Online Lending App Harassment in the Philippines: How to Build a Case and File Complaints with the NPC, SEC, and NBI

Executive Summary

Online lending app (OLA) harassment—“debt shaming,” mass-texting your contacts, threats, fake legal notices, and public posts—is illegal in multiple ways under Philippine law. Three agencies can help, depending on what happened:

National Privacy Commission (NPC) – for privacy violations (accessing your contacts, using or disclosing personal data without proper basis, debt-shaming messages sent to third parties, etc.).
Securities and Exchange Commission (SEC) – for lending/financing company violations, especially unfair debt collection practices and operating without proper SEC registration and authority to operate.
National Bureau of Investigation (NBI) – for crimes such as threats, extortion, cyber libel, and other offenses under the Revised Penal Code and the Cybercrime Prevention Act.

Below is a practical, end-to-end guide: what counts as harassment, how to preserve evidence, which agency to approach and when, and step-by-step filing instructions (with templates).

1) What Counts as OLA Harassment?

Common unlawful acts include:

Debt shaming: messaging or calling your employer, family, or entire contact list; posting about you online; group chats naming and shaming.
Unauthorized data grabs: forcing blanket access to your phonebook/photos, or using that data for collection even if you did not freely consent.
Threats and coercion: threats of arrest, harm, or fabricated “warrants,” “court orders,” or “subpoenas.”
Obscene/abusive language, stalking, repeated calls at odd hours, and misrepresentation (e.g., pretending to be a lawyer, court officer, police).
Unfair collection tactics: public disclosure of your debt, contacting people not listed as your references, or contacting you at work after being told to stop.

You can be a victim even if you owe money. Owing a debt never justifies illegal collection practices.

2) Legal Bases at a Glance

A. Data Privacy Act of 2012 (RA 10173)

Principles: transparency, legitimate purpose, proportionality (collect only what’s necessary).
Rights: to be informed, to object, to access/correct, to erasure/blocking, to damages, and to data portability.
Typical violations in OLA cases: unauthorized processing of your data; processing for an incompatible purpose (e.g., blasting your contacts); illegal disclosure; failure to implement safeguards.
Remedies: NPC compliance orders, administrative fines/sanctions; possible criminal liability referred to prosecution authorities.

B. Lending Company Regulation Act (RA 9474) and SEC Rules

Who is covered: lending/financing companies and online lending platforms operating in the Philippines.
Key obligations: proper SEC registration and a Certificate of Authority; truthful disclosures; compliance with prohibitions on unfair debt collection practices (e.g., threats, profane language, contacting persons not involved in the loan, public shaming, false representations).
Remedies: SEC investigations, show-cause orders, Cease and Desist Orders, fines, and revocation of authority; referrals for criminal action where appropriate.

C. Penal & Cybercrime Laws (through the NBI/PNP)

Cyber libel (defamatory posts/messages online), grave threats, unjust vexation, coercion, extortion, identity theft/illegal access, and related offenses.
Remedies: criminal complaints via NBI; possible takedown coordination and digital forensics.

3) Preserve and Organize Your Evidence (Do This First)

Screen-record and screenshot the app permissions, messages, call logs, and in-app notices. Include dates/times.
Export message threads (SMS, chat apps, emails). Save as PDFs when possible.
Collect third-party statements: ask colleagues/friends who received messages to provide screenshots and brief statements.
Keep your loan documents: application forms, e-mails, receipts, transaction history, and the lender’s privacy notice/consent screen.
Note identities: company/app name(s), any aliases, caller IDs, account handles, website/app-store listings, and payment channels.
Create a timeline of events. It’s often the backbone of your complaint-affidavit.
Avoid altering the device (e.g., factory reset) before you’ve secured copies; it can compromise digital evidence.

4) Before You File: Assert Your Rights in Writing (Optional but Helpful)

Send a rights-assertion notice to the company’s Data Protection Officer (DPO) and/or official customer support channel:

Withdraw any purported consent to access your contacts/photos.
Object to further processing unrelated to loan servicing (especially contacting third parties).
Demand deletion of contacts data and a cease-and-desist from harassment.
Request the DPO’s details, privacy notice, and data processing basis.
Set a deadline (e.g., 5–7 days) for written compliance and confirmation.

