If an online loan app is threatening you, messaging your contacts, posting your photo, calling you a “scammer,” or claiming the police will arrest you unless you pay today, the first thing to know is this: Philippine law allows a lender to collect a legitimate debt, but it does not allow harassment, public shaming, contact-list blasting, fake criminal threats, or abusive collection tactics. This guide explains how online loan scams and online lending harassment are treated in the Philippines, what evidence to preserve, where to report, and how to protect yourself without making the situation worse.

First: Is It a Legitimate Online Loan, an Illegal App, or a Scam?

Online lending in the Philippines can involve several different situations:

Situation	What it usually looks like	Why it matters
Legitimate lending company or financing company	Registered company, clear loan terms, official payment channels, customer service, SEC records	They may collect debts, but must follow Philippine law and SEC rules
SEC-recorded online lending platform	The app or platform appears in SEC records as connected to a lending or financing company	Being recorded does not excuse harassment or data privacy violations
Unrecorded or unauthorized online lending app	No clear company name, fake SEC details, personal wallet payments, hidden charges, abusive collectors	Reportable to the SEC and law enforcement if there is fraud, harassment, or unlawful data use
Pure scam	Advance-fee “loan processing,” fake approval, identity theft, fake warrants, threats without any real loan	Usually treated as fraud, cybercrime, or identity-related complaint

The Securities and Exchange Commission (SEC) regulates lending companies under the Lending Company Regulation Act of 2007, RA 9474 and financing companies under the Financing Company Act of 1998, RA 8556. Lending and financing companies generally need SEC registration and authority before they can legally operate.

Before paying or negotiating, check whether the company and app appear in the SEC’s official lists, including the SEC list of recorded online lending platforms, the list of lending companies, and the list of financing companies. App names change often, so rely on the current SEC list, not screenshots shared in Facebook groups.

A key point: even if you really borrowed money, the lender still cannot harass you. A valid debt does not give collectors the right to shame you, threaten your family, message your employer, or misuse your phone contacts.

What Online Lenders and Collectors Cannot Do

The main SEC rule is SEC Memorandum Circular No. 18, Series of 2019, which prohibits unfair debt collection practices by financing companies, lending companies, and their third-party collectors.

Under this circular, collectors must act in good faith and within legal limits. They cannot use collection methods that are abusive, deceptive, or unfair.

Common prohibited acts include:

Using or threatening violence or other criminal means to harm your person, reputation, or property
Threatening legal action that they cannot legally take
Using obscene, insulting, or profane language meant to abuse or intimidate you
Publishing or disclosing your name or personal details as someone who supposedly refuses to pay
Telling other people false information about your loan
Using false representation or deceptive means to collect payment
Calling or messaging at unreasonable or inconvenient times, generally before 6:00 AM or after 10:00 PM, subject to the limits in the SEC rule
Contacting people in your phone contacts who are not your guarantors or co-makers

The 2026 DICT-NPC-SEC public advisory on Online Lending Platforms also specifically warned against harassment, intimidation, public shaming, excessive app permissions, and unlawful use of personal data by online lending platforms.

In simple terms: a lender may remind you to pay, send statements, negotiate, or file a lawful case. But a lender may not terrorize you into paying.

Your Main Legal Protections in the Philippines

SEC rules on unfair debt collection

The SEC can act against lending companies, financing companies, and online lending platforms that violate its rules.

SEC Memorandum Circular No. 18 provides administrative penalties. For lending companies, penalties may include fines starting at ₱25,000 for a first offense and ₱50,000 for a second offense. For financing companies, penalties may start at ₱50,000 for a first offense and ₱100,000 for a second offense. For serious or repeated violations, the SEC may impose higher penalties, suspension, or even revocation of the company’s authority.

The SEC rule also makes companies responsible for the acts of outsourced collectors. A lender cannot simply say, “That was our collection agency, not us.” If the collector was acting for the lender, the company may still be accountable.

Data privacy rights when an app harvests your contacts

The Data Privacy Act of 2012, RA 10173, protects personal information. Online lending apps must follow the principles of transparency, legitimate purpose, and proportionality. This means they should tell you what data they collect, collect it for a lawful and specific purpose, and collect only what is necessary.

