If constant harassing messages, calls to your family and friends, or shaming tactics from an online lending app have left you stressed and unsure where to turn, you have clear legal options under Philippine law. These practices often violate specific rules on debt collection and data privacy. This guide explains exactly where to file complaints, which agency handles what type of violation, the required documents and evidence, step-by-step processes, realistic timelines, and practical considerations for ordinary borrowers, OFWs, and foreigners.

What Counts as Illegal Online Lending Harassment

Online lending apps (OLAs) and their collection agents commonly use tactics such as repeatedly calling or texting the borrower and their “references” (contacts harvested from the phone), disclosing the debt to family members, employers, or social media contacts to shame the person into paying, using profane or threatening language, sending manipulated photos or fake legal notices, and threatening arrest or imprisonment for a civil debt.

These actions are not “standard collection.” They cross into prohibited territory. Legitimate lenders may contact the borrower directly using reasonable means, but they cannot weaponize personal data or humiliate third parties.

Key Legal Protections You Can Invoke

Several laws and regulations directly address these situations.

SEC Memorandum Circular No. 18, Series of 2019 prohibits financing companies and lending companies (and their third-party collectors) from unfair debt collection practices. Banned acts include using profane language, shaming or humiliating the borrower or references, contacting third parties except in narrowly defined circumstances, threatening criminal action for a purely civil debt, and publicly disclosing the debt.

Republic Act No. 11765 (Financial Products and Services Consumer Protection Act of 2022) reinforces these protections. It explicitly bans abusive, deceptive, or oppressive collection practices by financial service providers under SEC supervision and gives regulators stronger enforcement tools.

Republic Act No. 10173 (Data Privacy Act of 2012) makes it illegal to process or disclose personal information without legal basis or consent. Harvesting an entire contact list and then calling or texting those people about your debt almost always violates this law. The National Privacy Commission (NPC) enforces it and can issue cease-and-desist orders.

Revised Penal Code provisions (grave threats under Article 282, unjust vexation or light threats, and possibly libel or slander if statements are published) and Republic Act No. 10175 (Cybercrime Prevention Act of 2012) cover serious threats, persistent harassment through electronic means, and cyber libel.

Civil Code Articles 19, 20, and 21 allow you to claim damages (including moral and exemplary damages) when someone willfully causes injury through acts that violate your rights or good morals.

You can pursue regulatory complaints (SEC, NPC), criminal complaints, and civil damages separately or together. They address different aspects of the same problem.

Where to File: Matching the Violation to the Right Agency

No single agency covers every angle. Most people file with more than one because the violations overlap.

Agency	What It Handles Best	Typical Filing Method	Practical Notes
Securities and Exchange Commission (SEC)	Unfair debt collection practices by registered lending/financing companies (shaming, third-party contact, threats, profane language) under MC 18 s. 2019 and RA 11765	Online via imessage.sec.gov.ph or email to enforcement@sec.gov.ph; submit sworn complaint-affidavit + evidence	Fastest route for stopping collection tactics; works even if app is only partially registered
National Privacy Commission (NPC)	Unauthorized collection, use, or disclosure of personal data (contact list harvesting, sharing debt details with third parties) under RA 10173	Download latest Complaint-Affidavit form from privacy.gov.ph, notarize, submit by email (complaints@privacy.gov.ph), courier, or in person at Pasay office	Strong for privacy-focused cases; can order companies to stop processing data
PNP Anti-Cybercrime Group (ACG) or nearest police station	Immediate threats, persistent electronic harassment, possible cybercrime elements	Hotline (02) 8723-0401 loc. 7491 or text 0917-847-5757; online portal at acg.pnp.gov.ph; or walk-in blotter	Good first step for threats; they document and can investigate or refer to prosecutor
Office of the City/Provincial Prosecutor	Criminal charges (grave threats, unjust vexation, cyber libel)	Prepare and file sworn Complaint-Affidavit with supporting evidence at the prosecutor’s office where you reside or where elements of the crime occurred	Leads to preliminary investigation; possible court case if probable cause is found
National Bureau of Investigation (NBI) Cybercrime Division	Complex cyber-related cases needing forensic tracing of numbers or app operators	Walk-in or through referral from PNP	Useful when PNP refers or when technical tracing is needed
Department of Trade and Industry (DTI)	General consumer protection and deceptive practices	Hotline 1-384 or online form at dti.gov.ph	Secondary option for misleading loan terms or practices

You can (and often should) file with SEC and NPC simultaneously. Criminal complaints go through police/prosecutor channels.

