I. Introduction

Online lending apps have become a common source of quick credit in the Philippines. They are marketed as fast, convenient, and accessible, especially for people who need emergency funds but have limited access to banks, credit cards, or formal loans. Many borrowers use online lending apps for medical expenses, rent, food, tuition, utilities, business capital, transportation, or urgent family needs.

However, online lending has also produced widespread complaints of harassment, public shaming, abusive debt collection, excessive interest, hidden fees, threats, fake legal notices, and misuse of personal data. Borrowers often report that online lending apps or their collectors access phone contacts, message relatives and employers, post defamatory statements, threaten arrest, use insulting language, and disclose private loan information to third parties.

In the Philippines, lending and debt collection are legal. But harassment is not legal. A borrower’s failure to pay a loan does not give a lender, collector, or lending app the right to threaten, shame, defame, intimidate, or misuse personal data. The borrower may still owe a valid debt, but the lender must collect it through lawful means.

This article discusses online lending harassment and data privacy violations in the Philippine context, including the rights of borrowers, obligations of lenders, prohibited collection practices, data privacy issues, remedies before government agencies, criminal and civil liability, evidence gathering, and practical steps for victims.

II. Online Lending Apps in the Philippine Setting

Online lending apps usually operate through mobile applications, websites, social media pages, or messaging channels. Borrowers submit personal information, identification documents, selfies, employment details, bank or e-wallet information, and sometimes grant app permissions to access phone contacts, photos, storage, SMS, camera, location, or device information.

The promise is convenience. The risk is overcollection and misuse of personal data.

Some apps are operated by registered lending companies or financing companies. Others may operate without proper registration, under multiple app names, through foreign-controlled platforms, or through informal collection networks. Some apps also use third-party collectors whose methods may be aggressive, anonymous, or abusive.

A borrower should distinguish between:

A legitimate lender collecting a valid debt through lawful means;
A registered lender using abusive collection tactics;
A lending app operating under unclear or multiple company names;
A scam app using loan collection as a pretext for extortion;
A collector with no proof of authority;
A fake legal collector pretending to be a lawyer, court officer, police officer, barangay official, or prosecutor.

Even a legitimate lender may violate the law if it engages in harassment or data privacy abuse.

III. The Basic Rule: Debt Collection Is Allowed, Abuse Is Not

A lender may lawfully ask a borrower to pay. It may send reminders, demand letters, statements of account, settlement offers, restructuring proposals, or lawful collection notices. It may also file a civil collection case if the debt remains unpaid.

But a lender may not collect by unlawful means.

A collector should not:

Threaten physical harm;
Threaten imprisonment for ordinary debt;
Send abusive or obscene messages;
Contact unrelated third parties to shame the borrower;
Publicly post the borrower’s name, photo, address, employer, or debt;
Call the borrower a scammer, thief, criminal, or estafador without lawful basis;
Use fake legal documents;
Pretend to be from a court, police station, prosecutor’s office, barangay, or law office;
Harass the borrower’s employer, relatives, friends, or co-workers;
Access or misuse phone contacts;
Use personal data beyond lawful purposes;
Force payment through intimidation, public humiliation, or coercion.

The law does not allow “collection by terror.”

IV. Common Forms of Online Lending Harassment

Online lending harassment in the Philippines commonly appears in several forms.

A. Excessive Calls and Messages

Collectors may repeatedly call or message the borrower within minutes or hours, sometimes using different numbers. Some call early in the morning, late at night, during work hours, or continuously until the borrower responds.

Persistent communication may become harassment when it is excessive, abusive, threatening, or intended to disturb rather than merely remind.

B. Threatening Messages

Collectors may say:

“Ipapakulong ka namin.”
“May warrant ka na.”
“Pupunta ang pulis sa bahay mo.”
“Ipapahiya ka namin sa opisina.”
“Ipo-post namin mukha mo.”
“Tatawagan namin lahat ng contacts mo.”
“Hindi ka titigilan hanggang magbayad ka.”
“May pupunta sa bahay mo.”
“Estafador ka.”
“Scammer ka.”

Threats may give rise to criminal, civil, regulatory, or privacy complaints depending on the facts.

C. Contact List Harassment

One of the most abusive practices is contact blasting. The app or collector messages people in the borrower’s phone contacts, even those who are not co-makers, guarantors, references, or parties to the loan.

Collectors may contact:

Parents;
Spouse or partner;
Children or siblings;
Co-workers;
Employer or HR department;
Friends;
Neighbors;
Clients;
Churchmates;
Former classmates;
Random contacts saved in the phone.

This may violate data privacy rights and may also amount to harassment, defamation, or unfair collection practice.

D. Public Shaming

Some collectors create posts, group chats, edited photos, memes, or messages branding the borrower as a scammer, criminal, or debtor.