Online loan apps became controversial because many demanded access to a borrower’s contact list, photos, storage, camera, or location. The National Privacy Commission (NPC) has issued rules limiting how online lending apps may process such data. Under NPC guidance and the 2026 joint advisory, access to contacts should not be used to shame borrowers or pressure unrelated people to pay.

The NPC has previously acted against abusive online lending practices. In the PondoPeso/Fynamics matter, the NPC found grounds to recommend prosecution for unauthorized processing of personal information after complaints involving use of borrowers’ phone contacts, messages to third parties, and reputational harm. The NPC discussion is available in its official article on an online lending firm found criminally liable for violating data privacy law.

Financial consumer protection

The Financial Products and Services Consumer Protection Act, RA 11765, strengthens consumer protection in financial services. It requires financial service providers to treat consumers fairly, disclose important information, protect client data, and maintain a free consumer assistance mechanism.

RA 11765 also prohibits abusive collection and debt recovery practices. It recognizes that collection must be done with fairness, respect, and proper handling of consumer information.

Possible criminal liability

Some online loan harassment may also involve criminal laws, depending on the facts.

Possible laws include:

Revised Penal Code, Article 282 on grave threats, Article 283 on light threats, Article 286 on grave coercions, Article 287 on unjust vexations, and Articles 353 to 355 on libel
Cybercrime Prevention Act of 2012, RA 10175, especially where defamatory, fraudulent, or identity-related acts are committed through a computer system or online platform
Data Privacy Act provisions on unauthorized processing of personal or sensitive personal information

For example, if a collector posts your photo online and falsely says you are a criminal or scammer, that may raise issues of libel or cyberlibel. The Supreme Court discussed cyberlibel under RA 10175 in Disini v. Secretary of Justice.

If a collector says, “The police are coming to arrest you today,” that is usually a scare tactic unless there is an actual criminal case and lawful warrant. Non-payment of debt alone is not a crime. The 1987 Constitution also protects against imprisonment for debt. However, fraud-related crimes such as estafa are different and require specific elements, not mere failure to pay.

Civil remedies for damages

The Civil Code of the Philippines may also apply. Article 19 requires people to exercise rights with justice, honesty, and good faith. Article 20 allows damages when a person violates the law and causes injury. Article 21 covers willful acts contrary to morals, good customs, or public policy. Article 26 protects privacy and dignity against acts such as humiliating another person or meddling with private life.

This means that, in serious cases, harassment, shaming, and privacy violations may support a civil claim for damages separate from the loan dispute.

Are High Interest Rates and Hidden Charges Legal?

Online loan apps often deduct fees upfront, then demand repayment far higher than the amount received. For example, a borrower may receive ₱3,000 but be told to repay ₱5,000 within seven days.

Several rules may matter:

The Truth in Lending Act, RA 3765, requires disclosure of the true cost of credit, including finance charges.
BSP Circular No. 1133, implemented through SEC rules, imposes caps for certain small online loans.
The Supreme Court has repeatedly reduced unconscionable interest rates. In Medel v. Court of Appeals, the Court treated a 5.5% monthly interest rate as excessive, iniquitous, unconscionable, and contrary to morals.

For covered unsecured, general-purpose loans not exceeding ₱10,000 and with a loan term of up to four months, the caps generally include:

Charge	General ceiling for covered small online loans
Nominal interest	6% per month, or about 0.2% per day
Effective interest	15% per month, or about 0.5% per day, including many fees and charges
Late or non-payment penalty	5% per month on the outstanding scheduled amount due
Total cost cap	100% of the total amount borrowed

If the lender’s charges are confusing or much higher than what was disclosed, preserve the loan disclosure, screenshots, app terms, and payment history. The amount legally collectible may be different from the amount being shouted by collectors.

What To Do Right Now If You Are Being Harassed

1. Do not panic over fake arrest threats

Debt collectors often use urgent scripts:

“Police will arrest you today.”
“We filed a cybercrime case already.”
“We will send your name to immigration.”
“We will message all your contacts every hour.”
“We will post you as a scammer.”

Treat these as evidence. Do not respond emotionally. Do not send money to a personal wallet just because someone is threatening you.

