Unfair Debt Collection by Online Lending Apps (Philippines): Everything You Need to Know — and How to Complain to the SEC and NPC

This guide is for general information only and isn’t legal advice. If you’re under immediate threat, contact law enforcement.

Quick Primer

Problem: Some online lending apps (OLAs) use abusive “debt-shaming,” threats, or mass-texting your contacts to force payment.

Who can help?

SEC (Securities and Exchange Commission): Regulates lending and financing companies and their collection practices.
NPC (National Privacy Commission): Enforces the Data Privacy Act against unlawful collection/use of your personal data (e.g., scraping your contacts, public shaming).

You can file with both the SEC and the NPC at the same time. They cover different legal harms.

What Counts as “Unfair” or Abusive Collection?

Typical red flags (non-exhaustive):

Debt shaming: Mass-messaging or posting to friends, family, coworkers, or social media to embarrass you.
Harassment: Repeated calls, vulgar/obscene language, calling at unreasonable hours, or contacting you at work after being told to stop.
Threats & intimidation: Threatening arrest, deportation, job loss, or public exposure; pretending to be police, lawyers, or court officials.
Data abuse: Accessing your contacts, photos, camera, SMS, location with no clear necessity; retaining data with no limit; using contact lists to coerce payment.
Deceptive practices: Hiding fees, misstating interest/charges, or pressuring you to pay to personal accounts.
Unregistered operations: App or company operates without the proper SEC registration or uses an unregistered online lending platform.

Key Legal Anchors (plain-English summary)

Lending Company Regulation Act (RA 9474) & Financing Company Act (RA 8556): Lending/financing companies must register with the SEC and follow its rules. The SEC can fine, suspend, or revoke authority to operate.
Financial Consumer Protection Act (RA 11765): Prohibits abusive collection and unfair, deceptive, or abusive acts/practices (UDAAP). Enables regulators (including SEC) to order restitution and penalties.
Data Privacy Act (RA 10173): Requires a lawful basis to process personal data, limits collection to what’s necessary, and protects your rights (to be informed, object, access, correct, and request erasure/blocking).
Truth in Lending Act (RA 3765): Requires clear disclosure of finance charges and the cost of credit.
Revised Penal Code / Cybercrime Act (RA 10175): Threats, coercion, or online defamation may be criminal.

There’s no fixed statutory interest “cap” for most private loans, but courts can strike down unconscionable interest/charges. Always keep the focus on abusive collection and data misuse, which are clearly actionable.

Before You File: Preserve and Protect

Collect Evidence
- Screenshots of texts/chats (include sender IDs, dates/times).
- Call logs/recordings (if lawfully made).
- Screenshots of the app’s permissions (contacts, SMS, camera, etc.).
- Loan contract, app store page, in-app disclosures, receipts, payment proof.
- Names/numbers of agents, payment accounts they gave you.
Lock Down Your Phone
- Revoke app permissions (Contacts, SMS, Camera, Location).
- Change passwords/PINs; enable two-factor authentication.
- Keep the app installed until you’ve captured evidence. Then delete if you want.
Tell Them to Stop (Optional but Helpful)
- Email the company’s Data Protection Officer (DPO) demanding they cease unlawful processing and erase contact lists gathered from your device.
- Ask for a proper breakdown of your balance (principal, interest, fees) and official payment channels.
Tell Your Contacts (If They’re Being Messaged)
- Briefly explain you’re handling the matter and that any messages may be harassment. Ask them to keep screenshots.

Filing a Complaint with the SEC (for abusive collection / unregistered lending)

Best when: The entity is a lending or financing company (typical for OLAs), or you suspect it’s unregistered or violating SEC rules on collections/online lending platforms.

What to prepare

Your details: Full name, mobile number, email.
Company details: App name, corporate name (if known), addresses/links, numbers used to contact you.
Narrative: What happened, when, who contacted you, what they said/did, how often.
Evidence: Screenshots, recordings, loan agreement, proof the app accessed contacts, fee/interest disclosures.
Relief sought: Stop harassment, investigate the app, sanction/suspend, refund unlawful charges if any.