This may include:

Posting the borrower’s photo;
Publishing the borrower’s name and address;
Tagging relatives or co-workers;
Sending “wanted” style images;
Creating group chats with contacts;
Posting in community groups;
Calling the borrower “magnanakaw,” “estafador,” or “fraudster”;
Publishing ID photos or selfies submitted during loan application.

Public shaming may create liability for privacy violations, libel, cyber libel, defamation, moral damages, and regulatory violations.

E. Fake Legal Threats

Collectors may send fake documents such as:

Fake subpoenas;
Fake warrants of arrest;
Fake court orders;
Fake prosecutor notices;
Fake barangay summons;
Fake police blotters;
Fake hold departure orders;
Fake notices of criminal complaint;
Fake law office letters;
Fake “final warning” documents.

A private collector cannot issue a warrant of arrest. A lender cannot simply order police to arrest a borrower for ordinary non-payment of debt. Fake legal documents may be evidence of intimidation, misrepresentation, fraud, or other legal violations.

F. Threats to Employment

Some collectors call or message the borrower’s employer, supervisor, HR department, or co-workers. They may accuse the borrower of fraud or irresponsibility and demand that the employer pressure the borrower to pay.

This can cause embarrassment, workplace issues, reputational harm, and even job loss. If the employer is not a guarantor or authorized contact, disclosure of the borrower’s debt may be improper and may violate privacy rights.

G. Harassment After Payment

Some borrowers continue receiving threats after payment because records were not updated, collectors are working from outdated lists, or the app imposes unclear penalties.

If the borrower already paid, proof of payment should be preserved and sent to official channels. Continued harassment after payment may strengthen a complaint.

V. Data Privacy Issues in Online Lending

Online lending apps collect personal data. Personal data may include:

Full name;
Address;
Phone number;
Email address;
Date of birth;
Government ID;
Selfie or facial image;
Employment details;
Employer name;
Salary information;
Bank or e-wallet details;
Phone contacts;
Device information;
Location data;
Photos or media files;
Social media information;
References;
Loan history;
Payment behavior.

Because this information is sensitive and may cause harm if misused, lenders must handle it lawfully, fairly, transparently, securely, and proportionately.

VI. Data Privacy Principles

Philippine data privacy law is built around key principles. Online lending companies and their collectors should observe these principles when collecting and processing borrower data.

A. Transparency

The borrower should be informed about what data is collected, why it is collected, how it will be used, who will receive it, how long it will be kept, and how the borrower may exercise rights.

A privacy policy hidden in vague language is not enough if the actual data use is abusive or unexpected.

B. Legitimate Purpose

Data should be collected and used only for legitimate lending purposes, such as identity verification, credit assessment, fraud prevention, loan servicing, payment processing, and lawful collection.

Using contact lists to shame borrowers is not a legitimate purpose.

C. Proportionality

The data collected should be limited to what is necessary. A lending app should not collect excessive data unrelated to the loan.

For example, requiring access to all phone contacts, photos, storage, or messages may be questionable if the loan can be processed with less intrusive data.

D. Fairness

Even when data is collected with consent, it must not be used unfairly, abusively, or oppressively. Consent does not authorize humiliation, defamation, or harassment.

E. Security

Lenders must protect borrower data from unauthorized access, disclosure, misuse, leaks, or abuse by employees and third-party collectors.

VII. Consent and App Permissions

Many online lending apps ask users to grant access to contacts, camera, storage, SMS, location, or device data. Borrowers often click “allow” because the app will not proceed without permission.

However, permission does not automatically justify all later uses of data.

Important points:

Consent should be informed, specific, and freely given;
Borrowers should know exactly what data is collected;
Consent to verify identity is not consent to public shaming;
Consent to provide references is not consent to contact all phone contacts;
Consent to collection communication is not consent to abusive harassment;
A borrower cannot be forced to surrender excessive personal data as a condition for a small loan if the data is unnecessary;
Data must be processed only for lawful and declared purposes;
Data processing must remain fair and proportionate.

A lender cannot rely on app permissions to justify unlawful disclosure of a borrower’s debt to third parties.

VIII. Contact Harvesting

Contact harvesting occurs when an app accesses the borrower’s phonebook and collects names, numbers, and other contact details.

This is one of the most problematic online lending practices because third parties in the contact list did not borrow money, did not consent to be contacted, and may not even know the borrower well.

Contact harvesting may become a data privacy violation when:

The app collects all contacts without necessity;
The app uses contacts for debt shaming;
The app discloses the borrower’s debt to contacts;
The app sends threatening messages to contacts;
The app stores contact data without lawful purpose;
The app transfers contact data to collectors;
The app uses contact data beyond what was disclosed;
The app refuses to delete or stop using the data.

