Legal framework, abusive practices, and remedies for borrowers

I. The rise of online lending and the problem of harassment

Online lending apps and digital lending platforms have made it easy for Filipinos to borrow small amounts in minutes—often with minimal documentation and purely via smartphone.

But the convenience has come with a darker side:

Excessive interest and penalties
Aggressive, abusive collection tactics
Harassment of borrowers and even their family, friends, and co-workers

This has prompted action from regulators and raised important issues under Philippine financial, criminal, civil, and data privacy laws.

This article explains when collection crosses the line into harassment, what laws are involved, and what borrowers can do.

II. Basic legality: Online lending itself vs. the way it’s collected

Two separate questions must always be kept in mind:

Is the lender operating legally?
- Lending companies and financing companies must generally be registered with the SEC and comply with special rules if they operate as online lending platforms.
- Banks and certain other financial institutions are supervised by the Bangko Sentral ng Pilipinas (BSP).
Are the lender’s collection practices lawful?
- Even if a lender is properly registered, it cannot collect debts through harassment, threats, public shaming, or illegal data processing.
- If it is unregistered or operating illegally, its abusive collection practices can be subject to both regulatory and criminal action, though the underlying obligation to repay may still exist as a civil debt, subject to scrutiny of the interest and charges.

So:

Owing money does not give a lender a license to harass or humiliate the borrower.

III. Typical abusive practices by online lenders

Online lending harassment often looks like this:

Contact-list harassment and “shaming”
- The app demands access to contacts during installation.
- When the borrower is late, the lender:
  - Sends mass messages to contacts calling the borrower a “scammer,” “criminal,” or “delinquent.”
  - Contacts the borrower’s employer, HR, or co-workers.
  - Threatens to post pictures and accusations on social media.
Threats and intimidation
- Threats of arrest, imprisonment, or warrants supposedly issued by courts.
- Threats of physical harm, harm to family, or “visits” by “field investigators.”
- Use of obscene, degrading, or insulting language in chat or calls.
Fake legal documents and misrepresentation
- Sending fake subpoenas, demand letters with court seals, “NBI” or “police” letters that are not real.
- Claiming they have already filed a criminal case for “estafa” when they clearly have not.
- Misrepresenting themselves as lawyers, law enforcement agents, or court personnel.
Unreasonable frequency and timing of calls/messages
- Repeated calls/texts many times per day, including late at night or very early morning.
- Group chats that include the borrower’s contacts and relatives, meant purely to pressure and shame.

Most of these go far beyond “reminding someone of a due date” and fall into harassment, unfair collection, or even criminal acts.

IV. Key laws involved

1. Data Privacy Act of 2012 (RA 10173)

Online lending apps often force access to contacts, photos, SMS, and other personal data as a condition for granting a loan.

Under the Data Privacy Act:

Personal data must be collected and processed only when there is:
- Legitimate purpose
- Transparency (the data subject is clearly informed)
- Proportionality (only data reasonably necessary is collected).

Red flags under data privacy:

Requiring full access to the entire contact list just to process a small loan is often disproportionate.
Using contact data to harass, shame, or disclose debts to third parties (friends, relatives, employer) is unauthorized processing of other people’s personal data, because those contacts never consented.
Misuse of borrower’s own data (e.g., photos, private information) as a tool of intimidation can be unlawful processing and may also violate other laws (e.g., libel, grave threats).

The National Privacy Commission (NPC) can:

Investigate complaints
Order the cease and desist of unlawful processing
Impose administrative fines and sanctions
Recommend criminal prosecution for serious violations.

2. Financial Products and Services Consumer Protection Act (RA 11765)

This relatively new law strengthens consumer rights in dealings with financial service providers (banks, lending companies, online lenders, etc.).

