Unfair Debt Collection by Online Lending Apps in the Philippines: Your Rights and How to Complain

Philippine-focused legal explainer. This is general information, not a substitute for legal advice. Laws and procedures change; check official sources or consult a lawyer/PAO for your situation.

At a glance

Harassment, “shaming,” and threats are illegal. You have the right to fair, respectful, and proportionate collection.
No one goes to jail for simple non-payment of a loan. The 1987 Constitution prohibits imprisonment for debt (Art. III, Sec. 20).
Your personal data can’t be abused. Harvesting and blasting your contacts, posting your photo, or doxxing you can violate the Data Privacy Act of 2012.
Regulators you can complain to: SEC (lending/financing companies and online lending platforms), NPC (privacy/data abuses), BSP (if the lender is a bank/e-money issuer), and law enforcement for threats, extortion, or libel/cyber-libel.
Document everything. Screenshots, call logs, messages, the app’s name and links, receipts—these win cases.

The legal framework (Philippine context)

Lending Company Regulation Act of 2007 (RA 9474) and its IRR: Lending/financing companies must be registered and follow SEC rules.
Financial Consumer Protection Act of 2022 (RA 11765): Prohibits abusive, deceptive, and unfair practices by financial service providers; provides complaint, redress, and enforcement powers to regulators (SEC/BSP/IC/CDA) over their respective supervised entities.
Truth in Lending Act (RA 3765): Requires clear disclosure of finance charges, interest, and the true cost of credit.
Data Privacy Act of 2012 (RA 10173): Requires lawful, transparent, and proportional processing of personal data; grants rights to access, object, erasure, and damages; enforced by the National Privacy Commission (NPC).
Cybercrime Prevention Act (RA 10175) & Revised Penal Code: Criminalizes cyber-libel, grave threats/coercion, extortion, and related offenses.
1987 Constitution, Art. III, Sec. 20: No imprisonment for debt or non-payment of a poll tax.
Civil Code & jurisprudence on interest: Courts may reduce unconscionable interest/penalties; if no rate is validly agreed, the legal interest rate applies (jurisprudence commonly references 6% p.a. as the default “legal interest”).

Note: Banks and e-money issuers are under BSP; most non-bank online lenders and their online lending platforms (OLPs) are under SEC. Many apps are merely platforms for an SEC-registered lender.

What counts as unfair or abusive collection

While exact wording sits in SEC circulars and RA 11765, the following practices are widely prohibited for SEC-supervised lenders/collectors and considered abusive for any collector:

Harassment & intimidation
- Threatening arrest, incarceration, or police involvement for simple non-payment.
- Threats of violence or harm; stalking; repeated calls at unreasonable hours.
- Using profane/obscene language; yelling or humiliation tactics.
Public shaming & doxxing
- Text blasts or messages to your contacts, employer, clients, or relatives that disclose your debt.
- Posting your photo/details online or group chats (“blacklists,” “wanted posters,” “delinquent boards”).
False or misleading representations
- Impersonating attorneys, court officers, police, or government agencies.
- Claiming a lawsuit, warrant, or criminal case exists when it does not.
- Misstating amounts due, adding undisclosed fees, or misrepresenting interest.
Unlawful data practices
- Collecting/using your contacts, photos, SMS beyond what’s necessary or without valid legal basis.
- Continuing to process data after you withdraw consent (when consent is the basis) or after purpose is achieved.
- Retaining data longer than necessary; failing to secure it.
Other abuses
- Contacting you at your workplace when your employer prohibits personal calls.
- Contacting third parties who are not your guarantors solely to pressure you to pay.
- Requiring excessive “processing fees” that were not properly disclosed.

What collectors may do (within limits):

Remind you of due dates, request payment plans, send demand letters, file a civil case, or assign to a third-party collection agency—provided they are truthful, respectful, and compliant with disclosure and privacy rules.