How to submit

Use the SEC’s complaint channels for the Enforcement and Investor Protection function (you can submit online or via email; physical filing is optional).
Clearly mark the subject: “Complaint re: Abusive Debt Collection by [App/Company]”.
You can file even if you still owe money. Abusive collection is a separate violation.

What the SEC can do

Investigate; issue Show Cause or Cease and Desist Orders.
Fine, suspend, or revoke a lender’s authority; order corrective measures.
Coordinate with other agencies if criminal acts are involved.

Filing a Complaint with the NPC (for privacy/data abuses like debt shaming)

Best when: The app scraped your contacts, sent mass messages, published your personal data, or processed more data than necessary to collect a debt.

First, consider a Data Subject Request (DSR) to the DPO

Send a DSR asserting your rights to:

Be informed of data sources, recipients, retention.
Object to processing not necessary for collections (e.g., messaging your contacts).
Erasure/blocking of unlawfully obtained data (e.g., your contact list).
Access logs of who received your data and when.

If the DPO ignores you or the situation is urgent (ongoing shaming/harassment), proceed to the NPC complaint.

What to prepare

Your details and a government ID (if requested).
Controller details: Company/App name, DPO email (if known).
Narrative: How your data was collected/used; which contacts were messaged; ongoing risks/harm.
Evidence: Screenshots of the spam/debt-shaming messages to your contacts, app permission screens, your DSR and any reply (or non-reply).
Relief sought: Order to stop processing; delete/erase contact lists; notify recipients; sanctions.

What the NPC can do

Docket your case, require the company to respond, order cease-and-desist and erasure, and impose administrative measures/penalties available under the DPA and its rules.

Can I File with Both Agencies?

Yes. SEC addresses lending conduct/registration; NPC addresses privacy/data abuses. Many abusive scenarios involve both.

If There Are Threats or Extortion

Save everything.
File a police blotter and consult the PNP Anti-Cybercrime Group/NBI for threats, extortion, doxxing, or online defamation.
If someone pretends to be a sheriff/lawyer to coerce payment, that can be a separate criminal offense.

Practical Do’s and Don’ts

Keep communications in writing where possible.
Ask for a full statement of account (principal/interest/fees).
Pay only through official channels; keep receipts.
Tell collectors to stop contacting your employer/contacts.

Don’t

Share IDs/selfies or “video apologies” with collectors.
Pay to personal e-wallets/bank accounts.
Click links from unknown numbers.

Templates You Can Use

1) Data Subject Request (to the lender’s DPO)

Subject: Data Subject Request – Cease Unlawful Processing and Erasure

Dear Data Protection Officer,

I am [Full Name], a borrower of [App/Company]. I assert my rights under the Data Privacy Act (RA 10173) to:
1) Be informed of the personal data you process about me, the lawful basis, retention period, and recipients.
2) Object to processing not necessary or proportionate for debt collection (including accessing my phone contacts and messaging third parties).
3) Erasure/blocking of any contact lists or third-party numbers obtained from my device and any copies/derived datasets.
4) Access to logs indicating which third parties received my data and when; and
5) A copy of your privacy notice and your Data Protection Impact Assessment (if any) covering your collection practices.

I also demand that you immediately cease debt-shaming and any further messages to my contacts. Kindly confirm compliance within 10 calendar days.

Sincerely,
[Name]
[Mobile / Email]
[Loan account / Reference No.]

2) SEC Complaint (email/online form body)

Subject: Complaint re Abusive Debt Collection by [App/Company]

To the Securities and Exchange Commission,

I am filing a complaint against [App/Company] for abusive debt collection and potential violations of SEC rules governing lending/financing companies and online lending platforms.

Facts:
• I obtained a loan via [App] on [date].
• Since [date], their agents have [harassed me via repeated calls at odd hours / threatened me with arrest / messaged my contacts].
• They demanded payment through [channel], and refused to provide a detailed statement of account.

