By Praise Olasupo[1]
![](https://thenigerialawyer.com/wp-content/uploads/2026/09/2026-IDRI-Masterclass.png")
INTRODUCTION
Digital lending has significantly eased access to short-term credit in Nigeria, yet it has also triggered a persistent debt-recovery problem. In attempting to enforce repayment, some lenders resort to contacting borrowers’ relatives, employers, and associates, often using contacts obtained from mobile devices, sometimes accompanied by accusations of fraud, theft, or criminality.
While a creditor is undoubtedly entitled to recover a lawful debt, that right is not unlimited. A missed repayment date does not automatically turn a civil default into a crime, nor does a contractual claim grant an unrestricted license to expose a debtor’s private affairs to third parties.
This article examines those legal boundaries through Section 124 of the Federal Competition and
Consumer Protection Act (FCCPA) 2018, the law of defamation, the Nigeria Data Protection Act (NDPA) 2023, the current digital lending regulatory framework, and relevant criminal law provisions.
DEFAMATION: INJURING REPUTATION UNDER THE LAW
Section 373 of the Criminal Code Act[2] defines defamatory matter as:
“…a matter likely to injure the reputation of any person by exposing him to hatred, contempt, or ridicule, or likely to damage any person in his profession or trade by any injury to his reputation. Such matter may be expressed in spoken words or in any audible sounds, or in words
marked on any substance whatever, or by any sign or object signifying such matter otherwise than the words, and may be expressed either directly or by insinuation or irony…”
The apex Court in C.S.S. & D.F. Ltd. v. Schlumberger (Nig.) Ltd. (2018) 15 NWLR (Pt.
1642) 238 (Pp. 253, para. F; 257, paras. C-E)[3] held;
“Defamation, as a tort, whether as libel or slander, consists of the publication to a third person or persons of any false word or matter which tend:
to lower the person defamed in the estimation of right-thinking members of society generally; or to expose him to hatred, contempt, opprobrium or ridicule; or to cut him off from society or cause other persons to shun or avoid him; or to discredit him or injure his reputation in his office, trade or profession; or to injure his financial credit.
Under Nigerian law, defamation splits into two distinct forms:
Libel, which covers written or permanent statements, and Slander, which takes a spoken or transient form. When digital lenders send out shame messages, three critical factors come into play:
First, intention is not an element of civil libel. The court does not care whether a lender intended to cause harm; liability turns solely on the impact of the message. If a published statement falsely lowers a person’s standing in the eyes of right-thinking members of society, the publisher is liable regardless of motive.
Second, digital debt-shaming falls squarely under libel. Because these messages rely on text messages, WhatsApp broadcasts, or social media posts, they exist in permanent form. In
Guardian Newspapers Ltd v. Ajeh (SC.234/2005)[4], the Supreme Court reaffirmed that any
publication exposing a person to public hatred and ridicule satisfies the elements of libel, thereby making it actionable per se. The law automatically presumes reputational damage, so a borrower does not need to prove actual financial loss to succeed in court.
Third, lenders cannot hide behind the defence of justification (truth). Lenders frequently argue that their messages are justified because the borrower defaulted. However, the truth of a debt and the truth of a defamatory label are entirely separate issues. Proving that a borrower owes ₦100,000 establishes a simple breach of contract; it does not prove they are a “thief,” “fraudster,” or “wanted criminal.” Unless the lender can establish that the borrower actually committed a criminal offense, the defence of justification (truth) fails completely, leaving the lender fully exposed to civil liability.
UNFAIR TACTICS UNDER SECTION 124 OF THE FCCPA
Section 124 of the Federal Competition and Consumer Protection Act (FCCPA) 2018[5] establishes a clear boundary between legitimate debt collection and unlawful harassment. Under the heading Right to Fair Dealing, the Act strictly provides:
“An undertaking or any person acting on its behalf shall not use physical force, coercion, undue influence or pressure, harassment, unfair tactics or any other similar conduct against any person in connection with:
- Marketing of any goods or services;
- Supply of goods or services to a consumer;
- Negotiation, conclusion, execution or enforcement of an agreement to supply any goods or services to a consumer;
- Demand for, or collection of, payment for goods or services by a consumer; or
- The conduct of a legitimate business transaction.”
The tactics employed by aggressive digital lending apps such as scraping phone address books, firing off mass SMS blasts, or sending threatening messages fall directly under the prohibitions of undue pressure, coercion, and harassment under Section 124(d)[6].
To stop these abuses, the Federal Competition and Consumer Protection Commission (FCCPC) rolled out the Digital, Electronic, Online, or Non-Traditional Consumer Lending Regulations (DEON Regulations) 2025. Under this system, online lenders must sign strict commitments using Form 001 and Form 002. Form 001 forces lenders to guarantee that their apps will never hack into or access a user’s contacts, call history, or photos. Form 002 ties them down to respecting personal privacy and following lawful recovery standards. Unfortunately, many loan apps still ignore these rules just to chase quick repayments.