A borrower may complain not only for their own privacy violation but also because the contacts’ personal data may have been processed without proper basis.

IX. Disclosure of Debt to Third Parties

A loan obligation is private information. A lender may communicate with the borrower, authorized representatives, co-makers, guarantors, or declared references within lawful limits. But disclosure to unrelated persons is highly problematic.

Improper disclosure may include telling third parties:

The borrower has a loan;
The borrower has not paid;
The amount owed;
The due date;
The borrower is hiding;
The borrower is a scammer;
The borrower should be pressured to pay;
The borrower’s ID, address, employer, or photo;
The borrower’s loan app account details.

Disclosure may violate privacy rights even if the statement that the borrower has a debt is true. Truth does not automatically justify unnecessary disclosure of personal financial information.

X. Public Posting of Borrower Information

Posting borrower information online is one of the most serious forms of abuse.

Examples include posting:

Name;
Photo;
Government ID;
Selfie;
Phone number;
Address;
Employer;
Family member details;
Loan amount;
Alleged unpaid balance;
Accusations of fraud;
Edited defamatory images;
Screenshots of loan information.

This may be actionable under data privacy law, cybercrime law, defamation law, consumer protection principles, and civil law.

Public posting can cause lasting harm because online content may be copied, shared, downloaded, and reuploaded even after deletion.

XI. Abusive Collection and Lending Regulation

Online lending companies and financing companies are subject to regulation. They must comply with rules on registration, disclosure, interest and charges, fair collection, consumer protection, and lawful business conduct.

Abusive collection may involve:

Threats;
Insults;
False legal claims;
Public shaming;
Contact-list harassment;
Misrepresentation;
Deceptive loan terms;
Hidden fees;
Excessive penalties;
Operating without proper authority;
Using unregistered app names;
Delegating collection to abusive third parties.

A lender may be sanctioned even if the borrower still owes money.

XII. Regulatory Complaints Against Online Lending Apps

Victims may file complaints with government agencies depending on the nature of the violation.

The usual agencies include:

Securities and Exchange Commission, for lending companies, financing companies, abusive collection practices, and unregistered lending operations;
National Privacy Commission, for data privacy violations, contact harvesting, unauthorized disclosure, and misuse of personal data;
PNP Anti-Cybercrime Group, for cyber threats, cyber libel, online harassment, fake accounts, and digital evidence;
NBI Cybercrime Division, for cybercrime-related complaints;
Bangko Sentral ng Pilipinas, if the entity is a BSP-supervised financial institution or payment-related entity;
Department of Trade and Industry, in appropriate consumer protection cases;
Local police, for threats, coercion, harassment, or home visits;
Prosecutor’s office, for criminal complaints;
Courts, for civil damages, injunction, or defense in collection cases.

The same facts may support multiple complaints.

XIII. SEC Complaint: When Appropriate

A complaint to the Securities and Exchange Commission may be appropriate when the issue involves the lending company’s conduct as a regulated lender.

Examples:

Abusive collection messages;
Public shaming;
Contacting the borrower’s phone contacts;
Threatening arrest;
Misrepresenting legal consequences;
Using fake legal notices;
Unclear or excessive charges;
Operating under multiple app names;
Lack of company registration or authority;
Harassment by collectors acting for the lending company.

The SEC may investigate whether the company is authorized to lend, whether it violated lending regulations, and whether sanctions should be imposed.

XIV. NPC Complaint: When Appropriate

A complaint to the National Privacy Commission is appropriate when personal data is misused.

Examples:

The app accessed the borrower’s contact list;
The app messaged contacts about the borrower’s debt;
The app disclosed loan information to third parties;
The app posted the borrower’s photo or ID;
The app collected excessive permissions;
The app failed to explain data use;
The app refused to stop using personal data;
The app shared data with collectors without proper basis;
The app used personal data for shaming or threats;
Personal information was leaked or exposed.

The NPC complaint should focus on data collection, processing, disclosure, security, consent, and privacy harms.

XV. Cybercrime Complaint: When Appropriate

Cybercrime authorities may be approached when harassment is done through electronic means.

Possible cyber-related issues include:

Cyber libel;
Online threats;
Use of fake accounts;
Identity misuse;
Hacking or unauthorized access;
Data exposure online;
Digital forgery or fake legal notices;
Harassing group chats;
Obscene or abusive online messages;
Repeated digital intimidation.

The victim should preserve electronic evidence quickly because posts and accounts may be deleted.

XVI. Criminal Liability

Depending on the facts, abusive collectors may face criminal complaints for:

Grave threats;
Light threats;
Unjust vexation;
Grave coercion;
Oral defamation;
Libel or cyber libel;
Identity-related offenses;
Falsification or use of fake documents;
Data-related offenses;
Other offenses depending on the conduct.

