Model paragraph you can adapt:

I am invoking my rights under the Data Privacy Act. I withdraw any consent to access or process my contacts and to disclose my personal data to third parties. Your personnel and agents must cease contacting my relatives, co-workers, and employer. Any further harassment, threats, or publication of my personal data will be documented and reported to the NPC, your regulator, and law enforcement. I demand confirmation within five (5) days that you have restricted processing to what is strictly necessary for lawful collection and erased unlawfully obtained data.

4) Control the Calls

Block numbers; use “silence unknown callers” features; set spam filters.
If you must pick up, use this two-sentence script:
1. “Please note this call is being documented. You are instructed to communicate only via email to [your email], during reasonable hours.”
2. “Any contact with my employer/contacts or threats to publish my data will be reported to the NPC and authorities.”
Then end the call. Do not argue.

5) Plan Your Repayment Safely (If You Owe)

Make a realistic repayment plan (even partial) via traceable channels; avoid meeting collectors in person or sending to personal accounts.
Never hand over your phone for “inspection” or “data checking.”

V. Formal Remedies & Where to File

A) National Privacy Commission (NPC) – Data Privacy Violations

When: They accessed or messaged your contacts, threatened “debt-shaming,” posted your data, or refused to honor your DPA demands. How: File a complaint with evidence (screenshots, app permissions, your cease-and-desist letter, and any reply). What to ask for:

Order to cease processing and delete unlawfully collected data
Administrative fines/sanctions against the company
Coordination with other regulators (SEC/BSP) for systemic violations

B) Securities and Exchange Commission (SEC) – Lending/Financing Companies & OLPs

When: The entity is a lending/financing company or OLP using abusive collection or operating without proper registration. How: Lodge a complaint with evidence. Include the company/app name, links, phone numbers used, and your proof that they harass you or your contacts. Possible outcomes: Warnings, fines, suspension of licenses, takedown of offending apps/platforms, and referral for prosecution.

C) Bangko Sentral ng Pilipinas (BSP) – Banks & Their Collectors

When: The creditor is a bank (or a bank’s outsourced collector). How: File under the bank’s Consumer Assistance channel first; escalate to BSP if unresolved. Relief: Corrective actions, sanctions for unfair collection practices.

D) Law Enforcement (PNP-ACG / NBI) – Criminal Conduct

When: There are threats, extortion, identity theft, defamation, doxxing, or persistent unjust vexation. How: File a criminal complaint; bring your evidence (including recordings if obtained in good faith for reporting a crime).

E) Civil Action for Damages

When: You suffered mental anguish, reputational harm, or other losses due to harassment or public shaming. Basis: Civil Code Articles 19, 20, 21 (abuse of rights/acts contrary to morals) and privacy torts. Relief: Moral/exemplary damages, attorney’s fees, injunction against further harassment.

VI. Special Situations

1) They Messaged Your Boss/HR

Ask HR to document and forward all messages and to refrain from replying beyond acknowledging receipt.
Provide HR a short memo:
- You are addressing the debt privately;
- The third party has no lawful basis to process or disclose your personal data to the company;
- Any further contact should be preserved and not entertained.
Attach your DPA notice and say you are filing with the NPC/SEC.

2) Your Contacts Received “Shaming Posters” or Mass Texts

Ask them to screenshot and forward without engaging the sender.
Include these in your NPC complaint as unauthorized disclosure and malicious processing.

3) You Already Paid but Calls Continue

Send proof of payment; demand closure and data erasure beyond retention limits.
If they keep calling, escalate to regulators and law enforcement.

4) You Never Borrowed (Identity Fraud)

File an ID theft report with PNP/NBI; notify the app and all regulators; place fraud alerts on your accounts; demand data erasure and a non-liability certificate.