Evidence attached:
• Screenshots of messages/calls, app permissions, loan agreement, payment proofs.
• Names/numbers used by their agents.

Relief requested:
• Investigate and sanction the company; order them to cease abusive collection and comply with disclosure rules; and require proper statements of account.

Complainant:
[Name, Address, Mobile, Email]

3) NPC Complaint (email/portal text)

Subject: Data Privacy Complaint – Debt Shaming and Unlawful Processing by [App/Company]

To the National Privacy Commission,

I allege that [App/Company] violated the Data Privacy Act (RA 10173) by:
• Accessing my device contacts without valid basis and using them to send debt-shaming messages; and/or
• Collecting more data than necessary for debt collection; and
• Failing to honor my Data Subject Request dated [date].

Timeline:
[Summarize events with dates, including harassment of contacts.]

Evidence attached:
[Screenshots of messages to contacts, app permission screenshots, your DSR and any reply.]

Relief requested:
• Order the company to cease processing and delete unlawfully obtained data;
• Require notification to affected recipients and other corrective actions; and
• Impose appropriate penalties.

Complainant:
[Name, Address, Mobile, Email]

FAQs

Q: I still owe money. Can I complain? Yes. Abusive collection and data misuse are violations regardless of whether you owe a debt.

Q: I clicked “Allow Contacts.” Does that mean they can message everyone? Not necessarily. Consent must be freely given, specific, informed, and limited to what’s necessary. You can withdraw consent and object to disproportionate uses (like shaming your contacts).

Q: The interest seems sky-high. Is that illegal? Courts can reduce unconscionable interest/fees. The SEC and NPC can still act on abusive collection and privacy violations even if you dispute the amounts separately.

Q: Can my employer fire me because collectors called HR? Employers generally have their own policies, but harassment of third parties to coerce payment is a red flag you should report.

Q: The app looks foreign. Can Philippine regulators still act? If the app targets users in the Philippines or processes the data of Philippine residents, local laws and regulators still apply.

Decision Map: Where to File

Abusive collection tactics / unregistered lender: SEC
Contact scraping / debt-shaming / privacy misuse: NPC
Threats, extortion, impersonation, doxxing: PNP ACG / NBI, possibly criminal complaints
Bank/e-money issuer involved (not an SEC-regulated lender): BSP (Bangko Sentral) complaint route
Insurance/Cooperative: Insurance Commission / Cooperative Development Authority

(If unsure who regulates your lender, you can file with both SEC and NPC; they can route or coordinate.)

What to Expect After You File

Acknowledgment & docketing of your complaint.
Company asked to explain; you may be asked for more evidence.
Interim relief (e.g., cease harassment) may be sought while the case is pending.
Orders/penalties against the company if violations are found (SEC/NPC).
You can still negotiate payment terms separately—preferably in writing—without waiving your rights.

Extra Tips If You’re Under Active Harassment

Create a single, short written reply to collectors: “Please stop contacting my contacts and stop harassment. Communicate with me only in writing at [email]. Provide a detailed statement of account and official payment channels.” Then stop engaging except to keep records.
If your photo/ID is being used to shame you, do not send new photos/videos. Report abusive posts to the platform; include your ongoing SEC/NPC case number once available.
If they leak sensitive IDs or addresses, raise security concerns in your NPC complaint and consider a police blotter.

Checklist (printable)

Evidence

Screenshots (messages, calls, group chats) with timestamps
App permissions & privacy notice screenshots
Loan agreement & disclosures (fees/interest)
Payment proofs & official channels
Names/numbers/email addresses used by agents

Actions

Revoke app permissions / change passwords
Send DPO Data Subject Request
File SEC complaint (abusive collection/unregistered)
File NPC complaint (privacy violations)
Consider police/NBI for threats/doxxing
Tell contacts to keep screenshots

If you want, tell me the app name and a brief timeline, and I’ll tailor the SEC/NPC complaint texts to your case—tight, factual, and ready to file.