Step-by-Step: Filing a Regulatory Complaint with the SEC

Gather and organize your evidence (see section below).
Prepare a sworn complaint-affidavit. Clearly state the facts in chronological order, name the lending company or app (include any SEC registration number if known), describe the prohibited acts, cite SEC MC No. 18 s. 2019 and RA 11765, and attach your evidence as annexes.
Have the affidavit notarized.
Submit through the SEC’s iMessage portal at imessage.sec.gov.ph or email enforcement@sec.gov.ph. Include all attachments.
Keep copies of everything you sent and note the date and reference number if provided.

Processing typically takes 30–60 days for initial action, though complex cases or backlogs can extend this. The SEC can impose fines, order cessation of practices, or suspend or revoke registration.

Step-by-Step: Filing a Privacy Complaint with the NPC

Download the current Complaint-Affidavit template from privacy.gov.ph (updated version effective July 2025).
Fill it out completely and accurately. Describe how the app obtained and used your personal data, which contacts were contacted, what was disclosed, and the impact on you and your family.
Have the affidavit notarized by any notary public.
Pay the filing fee (currently ₱500 plus legal research fee; indigent litigants may apply for exemption with a barangay certificate of indigency).
Submit by scanning and emailing to complaints@privacy.gov.ph (most convenient), sending via courier, or delivering in person to the NPC office at the PICC Complex in Pasay City.

The NPC can investigate, require the company to explain its data practices, and issue orders to stop the unlawful processing. This often produces quicker relief from harassing calls and texts than criminal routes.

Step-by-Step: Reporting to Police and Filing a Criminal Complaint

If you are receiving direct threats of harm or arrest, go to the nearest PNP station immediately and have a blotter entry made. Ask for a copy.
For cyber-related harassment, contact the PNP Anti-Cybercrime Group via their hotline, text line, or online portal. Provide your evidence.
Prepare a sworn Complaint-Affidavit (standard form available at any Hall of Justice). Detail the specific threats or harassing acts, identify the elements of the crime (e.g., grave threats or unjust vexation), and attach clear evidence.
File the affidavit with the Office of the City or Provincial Prosecutor in the place where you reside or where you received the messages (practical choice for most victims).
The prosecutor will conduct a preliminary investigation. You may be asked to submit additional evidence or attend a clarificatory hearing.

If probable cause is found, the prosecutor files an Information in court and the case proceeds to trial. Arrest warrants can be issued for grave threats or other serious offenses.

Preparing Strong Evidence

Strong evidence wins cases and speeds up action.

Timestamped screenshots or screen recordings of every harassing message, call log, or social media post (include the sender’s number or username and the date/time).
A chronological summary or table listing dates, times, content, and who was contacted.
Statements or affidavits from family members, friends, or colleagues who received calls or messages about your debt.
Copies of the loan agreement, app terms, and any payment records.
Medical or psychological records if the harassment caused documented anxiety, sleep problems, or other health effects (helpful for damages claims).
Any previous complaints you made to the app’s customer service or grievance channel and their responses (or lack thereof).

Do not delete messages or alter screenshots. Preserve original files. One-party consent recording of calls can be useful in some cases but consult on admissibility if you plan to use audio.

What Happens After You File and Realistic Timelines

Regulatory complaints (SEC and NPC) often produce the fastest practical relief because agencies can order companies to stop specific practices or face penalties. Criminal cases move more slowly due to preliminary investigation and court dockets but carry stronger sanctions (fines, imprisonment) against individuals.

Recent PNP directives show increased attention to OLA harassment cases, with thousands of complaints processed. Outcomes can include cease-and-desist directives, company fines or closure (especially for unregistered operators), and in serious criminal cases, arrests or convictions.

You can follow up politely with the agency using your reference number. Multiple filings do not cancel each other out; they strengthen the overall record.

Special Considerations for OFWs, Foreigners, and People Outside Metro Manila

You can file most complaints online or by email and courier, which helps greatly if you are abroad or in the provinces.

