A full-spectrum guide to stopping, documenting, and prosecuting abusive collection tactics by lending apps and third-party collectors in the Philippines—covering criminal, civil, regulatory, and data-protection remedies.

I. Core Legal Anchors

Criminal law (Revised Penal Code).
- Grave threats / light threats: threats to harm life, limb, reputation, or property to compel payment.
- Grave coercion: violence, intimidation, or force to compel a person to do something not legally obligatory.
- Robbery/extortion (when payment is extracted by intimidation beyond lawful debt collection).
- Libel / slander / cyber libel: shaming posts, mass messages to contacts accusing you of crimes or dishonor.
- Unjust vexation and alarms/scandals: harassing conduct (fact-sensitive).
- Stalking/harassment may trigger other special laws when gender-based (see Safe Spaces Act).
Financial consumer protection.
- Financial Products and Services Consumer Protection Act (R.A. 11765): guarantees fair treatment, prohibits abusive collection, and requires issuers to have effective redress mechanisms. Applies across regulated lenders (banks, financing and lending companies, credit providers).
Securities & lending regulation.
- Lending/Financing Companies laws: companies must be duly registered/licensed; unfair debt collection practices are sanctionable (suspension, revocation, fines). “Online lending platforms” (OLPs) fall under these rules.
Bangko Sentral (for banks/credit cards/e-money).
- BSP consumer protection and credit/collection standards prohibit threats, harassment, public shaming, and contacting unrelated third parties except for location/skip-tracing with safeguards.
Data Privacy Act (R.A. 10173).
- Outlaws unauthorized processing of your personal data, scraping contact lists, and disclosure to your phonebook for shaming; allows complaints, fines, and orders to stop processing and delete data.
Civil Code (Arts. 19, 20, 21, 26).
- Abuse of rights and injury to dignity/privacy justify moral/exemplary damages, plus attorney’s fees.

II. Abusive Behaviors—What’s Actionable

Threats of physical harm, arrest, or “NBI warrant” unless you pay—criminal.
Doxxing / contact blasting (messaging your contacts/boss)—privacy & defamation; also unfair collection.
Defamatory posts on social media/GCs with your photo—libel/cyber libel.
Sexualized or gender-based insults/threats—Safe Spaces Act offenses + damages.
False legal claims (e.g., “we will freeze your bank account today” without court order)—unfair/deceptive practice; can support damages and regulatory sanctions.
Unauthorized fees or rolling “extensions” with harassment—unfair collection and unconscionable charges reducible in court.

III. Immediate Response Plan (First 24–72 Hours)

Preserve evidence.
- Full screenshots of chats (showing sender, number/handle, timestamps), call logs/recordings (if lawfully recorded), SMS headers, social-media URLs, group membership lists, and any posts about you.
- Keep payment history, loan contract, disclosure statement, app permissions granted, and privacy policy.
Cut data exfiltration.
- Revoke the app’s permissions, especially Contacts, SMS, Storage, and Location; remove background activity.
- Change passwords; enable MFA on email/e-wallet/banking.
Send a cease-and-desist (C&D).
- Demand they stop threats/public shaming and limit contact to your counsel or a designated channel; cite criminal and privacy exposure (template in §XI).
Choose your escalation tracks (you can do all in parallel):
- Criminal complaint for threats/coercion/libel/cyber libel.
- Regulatory complaint (SEC for lending/financing companies/OLPs; BSP if a bank/e-money issuer).
- Privacy complaint with the National Privacy Commission (NPC) for scraping/third-party messaging.
- Civil action for damages + injunction/TRO to stop harassment.
Protect your workplace/family.
- Pre-empt by informing HR that any collector contact should be referred to Legal; provide C&D copy.
- For sensitive cases or continuing harassment, consider police blotter and barangay coordination as safety documentation.

IV. Building a Strong Case

Map the actors. Identify the app entity, SEC/BSP status, collection agency name, and individual agent personas/handles.
Chain the conduct. Create a timeline: date/time (Asia/Manila), channel, content of threat, target (you, your contacts), and any demanded amount.
Damages diary. Document anxiety treatments, missed work, disciplinary issues from workplace contact, and direct costs (SIM replacement, device cleanup).
Preserve device forensics. Don’t factory-reset until you’ve exported data; keep original files; use hashes for large archives.

V. Criminal Remedies (Where & What to File)

Venue: City/Provincial Prosecutor where the threat/post was received or published, or where you reside (for online publication, venue can follow your residence).
Offenses to consider:
- Grave threats / light threats (force/intimidation to compel payment).
- Grave coercion (forcing acts you’re not legally bound to do).
- Libel / cyber libel (public shaming).
- Unjust vexation; alarm/scandal; other RPC articles as facts allow.
Attachments: Your sworn complaint-affidavit, evidence bundle, and list of witnesses (co-workers who received messages, group-chat admins, HR).

Tip: Even if you owe money, debt does not justify crime. Lawful collection must be civil and respectful; threats and shaming are prosecutable.