A criminal case requires evidence and must be evaluated based on the exact acts committed.

XVII. Civil Liability

A borrower may also pursue civil remedies if harassment caused harm.

Possible civil claims may include:

Moral damages for anxiety, humiliation, sleeplessness, shame, or mental suffering;
Actual damages for financial loss;
Damages for loss of employment or business opportunities;
Damages for reputational injury;
Attorney’s fees;
Injunction or order to stop harmful acts;
Removal or correction of defamatory or privacy-violating content;
Other relief allowed by law.

Civil claims require proof of harm, causation, and wrongful conduct.

XVIII. Non-Payment of Debt Is Generally Civil, Not Criminal

Collectors often threaten borrowers with imprisonment. This is a common fear tactic.

As a general rule, failure to pay an ordinary debt is a civil matter. A borrower is not automatically imprisoned simply for being unable to pay a loan.

However, separate criminal liability may arise if there are additional facts such as fraud, falsification, identity theft, use of fake documents, or issuance of bad checks where applicable. But the lender cannot simply label every unpaid borrower as a criminal.

Threatening arrest or imprisonment without legal basis may be abusive and misleading.

XIX. Estafa Threats by Collectors

Collectors frequently threaten to file estafa. But estafa requires specific elements. Non-payment alone does not automatically equal estafa.

A borrower may become exposed to criminal risk if the loan was obtained through deceit, false identity, fake employment, falsified documents, or fraudulent misrepresentation existing from the beginning. But inability to pay after a genuine loan is ordinarily a civil collection matter.

Collectors who casually threaten estafa to scare borrowers may be engaging in unfair or abusive collection.

XX. Fake Warrants and Subpoenas

A warrant of arrest is issued by a court. A subpoena is issued through proper legal processes. A private lender or collector cannot create a fake warrant or fake subpoena to force payment.

If a borrower receives a supposed legal notice, check:

Is there a court name?
Is there a case number?
Is it signed by a real judge, prosecutor, or authorized officer?
Is there an official seal?
Was it served through proper channels?
Does it contain suspicious grammar, layout, or threats?
Does it demand payment to a private e-wallet immediately?
Does it come from a random phone number?

Fake legal documents should be preserved and included in complaints.

XXI. Harassment of References

Borrowers sometimes provide references during loan application. A lender may contact references for verification if properly disclosed and consented to. But references are not automatically liable for the borrower’s debt.

Collectors should not:

Demand payment from references;
Threaten references;
Shame the borrower through references;
Disclose unnecessary loan details;
Harass references repeatedly;
Accuse references of hiding the borrower;
Add references to group chats for humiliation.

A reference is usually not a guarantor unless they signed a separate obligation.

XXII. Harassment of Family Members

Family members are not automatically liable for the borrower’s online loan. Parents, spouses, siblings, children, or relatives generally do not have to pay unless they signed as co-borrower, co-maker, guarantor, or surety.

Collectors who threaten family members may be liable for harassment, privacy violations, or other offenses.

If family members receive messages, they should preserve screenshots and avoid engaging in heated exchanges.

XXIII. Harassment of Employers and Co-Workers

Contacting an employer can be especially damaging. It may embarrass the borrower and affect employment.

Collectors may tell HR or supervisors that the borrower is a scammer or has unpaid loans. This may be improper disclosure of personal financial information and may also be defamatory if false or malicious.

The borrower should request copies of messages sent to the employer or co-workers. These may be strong evidence in complaints.

XXIV. Use of Debt-Shaming Group Chats

Some collectors create group chats with the borrower’s contacts and post accusations, threats, or loan details.

This can involve:

Data privacy violation;
Cyber harassment;
Cyber libel;
Defamation;
Unfair collection;
Moral damages;
Regulatory sanctions.

The borrower should take screenshots showing the group name, members, sender profile, message content, date, and time.

XXV. Edited Photos, Memes, and “Wanted” Posters

Using edited photos or “wanted” posters to shame borrowers is highly abusive.

These materials may include the borrower’s selfie, ID photo, employer, address, or accusations of fraud.

Such posts may support complaints for privacy violation, cyber libel, harassment, and damages.

The victim should preserve the original image, link, screenshot, account name, and evidence of publication or sharing.

XXVI. Excessive Interest and Hidden Fees

Harassment often comes with disputes over loan amount. Borrowers may receive less than the stated loan because of upfront deductions, then be asked to pay a much larger amount within a short period.

Common issues include:

Hidden processing fees;
Service fees deducted before release;
Very high daily penalties;
Short repayment terms;
Automatic renewal charges;
Inflated collection amounts;
Unclear interest rates;
Misleading display of loan cost;
Charges not disclosed before acceptance;
Payment not properly credited.

