Here’s a Philippine-context legal explainer on dealing with online loan-app (“OLA”) loan sharks who harass, shame, or threaten borrowers—what’s illegal, who regulates them, your criminal / civil / administrative remedies, how to preserve evidence, and action templates you can use right now.

Big picture

Harassment, doxxing, and public shaming by lenders/collectors are unlawful, even if you owe money. Debt collection doesn’t excuse crimes or privacy violations.
Regulators: The SEC (for lending/financing companies) polices registration and unfair collection practices; the NPC enforces the Data Privacy Act; PNP-ACG/NBI-Cybercrime pursue criminal acts; NTC/telcos can help with SMS spam/number blocking.
What you can seek: (1) Criminal charges (e.g., grave threats, libel, coercion, cybercrime, access-device fraud), (2) Administrative sanctions vs the lender (SEC) and data-privacy penalties (NPC), (3) Civil damages (moral/exemplary/actual) and interest/penalty reductions when terms are unconscionable, plus (4) court orders (injunction/protection) in specific scenarios.

What conduct is illegal (even if you’re in default)

Unfair debt-collection & consumer-protection violations

Shaming borrowers (mass texts, group chats, tagging family/co-workers), posting edited photos, or disclosing debt to third parties.
Threats of harm, arrest, or criminal records for mere non-payment of a civil loan.
Harassing contact (repeated calls at odd hours; contacting minors; workplace harassment).
False or deceptive statements (fake “subpoenas,” “NBI cases,” “blacklists”).
Unauthorized charges and undisclosed fees.

Regulatory hooks: SEC rules on lending/financing companies prohibit unfair debt-collection methods; deceptive ads and misrepresentations also violate trade and consumer laws.

Criminal liabilities commonly triggered

Grave threats / grave coercion (Revised Penal Code): “Pay or we will ___ (crime/expose/visit you).”
Libel / cyber-libel: public posts or mass messages imputing crimes/vice to shame you.
Unjust vexation / alarms & scandals / harassment-type offenses: repeated, oppressive nuisance acts.
Computer-related offenses (Cybercrime law): illegal access, computer-related fraud, identity theft, cyber-libel, cyber-threats.
Access-device law: if they misuse your cards/e-wallets/credentials.
Anti-Photo/Video Voyeurism & related special laws: when intimate images are threatened or shared.
Gender-based online sexual harassment (Safe Spaces Act): lewd or gender-based vilification online.

Data-privacy breaches (Data Privacy Act)

Harvesting your contacts/photos via app permissions then using them to shame you.
Processing and disclosing your personal data without lawful basis, beyond the purpose you consented to, or without transparency and security measures.
Failure to honor your data-subject rights (access, correction, deletion, objection).

What to do immediately (survive the next 24–48 hours)

Stop the data bleed
- On your phone, revoke app permissions (contacts, camera, storage, SMS) and remove the app; change email / phone / e-wallet / bank passwords; enable MFA (prefer authenticator app over SMS).
- If they obtained card/e-wallet access: block cards, freeze wallets, file fraud disputes.
Preserve evidence (don’t edit originals)
- Full screenshots (showing sender, number/account, date/time, message) of threats/shaming posts; export chat threads (Messenger/WhatsApp/Telegram/Viber).
- Save URLs of social posts/GCs, and download copies; keep call logs and voicemails.
- Keep loan documents, app screens (loan amount/fees/interest), and payment proofs.
- Make a simple Evidence List (filename, description, date/time).
Tell your contacts (brief, neutral)
- “My number was compromised by a predatory loan app. You may receive false messages. Please ignore and forward any harassment to me for reporting.”

