How to Report Harassment by Online Loan Apps in the Philippines
A comprehensive legal guide for borrowers facing abusive collection practices

Executive Summary

The Philippines has a clear legal and regulatory framework that protects borrowers from abusive, threatening, or privacy-violating tactics used by some online lending platforms. Several agencies—principally the Securities and Exchange Commission (SEC), the National Privacy Commission (NPC), the Bangko Sentral ng Pilipinas (BSP), and law-enforcement cybercrime units—may take action once a complaint is properly filed. This article explains:

What counts as harassment.
The laws that prohibit it.
Which government office to approach for each type of violation.
The evidence you must gather.
Step-by-step filing procedures and timelines.
Potential civil, criminal, and administrative outcomes.

(This material is for general information only and is not a substitute for individualized legal advice.)

1 Defining “Harassment” in the Debt-Collection Context

Harassment can be civil, administrative, or criminal, depending on the conduct:

Conduct	Typical legal classification
Continuous calls or messages at unreasonable hours	Unfair collection practice (SEC & BSP rules)
Threats of violence, arrest, or harm	Grave threats (Revised Penal Code, Art. 282)
Public disclosure of debt to employer, relatives, or social-media contacts	Privacy breach (RA 10173) and unjust vexation (RPC Art. 287)
Use of obscene, profane, or defamatory language	Cyber-libel (RA 10175)
Use of borrower’s phone contacts without consent	Unauthorized processing of personal data (RA 10173)

2 Key Philippine Laws and Regulations

Law / Regulation	Core protections relevant to borrowers
RA 10173 – Data Privacy Act of 2012	Requires lawful, proportional, and purpose-specific processing of personal data. Outlaws “unauthorized disclosure” and “malicious disclosure.”
SEC Memorandum Circular No. 18-2019	Lists Prohibited Debt-Collection Practices for lending/financing companies, e.g., threatening violence, contacting borrowers’ phone contacts, or publicly shaming them.
SEC MC 19-2019 & MC 10-2021	Registration and conduct rules for Online Lending Platforms (OLPs); empowers SEC to suspend or revoke Certificates of Authority (CA) and order app takedowns.
RA 9474 – Lending Company Regulation Act	Requires lenders to obtain a CA from the SEC and comply with reporting and conduct standards.
RA 10175 – Cybercrime Prevention Act of 2012	Elevates traditional crimes (libel, threats, coercion) to cybercrimes when committed through ICT.
BSP Circular No. 1163-2023 (Consumer Protection)	Mandates fair, respectful collection for BSP-supervised financial institutions (e.g., banks, non-bank e-money issuers).
Revised Penal Code (Arts. 282, 287, 365-Other Fraud)	Criminalizes threats, coercion, unjust vexation, and swindling.

3 Regulators & Where to File Your Complaint

Violation	Primary agency	Where & how to file
Privacy violations (contact scraping, public shaming posts)	National Privacy Commission	Online: complaints@privacy.gov.ph or NPC Complaints Desk portal; attach filled-out Privacy Complaint Affidavit, evidence, and government ID.
Unfair collection practices; operating without SEC CA	Securities and Exchange Commission – CGFD & EIPD	Email: cgfd@sec.gov.ph or eipd@sec.gov.ph; or use SEC Lending/Financing e-Complaint Form. Attach screenshots, call recordings, contract, proof of identity.
Harassment by banks or EMI-licensed firms	Bangko Sentral ng Pilipinas – Financial Consumer Protection Department	Email: consumeraffairs@bsp.gov.ph; hotline: (02) 8708-7087; BSP Online Buddy (BOB) chatbot.
Threats, cyber-libel, extortion	PNP Anti-Cybercrime Group (ACG) or NBI Cybercrime Division	Blotter at nearest ACG regional office; or NBI Cybercrime Division, Taft Ave., Manila. Provide sworn statement, digital evidence, IDs.
Misleading ads, hidden charges	Department of Trade & Industry – Fair Trade Enforcement Bureau	1-DTTI (1-3884) hotline; consumercomplaint@dti.gov.ph.

Tip: Agencies coordinate. Filing with the SEC does not bar you from filing with the NPC or police. Send separate, tailored complaints for faster action.

4 Collecting Evidence: What to Preserve

Screenshots of threatening SMS, chat, or in-app messages (show visible phone number and timestamp).
Call recordings (check two-party consent; under Philippine law, you may record if one party—you—consents).
Copies of app permissions showing access to contacts/photos.
Loan documents: electronic loan agreement, disclosure statement, receipts.
Proof of payments (GCash, bank transfer screenshots).
Incident log: a simple diary noting date, time, caller ID, summary of each incident.

Back up files to cloud storage and include hash values (optional) to authenticate digital evidence.