A borrower should document the amount applied for, amount actually received, due date, charges, payments made, and current amount demanded.

XXVII. Data Privacy Rights of Borrowers

Borrowers have rights over their personal data. These include the right to be informed, to access, to object, to correct inaccurate data, to request blocking or deletion where applicable, and to complain about misuse.

A borrower may ask the lending company:

What personal data did you collect?
Why did you collect it?
Did you access my contacts?
To whom did you disclose my data?
Who are your third-party collectors?
How long will you retain my data?
How can I withdraw consent where applicable?
How can I request deletion or blocking?
Who is your data protection officer?
What is the basis for contacting third parties?

A lender should have a clear privacy mechanism and should not ignore data subject requests.

XXVIII. Data Subject Request to Lending App

A borrower may send a data privacy request to the company or its data protection officer.

The request may ask for:

Access to personal data collected;
List of recipients of personal data;
Copy of privacy policy accepted;
Basis for processing phone contacts;
Deletion of unlawfully processed contact data;
Cessation of third-party disclosures;
Correction of false information;
Removal of online posts;
Identification of collection agencies;
Confirmation that harassment will stop.

If ignored, the request may be attached to an NPC complaint.

XXIX. Evidence Needed for Complaints

Evidence is the heart of an online lending harassment case.

Collect and preserve:

Screenshots of messages from collectors;
Full conversation threads;
Call logs;
Voice recordings, if lawfully obtained;
Screenshots from contacts who were messaged;
Social media posts;
URLs of posts;
Group chat screenshots;
Fake warrants or subpoenas;
Loan app screenshots;
Loan agreement;
Privacy policy;
App permissions;
Amount borrowed;
Amount actually received;
Payment receipts;
Statement of account;
App name and developer name;
Company name;
Collector phone numbers;
E-wallet or bank accounts used for payment;
Emails with customer service;
Demand letters sent;
Police or barangay blotter, if any;
Affidavits of affected contacts.

Screenshots should show date, time, sender, recipient, and full message.

XXX. How to Preserve Digital Evidence

Digital evidence can disappear quickly. Collectors may delete messages, change names, deactivate accounts, or use disposable SIM cards.

Best practices:

Take screenshots immediately;
Make screen recordings showing profile and full thread;
Save URLs;
Do not crop important details;
Export conversations if possible;
Ask contacts to send original screenshots;
Preserve call logs;
Back up files to cloud storage;
Save payment receipts;
Keep the phone used for the transaction;
Do not delete the app until screenshots are saved;
Record the app store link and developer details;
Save the privacy policy and terms before they change.

Evidence should be organized chronologically.

XXXI. Identifying the Lending Company

Many apps use a brand name different from the registered company name. The complaint should identify all available details:

App name;
App store link;
Developer name;
Company name in loan agreement;
SEC registration details, if shown;
Certificate of authority details, if shown;
Website;
Customer service email;
Data protection officer email;
Collector names or aliases;
Phone numbers;
Social media pages;
Payment account names;
E-wallet numbers;
Bank accounts.

If the company name is unclear, include all identifiers in the complaint.

XXXII. Complaint Before the SEC

A complaint to the SEC should focus on lending regulation and abusive collection.

A. Information to Include

Include:

Borrower’s full name and contact details;
App name;
Company name, if known;
Loan amount and amount received;
Due date;
Amount demanded;
Description of harassment;
Screenshots of threats;
Proof of contact blasting;
Public shaming posts;
Fake legal documents;
Proof of payment, if any;
Names and numbers of collectors;
Relief requested.

B. Possible Requests

The complainant may ask for:

Investigation of the lending company;
Sanctions for abusive collection;
Order to stop harassment;
Verification of registration;
Action against unauthorized app operations;
Referral to other agencies;
Direction to correct abusive practices.

The SEC complaint may result in regulatory action but does not automatically cancel the debt.

XXXIII. Complaint Before the National Privacy Commission

An NPC complaint should focus on personal data misuse.

A. Information to Include

Include:

Borrower’s identity;
App and company details;
Personal data collected;
App permissions requested;
How data was misused;
Contacts who were messaged;
Screenshots of disclosures;
Public posts showing personal data;
Privacy policy screenshots;
Data subject request sent, if any;
Company’s response or failure to respond;
Harm suffered.

B. Possible Requests

The complainant may ask for:

Investigation;
Order to stop unlawful processing;
Deletion or blocking of unlawfully collected contacts;
Removal of public posts;
Correction of false information;
Sanctions for privacy violations;
Direction to improve data protection practices.

The NPC complaint is especially important when the main issue is contact harvesting or disclosure of debt to third parties.

XXXIV. Cybercrime Complaint

For online threats, cyber libel, fake accounts, or digital harassment, the victim may approach cybercrime authorities.

