If a lending app keeps calling you, messaging your family and friends, posting shaming content, or making threats even after you’ve closed your account—whether by full payment or formal request—you have strong legal protections under Philippine law. Multiple government agencies and courts can step in to stop the harassment, order the deletion or restriction of your data, and hold the company accountable. This article explains exactly what counts as illegal conduct, the specific laws that apply, and the practical steps thousands of Filipinos have used successfully to regain peace of mind.

Why Harassment Continues After Account Closure

Many borrowers assume that settling a loan or requesting account closure ends all contact. In reality, some apps and their third-party collectors continue aggressive tactics because the data (including harvested contacts) remains in their systems and they treat closure as irrelevant.

Common post-closure tactics include repeated calls and texts at odd hours, mass messages to your entire contact list claiming you owe money or are a “guarantor,” social media posts with your photo or loan details, threats of arrest, jail time, or blacklisting, and impersonation of government officials or lawyers. These practices do not become legal simply because an account shows as closed in the app. Once the debt is settled or the account is formally closed, the company’s legitimate interest in aggressive collection shrinks dramatically, making continued intrusive processing even harder to justify.

Legal Bases Protecting You

Philippine law treats abusive collection as a violation of privacy, unfair business practice, and often a criminal offense.

Data Privacy Act of 2012 (Republic Act No. 10173) is the strongest and most frequently used protection. It requires that personal data be processed only for a declared, legitimate purpose with transparency and proportionality. Harvesting your phone contacts without the separate, informed consent of those individuals, then using that data to shame or pressure you, violates purpose limitation and the rights of third-party data subjects. The National Privacy Commission (NPC) has repeatedly ruled against online lending platforms for exactly these practices and has referred cases for criminal prosecution. Continued processing after payment or closure often lacks any lawful basis.

SEC Memorandum Circular No. 18, Series of 2019 directly prohibits unfair debt collection practices by all lending companies, financing companies, and their online lending platforms (OLPs), including third-party collectors. It bans the use or threat of violence, public shaming or disclosure of debt to third parties, contacting relatives, friends, or employers who are not guarantors or co-makers, use of obscene or abusive language, misrepresentation as a government official or court employee, communication at unreasonable hours, and mass-messaging contacts. Violations can result in fines from ₱25,000 to ₱1,000,000 per violation, suspension or revocation of the company’s certificate of authority, and orders to remove the app from Google Play and the App Store.

Revised Penal Code provisions apply to the most serious acts. Article 282 covers grave threats (threatening harm to person, honor, or property). Article 287 covers unjust vexation—repeated annoying or tormenting acts without just cause, which fits most patterns of incessant calls and texts. When committed through information and communications technology, penalties are increased under the Cybercrime Prevention Act (Republic Act No. 10175). Public shaming posts can also constitute cyber libel.

Civil Code Articles 19, 20, and 21 make persons who abuse their rights or act in a manner contrary to morals or good customs liable for damages, including moral and exemplary damages. Courts have awarded compensation for emotional distress, reputational harm, and anxiety caused by these tactics. In the 2025 Supreme Court decision Grace M. Trimillos v. FCash Global Lending, Inc. (G.R. No. 271360, August 13, 2025), the Court upheld liability for unauthorized contact-list access and shaming messages, affirming that such conduct violates the Data Privacy Act and supports damages claims.

These laws work together. You can pursue regulatory complaints (NPC and SEC), criminal complaints, and civil damages at the same time.

Step-by-Step Practical Guide

1. Preserve every piece of evidence immediately.
Take clear, timestamped screenshots of every message, call log entry, notification, and social media post. Include the sender’s number or username, date, time, and full content. Record call details in a simple log (date, time, number, what was said). Ask affected family members or friends to write sworn affidavits describing the messages they received and how it affected them. Keep proof of payment or your closure request. Do not delete anything. Organize everything chronologically in a folder (physical and digital backup). Notarized printouts of screenshots carry strong weight with agencies and courts.

