1) Understand what “harassment” by lending apps usually looks like

Online lending app (OLA) harassment often goes beyond ordinary collection follow-ups and may include:

Threats: arrest, imprisonment, “warrants,” police visits, barangay summons, deportation (for foreigners), or harm.
Public shaming: posting your name/photo on social media, calling you a scammer, or sending “wanted” posters.
Contacting your network: messaging your contacts, employer, family, friends, or coworkers to pressure you.
Doxxing: sharing your address, ID photos, workplace, or other personal details.
Sexualized or gender-based insults (or threats of exposing intimate images).
Relentless communications: dozens of calls/texts daily, calls at odd hours, abusive language.
Impersonation: pretending to be from the NBI/PNP, a law office, court personnel, barangay officials, or using fake letterheads.

Key point: Even if you truly owe money, debt collection must still be lawful. Your obligation to pay a valid debt is separate from a collector’s illegal acts.

2) Know the main legal protections you can invoke (Philippines)

Several laws may apply depending on what the lender/collector did:

A. Data Privacy Act of 2012 (Republic Act No. 10173)

Common OLA abuses often trigger the Data Privacy Act, especially when the app:

accessed your contacts, photos, files, or location without a lawful basis,
used your personal data for shaming or mass messaging,
disclosed your debt status to third parties without authority,
processed data in ways inconsistent with what you consented to.

Agency: National Privacy Commission (NPC)

B. Cybercrime Prevention Act of 2012 (Republic Act No. 10175)

May apply if harassment happens through electronic means, especially:

online libel (public accusations you are a scammer/thief, etc.),
cyber-related threats, coercion, identity misuse, and other offenses committed via ICT.

Agencies: PNP Anti-Cybercrime Group (PNP-ACG), NBI Cybercrime Division, prosecutors.

C. Revised Penal Code (RPC) offenses (as applicable)

Depending on the facts, harassment may fall under:

Grave threats / light threats
Coercion
Slander / oral defamation
Libel (and if online, often handled as online libel)
Unjust vexation (historically used for pestering conduct, though charging practice varies)

D. Civil Code remedies (civil cases)

You may pursue civil actions for:

damages (moral, exemplary, actual),
injunction / restraining orders (to stop further disclosure/harassment),
other civil relief when your rights are violated.

E. SEC regulation of lending/financing companies and unfair collection practices

Online lenders that are lending/financing companies (or operating as such) are generally under SEC oversight, and the SEC has issued rules/circulars addressing unfair debt collection practices and OLA misconduct (including shaming, threats, and contacting third parties).

Agency: Securities and Exchange Commission (SEC)

F. If the harassment is sexual or gender-based

If messages are sexual, sexist, or gender-based harassment, the Safe Spaces Act (RA 11313) may also be relevant, especially for online harassment.

3) Immediate steps: what to do the moment harassment starts

Step 1 — Stabilize your safety and reduce exposure

Do not engage in a shouting match. Abusive exchanges can complicate evidence and escalation.
Limit channels: Use one communication line (email or messaging) and stop answering random calls.
Tell trusted people early: If collectors target family/work, pre-empt the narrative with a calm explanation.

Step 2 — Preserve evidence (this is crucial)

Create a folder (cloud + local backup) and keep:

Screenshots of SMS, Viber/WhatsApp/Telegram messages, social media posts, comments, and profiles.
Screen recordings showing the message thread + timestamps.
Call logs showing repeated calls; if lawful/possible, keep recordings (check your device options and keep context; do not alter files).
Copies/photos of any “demand letters” or messages claiming to be legal notices.
Names, numbers, email addresses, GC names, links, collector usernames, and the app name.
If they messaged your contacts: ask your contacts to send you their screenshots too.

Tip: Save files in original format. Avoid editing screenshots. If you must blur sensitive information for sharing, keep an unedited original.

Step 3 — Check what you actually owe (separate debt from abuse)

Even while harassment is ongoing, clarify the debt facts:

What was the principal?
What does the contract/app state about interest, fees, and penalties?
How much is being demanded now, and how computed?
Is the lender/app the same entity collecting, or a “third-party collector”?

If demands look inflated, request a full statement of account in writing.

Step 4 — Verify if the lender is legitimate/registered (where possible)

Many abusive OLAs are tied to entities that are:

not properly registered as lending/financing companies, or
operating through questionable arrangements.

