I. Introduction

The rise of online lending applications in the Philippines has given many borrowers quick access to emergency credit. With only a mobile phone, internet connection, and a few identity documents, a person may now apply for a loan without visiting a bank or traditional lending office. This convenience, however, has also created serious legal and social problems.

A recurring abuse involves online lending companies, collectors, agents, or third-party service providers who harass borrowers, shame them publicly, threaten them, contact their relatives, access their phone contacts, disclose their debts, or use personal information without valid consent. These acts may give rise to liability under Philippine laws on lending regulation, data privacy, cybercrime, consumer protection, civil liability, and, in some cases, criminal law.

Online loan harassment is not merely an issue of unpaid debt. Even when a borrower is in default, lenders and collectors must still comply with the law. Debt collection must be fair, lawful, proportionate, and respectful of privacy and dignity. A person’s failure to pay a loan does not authorize threats, humiliation, unauthorized disclosure of personal data, or digital surveillance.

This article discusses the legal framework governing online loan harassment and data privacy violations in the Philippines, the rights of borrowers, the obligations of lenders, possible remedies, and practical steps for victims.

II. Nature of Online Lending and Common Abuses

Online lending platforms usually operate through websites or mobile applications. They may be lending companies, financing companies, loan marketplaces, or intermediaries connecting borrowers to lenders. Many require the borrower to submit personal information, such as:

Name, address, phone number, email address, government ID, employment information, income details, bank or e-wallet account, facial image, device information, location data, and sometimes access to phone contacts or social media information.

The problem arises when lenders or collectors use this information for abusive collection practices. Common complaints include:

Repeated calls and messages at unreasonable hours;
Threats of arrest, imprisonment, barangay action, or public exposure;
Sending defamatory or humiliating messages to the borrower;
Contacting the borrower’s family, friends, employer, co-workers, or phone contacts;
Disclosing the borrower’s loan, alleged debt, or default to third persons;
Posting the borrower’s photo, name, address, ID, or debt details online;
Creating group chats to shame the borrower;
Using obscene, insulting, or degrading language;
Threatening physical harm;
Falsely claiming to be a lawyer, police officer, court officer, or government employee;
Accessing a borrower’s contact list without valid consent;
Using personal data for purposes beyond the loan application;
Continuing to process or share personal data after consent has been withdrawn, where withdrawal is legally effective;
Failing to provide a privacy notice or hiding invasive data permissions in vague terms.

These practices may violate multiple Philippine laws at once.

III. Debt Is Not a License to Harass

A central principle must be emphasized: owing money is not a crime by itself. Non-payment of a loan, standing alone, generally gives rise to civil liability, not imprisonment. A lender may demand payment, charge lawful interest and penalties, report the account to lawful credit reporting systems if allowed, file a civil collection case, or pursue legitimate legal remedies. But the lender may not use harassment, intimidation, public shaming, unauthorized disclosure, or misuse of personal information.

The Philippine Constitution protects human dignity, privacy, and due process. Civil law protects persons from abuse of rights. Criminal law punishes threats, coercion, libel, unjust vexation, and other wrongful acts. Data privacy law protects personal information from unlawful or excessive processing. Regulatory rules also prohibit unfair debt collection practices.

Thus, even a valid debt must be collected through lawful means.

IV. Relevant Philippine Laws and Legal Framework

A. Data Privacy Act of 2012

The Data Privacy Act of 2012, or Republic Act No. 10173, is one of the most important laws in online loan harassment cases. It governs the processing of personal information and sensitive personal information by personal information controllers and processors.

Online lenders collect and process large amounts of personal data. They are generally considered personal information controllers because they determine why and how personal information is collected, used, stored, disclosed, and retained.

Under the Data Privacy Act, personal data processing must observe the principles of transparency, legitimate purpose, and proportionality.

Transparency means the borrower must know what personal data is being collected, why it is collected, how it will be used, who will receive it, how long it will be retained, and what rights the borrower has.

Legitimate purpose means the data must be processed only for lawful and declared purposes. A lender may process personal data to evaluate a loan application, verify identity, disburse funds, manage the account, and conduct lawful collection. But using the borrower’s contacts to shame, threaten, or pressure the borrower is not a legitimate purpose.

Proportionality means data collection and use must be adequate, relevant, suitable, necessary, and not excessive. An app that collects all phone contacts, photos, messages, or unrelated device information may violate proportionality if such access is unnecessary for the lending transaction.

