LabanPH
CashaloContact-List Access / Debt Shaming

Cashalo — Contact-List Access / Debt Shaming

Lending app accessed phone contacts without consent and used them to shame or pressure the borrower — calling family, friends, or employers about the debt.

Cashalo, part of the Oriente group, is named in multiple documented complaints describing contact-list access used as a collection tool: messages and calls to people in the borrower's phonebook who never agreed to act as references for a loan. The pattern is the same one that triggered the SEC's 2019 issuance of Memorandum Circular 18, which prohibits SEC-registered lending and financing companies from contacting persons in a borrower's phone contacts as a collection mechanism, and prohibits the use of obscene, threatening, or harassing language.

Cashalo is SEC-registered as a financing company, so the SEC Enforcement and Investor Protection Department (EIPD) is the front-line forum, with concurrent jurisdiction at the NPC for the data-privacy violation. RA 10173 makes Cashalo's processing of third-party contacts without lawful basis a separate, parallel violation. This page documents Cashalo's public record, the cohort already on file at LabanPH for this exact issue, and the dual-track SEC + NPC filing path that turns contact-list harassment screenshots into a regulator-routed complaint.

Legal basis (Philippines)

See the issue page for the full citation list. Primary statutes implicated by contact-list access / debt shaming include RA 11765 (FCPA, 2022), RA 3765 (Truth in Lending Act), RA 10173 (Data Privacy Act), BSP Circular 1048 / 1133 / 1160, and SEC MC 18 (2019) where applicable.

Public record — Cashalo × Contact-List Access / Debt Shaming

No documented public-record events for Cashalo on contact-list access / debt shaming yet — be the first to file.

(1 other public-record entries exist for Cashalo on unrelated issues — see the company record page.)

File the first complaint →

Documented complaints

No complaints documented yet for Cashalo on this issue.

File the first complaint →

Recommended actions

  1. 1.Build the harassment-evidence checklist
  2. 2.Generate the SEC MC-18 complaint letter
  3. 3.File the parallel NPC data-privacy complaint
  4. 4.Read the SEC MC-18 cease-and-desist guide

Related questions

How do I file a complaint against an online lending app?

File simultaneously with the SEC Corporate Governance and Finance Department (cgfd@sec.gov.ph) for SEC MC 18 violations and with the National Privacy Commission (privacy.gov.ph) for unauthorized contact-list access under RA 10173. Both agencies can suspend the lender's Certificate of Authority and order data deletion; the SEC has revoked the licenses of multiple OLPs since 2019.

How do I report a data privacy violation in the Philippines?

File with the National Privacy Commission (NPC) at privacy.gov.ph using the official complaint form. The Data Privacy Act of 2012 (RA 10173) gives the NPC authority to investigate, order data deletion, fine controllers, and refer criminal cases to the DOJ. The complaint must identify the data controller, describe the alleged violation, and attach documentary evidence.

How long does an SEC complaint take?

SEC's Enforcement and Investor Protection Department (EIPD) typically issues show-cause orders within 30–60 days of a complete complaint and decides administrative cases within 6–12 months. Cease-and-desist orders against unregistered or egregiously violating online lending platforms have been issued in as little as 14 days. Timelines lengthen when the respondent contests the SEC's jurisdiction.

What is the SEC MC 18?

SEC Memorandum Circular No. 18, series of 2019, prohibits unfair debt-collection practices by SEC-registered lending and financing companies. It bars contacting the borrower's contacts, employer, or family without consent; using profane language; threatening criminal prosecution without legal basis; and calling between 10 PM and 6 AM. Violations carry administrative fines of ₱25,000–₱1,000,000 per count and possible suspension or revocation of the Certificate of Authority.

Can creditors call my employer in the Philippines?

No, except under narrow conditions. SEC MC 18 (2019) prohibits SEC-registered lenders from contacting your employer, family, or any third party without your prior written consent. BSP Circular 1048 imposes the same prohibition on BSP-supervised institutions. The only permitted contact is with a person you specifically designated as an emergency contact during the loan application.

Related guides — Contact-List Access / Debt Shaming

How to document a data-privacy violation for an NPC complaint

How to document a Philippine data privacy violation for an NPC complaint — RA 10173, NPC Circular 16-01, evidence pack, screenshots, and the filing path.

npc · data-privacy · ra-10173

SEC MC 18 (2019) — File a Complaint Against an Online Lending App

Step-by-step guide to filing a Securities and Exchange Commission complaint against a Philippine online lending app — SEC MC 18 (2019), evidence checklist, and the FinCare portal.

sec · online-lending · harassment

Illegal Debt Collection PH — RA 11765 & SEC MC 18 Response Guide

How to respond to illegal debt collection in the Philippines — SEC MC 18, BSP Circular 1160, cease-and-desist template, evidence pack, and regulator complaint paths.

debt-collection · harassment · cease-and-desist

Did this happen to you?

File a complaint and we will pre-fill your BSP, SEC, DTI, and small-claims letters.

File a Complaint →Build a Letter →

Frequently asked — Cashalo × Contact-List Access / Debt Shaming

Can a lending app legally access my phone contacts?

No. SEC MC 18 (2019) prohibits SEC-registered lenders from accessing phone contacts; RA 10173 §13 separately bars processing of personal data without explicit consent. The SEC has revoked Certificates of Authority for this conduct.

Where do I report contact-list shaming?

File simultaneously with the SEC EIPD (cgfd@sec.gov.ph) for SEC MC 18 violations and with NPC at privacy.gov.ph for unauthorized data processing under RA 10173. Both filings are free and may be lodged online.

Anong evidence ang dapat i-save sa harassment?

Screenshots ng harassing SMS o chat, call recordings, ang permission request screen ng app, at anumang messages na ipinadala sa inyong contacts o pamilya. I-save ang loan disclosure at SEC registration screenshot ng lender.

Can my employer be contacted about my debt?

No. SEC MC 18 prohibits SEC-registered lenders from contacting your employer, family, or any third party other than a designated co-maker, without prior written consent. BSP Circular 1048 imposes the same prohibition on BSP-supervised entities.

What penalties can the lender face?

SEC MC 18 §6 imposes fines of ₱25,000–₱1,000,000 per count and possible suspension or revocation of the Certificate of Authority. RA 10173 imposes administrative fines up to ₱5M per offence (NPC Circular 2022-01) and criminal penalties up to 6 years.

Is Cashalo SEC-registered?

Cashalo is operated by Paloo Financing Inc. (Oriente Group), an SEC-registered financing company. The brand is bound by SEC MC 18 (collection conduct) and SEC MC 3, 2022 (effective interest disclosure).

What is Cashalo's maximum interest rate?

BSP Circular 1133 caps consumer-loan effective interest at 6% per month nominal (24% per annum) and total cost (incl. penalties) at 15% per month for short-term, low-value loans. The cap was extended by BSP Circular 1165 (2023).

How do I report Cashalo collection harassment?

File simultaneously with the SEC EIPD (cgfd@sec.gov.ph) for SEC MC 18 violations and with NPC at privacy.gov.ph for unauthorized contact-list access under RA 10173.

Can Cashalo legally call my contacts?

No. SEC MC 18 prohibits contacting any third party other than a designated co-maker without prior written consent. RA 10173 separately prohibits accessing phone contacts without explicit consent.

💬