You can verify by checking SEC registration/records and the company identity shown in the loan documents/app disclosures. Lack of clear company identity is a major red flag.

4) Communicate strategically (do this in writing)

Step 5 — Send a “cease harassment + data privacy + verification” notice

Send a short, firm message by email or the app’s official support channel:

Request the company’s full legal name, SEC registration details, office address, and authorized collector details.
Request a statement of account and breakdown.
State that you will communicate only in writing and that contacting third parties and public shaming/threats must stop.
If they accessed contacts or disclosed your debt to others, demand they stop processing/disclosing your personal data beyond what is lawful and necessary, and preserve records.

Keep it factual. Avoid insults.

Sample wording (adapt as needed)

I am requesting the full legal name of your company, SEC registration details, and a complete statement of account with itemized computation of principal, interest, and charges.

I will communicate only in writing. Stop contacting third parties (family, employer, or contacts) and stop any threats, shaming, or disclosure of my personal information. Any unauthorized access/use/disclosure of my personal data will be documented for complaints with the SEC/NPC and appropriate law enforcement agencies.

Kindly confirm receipt and provide the requested documents.

Step 6 — Do not be tricked by fake “criminal” threats for ordinary debt

In general, non-payment of a typical loan is not automatically a criminal case. Criminal liability usually arises from separate acts (e.g., fraud, bouncing checks under specific circumstances, identity theft), not mere inability to pay.

Collectors often use “kulong,” “warrant,” “estafa,” or “NBI/PNP” language to frighten borrowers. Treat these as claims requiring verification.

Step 7 — If you plan to pay, pay safely and document everything

If you decide to settle:

Pay only through traceable channels.
Require a written acknowledgment and clearance/closure confirmation.
Do not send money to random personal accounts unless you can prove it is an authorized official payment channel and you get official receipts.

5) Protect your accounts and prevent further data abuse

Step 8 — Lock down your phone and online accounts

Revoke permissions for the lending app (Contacts, Files/Media, SMS, Phone, Location).
Uninstall the app after you’ve preserved evidence and captured needed account details.
Change passwords for:
- email,
- social media,
- e-wallets/banking apps (if you suspect compromise).
Turn on two-factor authentication (2FA).
Tighten privacy settings on Facebook and other platforms (limit public visibility of friends list, workplace, phone number).

Step 9 — Warn your contacts (short and calm)

A simple message to family/friends/coworkers helps:

“If you receive messages about me from unknown numbers claiming debt issues, please ignore and send me a screenshot. Do not click links.”

6) Escalation path: where to file complaints (and what each can do)

A. Securities and Exchange Commission (SEC)

File a complaint when:

the lender/collector engages in unfair debt collection (threats, shaming, contacting third parties, abusive language),
the lender appears unregistered or misrepresenting itself,
there is systemic abuse by an OLA.

What to include:

app name, company name (if known), collector details,
timeline of harassment,
screenshots, recordings/logs,
your loan details and communications.

What SEC can do (in general):

investigate regulated entities,
impose sanctions, suspend/revoke authority where warranted,
issue advisories and enforcement actions.

B. National Privacy Commission (NPC)

File a complaint when:

your contacts were accessed/messaged,
your personal info/ID was disclosed publicly,
your debt was broadcast to third parties,
the app processed data beyond lawful purpose/consent.

What to include:

proof of third-party messages/posts,
app permissions you granted and how data was used,
your cease-and-desist notice,
identities of suspected data controllers/processors.

Possible outcomes:

orders to comply, stop processing, remove posts,
investigation for Data Privacy Act violations.

C. PNP Anti-Cybercrime Group / NBI Cybercrime Division

Go here when there are:

online threats,
blackmail/extortion,
impersonation of authorities,
online libel or coordinated harassment,
doxxing with real-world safety risks.

Bring:

printed screenshots with URLs/usernames,
phone with original messages,
IDs and a written timeline.

D. Barangay blotter / police blotter (documentation step)

If harassment is severe or involves threats/visits:

Make a blotter entry to create an official record.
This helps support later complaints, protective actions, or prosecution.

E. Prosecutor’s Office (criminal complaint) and civil actions

For criminal cases (threats, coercion, online libel, etc.) you typically file a complaint-affidavit with supporting evidence.

For civil cases, remedies may include damages and injunctive relief—especially where ongoing disclosure is causing harm.