B. Sensitive Personal Information

The Data Privacy Act gives stronger protection to sensitive personal information. This includes information about age, marital status, health, education, government-issued identification numbers, and other legally protected data. Many online loan applications collect government IDs, selfies, biometric-like images, employment details, and financial information. Misuse or unauthorized disclosure of these may lead to greater liability.

C. Rights of Data Subjects

Borrowers are data subjects. They have rights under the Data Privacy Act, including:

The right to be informed;
The right to access their personal data;
The right to object to processing;
The right to erasure or blocking, when legally justified;
The right to rectification of inaccurate data;
The right to data portability, when applicable;
The right to damages for unlawful or harmful processing;
The right to file a complaint with the National Privacy Commission.

These rights are especially relevant when a borrower discovers that an online lender accessed contacts, disclosed debt information, or used personal data for harassment.

D. National Privacy Commission Rules and Enforcement

The National Privacy Commission, or NPC, is the principal authority implementing the Data Privacy Act. It may receive complaints, investigate violations, issue compliance orders, recommend prosecution, and impose administrative consequences where allowed.

Victims of online loan harassment involving misuse of personal data may file a complaint with the NPC. The complaint should include screenshots, call logs, text messages, app permissions, privacy notices, names of the lending app or company, and evidence that third persons were contacted or informed about the debt.

E. Lending Company Regulation Act and SEC Regulation

Lending companies and financing companies are regulated in the Philippines. They must be registered and must comply with rules issued by the Securities and Exchange Commission, or SEC. The SEC has taken action against abusive online lending operators in various instances, especially those using unfair collection practices.

Debt collection must not involve threats, obscene language, false representation, public shaming, unauthorized disclosure of borrower information, or communication with persons who are not legally responsible for the loan except in limited and lawful circumstances.

A lender that uses abusive collection practices may face regulatory sanctions, suspension, revocation of authority, penalties, or other enforcement measures.

F. Cybercrime Prevention Act of 2012

Republic Act No. 10175, or the Cybercrime Prevention Act, may apply when harassment is committed through information and communications technology. If threats, libelous statements, identity misuse, unauthorized access, or illegal data disclosure happen online, through social media, messaging apps, email, or digital platforms, cybercrime liability may arise.

Cyber libel may be relevant if a lender or collector posts or sends defamatory statements about the borrower to others. Computer-related offenses may be relevant if an app or system accesses data without proper authority. The use of electronic means can aggravate or transform certain acts into cyber-related offenses.

G. Revised Penal Code

Several provisions of the Revised Penal Code may apply depending on the facts:

Grave threats may arise when a collector threatens to inflict harm, accuse the borrower of a crime, or cause serious damage.

Light threats may apply to less severe but still unlawful threats.

Grave coercion may arise when a person is compelled to do something against their will through violence, threats, or intimidation.

Unjust vexation may apply to persistent acts intended to annoy, irritate, torment, or distress another person without lawful justification.

Slander or oral defamation may apply if defamatory words are spoken.

Libel may apply if defamatory statements are made in writing or similar means. If committed online, cyber libel may be considered.

Intriguing against honor may apply to acts spreading rumors or statements that damage reputation.

Usurpation of authority may apply if a collector falsely claims to be a police officer, court sheriff, prosecutor, government agent, or other authority.

The exact offense depends on the evidence, wording of the messages, method used, identity of the wrongdoer, and effect on the victim.

H. Civil Code

The Civil Code also provides remedies. Abuse of rights, acts contrary to morals, and acts causing damage to another person may give rise to civil liability. A borrower may claim damages if the lender’s conduct caused mental anguish, social humiliation, reputational harm, loss of employment, business injury, or other compensable damage.

Relevant civil law principles include:

Every person must act with justice, give everyone his due, and observe honesty and good faith;
A person who willfully or negligently causes damage to another may be liable;
Acts contrary to morals, good customs, or public policy may result in damages;
Defamation, invasion of privacy, and humiliation may support claims for moral damages.

I. Consumer Protection Principles

Borrowers are financial consumers. Lenders must provide fair, transparent, and responsible services. They must disclose loan terms, charges, penalties, interest, and collection practices. Unfair, deceptive, or abusive acts may violate consumer protection principles.