Non-payment of a loan is generally a civil matter. A real legal case has paperwork, proper parties, and lawful procedure. Police do not arrest people merely because a collector sends a text message.

2. Preserve evidence before blocking or deleting

Before blocking, deleting, or uninstalling the app, save proof.

Collect:

Screenshots of all threats, messages, emails, and app notifications
Call logs showing numbers, dates, and times
Screenshots of messages sent to your contacts, employer, relatives, or co-workers
App name, developer name, app store link, website, Facebook page, and customer service numbers
Company name, SEC registration number, Certificate of Authority number, and address if shown
Loan contract, disclosure statement, privacy consent, repayment schedule, and statement of account
Proof of the amount actually received
Proof of payments already made, including bank, GCash, Maya, or remittance reference numbers
Names or aliases used by collectors

If contacts received messages, ask them to send screenshots showing the sender’s number, date, time, and complete message. For formal complaints, written statements or affidavits from affected contacts can help.

3. Verify the lender and payment channel

Before paying anything, verify:

Is the company registered with the SEC?
Does it have a valid Certificate of Authority to operate as a lending or financing company?
Is the online lending platform recorded with the SEC?
Is the payment channel an official company account, not a random personal wallet?
Does the statement of account match the amount you received, the disclosed interest, and your payment history?

Do not pay “settlement” amounts to personal GCash or bank accounts unless you can clearly connect them to the legitimate creditor and get written confirmation.

4. Secure your phone and accounts

Online loan apps may have obtained more access than necessary. After saving evidence:

Revoke app permissions for contacts, camera, photos, storage, microphone, and location
Uninstall suspicious lending apps
Change passwords for email, banking, e-wallets, and social media
Turn on two-factor authentication
Check e-wallet and bank transaction history
Warn close contacts not to engage with collectors or click links
Report fake profiles or public shaming posts to the platform

If your SIM, e-wallet, or online banking account was compromised, report immediately to the provider and request account protection or transaction dispute procedures.

5. Send one calm written response

A short written response can help establish that you objected to unlawful collection and requested proper documentation.

Example:

Please communicate only through this number or email. I dispute the unlawful collection practices, including threats, contact-list messaging, and disclosure of my personal information. Do not contact my relatives, employer, co-workers, or other third parties unless they are lawful guarantors or co-makers. Please send the complete statement of account, company name, SEC registration details, Certificate of Authority, and official payment channels. I am preserving evidence of all communications.

Avoid insults or threats in return. Keep your tone factual. Your messages may later become evidence.

6. Report to the correct agency

Different problems go to different offices. Many victims need to file with more than one agency because online loan harassment may involve lending regulation, data privacy, and cybercrime at the same time.

Problem	Where to report	What to prepare	Practical note
Unfair debt collection by lending company, financing company, or online lending platform	SEC iMessage portal under complaints on financing and lending companies	App name, company name, loan details, screenshots, payment records, collector numbers	SEC can investigate and impose administrative penalties
Contact-list harvesting, public shaming, misuse of personal data	National Privacy Commission complaint process	Notarized complaint form, valid ID, screenshots, privacy notices, proof of data misuse	NPC complaints are document-sensitive; incomplete evidence causes delay
Threats, fake warrants, extortion, identity theft, hacking, cyberlibel	PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT cyber channels	Complaint-affidavit, screenshots, URLs, phone numbers, account names, device details	Criminal investigation may require sworn statements and preservation of digital evidence
Computer-related fraud or cybercrime needing NBI intake	NBI online complaint page or NBI CCD procedure	Complaint sheet, ID, evidence, device if needed	Initial intake may be quick, but investigation can take time
Unauthorized bank or e-wallet transfers	Bank, e-wallet provider, and appropriate regulator	Transaction references, account details, timestamps, screenshots	Report quickly because dispute windows may be short
Credit report issue after payment or disputed loan	Lender, credit bureau/CIC process, and regulator if needed	Proof of payment, settlement agreement, credit report	Harassment complaints do not automatically correct credit records

For cyber harassment, the 2026 DICT-NPC-SEC advisory identifies reporting channels including the DICT Cyber Hotline, NBI Cybercrime Division, and PNP Anti-Cybercrime Group. For SEC-regulated lending and financing issues, the SEC iMessage portal is the central complaint route.