7) Special situations (common in OLA harassment)

Situation 1: They messaged your employer or HR

Preserve the message.
Inform HR briefly: this is a third-party harassment issue, not an official legal notice.
Ask HR not to engage and to forward any future messages to you.

Situation 2: They posted you on social media (“shaming wall”)

Screenshot the post, comments, shares, page profile, and timestamps.
Report the post on the platform (for doxxing/harassment).
Include it in SEC/NPC/cybercrime complaints.

Situation 3: They threaten to send people to your house

Treat as a safety matter: document, blotter, and report to cybercrime units if threats are explicit.
Do not meet “collectors” alone.
Do not hand over IDs, biometrics, or sign documents under pressure.

Situation 4: They demand you give access to your phone or accounts

This is a major red flag. Refuse. Preserve evidence and report.

Situation 5: They say your contacts “consented” or that app permission equals unlimited use

App permissions and consent are not a blank check. Processing and disclosure must still have a lawful basis, be proportional, and align with declared purpose; mass shaming and third-party pressure are classic abuse indicators.

8) Practical “do’s and don’ts” that prevent harm

Do

Keep everything in writing.
Use calm, factual language.
Build a timeline and evidence folder.
Report early when harassment escalates.
Separate repayment planning from harassment 대응.

Don’t

Don’t delete evidence in anger.
Don’t post defamatory counters (it can escalate).
Don’t pay random accounts without official proof/receipts.
Don’t give collectors access to your phone, OTPs, or social accounts.
Don’t believe “instant warrant” threats without verified legal documents.

9) A step-by-step action plan (quick checklist)

Screenshot + record all harassment (including third-party messages).
Stop phone calls; switch to written-only communications.
Request company identity + statement of account and demand they stop third-party contact and shaming.
Revoke app permissions, tighten privacy settings, change passwords, enable 2FA.
Inform family/employer to ignore messages and forward screenshots.
File complaints as applicable:
- SEC (unfair collection / OLA misconduct)
- NPC (data misuse / disclosure)
- PNP-ACG / NBI Cybercrime (threats, doxxing, extortion, online libel)
Blotter threats or in-person intimidation.
If settling, pay traceably and get written closure/clearance.

10) What “legal collection” generally looks like

Legitimate collection efforts typically involve:

respectful reminders,
written demand letters with correct company identity,
reasonable communication frequency,
no disclosure to unrelated third parties,
no threats of arrest for ordinary debt,
clear itemization of charges.

When a lender relies on humiliation and threats, it is often a sign of non-compliance and potentially unlawful processing of personal data.

11) Frequently asked questions

“Can they really have me arrested for not paying?”

Ordinary non-payment of a loan is generally not, by itself, a criminal offense. Arrest threats are commonly used as intimidation. Criminal exposure depends on separate conduct (e.g., fraud or specific offenses), not mere inability to pay.

“They contacted my entire phonebook. Is that legal?”

Mass messaging your contacts to shame or pressure you raises serious data privacy and unfair collection concerns and is a common basis for complaints with the NPC and SEC.

“They’re charging huge interest and penalties. Is that allowed?”

There is no single universal interest ceiling in all situations, but Philippine courts can strike down unconscionable interest/penalties, and regulators can act on abusive practices. Demand a written computation and keep records.

“Should I uninstall the app?”

Yes—after preserving evidence and capturing essential account details. Revoke permissions first, then uninstall.

“What if I borrowed from an unregistered or shady app?”

You should still document the transaction and harassment. Unregistered operations and abusive collection practices increase the importance of reporting to the SEC/NPC and cybercrime authorities.

12) Template: Evidence log (copy this format)

Date/Time:
Channel: SMS / Call / Facebook / Messenger / Viber / Email
Sender name/number/profile:
Content summary: threat/shaming/third-party contact/etc.
Evidence files: screenshot_001.png, screenrec_002.mp4
Witness/recipient: (e.g., sister, coworker, HR)
Action taken: cease notice sent / reported / blotter entry

13) Bottom line

You can (1) preserve evidence, (2) reduce data exposure, (3) demand lawful, written-only communications and proper accounting, and (4) report harassment to the SEC, NPC, and cybercrime authorities. Paying a legitimate debt can be handled through documented, traceable settlement—without tolerating threats, shaming, or misuse of your personal information.