Keep proof of sending (e.g., e-mail with delivery receipt, registered mail, or in-app ticket). This often strengthens NPC and SEC cases and can stop harassment early.

5) Where to File (Decision Tree)

Your contacts were messaged / your data was misused → NPC (privacy violations) and possibly SEC (if the actor is a lending/financing company or OLP).
Threats, extortion, libelous posts, doxxing, impersonation → NBI (criminal complaint). You may file with NPC/SEC in parallel if there’s data misuse or unfair collection.
Unregistered or rogue “lender” → SEC (registration/authority violations), and NBI if crimes are involved.
You’re not a borrower but got harassed → NPC (your data was processed without consent) and NBI for any criminal aspects.

Filing with more than one agency is normal; they cover different violations.

6) How to File with the National Privacy Commission (NPC)

A. What to Prepare

Complaint-Affidavit stating:
- Your identity and contact details.
- The respondent’s identity (company/app name; any known representatives).
- Statement of facts in chronological order (who, what, when, where, how).
- Specific privacy violations (e.g., unauthorized disclosure to third parties; processing beyond stated purpose; lack of valid consent).
- Relief sought: cease-and-desist, deletion/blocking of unlawfully obtained data, sanctions, damages (if applicable), referral for prosecution.
Annexes: evidence bundle (screenshots, recordings, statements, loan docs), proof you notified the DPO/firm (if you did), and your valid ID.
Formatting: paginate annexes; label exhibits; ensure timestamps are visible.

B. Filing Notes

You may file even if you couldn’t reach the DPO—especially for urgent/serious harm.
NPC may invite parties to a conference/mediation. Cooperate; many cases resolve here.
Possible outcomes: compliance orders, administrative fines/sanctions, or referral to law enforcement for criminal prosecution.

Tip: Frame the privacy issue clearly: “The app used/kept my contacts list and messaged non-consenting third parties to shame me into paying. This lacks a lawful basis and violates proportionality and purpose limitation.”

7) How to File with the Securities and Exchange Commission (SEC)

A. When SEC is the Right Forum

The actor is a lending/financing company or online lending platform operating in the Philippines.
You experienced unfair debt collection practices (threats, obscenities, contacting uninvolved third parties, public shaming, false claims of legal authority).
The entity appears unregistered or lacks a Certificate of Authority to operate as a lender.

B. What to Prepare

Sworn complaint or detailed report describing:
- The company/app name(s), links, and any corporate details you have.
- The unfair collection acts used on specific dates/times.
- Whether the entity disclosed its SEC registration/Certificate of Authority.
Annexes: harassment evidence, app listings/ads, payment instructions (to identify accounts), and your ID.

C. What SEC Can Do

Issue Show-Cause and Cease and Desist Orders, impose fines, and revoke a lender’s authority.
Coordinate with platforms and, when appropriate, refer criminal aspects to law enforcement.

Tip: If you don’t know whether the company is registered, still file—SEC can verify. Your screenshots and payment channel details help identify the operator.

8) How to File with the National Bureau of Investigation (NBI)

A. When to Go to the NBI

You received threats (harm, arrest, exposure of intimate images), extortion, impersonation of officials, cyber libel, or identity theft.
Your or others’ data were posted publicly (doxxing), or group chats/posts were created to shame you.

B. What to Prepare

Affidavit-Complaint narrating the facts and criminal elements (who said what; exact words; context; malice; harm).
Digital evidence: raw files (original images/videos/audio), devices if needed for forensic imaging, and notarized witness statements where available.
Your IDs and any information that can help trace the perpetrator (phone numbers, account handles, wallets/bank accounts used for payments).

C. What to Expect

Intake and evaluation, possible digital forensics, and coordination with platforms/telcos (via proper legal process).
NBI may file a criminal complaint with the Prosecutor’s Office. You may be called to execute additional statements and attend inquest/prelim investigation.

Tip: Save defamatory posts using both screenshots and URL copies; if possible, capture message headers or file metadata. Do not engage further with the harasser aside from preserving evidence.