Online lenders should not conceal excessive fees, mislead borrowers about repayment obligations, or use pressure tactics that deprive borrowers of informed choice.

V. Data Privacy Issues in Online Lending

A. Consent Is Not Always Valid

Many online lending apps rely on consent. However, consent must be freely given, specific, informed, and evidenced by recorded means. Consent buried in vague terms and conditions may not be sufficient if the borrower is not clearly informed of invasive data practices.

Consent is also limited by law. Even if a borrower clicks “I agree,” the lender still cannot process personal data for unlawful, unfair, excessive, or disproportionate purposes. Consent does not legalize harassment.

B. Excessive App Permissions

A common issue is the request for access to contacts, photos, camera, microphone, location, storage, or device identifiers. Some permissions may be necessary for identity verification or fraud prevention. But blanket access to all contacts, files, or messages may be excessive.

Under the proportionality principle, the lender must show that the data collected is suitable, necessary, and not excessive for the declared purpose. Accessing the entire contact list merely to pressure the borrower through social shame is not lawful.

C. Contacting Third Persons

Contacting third persons is one of the most common violations. A lender may ask for character references or emergency contacts, but this does not automatically authorize the lender to disclose the borrower’s debt to them.

Third persons who are not co-borrowers, guarantors, sureties, or legally responsible parties generally should not be informed of the borrower’s debt. Calling or messaging them to shame the borrower, demand payment, or reveal loan details may violate privacy rights.

D. Public Shaming

Public shaming is especially serious. Posting a borrower’s name, photo, ID, address, phone number, loan amount, or alleged delinquency on social media or in group chats may constitute unauthorized disclosure of personal information, defamation, harassment, and possibly cybercrime.

The fact that the borrower owes money does not make public exposure lawful. Debt collection must be addressed to the borrower or legally responsible parties through lawful channels.

E. Data Sharing with Collectors

Online lenders often use third-party collection agencies or outsourced agents. The lender remains responsible for ensuring that these parties comply with data privacy law. There should be proper data sharing or outsourcing agreements, security measures, confidentiality obligations, and clear limits on how borrower information may be used.

A lender cannot escape liability by saying that the harassment was done by a third-party collector if the collector acted on its behalf or used data obtained from the lender.

F. Retention of Personal Data

Personal data should not be retained longer than necessary. Lenders may retain records for legitimate legal, accounting, regulatory, or fraud-prevention purposes. However, indefinite retention without purpose may violate data privacy principles.

Borrowers may request deletion, blocking, or correction of personal data when the legal basis for processing no longer exists or when data has been unlawfully obtained or used.

VI. Harassment and Unfair Collection Practices

Debt collection becomes unlawful when it crosses the line from legitimate demand into abuse. Examples include:

Threatening imprisonment for non-payment of a civil debt;
Threatening to post the borrower’s photo online;
Sending messages such as “scammer,” “fraudster,” or “criminal” to relatives or employers;
Calling dozens of times a day to intimidate the borrower;
Using profanity, sexual insults, or degrading language;
Claiming that police or barangay officials are coming to arrest the borrower;
Creating fake legal documents or fake subpoenas;
Pretending to be from a law office without authority;
Disclosing loan details to persons not involved in the transaction;
Using contact lists obtained through app permissions to pressure payment;
Threatening to contact the borrower’s employer to cause job loss;
Demanding payment from family members who are not guarantors;
Harassing minors, elderly relatives, or uninvolved contacts;
Sending edited images, memes, or defamatory posts about the borrower.

These acts may support complaints before the NPC, SEC, police cybercrime units, prosecutors, or courts, depending on the circumstances.

VII. Legitimate Collection vs. Illegal Harassment

Not all collection activity is unlawful. A lender may:

Send payment reminders;
Call or message the borrower at reasonable times;
Explain the outstanding balance;
Offer restructuring or settlement;
Refer the account to a lawful collection agency;
Send a formal demand letter;
File a civil case;
Report to lawful credit information systems if legally allowed;
Communicate with a co-maker, guarantor, or surety if that person is legally bound;
Preserve records for legal and regulatory purposes.

However, the lender may not:

Threaten violence;
Threaten arrest without basis;
Shame the borrower publicly;
Reveal the debt to uninvolved persons;
Use false legal authority;
Misuse personal data;
Access contacts or files beyond what is lawful and necessary;
Use abusive, obscene, or defamatory language;
Continue unlawful processing after objection where no overriding legal basis exists;
Collect through intimidation rather than lawful process.