Your legal options (choose several in parallel)

A) Criminal route (police/NBI → prosecutor → court)

Where: PNP station (blotter) and PNP-ACG/NBI-Cybercrime for cyber offenses. What to file: A Complaint-Affidavit attaching your evidence; ask for preservation requests (to platforms/telcos) and subpoenas for account holders. Crimes to allege (as facts allow): grave threats, grave coercion, libel/cyber-libel, unjust vexation, computer-related offenses, access-device violations, voyeurism/GB-OSH if applicable. Tip: Identify the page/number/GC handle; provide e-wallet/card recipients; list SIMs used.

B) Administrative route vs the lender

SEC complaint (for lending/financing companies and their collectors)
- Grounds: unfair debt-collection, deceptive practices, operating without registration, unlawful interest/fees (where covered).
- Ask for cease-and-desist, show-cause, fines, and app takedown coordination.
NPC complaint (Data Privacy Act)
- Grounds: unauthorized processing / disclosure, failure to secure data, excessive data collection (e.g., contact harvesting).
- Reliefs sought: order to desist, delete data, sanctions and damages.
NTC / telco (spam/harassment numbers)
- Report the numbers; request blocking and trace as feasible.

C) Civil action (damages / injunction)

What to claim:
- Moral & exemplary damages for harassment/shaming (Civil Code Arts. 19, 20, 21).
- Actual damages (lost wages, therapy, SIM change costs, device/security expenses).
- Injunction to stop further contact/shaming; demand data deletion.
Where: Regular courts; Small Claims for pure money claims under the cap; otherwise, ordinary civil action.
Against whom: The company (if identifiable/registered), its officers/collectors, and Jane/John Does (to be identified via subpoenas).

D) Debt restructuring—on your terms

You can propose a written plan with a realistic schedule. Never agree to “collection fees” or “interest per day” that are usurious in effect or not in your contract. Courts routinely strike down unconscionable interest/penalty rates and reduce liquidated damages.

Interest, fees, and “usury is dead”—how courts actually treat it

While the old usury ceiling is suspended, courts still void or reduce unconscionable interest/penalty/collection charges (e.g., double-digit per month, or stacked daily penalties).
Penalties may be reduced under the Civil Code when iniquitous; hidden charges and undisclosed add-ons are disallowed.
Short-term lending is also subject to regulatory caps and disclosure standards from time to time—another angle for SEC enforcement.

Evidence & paper trail (what convinces authorities)

Threat screenshots with full metadata (number/handle, date/time) and link/URL where public.
Harassment to contacts (forwarded messages with headers/handles).
Loan documents/app screens (principal, tenor, interest, penalties, due dates).
Payment proofs (receipts, e-wallet transfers) and running balance computation.
Phone permissions screen (showing the app requested Contacts/Storage/SMS).
Your timeline (1–2 pages) narrating: loan, due date, demands, harassment, actions taken.

Practical playbooks

1) If they harass your contacts

Reply once (politely) from your account: “Stop contacting third parties. All further communications must be to me in writing at [email]. You are violating privacy/collection rules.” Then block; do not argue further.
Send a Cease & Desist + DPA letter (template below).
File NPC and SEC complaints attaching the mass-message screenshots.

2) If they threaten to post nudes / defame you

Treat as extortion + cybercrime. File immediately with NBI/PNP-ACG.
Preserve originals; do not pay hush money; request takedown/preservation to the platform.

3) If your workplace is contacted

Inform HR/Legal: collection harassment is unlawful; give them your case number and a short memo asking they route any messages to Legal and refrain from sharing your data.

Templates (copy-paste, customize)

A) Cease & Desist + Data Privacy Demand (email/letter to lender/collector)

Subject: Cease & Desist from Unlawful Collection & Privacy Violations I demand that [Company/App/Collector] and its agents immediately cease (a) contacting my relatives, co-workers, or any third party about my account; (b) sending threats, defamatory statements, or edited images; and (c) processing or disclosing my personal data beyond lawful, transparent purposes. All communications must be in writing to [your email] only. I invoke my rights under the Data Privacy Act to: (1) access my data; (2) object to unlawful processing; (3) erasure of contact-list data and photos scraped from my device; and (4) data portability (complete account statement). Within 5 days, provide: (i) my account ledger (principal, interest, fees, payments), (ii) your SEC registration details (name, address), and (iii) your privacy notice in effect when you collected my data. Continued violations will be reported to the SEC, NPC, and law enforcement for appropriate action.