Documents and Evidence Checklist

Evidence	Why it helps
Valid government ID	Usually required for formal complaints
Screenshots of threats and harassment	Shows the exact words, numbers, dates, and times
Screen recording of chat threads	Helps show continuity and prevents claims that screenshots were edited
Messages sent to contacts or employer	Proves third-party harassment or data misuse
Loan agreement or app disclosure	Shows the stated amount, interest, fees, and due date
Proof of amount received	Important when the app deducted hidden charges upfront
Payment receipts	Prevents repeated collection of already-paid amounts
App store link, website, developer name	Helps identify the operator
Company name and SEC details	Helps SEC verify jurisdiction and records
Affidavits or statements from affected contacts	Useful for NPC, prosecutor, PNP, or NBI complaints
URLs of public posts	Needed for cyberlibel, takedown, or platform reports

For NPC formal complaints, the complaint form generally needs to be properly filled out, signed, notarized, and submitted according to the NPC’s filing rules. If you are abroad, sworn documents may need notarization before a Philippine Embassy or Consulate, or notarization and apostille depending on the receiving office and purpose.

Common Scenarios

“They messaged my contacts and employer.”

This is one of the most common online loan harassment tactics. Under SEC rules and the 2026 DICT-NPC-SEC advisory, contacting people in your phone contacts who are not guarantors or co-makers is generally prohibited as an unfair collection practice.

If your employer or co-workers received messages, save those screenshots. If the messages damaged your reputation, caused workplace issues, or falsely accused you of fraud, the conduct may raise SEC, NPC, civil, and possibly criminal issues.

“They posted my photo and called me a scammer.”

Posting your photo, name, address, ID, or loan details online may involve data privacy violations, civil liability, libel, or cyberlibel depending on the content and platform. Preserve the URL, screenshots, account name, comments, date, and time. Ask other people not to argue in the comments because that may spread the post further.

Report the post to the platform, but save evidence first. Once the post is removed, it may become harder to prove what happened.

“They said I will be arrested if I do not pay today.”

A collector cannot create an arrest by text message. A lawful arrest generally requires legal grounds, and debt alone does not justify imprisonment. Fake police threats are commonly used to pressure borrowers into paying immediately.

However, do not ignore real court or prosecutor documents. If you receive an official subpoena, court notice, prosecutor notice, or barangay summons from an actual government office, verify it directly with that office.

“The app says I owe much more than I received.”

Compare four numbers:

The amount approved
The amount actually released to you
The disclosed interest and fees
The amount now being collected

If the app deducted large “processing fees” upfront or imposed daily penalties, check whether the loan falls under the small online loan caps and whether the charges were properly disclosed under the Truth in Lending Act. If the interest is grossly excessive, the Supreme Court doctrine on unconscionable interest may also be relevant.

“The collector says they will go to my barangay or workplace.”

A collector may attempt lawful collection, but cannot trespass, cause a scandal, shame you, threaten you, or force you to sign documents. If someone appears in person:

Ask for a company ID and written authority
Do not let them enter your home without consent
Do not sign blank documents
Do not surrender IDs, ATM cards, phones, or SIM cards
Record names, vehicle plates, time, and witnesses
Call barangay officials or police if they create a disturbance or threaten harm

Barangay proceedings are not the main remedy for SEC-regulated lending abuses or cyber harassment. Barangay records may help document a local incident, but SEC, NPC, PNP, or NBI action may still be needed.

“I am an OFW or foreigner outside the Philippines.”

You can still preserve evidence and file many initial reports online or by email. The issue is usually documentation. For formal complaints, agencies may require signed and notarized statements. Documents signed abroad may need to be notarized at a Philippine Embassy or Consulate, or notarized and apostilled depending on the office and proceeding.

Foreigners dealing with Philippine online lending harassment should keep proof connecting the incident to the Philippines, such as Philippine phone numbers, Philippine payment channels, Philippine company details, SEC records, or messages sent to people in the Philippines.

Practical Timelines and Bottlenecks

Online lending complaints move faster when the evidence is organized.