2. Send a formal written demand (cease-and-desist + Data Subject Request).
Email the company’s customer support, grievance officer, and Data Protection Officer (DPO) if listed in their privacy policy. Also send via registered mail or courier to their registered business address (check the SEC company registration records if needed). In the letter:

State your account number and attach proof of payment or closure request.
Demand written confirmation within 5–7 days that the account is fully settled and closed, with updated status reflecting “paid” or “closed.”
Demand immediate cessation of all calls, texts, and third-party contacts.
Demand they stop processing or disclosing your personal data (including contacts) for collection purposes and delete or restrict unnecessary data.
Warn that failure to comply will result in complaints to the NPC, SEC, PNP Anti-Cybercrime Group, and prosecutor’s office, plus possible civil action for damages.
Request preservation of all records (call logs, messages, collector identities).

Keep proof of sending and any reply (or lack of reply). This letter creates an official record and often prompts companies to stop or at least respond.

3. File complaints with the regulatory agencies (do this in parallel for faster results).

National Privacy Commission (NPC): Best for data misuse, contact harvesting, and continued processing after closure. Download or prepare a notarized Complaint-Affidavit, attach your evidence as annexes, and submit via email to complaints@privacy.gov.ph, courier, or in person. The NPC can issue a Cease-and-Desist Order, order data deletion or restriction, impose administrative fines, and refer the case for criminal prosecution. Many borrowers see calls stop within weeks after an NPC order.
Securities and Exchange Commission (SEC): File a sworn complaint-affidavit with evidence if the lender is a registered lending or financing company (most OLPs are). Use the SEC’s online portal or email for lending company complaints. The SEC investigates unfair collection practices, can fine the company, revoke its authority to operate, and coordinate app takedowns.

Both agencies accept submissions from abroad or through a representative.

4. Address immediate threats or criminal conduct through law enforcement.
For serious threats, go to your nearest police station and request a blotter entry (ask for a certified copy). For cyber-related harassment (texts, social media, fake accounts), contact the PNP Anti-Cybercrime Group or NBI Cybercrime Division. Execute a complaint-affidavit before the prosecutor’s office for preliminary investigation on charges such as unjust vexation or grave threats. In some localities, minor offenses may first require barangay conciliation under the Katarungang Pambarangay Law before court filing.

5. Consider a civil action for damages if the harm is significant.
You can file in the appropriate trial court (MTC/MTCC for smaller amounts or RTC) claiming actual, moral, and exemplary damages, plus attorney’s fees. Many people include a prayer for a temporary restraining order or injunction to immediately stop the harassment. Small claims procedure may apply depending on the amount. Public Attorney’s Office (PAO) assistance is available for qualified individuals.

Common Pitfalls and Special Situations

Unregistered or “fly-by-night” apps are still fully liable under the Data Privacy Act and Revised Penal Code; the SEC can still act against them or facilitate takedowns. Collectors often use personal mobile numbers or third-party agencies—document the content anyway, as the lending company remains responsible for its agents.

Overseas Filipino workers and foreigners enjoy the same protections. You can file most complaints by email or through a Philippine-based representative armed with a notarized Special Power of Attorney (apostilled if executed abroad). Family members in the Philippines can help gather affidavits and coordinate.

A frequent mistake is paying again without written confirmation or deleting evidence while trying to “move on.” Another is responding emotionally to collectors—keep all communication professional and in writing after the first demand. Barangay mediation is sometimes required before court for minor offenses but is not a prerequisite for NPC or SEC complaints.