The distinction lies in lawfulness, necessity, proportionality, truthfulness, and respect for privacy.

VIII. Liability of Online Lending Apps, Companies, Officers, and Collectors

Liability may attach to different actors:

A. Lending Company

The lending company may be liable if the harassment was committed by its employees, agents, collectors, or outsourced providers acting within the collection process. It may also be liable for poor data governance, excessive data collection, unauthorized disclosure, or failure to supervise collectors.

B. Officers and Directors

Company officers may face liability if they authorized, tolerated, directed, or knowingly failed to prevent unlawful practices. Regulatory agencies may also evaluate management responsibility.

C. Collection Agencies

Collection agencies may be liable for abusive acts committed by their collectors. They must comply with privacy, consumer protection, and collection rules.

D. Individual Collectors

Individual collectors may face criminal, civil, or administrative liability for threats, defamation, harassment, coercion, or unlawful disclosure.

E. App Developers and Data Processors

App developers, data processors, analytics providers, or service providers may be liable if they participate in unlawful data processing, fail to implement security measures, or process data beyond lawful instructions.

IX. Possible Legal Remedies for Victims

A victim may pursue several remedies, depending on the facts.

A. Complaint with the National Privacy Commission

If the issue involves unauthorized collection, access, use, sharing, disclosure, or retention of personal data, a complaint may be filed with the NPC.

Useful evidence includes:

Screenshots of messages;
Call logs;
Audio recordings, where legally obtained;
Names and numbers of collectors;
App name and company name;
Privacy policy and terms of service;
Proof of app permissions;
Messages sent to relatives, friends, or employers;
Affidavits from third persons contacted;
Copies of posted defamatory content;
Evidence of identity documents or photos being shared.

B. Complaint with the SEC

If the lender is a lending or financing company, a complaint may be filed with the SEC for abusive collection practices, unregistered lending operations, or regulatory violations.

The complainant should include the name of the lending app, corporate name if known, screenshots, loan documents, payment records, and evidence of harassment.

C. Police or Cybercrime Complaint

If threats, cyber libel, identity misuse, hacking, unauthorized access, or online harassment occurred, the victim may seek assistance from cybercrime authorities or law enforcement.

D. Criminal Complaint Before the Prosecutor

The victim may execute an affidavit-complaint for applicable offenses such as threats, coercion, unjust vexation, libel, cyber libel, slander, or other crimes supported by the evidence.

E. Civil Action for Damages

The victim may seek damages for mental anguish, humiliation, reputational harm, loss of employment, business injury, or other losses caused by unlawful collection and privacy violations.

F. Barangay Proceedings

For disputes between individuals residing in the same city or municipality, barangay conciliation may sometimes be required before court action. However, cases involving corporations, offenses punishable beyond barangay jurisdiction, urgent relief, or parties in different localities may be treated differently. Legal advice should be obtained on whether barangay proceedings are required.

X. Evidence Preservation

Victims should preserve evidence immediately. Harassment often happens through disappearing messages, deleted posts, temporary accounts, or changing phone numbers. Recommended steps include:

Take screenshots showing the sender, number, date, time, and full message;
Save call logs;
Screen-record abusive conversations if possible;
Ask contacted relatives or friends to send screenshots;
Save URLs of posts or profiles;
Do not delete the lending app until relevant permissions and records are documented;
Download the app’s privacy policy and terms;
Keep loan agreements, payment receipts, and transaction records;
Record names used by collectors;
Preserve emails, text messages, and chat histories;
Write a timeline of events;
Obtain affidavits from witnesses if the matter will be formally filed.

Evidence should be organized by date and platform. A clear chronology helps regulators, police, lawyers, and prosecutors understand the pattern of harassment.

XI. Practical Steps for Borrowers Experiencing Harassment

A borrower experiencing harassment may consider the following:

Communicate in writing as much as possible;
Avoid engaging in emotional arguments with collectors;
Ask for the collector’s full name, company, authority, and official contact details;
Request a statement of account and breakdown of charges;
Tell the lender to stop contacting third persons not legally responsible for the loan;
Object to unauthorized processing and disclosure of personal data;
Revoke unnecessary app permissions;
Uninstall the app after preserving evidence, if continued access is a risk;
Inform family, friends, or employer that any contact from collectors should be documented;
File complaints with the proper agencies;
Seek legal assistance if threats escalate;
Pay only through official channels and keep receipts;
Beware of fake settlement offers or unofficial collector accounts;
Do not provide new sensitive information to unknown collectors.