Bring:

Valid ID;
Screenshots;
URLs;
Phone numbers;
Account names;
Full message threads;
Device used;
Payment records;
App details;
Witness screenshots;
Fake documents;
Timeline.

Cybercrime complaints should be filed promptly because digital evidence may be lost.

XXXV. Police or Barangay Blotter

A police or barangay blotter may be useful when:

Collectors threaten to visit;
Collectors actually visit the home or workplace;
The borrower receives threats of harm;
Family members are threatened;
There is stalking or intimidation;
The borrower needs an official record;
Harassment affects safety.

A blotter is not the same as a full case, but it creates documentation.

XXXVI. Cease-and-Desist Letter

A borrower may send a cease-and-desist letter to the lending company, collector, or data protection officer.

The letter should demand that they stop:

Threatening the borrower;
Contacting third parties;
Disclosing loan information;
Posting personal data;
Using abusive language;
Sending fake legal notices;
Processing contacts unlawfully;
Misrepresenting criminal consequences.

The letter should also request a statement of account and proof of authority to collect.

XXXVII. Sample Cease-and-Desist Letter

Subject: Demand to Stop Harassment and Unauthorized Use of Personal Data

Date: [Insert Date]

To: [Name of Lending Company / App / Collection Agency] [Email / Address]

Dear Sir/Madam:

I am writing regarding my account with [name of online lending app], loan account number [insert if available].

Your representatives have engaged in abusive collection and unauthorized use of personal data, including the following:

Sending threatening and insulting messages on [dates];
Contacting my relatives, friends, co-workers, or employer regarding my alleged loan;
Disclosing my personal loan information to persons who are not parties to the loan;
Threatening to post or actually posting my name, photo, address, or loan details;
Sending misleading or fake legal threats.

These acts violate my rights and have caused distress, humiliation, and damage to my privacy and reputation.

You are hereby demanded to immediately stop all harassment, threats, public shaming, third-party contact, unauthorized disclosure, and unlawful processing of my personal data.

Please provide:

A complete statement of account;
Proof of your authority to collect;
The registered name of the lending or financing company;
The name and contact details of your data protection officer;
Identification of any third-party collection agency handling my account;
Confirmation that my personal data and phone contacts will no longer be used for unlawful collection or harassment.

This letter is without prejudice to my right to file complaints before the Securities and Exchange Commission, National Privacy Commission, cybercrime authorities, police, prosecutor’s office, and courts.

Sincerely, [Name] [Contact Details]

XXXVIII. Data Privacy Request Letter

Subject: Data Subject Request Regarding Online Lending Account

Date: [Insert Date]

To: The Data Protection Officer [Company / App Name]

Dear Sir/Madam:

I am a borrower / user of [app name]. I request information regarding the personal data your company collected and processed in relation to my loan application and account.

Please provide:

The categories of personal data collected from me;
The purpose of each category of data processing;
Whether my phone contacts, photos, device information, or location were accessed;
The legal basis for processing my contacts and third-party information;
The persons, collectors, or third parties to whom my personal data was disclosed;
The retention period for my data;
The process for deleting, blocking, or correcting unlawfully processed data;
Confirmation that you will stop contacting persons who are not parties to my loan.

I also object to the use of my personal data for harassment, public shaming, third-party disclosure, or abusive collection.

Please respond in writing.

Sincerely, [Name] [Contact Details]

XXXIX. Settlement With the Lending App

A borrower may settle a valid loan while still complaining about harassment. Settlement and harassment complaints are separate.

Before paying, ask for:

Official statement of account;
Total settlement amount;
Waiver of penalties, if agreed;
Payment deadline;
Official payment channel;
Written confirmation that payment fully settles the account;
Confirmation that collection will stop;
Confirmation that third-party contact will stop;
Receipt after payment;
Certificate of full payment or clearance.

Do not pay to unknown personal accounts without proof of authority.

XL. Sample Settlement Confirmation Request

Subject: Request for Written Settlement Confirmation

Dear [Company/App/Collector]:

Before making any payment, please confirm the following in writing:

Total settlement amount;
Loan account covered;
Official payment channel;
Deadline for payment;
Confirmation that payment will fully settle the account;
Confirmation that no further charges will be imposed after payment;
Confirmation that all collection calls, messages, and third-party contacts will stop;
Confirmation that no personal information will be posted or disclosed.

Please send confirmation from an authorized company representative.

Sincerely, [Name]

XLI. What If the Borrower Cannot Pay Yet?

A borrower who cannot pay immediately should avoid panic. The borrower may:

Request a statement of account;
Ask for restructuring;
Offer installment settlement;
Dispute illegal charges;
Pay only through official channels;
Document harassment;
File complaints for abuse;
Avoid borrowing from another predatory app to pay the first app;
Inform family members not to engage with collectors;
Seek financial counseling or legal assistance.

