Reporting Harassment by Online Lenders in the Philippines

(A practical legal guide—Philippine context)

Disclaimer: This is general information, not legal advice. Outcomes depend on facts and the specific lender involved. If you’re in danger, contact law enforcement immediately.

1) What “harassment” by online lenders looks like

Common abusive practices reported by borrowers of online lending apps (OLAs) and digital collectors include:

Debt shaming: Mass-texting your contacts, posting on social media, or messaging your employer to expose your alleged debt.
Threats and intimidation: Threats of arrest, criminal cases for “estafa,” violence, or public humiliation if you don’t pay immediately.
Defamation: False statements that you’re a thief, swindler, or absconding employee.
Unfair collection tactics: Calling at unreasonable hours, repeated calls after a request to stop, using obscene language.
Data overreach: Forcing excessive permissions (contacts, photos, location) and misusing them in collection.
Impersonation or deception: Posing as government agents, lawyers, or law-enforcement.

2) Core legal protections you can invoke

A. Securities & Exchange Commission (SEC) rules on collection

Financing and lending companies (including those operating through apps) are covered by the Lending Company Regulation Act (RA 9474) and Financing Company Act (RA 8556), as implemented by the SEC. The SEC has issued circulars prohibiting unfair debt-collection practices, such as threats, intimidation, use of profane language, and contacting persons other than the borrower except for locating the borrower (and even then, with restrictions). Violations can result in fines, suspension/revocation of license, or referral for prosecution.

Key idea: If the collector harasses, shames, or contacts your employer/contacts about your debt, you can complain to the SEC—even if you still owe money.

B. Data Privacy: Data Privacy Act of 2012 (RA 10173)

Lawful processing & consent: Apps must have a valid legal basis to process your data; consent must be informed and specific.
Proportionality/minimization: Collecting your entire contact list to pressure you is typically excessive.
Purpose limitation: Data gathered for identity verification or contact cannot be repurposed for public shaming.
Security obligations: Companies must protect your information from unauthorized use or disclosure.
Enforcement: The National Privacy Commission (NPC) can investigate, order cease-and-desist, direct erasure/rectification, and recommend prosecution; criminal penalties include fines and imprisonment for serious breaches.

C. Criminal law (Revised Penal Code & special laws)

Grave threats / coercion: Punishes threats of harm or coercive acts to force payment.
Libel / cyber libel (RA 10175): False, malicious imputations (especially online) can be criminally actionable.
Unjust vexation / alarm & scandal: For harassing conduct not squarely covered elsewhere.
Anti-Wiretapping (RA 4200): Do not secretly record private voice calls without consent; it’s generally illegal. Keep texts, chats, emails, voicemail messages instead.
Identity-related offenses: Impersonating public officers or lawyers may be separately punishable.

D. Consumer protection & platform policies

App-store policies prohibit predatory or abusive collection conduct; repeated violations can get an app de-listed.
Telecom rules allow you to block numbers and report SMS spam/scams.

3) Who regulates what (and when to go to which office)

SEC (Lending/Financing Companies): Harassment, unfair collection, unregistered or illegally operating lenders, abusive agents of SEC-regulated entities.
Bangko Sentral ng Pilipinas (BSP): If the creditor is a bank or a BSP-supervised financial institution (e.g., many credit card issuers, e-money issuers).
National Privacy Commission (NPC): Any privacy/data misuse (e.g., scraping/using your contacts, posting your photos, data breaches).
PNP Anti-Cybercrime Group / NBI Cybercrime Division: Threats, doxxing, cyber libel, extortion, identity-based abuse, and to secure digital forensic assistance; file a police blotter as contemporaneous record.
Courts / Prosecution: For criminal complaints (libel, threats, coercion) or civil damages (defamation, invasion of privacy).
Local Barangay (Katarungang Pambarangay): For initial mediation if parties reside in the same city/municipality (not required for criminal complaints).
App stores & platforms: Report the app/developer for TOS violations (helps create a paper trail).
Your employer’s DPO/HR: If collectors contact your workplace, HR should refuse to disclose your personal data and may file its own NPC/SEC complaint.

4) Evidence: what to keep (and what not to do)

Preserve:

Screenshots of messages, call logs, voicemails, chat threads, and the app’s permission prompts and privacy policy pages.
Copies of messages sent to your contacts/employer, with timestamps.
Proof of payments, loan agreements, statements of account.
If they used your photos or IDs, keep the original copies and any links/URLs where posted.
A written incident log (dates, numbers used, names/aliases of agents, exact words if possible).

Avoid:

Secretly recording phone calls (risk of violating RA 4200).
Deleting the app before exporting or capturing the data you need.
Retaliatory posts that could expose you to counter-claims.

5) Step-by-step: how to report and escalate

Step 1: Secure yourself and your data

Change passwords and enable 2FA on email/social accounts.
Revoke unnecessary app permissions (contacts, storage, camera, location).
Block abusive numbers and report spam/SMS to your telco.

Step 2: Put the lender on clear notice (optional but often helpful)

Send a dated, written notice (email or in-app ticket):

Dispute abusive conduct; demand it cease immediately.
Cite: SEC prohibitions on unfair collection, RA 10173 (privacy principles), and criminal exposure for threats/defamation.
State you are preserving legal rights and have reported/will report to regulators.
Request (a) name of their DPO and contact; (b) sources of your data; (c) specific lawful basis for processing; (d) erasure/rectification of data shared to third parties; (e) assurance they won’t contact your employer/contacts.