Your rights as a borrower

Right to fair treatment: Freedom from harassment, intimidation, and deceptive practices.
Right to privacy: To object to unlawful processing, withdraw consent, demand erasure of unlawfully obtained contact lists/photos, and seek damages for violations.
Right to information: Clear disclosure of interest, fees, penalties, due dates, total cost of credit, lender identity, and complaint channels.
Right to rectification: Correct errors in your account or personal data.
Right to redress: Use internal complaint channels and escalate to the proper regulator or courts.
Right to due process: No arrest for debt; court processes must be followed for civil recovery.

Evidence you should gather (now)

Create a secure folder and keep:

App name, developer/publisher, download page link/icon, and screenshots of permissions requested.
Your loan documents: e-contract, payment schedule, receipts, “statement of account,” and any in-app chat logs.
All communications: SMS, Viber/WhatsApp/Messenger screenshots, call logs, voicemail, and caller IDs.

Caution: The Anti-Wiretapping Law (RA 4200) prohibits recording private calls without consent. Use consented recordings or rely on texts and screenshots.
Proof of harassment/shaming: posts, group messages, contact blasts; URLs; timestamps.
Names of the company, collection agency, and people who contacted you, plus phone numbers and email addresses used.
Any proof of data misuse (e.g., they accessed and messaged your contacts).

How to complain (step-by-step)

1) Write to the lender/collector (internal complaint)

Ask for: (a) a complete and itemized Statement of Account; (b) the legal basis for any fees/penalties; (c) their privacy notice and legal basis for accessing/using your contacts; and (d) to cease and desist from harassment and third-party disclosures.
Give a reasonable deadline (e.g., 10 calendar days) and state you will elevate to the SEC/NPC if unresolved.

Template (short):

Subject: Formal Complaint and Cease-and-Desist (Harassment & Data Privacy) I am a borrower under [App/Lender Name, Account/Reference No.]. Your representatives have [describe conduct: threats/shaming/contacting my employer/contacts, etc.]. This violates fair collection rules and the Data Privacy Act (RA 10173). I demand that you: (1) stop all threatening/harassing communications; (2) stop contacting third parties; (3) delete any contact lists or photos obtained without valid basis; (4) provide a complete Statement of Account and lawful basis for all charges. If unresolved within 10 days, I will file with the SEC/NPC and consider further remedies. Signed, [Name, mobile/email], [Date]

2) Escalate to the SEC (for lending/financing companies & OLPs)

Use the SEC’s complaint channels (online or at a nearest SEC office).
Provide: your ID, contact info, company name (and Certificate of Authority if known), screenshots/links, and a chronology of events.
What to ask for: investigation, administrative sanctions, and where appropriate, takedown of the abusive OLP.

3) File with the NPC (for privacy violations)

Grounds: unlawful access/use of contacts, disclosure of debt to third parties, posting of your data/photos, failure to honor your right to object/erasure.
Attach proof and your Cease-and-Desist request to the lender.
Ask for: an order to stop processing, delete unlawfully processed data, and impose penalties.

4) Report criminal conduct to law enforcement

NBI Cybercrime Division / PNP Anti-Cybercrime Group for: grave threats, extortion, cyber-libel/defamation, doxxing, and other ICT-facilitated abuses.
Bring printed evidence and a concise sworn statement. If the post is live, capture URLs and full-page screenshots.

5) If the lender sues—or you need court relief

No jail for debt. A lender may file a civil case to collect.
You can file your own civil action for damages (e.g., defamation/privacy breach) and seek injunctions against harassment.
Small claims (no lawyers required) are available for money claims up to the Supreme Court’s current threshold (commonly understood to be ₱1,000,000 after 2023 revisions). Check the latest rules and your court’s guidance.

Practical playbook (do’s & don’ts)

Revoke app permissions you don’t need (especially Contacts, SMS, Camera). Consider uninstalling after you’ve backed up evidence.
Use one official channel for payments and keep receipts. Confirm the account name matches the company.
Negotiate restructuring in writing: new schedule, waived penalties, no more contact-blasts.
Inform your employer (if they were contacted) that the conduct is unlawful and you’re pursuing remedies.