Borrowers should also distinguish between disputing harassment and ignoring legitimate debt. If the debt is valid, the borrower may still negotiate payment, restructuring, waiver of penalties, or settlement, but the lender must collect lawfully.

XII. Employer and Workplace Harassment

Some collectors contact employers or co-workers to pressure payment. This may be unlawful if they disclose the borrower’s debt or make defamatory statements. An employer is generally not responsible for an employee’s personal loan unless the employer is a party to the transaction.

A borrower whose workplace is contacted should document:

Who was contacted;
What was said;
The number or account used;
Whether the loan details were disclosed;
Whether threats or defamatory statements were made;
Whether employment consequences resulted.

If the harassment affects employment, the borrower may have stronger claims for damages.

XIII. Family Members and Emergency Contacts

Online lenders often ask for references or emergency contacts. Providing a contact number does not necessarily mean the lender may disclose the borrower’s debt or demand payment from that person. Unless the person is a co-maker, guarantor, surety, or otherwise legally bound, the lender should not demand payment from them.

Collectors who tell parents, spouses, siblings, friends, or neighbors that the borrower is a debtor, scammer, or criminal may be committing privacy violations and possibly defamation.

XIV. Defamation and Cyber Libel Concerns

A lender or collector may be liable for defamatory statements if they publicly or privately impute a crime, vice, defect, dishonesty, or condition that dishonors or discredits the borrower.

Calling a borrower a “scammer,” “estafador,” “criminal,” or “fraudster” may be defamatory if not supported by a lawful finding and if communicated to third persons. If posted online or sent through digital platforms, cyber libel may be considered.

Truth alone is not always a complete defense if the communication is malicious, excessive, or made to persons with no legitimate interest. Debt collection should not become a reputational attack.

XV. Threats of Imprisonment and Estafa

Collectors sometimes claim that a borrower will be jailed for non-payment. This is often misleading. Non-payment of debt is generally civil in nature. However, criminal liability may arise in separate circumstances, such as fraud, deceit, falsification, or issuance of a bouncing check under applicable laws.

A mere inability to pay does not automatically constitute estafa. To establish estafa, there must generally be deceit or abuse of confidence resulting in damage. Collectors who automatically label borrowers as criminals may expose themselves and their companies to liability.

XVI. Interest, Penalties, and Transparency

Another issue in online lending is excessive or unclear charges. Borrowers may complain that the amount received is much lower than the amount payable due to processing fees, service fees, platform fees, insurance charges, or penalties.

Lenders must disclose material loan terms clearly. These include principal, interest rate, finance charges, penalties, due date, total amount payable, and consequences of default. Hidden charges or misleading disclosures may support regulatory complaints.

Even when fees are disclosed, they may still be scrutinized if they are unconscionable, deceptive, or contrary to law or regulation.

XVII. Unregistered or Illegal Online Lenders

Some online lending apps may operate without proper registration or authority. Borrowers should verify whether the company is registered and authorized to lend. Use of a trade name or app name may hide the actual corporate entity, making enforcement more difficult.

Operating without proper authority may expose the lender to regulatory action. It may also strengthen a borrower’s complaint if the lender engages in abusive collection.

However, the possible illegality of a lender’s operation does not automatically erase all factual questions about money received. Borrowers should seek legal advice on the effect of illegality, enforceability, and remedies.

XVIII. Cross-Border and Anonymous Collectors

Some online lending harassment involves anonymous numbers, foreign-based operators, or apps with unclear ownership. This complicates enforcement but does not make the conduct lawful.

Victims should still gather evidence and report the app, phone numbers, e-wallet accounts, websites, and social media profiles. Regulators and law enforcement may coordinate with platforms, telcos, payment providers, and app stores where appropriate.

XIX. Responsibility of App Stores, Platforms, and Payment Channels

App stores, social media platforms, messaging services, and payment channels are not automatically liable for every act of a lender. However, they may have policies against abusive, fraudulent, or privacy-invasive apps and accounts. Victims may report offending apps or accounts to the relevant platform.