Step 3: File regulatory complaints (you can do several in parallel)

SEC: Provide the lender/app name, corporate details (if known), screenshots, numbers used, and description of unfair collection. Ask for investigation and sanctions.
NPC: File a privacy complaint for unauthorized collection/use of your contacts/photos and for debt shaming. Identify harms (mental distress, workplace issues), the dates, and attach evidence. Request cease-and-desist, erasure, and penalties.
BSP (if a bank/BSP-supervised entity): Use the bank’s Consumer Assistance Mechanism first; escalate to BSP with the case reference if unresolved.
Law enforcement (PNP ACG/NBI CCD): If there are threats, doxxing, cyber libel, or extortion, submit a complaint with your evidence and IDs; get a blotter printout.

Step 4: Consider civil/criminal action

Criminal: Sworn complaint for libel/cyber libel, grave threats, coercion, etc., filed with the prosecutor’s office (National Prosecution Service).
Civil: Action for damages (defamation/abuse of rights/invasion of privacy) and injunction to stop further harassment.
Writ of Habeas Data: To compel a lender to disclose, correct, or destroy unlawfully obtained personal data.

6) Special situations

A. They contacted your workplace

Ask HR to log the incident and politely refuse to disclose any personal data.
HR (or the company DPO) may file a separate NPC complaint for unlawful processing targeting the employer.

B. They messaged your relatives and friends

Have recipients forward or screenshot the messages.
If defamatory, each recipient can be a witness; cyber libel aggravates penalties when done online.

C. The lender isn’t registered / is a pure “app” with no clear company

Treat it as illegal lending activity; complain to SEC and law enforcement.
Emphasize lack of transparency, hidden fees, and abusive conduct; request takedown/coordinated action.

7) Practical payment/negotiation pointers (without waiving rights)

If you legitimately owe, you may still negotiate for a written payment plan without admitting to unlawful charges, penalties, or abusive practices.
Ask for a statement of account (principal, interest, charges). Challenge unauthorized fees and usurious-like structures (note: legal caps differ by entity; banks/credit cards have BSP caps; others must still abide by fair and lawful terms).
Pay only through official channels (never to an agent’s personal account). Keep receipts.

8) Template language you can adapt

A. Cease-and-desist & privacy demand (email)

Subject: Unfair Collection & Privacy Violation – Demand to Cease I am the borrower in Loan Ref No. ______. Your representatives have engaged in unfair collection (threats, debt shaming, contacting my employer/contacts) and unlawful processing of my personal data. These acts violate SEC rules on collection and the Data Privacy Act (RA 10173), among others. I demand that you immediately cease all harassing practices; stop contacting third parties; delete any data taken from my contact list or shared with others; and identify your DPO and lawful basis for processing. I am preserving my evidence and am filing complaints with the SEC, NPC, and law enforcement. Please confirm compliance within 3 business days. Name / Mobile / Email / Date

B. NPC complaint outline

Complainant details (name, contact, ID).
Respondent (lender name/app, any corporate info).
Facts (chronology; what data they accessed; what was disclosed to whom; how debt shaming occurred).
Legal basis (RA 10173: consent, proportionality, purpose limitation, unauthorized disclosure).
Reliefs sought (cease-and-desist, erasure/rectification, penalties, coordination with SEC).
Attachments (screenshots, logs, messages to contacts/employer, proof of identity/authority).

C. SEC complaint outline

Complainant and Respondent details.
Nature of business (lending/financing; app name; how it operates).
Unfair collection acts (debt shaming, threats, impersonation, contacting third parties, obscene language).
Dates, numbers/handles used, agents’ aliases.
Requested action (investigate; penalize; order corrective measures; refer to law enforcement/NPC).
Evidence list.

9) Borrower FAQs

Q: I clicked “Allow contacts” during install—did I consent to debt shaming? A: No. Consent must be specific and informed; using your contacts to pressure or shame is generally excessive and unlawful.

Q: Can they have me arrested for non-payment? A: Debt is a civil matter. Arrest requires a criminal offense, not mere non-payment. Threats of arrest for ordinary loan default are abusive.

Q: They keep calling at 11 p.m.—is that illegal? A: Late-night, repeated calls after you’ve asked them to stop are classic unfair collection behavior that can be sanctioned.

Q: Should I record phone calls? A: Avoid secret call recordings (risk of violating RA 4200). Keep texts, chats, voicemails, emails, and written notes instead.

Q: What if I already paid but they still harass me? A: Send proof of payment; demand deletion/rectification; escalate to SEC/NPC with evidence.

10) Quick checklist

Capture screenshots, call logs, and voicemails.
Revoke app permissions; change passwords; 2FA on.
Send a cease-and-desist/privacy demand.
File SEC complaint (unfair collection) and NPC complaint (privacy violations).
Blotter with PNP ACG/NBI for threats/cyber libel.
Consider civil/criminal action with counsel.
Inform HR/DPO if the lender contacted your workplace.

11) When to get a lawyer

Repeated harassment despite notice;
They contacted your employer or published defamatory posts;
You’re contemplating a criminal complaint or civil suit;
You need a habeas data petition or urgent injunction.

A lawyer can tailor your notices, preserve evidence properly, and coordinate simultaneous filings with the SEC, NPC, and prosecutors to stop the harassment fast and preserve your claims for damages.

Bottom line

You can—and should—push back. Philippine law prohibits debt shaming and abusive collection tactics, safeguards your personal data, and provides multiple avenues (SEC, NPC, law enforcement, and courts) to stop the harassment and hold violators accountable.