9) Special Scenarios & Practical Tips

Your contacts were spammed: Share a short notice with them (template below) explaining that an app illegally accessed/used your phonebook and that they may also assert privacy rights or file their own complaints.
Fake legal papers: Verify court papers independently. OLAs commonly send fabricated “warrants” or “court orders.” Genuine court documents carry clear docket numbers and are served through proper channels—not via random chat apps.
You actually owe the debt: You still have the right to fair collection. Keep paying via official channels only. If charges are questionable, raise a billing dispute in writing. Consider a repayment plan you can afford.
Cross-border apps: Even if the operator is offshore, authorities can still act (administrative sanctions, takedown coordination, platform actions, and criminal complaints against local agents).
Safety first: If threats imply imminent harm, file a police blotter immediately (nearest station) in addition to NBI.

10) Templates (You Can Copy–Paste and Edit)

A. Rights-Assertion / Cease-and-Desist to the Lender’s DPO

Subject: Assertion of Rights Under the Data Privacy Act; Demand to Cease Unlawful Processing

I am [Full Name], borrower/account no. [____]. I withdraw any purported consent to access or use my contacts, photos, or other unrelated personal data. I object to further processing of such data and demand immediate cessation of collection practices involving my contacts or public disclosures about my account.

Please delete any contacts or third-party data obtained from my device and confirm deletion in writing within 7 days. Provide your privacy notice, the lawful basis relied upon for processing, and your DPO details.

Continued harassment, disclosure to third parties, or misrepresentation will prompt complaints with the NPC, SEC, and NBI, and claims for damages.

Sincerely, [Name, Address, Contact No., ID No.] [Date]

B. NPC Complaint-Affidavit (Outline)

Parties and jurisdiction
Detailed timeline of facts
Specific DPA violations (unauthorized disclosure, processing beyond purpose, etc.)
Evidence list (Exhibits A-__)
Reliefs sought (cease-and-desist, deletion/blocking, sanctions, damages, referral for prosecution)
Verification and notarization

C. SEC Complaint (Outline)

Your details; company/app details (names, links)
Description of unfair collection acts and dates
Statement on registration/authority unknown (if applicable)
Evidence list (screens, call logs, messages, app permissions)
Prayer for investigation, CDO, fines, revocation, and referrals

D. NBI Affidavit-Complaint (Outline)

Your identity; respondents (names/numbers/handles if known)
Elements of the offense (e.g., for cyber libel: defamatory imputations, publication, identification, malice)
Full narrative with timestamps and platform details
Evidence (raw files + screenshots + witness statements)
Prayer for investigation and prosecution

E. Message to Contacts Who Were Harassed (Short)

Sorry for any messages/calls you received. A lending app unlawfully accessed/used my contacts and sent you messages without consent. Please ignore, block, and forward any screenshots to me if possible. You may also assert your own privacy rights or file a complaint with authorities.

11) Frequently Asked Questions

Do I need a lawyer? Not to file with NPC or SEC, but legal counsel helps, especially for NBI/criminal cases or if you’re claiming damages.

Will complaints stop the harassment right away? They often help quickly—especially a documented cease-and-desist—but agency processes take time. Preserve evidence and keep reporting new incidents.

Can the lender sue me for filing? Retaliation or malicious prosecution risks are low if you’re truthful and acting in good faith. Truthful complaints with evidence are protected; harassment or libel from their side is unlawful.

What if I never borrowed but they’re harassing me? You still have strong claims (privacy violations, harassment). File with NPC and, if threatened or defamed, with NBI.

12) Quick Checklists

Evidence Checklist

Screenshots/screen recordings with timestamps
Copies of messages to you and to third parties
Loan/application documents and in-app consent screens
Names/numbers/handles used by collectors
Payment receipts and channels used
Witness statements from affected contacts
Your ID and proof of residence

Filing Bundle (per agency)

NPC: Complaint-Affidavit + evidence + ID (+ proof of DPO notice if any)
SEC: Sworn complaint/report + evidence + ID (note suspected lack of registration if applicable)
NBI: Affidavit-Complaint + raw digital evidence + ID (bring your device if requested)

13) Final Notes

You may file with NPC, SEC, and NBI in parallel; each addresses different harms.
Always act promptly: the fresher your evidence, the stronger your case.
Keep communications civil and factual; let your documents and exhibits do the heavy lifting.

This article is general information for the Philippine context and not a substitute for tailored legal advice.