For notarization, use a Philippine embassy or consulate, or a notary public authorized in your location (some countries allow apostille of the notarized document). A Special Power of Attorney (SPA) lets a trusted relative or lawyer in the Philippines file and follow up on your behalf.

Jurisdiction generally exists where the harassing messages were received or where you reside. Foreigners have the same complaint rights as citizens for acts occurring in or affecting the Philippines. If you later need to enforce a court judgment abroad, reciprocity rules and apostille requirements apply, but that is a separate enforcement step.

Common Pitfalls and How to Avoid Them

Many complaints weaken because evidence is incomplete or disorganized. Others target only one agency when two or three violations exist. Some borrowers delete messages thinking they are “moving on,” only to lose critical proof.

A frequent misconception is that any debt collection threat of jail is valid—most consumer loans are civil obligations, and baseless threats of criminal action are themselves illegal. Another issue is continuing to engage with collectors in ways that create new evidence against you while a complaint is pending; keep communication minimal and documented.

Unregistered apps are harder to regulate but not immune—NPC privacy complaints and criminal cases can still proceed, and SEC can act against illegal operators.

Frequently Asked Questions

Can I file complaints with the SEC and NPC at the same time?
Yes. The agencies address overlapping but distinct violations. Filing with both is common and often recommended because it covers collection tactics and data privacy separately.

What if the lending app is not registered with the SEC or has already shut down?
You can still file with the NPC for privacy violations and with police or the prosecutor for criminal acts. The SEC may also investigate and take action against unregistered entities operating as lending companies.

Do I still have to pay the loan if I file a complaint?
Filing a complaint challenges illegal collection methods, not the underlying debt itself. A legitimate debt remains a civil obligation. Focus your complaint on the prohibited tactics while addressing the principal separately if needed.

How much does it cost to file?
NPC has a filing fee of around ₱500 plus research fee (with indigency exemption possible). SEC submissions are generally free or low-cost. Criminal complaints with the prosecutor usually have no filing fee. Civil damages cases involve docket fees based on the amount claimed.

I’m an OFW. Can I file from abroad?
Yes. Use email and online portals for SEC and NPC. Have documents notarized at a Philippine embassy or consulate, or execute a Special Power of Attorney for someone in the Philippines to file and monitor on your behalf.

Will the harassment stop immediately after I file?
Not always immediately, but regulatory complaints frequently lead to quick orders to cease the specific practices. Document any continuation after filing—it strengthens your case.

Is contacting my references or “emergency contacts” ever allowed?
Only in very limited circumstances strictly defined by SEC rules and with proper basis. Mass-contacting your entire phone list to shame you into paying is almost always prohibited under both SEC MC 18 and the Data Privacy Act.

Can I claim damages for the stress and humiliation I suffered?
Yes. You can file a separate civil action for moral and exemplary damages under the Civil Code. Small claims procedure (currently up to ₱1,000,000 jurisdictional amount in first-level courts) offers a simplified, faster route without needing a lawyer for money claims within the limit.

Should I confront the collectors or try to negotiate while filing complaints?
Keep interactions minimal and fully documented. Many people find it better to let the regulatory and criminal processes work while protecting their peace of mind.

What if the harassment continues or gets worse after I file?
Immediately report the new incidents to the same agencies with updated evidence and reference numbers. Escalation can support additional charges or stronger enforcement action.

Key Takeaways

Illegal online lending harassment usually violates SEC rules on fair collection (MC 18 s. 2019 and RA 11765), the Data Privacy Act (RA 10173), and possibly the Revised Penal Code or Cybercrime Act.
File with the SEC for unfair collection practices and with the NPC for privacy violations—often both at once.
For direct threats or serious criminal harassment, start with a PNP blotter or ACG report, then file a sworn complaint-affidavit with the prosecutor.
Strong, well-organized, timestamped evidence (screenshots, call logs, third-party statements) dramatically improves outcomes.
You can pursue regulatory, criminal, and civil remedies in parallel; they serve different purposes and do not cancel each other out.
OFWs and foreigners can file online or through representatives with proper notarization or apostille.
Legitimate debts remain civil obligations, but collectors must follow strict legal boundaries—filing complaints protects your rights while you address the debt through proper channels.

The agencies exist precisely for situations like yours. Acting promptly with clear documentation gives you the best chance of stopping the harassment and holding the responsible parties accountable.