B) Complaint-Affidavit (skeleton) for PNP/NBI

I, [Name], of [address], state:

On [date], I borrowed ₱[amount] from [app/company].

Starting [date], respondents sent [threats/defamatory posts] to me and my contacts (Exhibits A-__).

They disclosed my debt to [names] and posted [links] to shame me.

They threatened [harm/arrest/exposure of images] unless I paid ₱[amount] by [date] (Exhibits B-__).

I request investigation and filing of charges for [grave threats / grave coercion / libel / cyber-libel / computer-related offenses / access-device violations] and related laws. (Attach Evidence List & copies.)

C) Debt Restructuring Proposal (if you want to pay on sane terms)

I propose to settle Account [#] as follows: ₱[principal] + [reasonable interest], payable ₱[x] every [date] for [n] months. I do not agree to daily penalties/collection fees or any undisclosed charges. Confirm in writing with a final statement of account.

Hitting the right agencies (what each one does)

SEC (Lending/Financing Companies) Use when: the app/company is registered (or appears to operate without registration) and is using unfair collection or deceptive practices. Ask for: CDO, fines, app takedown referrals, and public advisory.
NPC (Data Privacy) Use when: the app scraped contacts/photos, disclosed your debt, or ignored your data-subject rights. Ask for: an order to cease unlawful processing, erase data, notify affected contacts, and penalties.
PNP-ACG / NBI-Cybercrime Use when: there are threats, libel, doxxing, sextortion, hacking, or fraud. Ask for: preservation letters to platforms/telcos, subpoenas/warrants to identify accounts, and inquest if suspects are caught.
NTC / Telcos Use when: multiple spam/harassment numbers/SIMs are used. Ask for: number blocking and spam mitigation. (Keep expectations realistic—harassers rotate SIMs; the criminal/administrative routes are the real leverage.)

FAQs

Can they file a criminal case for non-payment? Mere non-payment of a civil loan is not a crime. Criminal cases arise from fraud at inception (e.g., bouncing checks, estafa), not from being unable to pay later.

I signed “consent” in the app. Can they contact my entire phonebook? No “consent” legitimizes excessive, unrelated, abusive processing or public shaming. The DPA requires specific, informed, and proportional processing.

Do I have to keep paying while I complain? You remain liable for valid principal and lawful interest/fees. You may pay directly (keep receipts) while disputing unlawful charges and pursuing harassment complaints.

What if the lender isn’t in the SEC list? Operating a lending business without registration/license is itself actionable. That strengthens your SEC complaint and criminal angle.

Clean, prioritized checklist

Secure accounts (password/MFA; block cards/e-wallets).
Preserve evidence (screens/exports/URLs; build list).
Cease & Desist + DPA demand to lender/collector.
File: Police blotter → PNP-ACG/NBI Complaint-Affidavit; SEC complaint; NPC complaint.
Notify contacts/HR (short advisory).
Consider restructuring on written, reasonable terms; reject unconscionable charges.
Track reference numbers and follow up every 2–3 weeks.

Bottom line

Online loan-app harassment is not “part of borrowing”—it’s a bundle of violations you can fight on three fronts: criminal, administrative (SEC/NPC), and civil. Move fast to lock down your accounts, preserve proof, and file in parallel. Pay only what is lawful and documented; push back on shaming, threats, and illegal fees with the tools above.

If you want, share (1) the app/company name, (2) exact messages they sent, and (3) your loan figures (principal/fees/dates). I’ll draft a tailored Cease & Desist, a ready-to-file complaint-affidavit, and a SEC/NPC cover in your name.