Required Documents, Offices, and Realistic Timelines

Core evidence package (use for all filings):

Timestamped screenshots and call logs
Notarized affidavits from you and affected contacts
Proof of payment or account closure request
Copy of your demand letter and proof of sending
Any medical or psychological reports documenting stress or anxiety (strengthens damages claims)

Main offices and processes:

NPC — complaints@privacy.gov.ph or privacy.gov.ph (notarized complaint-affidavit)
SEC — sec.gov.ph (sworn complaint for lending companies)
PNP / Prosecutor — nearest station for blotter; City/Provincial Prosecutor’s Office for criminal complaint-affidavit
Courts — MTC/MTCC or RTC depending on claim amount; PAO for free legal aid if qualified

Agency complaints are generally free or involve only notarization costs (₱100–300). Court filing fees vary with the amount claimed but are modest for small claims.

Timelines vary: NPC and SEC investigations often produce interim relief (stop orders) within weeks to two months. Criminal preliminary investigation can take several months. Full court cases for damages typically run six months or longer, though many settle earlier once regulatory pressure mounts.

Frequently Asked Questions

Is it legal for a lending app to contact my family and friends after I closed my account?
No. Contacting third parties who are not guarantors or co-makers violates both the Data Privacy Act (unauthorized disclosure and processing of their personal data) and SEC Memorandum Circular No. 18, s. 2019. This is one of the most common and successfully challenged practices.

What if I already paid everything and the app still shows an unpaid balance?
Demand written confirmation of full settlement and closure in your formal letter. Continued collection activity after verified payment is especially difficult for the company to justify and strengthens claims of bad faith, unjust vexation, and privacy violations.

Do I need a lawyer to file complaints with the NPC or SEC?
No. You can file yourself using a notarized complaint-affidavit. Many people succeed without counsel, especially at the regulatory stage. A lawyer becomes helpful if you later pursue substantial civil damages or face complex criminal proceedings.

How strong is my case if the app is not registered with the SEC?
Still very strong. The Data Privacy Act and Revised Penal Code apply regardless of registration. The NPC and police can act directly. The SEC may still investigate or coordinate app removal.

Can I claim money for the stress and anxiety this caused?
Yes. Civil courts award moral damages for emotional distress and exemplary damages to punish oppressive conduct. Document medical consultations or therapy if the harassment affected your mental health or work.

What is the fastest way to make the calls and messages stop?
Send the formal demand letter immediately, then file parallel complaints with the NPC and SEC. Regulatory cease-and-desist orders often produce quicker practical relief than waiting for a criminal conviction or civil judgment.

Are screenshots enough evidence?
Yes, especially when timestamped and supported by your sworn statement. Notarized printouts and witness affidavits from family members who received messages make the evidence even stronger.

What if the harassment involves fake social media posts or manipulated photos?
This can constitute cyber libel or unjust vexation under the Cybercrime Prevention Act. Preserve the posts (screenshots with URLs) and report to the PNP Anti-Cybercrime Group or NBI in addition to the NPC and SEC.

How long do I have to file these complaints?
Prescription periods apply (generally one to ten years depending on the offense), but act quickly while evidence is fresh and messages are still accessible. Early action also prevents further harm.

Key Takeaways

Closing or paying off your lending app account does not give the company a free pass to continue harassing you or your contacts.
The Data Privacy Act, SEC Memorandum Circular No. 18 s. 2019, the Revised Penal Code, and the Civil Code give you overlapping, enforceable rights.
Start by thoroughly documenting everything and sending a clear written demand for confirmation of closure, cessation of contact, and data restriction.
File complaints with the National Privacy Commission and Securities and Exchange Commission in parallel—these often deliver the fastest practical relief through cease-and-desist orders and regulatory sanctions.
For threats or serious criminal conduct, secure a police blotter and consider a complaint with the prosecutor’s office.
You can pursue regulatory, criminal, and civil remedies at the same time; many borrowers successfully stop the harassment and recover compensation for the distress caused.
OFWs and foreigners have the same rights and can file remotely or through a representative.
Persistence with complete, organized evidence is the key to success in these cases.

The situation is stressful and invasive, but it is not hopeless. By following these documented steps, you put yourself in the strongest possible position to stop the harassment and hold the responsible parties accountable under Philippine law.