VII. Building a Strong Paper Trail (Checklists)

Evidence Pack:

Loan agreement, screenshots of app permissions/consents
Call logs, recordings (date/time), voicemails
All messages to you, your contacts, and employer
Cease-and-desist/DPA letter + proof of delivery
Copies of complaints filed (NPC/SEC/BSP) and ticket numbers

Complaint Essentials:

Your full name, contacts (email/phone), and valid ID (as required)
Exact timeline of harassment (dates/times; keep a log)
The legal angles you allege (DPA violations; unfair collection; threats/defamation)
Relief requested (cease-and-desist, data erasure, sanctions, damages)
Attachments labeled and indexed

VIII. Frequently Asked Questions

1) Can they have me arrested for not paying? For ordinary consumer loans, no. Non-payment is typically a civil matter. Arrest requires a criminal offense (e.g., fraud). Threats of arrest to force payment can themselves be unlawful.

2) They say my consent allows them to message my contacts. Consent must be informed, specific, freely given, and proportionate to a legitimate purpose. Blanket access to your phonebook for debt-shaming is not a legitimate, necessary, or proportionate collection method under the DPA.

3) Is “debt-shaming” online illegal? Publicly posting your personal data to coerce payment can violate the DPA, and may be libel, grave coercion, or unjust vexation, among others. It can also lead to administrative sanctions by regulators.

4) If I block numbers, can they still sue me? Yes, creditors can still pursue lawful remedies (e.g., demand letters, civil suits). Blocking harassing calls does not erase the debt; it only stops abusive methods. Keep your email open for written, reasonable communications.

5) Can I recover damages? Yes. Under the Civil Code and DPA, you may claim moral and exemplary damages for abusive collection and privacy violations, subject to proof.

IX. Templates You Can Use (Customize)

A) Cease-and-Desist + DPA Notice (Short Form)

Subject: Cease-and-Desist; Data Privacy Act Notice

I withdraw any consent for your access to my contacts and for disclosure of my personal data to third parties. You must cease all calls/messages to my relatives, co-workers, and employer. Restrict all communications to email at [your email], within reasonable hours.

Pursuant to the Data Privacy Act, I demand: (1) restriction of processing to what is necessary for lawful collection; (2) erasure of any contacts or personal data acquired without a valid legal basis; and (3) confirmation within five (5) days.

Further harassment, threats, or publication of my data will be reported to the NPC, your regulator, and law enforcement.

B) Memo to HR (If Your Employer Was Contacted)

Our company received messages from [Lending App/Collector] about my personal debt. This third party has no lawful basis to process or disclose my data to the company. Please preserve all messages and refrain from further engagement. I am addressing the matter through the proper legal channels and have filed/shall file complaints with the NPC and the appropriate regulator.

X. Strategic Roadmap (Step-by-Step)

Day 1–2: Evidence capture; revoke app permissions; send cease-and-desist/DPA notice; block harassing numbers; set email-only channel.
Day 3–7: File NPC complaint (privacy violations) and contact the appropriate regulator (SEC for lending/financing/OLPs; BSP for banks).
Week 2: If threats/defamation persist, file with PNP-ACG or NBI; consider a criminal complaint.
Week 3+: Consult counsel for a civil action (damages/injunction) if harassment continues or if you suffered reputational/mental harm.
Any time you can pay: Arrange documented payment or a realistic plan; avoid in-person cash handoffs and personal accounts.

XI. Prevention Tips for the Future

Use only reputable lenders regulated in the Philippines; read privacy policies and permissions.
Never allow blanket access to your contacts, photos, or storage.
Keep a separate email/number for financial apps; enable spam filters.
Maintain an emergency fund or credit line with transparent terms.
Monitor your credit and online presence; set alerts for your name.

XII. Quick Reference – Who to Approach

NPC: Data privacy violations (contact scraping, doxxing, debt-shaming, unlawful disclosure)
SEC: Abusive OLPs/lending or financing companies; unregistered apps
BSP: Banks and bank-engaged third-party collectors (unfair collection)
PNP-ACG / NBI: Threats, extortion, identity theft, cyber harassment
Courts: Civil damages and injunctions for abuse of rights and defamation

Bottom Line

You do not lose your privacy or dignity because you borrowed money. Philippine law prohibits harassment, threats, and debt-shaming. Use your DPA rights, document everything, restrict communications to reasonable, written channels, and escalate to the NPC, your sector regulator, and law enforcement when necessary—while keeping any legitimate repayment arrangements on track.