Don’t

Don’t pay into personal accounts you can’t tie to the company.
Don’t send new selfies/IDs over chat unless strictly necessary—risk of identity theft.
Don’t engage with abusive messages beyond saying: “All further communications must be in writing. Harassment will be reported.”

Common myths—debunked

“Police will arrest you tomorrow if you don’t pay.” False for simple non-payment. Debt is a civil matter. Warrants come only from courts in criminal cases.
“We’re allowed to message all your contacts.” Generally false. Messaging third parties about your debt is a strong privacy violation and an unfair collection practice.
“Any interest rate is automatically illegal.” Not exactly. The Usury Law ceilings were suspended, but undisclosed or unconscionable rates/penalties can be invalidated or reduced by courts, and hidden charges violate disclosure rules.
“Deleting the app solves it.” Removing the app stops new data collection permissions, but if they already scraped your contacts, you need to demand erasure and complain to the NPC if they keep using them.

How to spot an illegal or non-compliant lending app

No clear company name, SEC registration, or Certificate of Authority in the app/website.
Vague or missing privacy notice; asks for excessive permissions (Contacts, Photos, Location) unrelated to underwriting.
No transparent disclosure of APR/fees/penalties before you borrow.
Aggressive scripts right after a missed due date (threats, contact-blasts), or collecting in the name of a company you’ve never heard of.

If you’re already being harassed: 10-minute action plan

Stop the bleed: Turn off Contact/SMS permissions; screenshot everything; export chat threads to PDF.
Paper trail: Send the Cease-and-Desist + SoA request (see template).
Protect your network: Warn close contacts that any message about you from the lender may be unlawful; ask them to screenshot and forward.
Report: File with SEC (for unfair collection/illegal OLP) and NPC (for privacy abuses).
Safety: If threats are credible, report to NBI/PNP immediately.

Frequently asked questions

Can they garnish my salary or freeze my bank account? Only with a court judgment and proper legal process (e.g., garnishment via writ). A collector cannot unilaterally take your salary or funds.

They added a “collection fee” I never agreed to. You can dispute undisclosed charges under RA 3765 and RA 11765. Ask for the contractual basis and file with SEC if they persist.

They messaged my boss/clients. What can I do? Tell your employer it may violate the Data Privacy Act and fair collection rules. Gather evidence and file with SEC/NPC. Consider a civil action for damages.

They threatened to post my pictures. That’s a serious privacy and potential criminal issue (coercion, extortion, cyber-libel). Preserve evidence and report to NBI/PNP and NPC.

Quick checklists

Regulators

SEC: Unfair collection by lending/financing companies; illegal/unregistered OLPs; undisclosed fees/misrepresentations.
NPC: Unauthorized contact-blasts, doxxing, misuse of your photos/contacts; refusal to honor erasure/objection.
BSP: If the lender is a bank or e-money issuer.
NBI/PNP: Threats, extortion, cyber-libel, identity theft, stalking.

What to include in a complaint

Your full name, contact details, and government ID (blur sensitive numbers if submitting online).
Lender/app name, SEC registration/Certificate of Authority (if known), and links/screenshots.
Chronology: dates, what happened, who called, exact words (quoted), and your asks (stop harassment, delete data, correct charges).
All evidence (screenshots, logs, receipts, URLs).

Final tips

Be prompt but calm. Most abusive scripts rely on panic and shame. Paper trails and regulator complaints work.
Don’t negotiate under threat. Say you’re willing to discuss payments once harassment stops and accounts are corrected.
Know when to get counsel. If damages are significant or there’s reputational harm, a lawyer can pursue injunctions and claims for moral/exemplary damages.

If you want, I can tailor a ready-to-use complaint packet (SEC + NPC) from your screenshots and timeline—just paste redacted details here.