Key consumer rights include:

Right to equitable and fair treatment – debt collection must not be abusive, unfair, or discriminatory.
Right to protection of consumer data – aligns with and reinforces the Data Privacy Act.
Right to disclosure and transparency – interest, fees, penalties, and collection policies must be explained clearly.
Right to redress – access to complaint and dispute resolution mechanisms.

Regulators (BSP, SEC, Insurance Commission, etc.) have stronger powers to:

Investigate financial institutions
Impose fines, suspension, or revocation of licenses
Order restitution or refunds
Disqualify officers.

For online lending companies under the SEC’s jurisdiction, harassing collection practices can be treated as unfair collection and business conduct under this framework and related SEC rules.

3. Lending Company Regulation laws and SEC rules

Lending and financing companies must generally:

Be registered with the SEC;
Comply with the Lending Company Regulation Act / Financing Company Act and relevant rules;
For online operation, comply with specific SEC rules for online lending platforms (OLPs), such as:
- Registration and disclosure of their apps and websites
- Proper disclosure of interest and charges
- Prohibition on misleading or abusive collection practices

The SEC has the power to:

Issue cease-and-desist orders;
Revoke registration or authority to operate;
Impose administrative sanctions;
Refer matters for criminal prosecution.

Operating a lending business without proper registration, or continuing to operate after revocation, may itself be a crime, separate from any harassment.

4. Revised Penal Code and related criminal laws

Abusive collectors may commit various criminal offenses, including:

Grave threats / light threats – threatening harm to life, person, or property.
Grave coercion – using violence or threats to force someone to do something against their will (e.g., forcing payment under unlawful threats).
Unjust vexation or other similar offenses – repeated annoying, disturbing, or harassing acts (depending on circumstances and current penal provisions).
Libel and cyberlibel – sending defamatory messages to the borrower’s contacts or posting accusations online.
Falsification – use of fake legal documents, forged signatures, or false representation of public officers.

Harassment that uses online platforms, social media, messaging apps, or emails can fall under cybercrime-related provisions, especially when paired with libel or threats.

Important:

The fact that the borrower owes money does not excuse criminal acts like threats of violence, fake warrants, or online shaming.

5. Civil Code – Abuse of rights and damages

Beyond criminal liability, the Civil Code provisions on abuse of rights can apply:

Article 19 – every person must, in the exercise of rights and performance of duties, act with justice, give everyone his due, and observe honesty and good faith.
Article 20 – a person who, contrary to law, causes damage to another is liable to pay damages.
Article 21 – a person who wilfully causes loss or injury in a manner contrary to morals, good customs, or public policy must compensate the victim.

An abusive lender may be sued for:

Moral damages – for anxiety, humiliation, and mental anguish
Exemplary damages – to serve as an example and deterrent
Actual damages – where the borrower can prove specific financial loss (e.g., job loss due to defamatory messages to employer)
Attorney’s fees

V. Are online lenders allowed to message contacts or employer?

In general:

No legitimate basis exists for contacting the borrower’s family, friends, or employer solely to shame and pressure the borrower.
The contacts themselves did not consent to having their personal data processed or their phone numbers used in this manner.
Even if the borrower clicked “allow contacts access,” the lender’s misuse of that data (for public shaming, defamation, etc.) can be illegal.

Legitimate collection might include:

Calling or messaging the borrower directly via contact information the borrower provided;
Sending formal demand letters to the borrower’s address or email;
Keeping communications professional and non-threatening.

Harassment includes:

Calling or messaging third parties (e.g., “Your friend owes us money, he is a scammer,” etc.);
Creating group chats including contacts with insulting or defamatory content;
Any form of public shaming.

VI. Does harassment erase the debt?

Usually, no.

Key points:

The existence of harassment does not automatically cancel the loan. The obligation to pay may still exist under:
- The loan contract, and
- General principles of obligations and contracts.
However:
- Unconscionable interest rates, penalties, and charges may be reduced or nullified by courts for being contrary to morals or public policy.
- A lender who violates laws and regulations may face sanctions, fines, and liability for damages, which can offset or affect the overall financial outcome.
- If the lender is unlicensed or illegally operating, this may affect the enforceability of the contract and significantly shift the legal landscape, but it does not automatically mean the borrower owes nothing—this requires careful legal analysis.