Payment channels may also be relevant where collectors use personal accounts, suspicious merchant accounts, or changing payment instructions. Borrowers should pay only through official and verifiable channels.

XX. Draft Notice to Stop Harassment and Unauthorized Data Processing

A borrower may send a written notice to the lender. A sample form is below:

Subject: Demand to Cease Harassment and Unauthorized Processing of Personal Data

To whom it may concern:

I am writing regarding my loan account with your company. I demand that you and your agents immediately cease all harassment, threats, public shaming, defamatory statements, and unauthorized disclosure of my personal information.

You are directed to stop contacting my relatives, friends, employer, co-workers, phone contacts, and other third persons who are not legally responsible for my loan. Any disclosure of my loan details, alleged default, personal information, photographs, identification documents, address, or contact details to unauthorized persons is without my consent and is contrary to my rights under Philippine law.

Please provide a complete statement of account, including principal, interest, fees, penalties, payments made, and the legal basis for all charges. All further communications should be made only through official channels and in a lawful and respectful manner.

I reserve all rights to file complaints with the National Privacy Commission, Securities and Exchange Commission, law enforcement authorities, and the proper courts for any violation of my rights.

Sincerely,

[Name]

This kind of letter does not erase a valid debt, but it documents objection to unlawful collection and data misuse.

XXI. Defenses Lenders Commonly Raise

Lenders may argue that:

The borrower consented to data collection;
The borrower agreed to the privacy policy;
Contacts were provided as references;
Collection messages were necessary for debt recovery;
The acts were done by a third-party collector;
The borrower is in default;
Communications were private;
The borrower’s allegations are fabricated.

These defenses are not automatically valid. Consent must be lawful and specific. Collection must be proportionate. Third-party collectors must comply with privacy obligations. Default does not justify harassment. Private messages to third persons may still be unauthorized disclosure or defamation. Evidence will determine liability.

XXII. Compliance Obligations of Online Lenders

A lawful online lender should implement the following:

Clear privacy notice;
Lawful basis for all data processing;
Minimal and proportionate app permissions;
Secure data storage;
Limited access to borrower data;
Written agreements with processors and collectors;
Training for collectors;
Prohibition on threats, shaming, and unauthorized disclosure;
Complaint-handling system;
Data retention and deletion policy;
Data breach response procedure;
Mechanism for data subject requests;
Accurate loan disclosures;
Responsible advertising;
Compliance with SEC and NPC rules;
Audit trails for collection activity.

Compliance is not merely a formal privacy policy. It must be reflected in actual practices.

XXIII. The Role of Lawyers and Legal Aid

Victims may benefit from consulting a lawyer, especially where:

There are threats of violence;
Personal data has been posted online;
The borrower’s employer was contacted;
False criminal accusations were made;
The borrower suffered job loss or reputational harm;
The amount involved is large;
A formal complaint or court case is being prepared;
The lender has filed or threatened legal action.

Those unable to afford counsel may seek assistance from legal aid organizations, law school legal aid clinics, public attorney services where qualified, or consumer protection offices.

XXIV. Balancing Creditor Rights and Borrower Protection

The law protects both sides. Lenders have the right to be paid and to pursue lawful remedies. Borrowers have the obligation to pay valid debts according to agreed terms. But collection must respect privacy, dignity, truth, fairness, and due process.

A healthy credit system requires responsible borrowing and responsible lending. Abusive collection harms not only borrowers but also the legitimacy of the lending industry. It discourages financial inclusion and exposes lenders to legal risk.

XXV. Conclusion

Online loan harassment in the Philippines is a serious legal issue involving privacy, consumer protection, cybercrime, criminal law, civil liability, and financial regulation. The most common violations include unauthorized access to contacts, disclosure of debts to third persons, public shaming, threats, defamatory messages, excessive collection calls, and misuse of personal data.

Borrowers should understand that non-payment of a loan does not strip them of legal rights. Lenders and collectors must act within the bounds of law. They may demand payment, negotiate settlement, and pursue civil remedies, but they may not harass, shame, threaten, or misuse personal information.

Victims should preserve evidence, assert their rights, report violations to the proper authorities, and seek legal assistance when necessary. Online lending can serve a legitimate financial purpose, but it must operate under the rule of law. In the Philippine legal framework, debt collection must never become a tool for humiliation, intimidation, or unlawful surveillance.