Step	Typical practical reality
SEC iMessage filing	You can create an online ticket and upload evidence. Response time varies depending on completeness, caseload, and whether the company can be identified.
NPC formal complaint	The common bottlenecks are notarization, incomplete screenshots, missing proof of identity, and unclear explanation of how personal data was misused.
PNP or NBI cyber complaint	Intake may be straightforward, but identifying anonymous accounts, prepaid numbers, or fake profiles can take time and may require preservation requests or technical investigation.
App takedown or blocking	Not instant. Agencies and platforms usually need sufficient evidence and process.
Payment dispute	Separate from harassment. You may need proof of payment, official receipts, settlement confirmation, and regulator complaints if the lender keeps collecting.
Credit report correction	Also separate. A harassment complaint does not automatically erase a legitimate debt or correct credit records.

Frequently Asked Questions

Can online loan apps message my contacts in the Philippines?

Generally, they cannot message random contacts from your phonebook for collection. SEC rules treat contacting people in your contact list who are not guarantors or co-makers as an unfair debt collection practice. The 2026 DICT-NPC-SEC advisory also warns against using contact-list access for harassment or collection outside lawful guarantors.

Can I be arrested for not paying an online loan?

Non-payment of debt alone is generally not a criminal offense, and the Constitution protects against imprisonment for debt. A lender may pursue lawful civil remedies, but fake arrest threats are not legitimate collection. Criminal cases such as estafa require specific facts like deceit or fraud, not mere inability to pay.

Where do I report online lending harassment?

Report unfair collection practices to the SEC through the SEC iMessage portal. Report misuse of personal data to the National Privacy Commission. Report threats, extortion, fake warrants, hacking, cyberlibel, or fraud to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT cyber channels.

What if the online lending app is not registered with the SEC?

Save the app details, screenshots, payment channels, and messages, then report it to the SEC. If there was fraud, identity misuse, threats, or hacking, also report to cybercrime authorities. An unregistered app may still claim you received money, but it cannot use unlawful collection methods.

Does filing a complaint erase my debt?

Not automatically. A complaint for harassment, data privacy violation, or unfair collection is separate from whether a valid loan exists. However, illegal charges, undisclosed fees, excessive interest, unauthorized collection methods, and payments already made may affect the amount that can be lawfully collected.

Can an online lender post my picture or call me a scammer?

Publicly posting your photo, name, address, ID, or loan details to shame you may violate SEC rules, the Data Privacy Act, civil law, and possibly libel or cyberlibel laws. Save screenshots and URLs before reporting the post.

Are high interest rates from online loan apps legal?

Not always. Certain small online loans are subject to interest and fee caps. Even outside those caps, courts may reduce interest that is excessive, iniquitous, or unconscionable. The lender must also comply with disclosure rules under the Truth in Lending Act.

What should I do if I already paid but they keep collecting?

Gather payment receipts, reference numbers, screenshots of payment confirmation, and any settlement messages. Ask for a written statement of account and official confirmation that the account is closed. If collection continues despite proof of payment, report the conduct to the SEC and preserve all new demands.

Can a collector contact my employer?

A collector should not contact your employer to shame you, pressure you, or disclose your personal loan information. If your employer is not a guarantor or co-maker, employer contact may support an SEC complaint and possibly a data privacy complaint.

Can OFWs or foreigners file complaints from abroad?

Yes, but formal filings may require proper identification, signed statements, and notarized or authenticated documents. Start by preserving digital evidence and checking the filing rules of the SEC, NPC, PNP, or NBI. Documents executed abroad may need consular notarization or apostille depending on the agency or proceeding.

Key Takeaways

A lender may collect a legitimate debt, but it cannot harass, shame, threaten, or misuse your personal data.
Contacting random phonebook contacts, employers, relatives, or co-workers is generally prohibited when they are not guarantors or co-makers.
Save evidence before blocking, deleting, uninstalling, or reporting.
Verify the lender, company name, SEC authority, app listing, and payment channel before paying.
Report unfair debt collection to the SEC, data privacy violations to the NPC, and threats, scams, hacking, or cyberlibel to cybercrime authorities.
Non-payment of debt alone is not a basis for arrest or imprisonment.
Hidden fees, excessive interest, and repeated collection after payment should be documented and disputed with proof.
The strongest complaints are specific, organized, and supported by screenshots, payment records, app details, and witness statements.