5 Step-by-Step Complaint Process

A. National Privacy Commission (NPC)

Step	Details
1. Demand Letter (Optional but encouraged).	Email the lender/OLP’s Data Protection Officer (DPO) demanding deletion of contacts and cessation of harassment. Give 15 days to comply.
*2. File a Privacy Complaint.*	After 15 days (or if harassment escalates), lodge complaint within 1 year of the last privacy-violating act.
3. Evaluation & Mediation.	NPC evaluates within 10 working days; may call parties for mediation or direct “Cease & Desist Order.”
4. Formal Investigation.	If unresolved, NPC issues Notice to Explain to the respondent.
5. Decision & Penalties.	NPC can impose fines up to ₱5 million per violation plus imprisonment (enforced via DOJ).

B. Securities and Exchange Commission (SEC)

Step	Details
1. Prepare Complaint Affidavit.	Sworn statement + evidence bundle in PDF, saved under 20 MB.
2. Send via Email or Personally File.	Email CGFD or EIPD; or walk-in at SEC Main Office, Mandaluyong.
*3. SEC Issues Show-Cause Order.*	The company must explain within 5 days.
4. Possible Outcomes.	Suspension/revocation of CA, ₱25,000–₱1 million fine per offense, order to delete harvested data, Google Play/App Store takedown request, referral for criminal prosecution.

C. PNP-ACG / NBI-CCD

Execute a Sworn Statement before a duty prosecutor or investigator.
Provide original devices (if needed) for forensic imaging.
Investigation & Inquest. For in flagrante delicto cyber-crimes, suspects may be arrested without warrant (Rule 113, Sec. 5, Rules of Court).
Filing of Information with the Regional Trial Court (Special Cybercrime Division).

6 Civil & Criminal Remedies

Remedy	Grounds	Statute of limitations
Damages suit for invasion of privacy, mental anguish	Art. 26 Civil Code, Art. 2219 (moral), 2224 (exemplary)	4 years
Cyber-libel criminal action	RA 10175; penalties: prision correccional max, fine up to ₱1 million	1 year
Breach of data privacy	RA 10173; up to 6 years imprisonment & ₱500 k–₱5 M fine	5 years

Small claims (≤₱400 k) for refund of illegal charges may be filed in the Metropolitan/ Municipal Trial Court under A.M. 08-8-7-SC as amended.

7 Template: Basic Complaint-Affidavit (SEC / NPC)

REPUBLIC OF THE PHILIPPINES  )
CITY OF ___________         ) S.S.

                            COMPLAINT-AFFIDAVIT

I, [Name], Filipino, of legal age, residing at [Address], after having been
duly sworn, depose and state:

1. On [dates], I obtained a loan of ₱[amount] from the mobile application
   “__________,” operated by [Company Name], SEC Certificate No. _____.

2. Beginning on [date], the respondent repeatedly ...
   (state facts in numbered paragraphs; attach evidence labels: Annex “A,” etc.)

3. The acts complained of violate:
   a) SEC MC 18-2019, Sec. 1(b) — ‘Unfair Debt Collection’; and
   b) RA 10173 — unauthorized processing and malicious disclosure of personal data.

PRAYER: Wherefore, premises considered, it is respectfully prayed that the
Honorable Commission order the respondent to CEASE AND DESIST from ...,
impose administrative fines, and refer the matter for criminal prosecution.

[Signature]
[ID details]

SUBSCRIBED AND SWORN to before me ...

8 Possible Agency Actions

Cease-and-desist order—immediately halts collection activities.
App-store takedown—Google/Apple remove the offending app.
Fines & suspension—SEC may levy escalating fines and revoke authority to operate.
Criminal referral—prosecutors may charge officers/directors personally.
Data-deletion order—NPC can mandate erasure of illegally obtained contacts.

9 Preventive Measures for Borrowers

Read app permissions; deny access to contacts and photos.
Borrow only from SEC-registered lenders (verify CA number on sec.gov.ph).
Keep written records of every payment.
Negotiate in writing; insist on updated Statement of Account.
Block harassing numbers while continuing to archive messages for evidence.
Consult a lawyer or Public Attorney’s Office before signing any “waiver” drafted by the lender.

10 Frequently Asked Questions (FAQ)

Question	Short Answer
Will filing a complaint erase my debt?	No. Legitimate principal + agreed interest remain payable. What the law stops is abusive collection.
Can the lender “blacklist” me with NBI or BI?	There is no legal “blacklist.” Only a valid court judgment can be a basis for a Hold-Departure Order or criminal record.
They threatened to sue me for Estafa—should I worry?	Simple non-payment of a loan is generally civil, not Estafa, unless fraud at inception (e.g., fake IDs) is proven.
How long do I have to complain?	For privacy breaches, within 1 year from last act (NPC); for SEC unfair collection, no rigid deadline but earlier is better.

Conclusion

Philippine law shields consumers from the predatory tactics of certain online lending apps. By meticulously documenting every incident and filing the proper complaint with the right regulator, a borrower can stop harassment, hold companies and their officers liable, and even trigger app removal from digital stores. Understanding your statutory rights—especially under the Data Privacy Act, the SEC’s unfair collection rules, and cybercrime laws—turns the power imbalance in your favor.

Need more help? You may contact the Integrated Bar of the Philippines (IBP) legal aid hotline at (02) 8251-1056 or your local PAO office for free counsel.