VI. Regulatory Remedies

1) SEC (Lending/Financing Companies; Online Lending Platforms)

Ask for investigation and sanctions for unfair debt collection, unlicensed operations, deceptive disclosures, and contact scraping.
Request cease-and-desist and platform takedown coordination where appropriate.

2) BSP (Banks, Credit Cards, E-Money Issuers)

File a complaint through the provider’s consumer assistance unit; elevate to BSP Consumer Protection if unresolved.
Cite harassment, third-party contact, misrepresentation of legal remedies, and any fee abuses.

3) National Privacy Commission (NPC)

Complain for unauthorized processing, improper purpose, and disclosure to your contacts; seek orders to cease processing, delete data, and notify affected contacts if they were messaged using your phonebook.

VII. Civil Remedies

Damages suit (RTC/MTC depending on amount) invoking Arts. 19/20/21/26 for abuse of rights, humiliation, and privacy invasion; tack on moral/exemplary damages and attorney’s fees.
Injunction/TRO (Rule 58): Stop further shaming, messages to contacts, or publication while the case is pending.
Small Claims for improper charges/fees (if your primary relief is money ≤ jurisdictional cap).

VIII. Defenses & Counter-moves You Can Expect—and How to Answer

“We’re enforcing a lawful debt.” → Lawful collection must not involve threats, shaming, or data misuse. Debt ≠ license to commit crimes.
“You consented via app permissions.” → Consent must be informed, specific, and proportional. Blanket contact scraping for shaming is unlawful purpose.
“Statements are true, no libel.” → Truth is not a shield for privacy invasion or harassment; defamatory insinuations and publicity still incur liability; malice can be inferred.

IX. Special Situations

Gender-based online harassment (sexual insults, unwanted images): invoke Safe Spaces Act alongside libel/privacy.
Employer involvement: If collectors harass HR/clients, include corporate injury proof; your employer may join as complainant/witness.
Multiple apps/rollovers: Combine evidence; show pattern of abusive methods across brands and agencies (useful for regulators).

X. Practical Do’s and Don’ts

Route all communications through written channels (email to the company address listed in disclosures).
Offer a reasonable payment plan you can afford; courts and regulators view good-faith borrowers favorably.
Keep calm, non-inflammatory replies; let the paper trail show their abuse.

Don’t

Pay to stop threats (invites repeat extortion).
Engage in counter-defamation online.
Share more data (IDs/selfies) to “verify” with unverified agents.

XI. Templates (Short-Form)

A. Cease-and-Desist to Collector

Subject: Cease and Desist—Unlawful Collection Threats and Privacy Violations Dear [Company/Agent], You (a) threatened me on [date/time], (b) contacted my contacts at [numbers/platforms], and (c) posted/attempted to post defamatory content. These acts constitute criminal threats/coercion, unfair debt collection, and violations of the Data Privacy Act. Effective immediately, cease all threats and stop contacting any third parties about my account. Limit communications to email at [address]. Further violations will be used in criminal, civil, privacy, and regulatory actions. Sincerely, [Name | Mobile | Address]

B. Complaint-Affidavit (Issue Outline)

Your identity and contact details;
Name of app/company (screenshots of app store listing/website), SEC/BSP status if known;
Detailed timeline of threats/shaming;
Copies of messages/posts/voicemails (annexed);
Damages suffered;
Offenses invoked; prayer for prosecution and protective orders.

C. NPC / SEC Complaint Cover

Subject: Unfair Debt Collection and Unauthorized Processing—[App/Company] I report abusive collection and unlawful disclosure of my data by [App]. Evidence attached: (Annexes A–F). I request investigation, cease-and-desist, deletion of unlawfully processed data, and sanctions.

XII. Evidence Checklist (Quick)

Screenshots with handles/numbers/URLs/timestamps
Audio files/transcripts (if legally recorded)
List of contacts harassed (names, numbers, messages)
Loan contract and disclosure statement
App permissions/privacy policy copies
Medical/HR records showing impact
C&D letter and courier/email proof of delivery

XIII. Litigation & Resolution Pathway (At a Glance)

Day 0–2: Evidence capture → C&D → Privacy & regulator complaints.
Day 3–10: File criminal complaint; seek workplace letters and witness affidavits.
Day 10–30: File civil suit with injunction if harassment continues.
Ongoing: Cooperate with regulators; update evidence; pursue settlement on lawful repayment terms without waiving claims for abuse.

XIV. Key Takeaways

Debt does not excuse crime. Threats, shaming, and data misuse by collectors are punishable and sanctionable.
Use four tracks together: criminal, regulatory, privacy, and civil (injunction + damages).
Evidence wins cases—capture content, protect devices, and keep a clean timeline.
Contain the data leak (revoke permissions) and control communications (designated channel).
Good-faith repayment can proceed separately; never trade your rights for silence on illegal tactics.

This article provides general legal information. For high-risk situations (credible threats, workplace damage, or large-scale doxxing), consult counsel to coordinate filings and seek urgent injunctive relief tailored to your facts.