Inability to pay does not justify harassment.

XLII. What If the Borrower Already Paid?

If harassment continues after payment:

Send proof of payment to official customer service;
Request updated account status;
Ask for certificate of full payment;
Demand that collection stop;
Preserve continued harassment evidence;
File or supplement complaints;
Notify contacts that messages are unauthorized.

Continued harassment after payment is strong evidence of abusive or negligent collection practices.

XLIII. What If the Borrower Never Took the Loan?

Sometimes people are harassed for loans they never took. This may involve identity theft, wrong number, stolen ID, fake application, or misuse of contacts.

The person should:

Deny the loan in writing;
Ask for proof of loan application;
Ask what data was used;
Demand deletion or correction of false data;
File a privacy complaint if personal data was misused;
File a cybercrime or police report if identity theft is suspected;
Tell contacts not to pay;
Preserve all messages and calls.

Do not pay a loan you did not take just to stop harassment without seeking advice.

XLIV. Digital Security Steps for Borrowers

Borrowers should protect their digital information.

Recommended steps:

Revoke app permissions;
Uninstall suspicious apps after saving evidence;
Change passwords;
Enable two-factor authentication;
Check e-wallet and bank security;
Review social media privacy settings;
Do not share OTPs;
Avoid clicking links sent by collectors;
Warn contacts about possible harassment;
Scan the phone for suspicious apps;
Keep backups of evidence;
Use official app or company channels only.

Do not delete evidence before saving copies.

XLV. Message to Contacts

If contacts are being harassed, the borrower may send:

“Please ignore messages from persons claiming to collect a loan from me. They are not authorized to harass you or disclose my personal information. Please take screenshots of any messages, numbers, or posts and send them to me so I can include them in complaints with the proper authorities.”

This helps gather evidence and reduces panic.

XLVI. Employer Communication

If the borrower’s employer is contacted, the borrower may inform HR:

“This is a personal financial matter. The lender or collector is not authorized to harass my workplace or disclose my personal information. If you receive any messages or calls, please preserve screenshots or call details. I am taking legal steps against the harassment.”

This keeps the employer informed and helps preserve evidence.

XLVII. Checklist Before Filing Complaints

Prepare:

Valid ID;
App name and screenshots;
Company name, if known;
Loan agreement or account screenshots;
Amount borrowed and amount received;
Statement of account;
Payment receipts;
Collector messages;
Call logs;
Screenshots from contacts;
Social media posts;
URLs;
Fake legal notices;
App permissions screenshots;
Privacy policy screenshots;
Cease-and-desist letter, if sent;
Data subject request, if sent;
Police or barangay blotter, if any;
Written timeline;
List of harms suffered.

Organized evidence increases the chance of meaningful action.

XLVIII. Complaint-Affidavit Template

Republic of the Philippines [City/Province]

Complaint-Affidavit

I, [Name], Filipino, of legal age, residing at [address], after being duly sworn, state:

I am the complainant in this case.
I used or applied for a loan through [name of online lending app] on or about [date].
The stated loan amount was ₱[amount], but I received ₱[amount] after deductions.
The due date was [date], and the amount demanded was ₱[amount].
On [date], I received messages from [number/account/name] claiming to collect for [app/company].
The collector stated: “[insert exact words].”
On [date], my [relative/co-worker/employer/friend], [name], received a message from the collector disclosing my alleged loan and stating [summarize or quote].
On [date], my personal information, including [name/photo/address/employer/loan details], was posted or shared through [platform/group chat/account].
I did not authorize the public disclosure of my personal information or the harassment of my contacts.
These acts caused me fear, distress, humiliation, and damage to my privacy and reputation.
I attach screenshots, call logs, loan details, and other evidence as annexes.
I am executing this affidavit to support the filing of appropriate complaints against the persons and entities responsible.

Affiant further sayeth none.

[Name and Signature] [Date]

Subscribed and sworn to before me this [date] at [place].

XLIX. Organizing Annexes

A complaint may be organized as follows:

Annex A – Screenshot of loan app and account;
Annex B – Loan amount and amount received;
Annex C – Threatening message to borrower;
Annex D – Message sent to family member;
Annex E – Message sent to employer;
Annex F – Public shaming post;
Annex G – Fake legal document;
Annex H – App permissions screenshot;
Annex I – Privacy policy screenshot;
Annex J – Payment receipt;
Annex K – Cease-and-desist letter;
Annex L – Police or barangay blotter.

Label each annex clearly.