Bottom line:

Harassment gives the borrower claims and defenses, but it does not magically erase all debt by itself.

VII. What borrowers can do: Practical and legal steps

1. Preserve evidence

Screenshots of messages and group chats (showing the sender’s name/number, date, time).
Call logs showing the frequency and timing of calls.
Copies of emails or in-app messages.
Any fake legal documents they send.

Be cautious about secretly recording calls: the Anti-Wiretapping Law generally prohibits recording private communications without consent, except in limited cases. Before relying on recorded calls, it is safer to consult a lawyer.

2. Stop giving new permissions

Don’t install new apps from the same lender.
Revoke unnecessary permissions from your phone settings if possible (though some apps may stop functioning).
Avoid sharing new contact numbers with them unless necessary.

3. Write a formal complaint to the lender

Clearly state:
- You acknowledge the debt (if you do), but
- You object to harassing, threatening, or defamatory collection methods;
- You demand that they cease contacting your contacts and employer;
- All future communication should be directed only to you, in a professional manner.

This becomes useful evidence later.

4. File regulatory complaints

Depending on who supervises the lender:

SEC – for lending and financing companies and many online lending platforms.
BSP – for banks and other BSP-supervised institutions engaged in lending.
National Privacy Commission (NPC) – for data privacy violations, especially contact-list harassment and misuse of personal data.

Regulators can:

Order the removal of abusive apps,
Revoke licenses or registrations,
Impose fines and administrative penalties,
Require corrective measures and consumer redress.

5. Consider criminal and civil action

For serious harassment:

Criminal complaints may be filed with:
- The PNP or NBI, particularly cybercrime units, for threats, harassment, cyberlibel, fake agency documents, etc.
Civil actions for damages may be filed with regular courts if you wish to seek:
- Moral, exemplary, and actual damages for abusive acts;
- Relief based on abuse of rights and violations of law.

These steps are more involved and often require assistance of a lawyer.

6. Manage the debt itself (without enabling abuse)

While asserting your rights against harassment:

Acknowledge valid debts and, if you’re able, propose realistic payment arrangements.
Be careful with “rollover” or refinancing offers from the same lender that only increase your total obligation.
Consider:
- Negotiating to waive or reduce penalties and excessive interests;
- Seeking help from family, employer, or legitimate financial institutions to consolidate or refinance under better terms;
- Talking to a lawyer or financial counselor for strategies if you are already in deep debt.

VIII. Red flags that a lender is especially problematic

You should be extremely cautious if the lender:

Refuses to show SEC registration or claims “not needed.”
Withholds clear information on interest rate, total cost of credit, and fees.
Asks for permissions beyond what’s necessary (full access to contacts, gallery, files, SMS) and uses them aggressively.
Uses foul language, slurs, threats, or fake official documents.
Brags that you have “no legal rights” because you clicked “agree” in the app.

No app’s terms and conditions can legalize criminal acts or violations of the Data Privacy Act.

IX. Final reminders

You remain responsible for legitimate debts, but lenders must collect lawfully and ethically.
Harassment, shaming, and threats are not only unethical but may violate:
- The Data Privacy Act,
- The Financial Products and Services Consumer Protection Act,
- SEC/BSP regulations,
- The Revised Penal Code,
- And the Civil Code on abuse of rights.
Borrowers can:
- Preserve evidence,
- Demand that harassment stop,
- Complain to SEC, BSP, NPC, DOLE (if an employer is involved), and law enforcement,
- Consider civil and criminal remedies with the help of counsel.

This article is general information, not tailored legal advice. Anyone dealing with online lending harassment in the Philippines is strongly encouraged to consult a Philippine lawyer or relevant government agency for guidance specific to their situation.