L. Common Defenses of Lending Apps

A lending app may claim:

The borrower consented to data access;
Contacts were listed as references;
The borrower agreed to collection terms;
The messages came from unauthorized third-party collectors;
Screenshots are fake;
The borrower is avoiding payment;
The statements were private, not public;
The borrower gave false information;
Charges were disclosed;
The company is registered.

The borrower should respond with complete evidence, especially screenshots of contact harassment, privacy policy gaps, app permissions, and abusive messages.

LI. Common Mistakes by Borrowers

Borrowers often weaken their complaints by:

Deleting messages;
Not saving screenshots from contacts;
Paying to unknown accounts without receipts;
Ignoring real court documents;
Posting defamatory statements online;
Threatening collectors back;
Signing unclear settlement terms;
Failing to identify the app and company;
Not documenting the amount actually received;
Not requesting a statement of account;
Borrowing from more apps to pay old apps;
Waiting until posts are deleted;
Assuming a complaint automatically cancels the debt.

A complaint against harassment does not automatically erase a valid loan.

LII. Common Mistakes by Lending Companies and Collectors

Lenders and collectors expose themselves to liability when they:

Access contacts unnecessarily;
Disclose debt to third parties;
Use abusive language;
Threaten imprisonment without basis;
Send fake legal notices;
Shame borrowers online;
Use anonymous numbers;
Fail to identify themselves;
Continue collecting after payment;
Inflate balances without explanation;
Ignore data subject requests;
Fail to control third-party collectors;
Operate through unauthorized app names;
Misrepresent civil debt as criminal liability.

The lender’s right to collect must be exercised lawfully.

LIII. Remedies Summary

A victim of online lending harassment and data privacy violations may pursue:

SEC complaint for abusive lending and collection practices;
NPC complaint for unauthorized personal data processing;
Cybercrime complaint for online threats, cyber libel, fake accounts, or digital harassment;
Police blotter for threats or intimidation;
Barangay assistance for local harassment or visits;
Prosecutor complaint for criminal offenses;
Civil action for damages;
Demand for deletion or blocking of unlawfully processed data;
Demand for removal of defamatory posts;
Settlement of valid loan under written terms;
Dispute of excessive or illegal charges;
Defense in any actual collection case filed by the lender.

The best remedy depends on the evidence and objective.

LIV. Frequently Asked Questions

1. Can an online lending app contact my phone contacts?

Not for harassment, public shaming, or unnecessary disclosure of your debt. Contacting all phone contacts is highly questionable, especially if those people are not parties to the loan.

2. Can they post my photo online because I failed to pay?

No. Public shaming and posting personal information may violate privacy rights and may expose the lender or collector to liability.

3. Can I be jailed for not paying an online loan?

Ordinary non-payment of debt is generally civil, not criminal. Separate criminal liability may arise only if there are additional facts such as fraud or falsification.

4. Can they call my employer?

They should not disclose your debt to your employer unless there is a lawful basis. Employer harassment may support a privacy or harassment complaint.

5. What if I clicked “allow contacts” in the app?

App permission does not authorize abusive, excessive, or unfair use of your contacts. Consent must still comply with data privacy principles.

6. Should I pay before filing a complaint?

Payment and harassment complaints are separate. Paying may settle the loan but does not erase prior abusive conduct. If you pay, use official channels and get receipts.

7. What if they continue harassing me after payment?

Preserve proof of payment and evidence of continued harassment. Demand account closure and file or update complaints.

8. What if the app is unregistered?

Include all app details, payment accounts, phone numbers, and screenshots in your complaint. Unregistered lending may be a serious regulatory issue.

9. Can my relatives be forced to pay?

Not unless they signed as co-borrowers, guarantors, sureties, or otherwise legally bound themselves.

10. Can I sue for damages?

Possibly, if you can prove wrongful conduct and harm, such as humiliation, reputational damage, job loss, or emotional distress.

LV. Conclusion

Online lending harassment and data privacy violations are serious problems in the Philippines. While lenders may lawfully collect valid debts, they cannot use threats, public shaming, contact-list harassment, fake legal documents, abusive language, or unauthorized disclosure of personal data.

Borrowers have rights even when they owe money. Personal data collected for loan processing must not be weaponized for humiliation. Phone contacts, employer details, photos, IDs, and private loan information must be handled lawfully, fairly, securely, and only for legitimate purposes.

Victims should preserve evidence, identify the lending app and company, document the timeline, request a statement of account, send cease-and-desist or data privacy requests when appropriate, and file complaints with the proper agencies. The SEC may address abusive lending practices, the National Privacy Commission may address data misuse, cybercrime authorities may address online threats and cyber libel, and courts may provide remedies for damages or unlawful conduct.

A valid debt should be resolved through lawful collection, settlement, or court process. It should never be collected through fear, shame, or misuse of personal data. In the Philippines, the right to collect does not include the right to harass.