These rules have solid backing from the courts. In Wireless Application Service Providers
Association of Nigeria Ltd/Gte v. Federal Competition and Consumer Protection
Commission[7], after an interim court order briefly halted enforcement of these regulations, the Federal High Court in Lagos dismissed the challenge on July 20, 2026, fully upholding the regulations, restoring the FCCPC’s authority to enforce compliance across the digital lending sector.
It is also worth noting that these specific registration rules apply to digital loan apps, not commercial banks licensed under BOFIA. But that does not mean traditional banks get a free pass. In United Bank for Africa Plc v. FCCPC[8], the Federal High Court affirmed that the FCCPC holds full authority to investigate banks whenever they violate consumer rights or mistreat customers.
UNDUE INFLUENCE VS. DEFAMATION & DIGITAL CRIMES
Combining the general law of torts with Section 124 of the FCCPA demonstrates how unethical recovery practices trigger direct legal liabilities. Mass-broadcasted messages or digital flyers that portray defaulting borrowers as absconding criminals cross the threshold from civil debt disputes into actionable defamation and cybercrime.
Beyond civil liability, debt-shaming carries serious criminal consequences under Southern Nigeria’s Criminal Code (and equivalent provisions under Sections 391 and 392 of the Penal Code in Northern states).
Under Section 375 of the Criminal Code Act[9]:
“Publishing defamatory matter is a misdemeanor punishable by up to one year in prison, or two years if the publisher knows the statement is false. However, the law goes even further when lenders resort to coercion.”
Under Section 376[10], anyone who publishes, threatens to publish, or offers to withhold defamatory matter with the intent to extort money or gain a benefit commits a felony punishable by up to seven years imprisonment. While prosecutors must prove the required statutory intent in each case, the coercive practice of “pay now or we expose you to your contacts” directly triggers this criminal exposure
Essentially, lenders cannot bypass civil courts by treating loan defaults as criminal offenses. A missed repayment date does not, by itself, convert a civil debt into fraud. In Kure v.
Commissioner of Police[11], the Supreme Court firmly held thus:
“The proper remedy for the failed transaction lay in civil proceedings for damages, restitution or specific performance, rather than criminal prosecution.”
The apex court explicitly rejected using criminal machinery or law enforcement agencies to resolve pure contractual disputes where the elements of a crime are completely absent.
Being owed money is not a defence to libel. A financial debt does not grant a creditor the legal right to destroy a citizen’s character. Furthermore, aggressive debt-shaming can trigger criminal liability under the Cybercrimes (Prohibition, Prevention, etc.) Act 2015 (as amended in 2024).[12]
Following the 2024 amendment, Section 24(1)13 was significantly narrowed, replacing the old, broad language around messages causing mere “annoyance” or “needless anxiety” with provisions strictly targeting pornographic content and false messages meant to threaten life or spark public disorder.
However, for coercive debt recovery practices, Section 24(2) remains the key provision. Where a digital lender or recovery agent sends electronic messages threatening to ruin a borrower’s reputation, publish damaging material, or falsely accuse them of a crime to force repayment, criminal liability may arise. Whether an offense has been committed ultimately depends on the specific content, context, and intent of the communication.
DEBT RECOVERY AND BREACH OF DATA PRIVACY
Unlawful recovery tactics directly conflict with statutory data privacy standards. Under the Nigeria Data Protection Act (NDPA) 2023, supplemented by the NDP Act General Application and Implementation Directive (GAID) 2025, personal data encompasses any information that can directly or indirectly identify a natural person (the data subject), including names, phone numbers, contact lists, and photos.
When digital lenders operate mobile applications, they act as Data Controllers, subjecting them to strict statutory principles under Section 24 of the NDPA[13]. These include processing data fairly, lawfully, and transparently; limiting collection to specified, explicit, and legitimate purposes; and adhering strictly to data minimization.
Granting an app permission to access your contacts on your phone is just a technical setting, it doesn’t count as real legal consent under Section 26 of the NDPA[14]. To be legally effective, consent must be freely given, specific, informed, and unambiguous through an affirmative action. It cannot be presumed through silence, or made an unnecessary condition for receiving a service.
A lender cannot establish a lawful basis under Section 25 of the NDPA to scrape a borrower’s address book merely because the borrower clicked “Allow.” While the law permits an individual to give consent on behalf of another where proper authorization exists, the mere possession of a contact number in a phonebook confers no such authority.
Furthermore, consent is only one of several lawful bases under Section 25[15]. A lender seeking to rely on contractual necessity will fail, as the borrower’s loan agreement does not make processing hundreds of uninvolved third parties’ data necessary for performing the contract. When you weigh any claimed business interest against the privacy rights of completely uninvolved third parties, people who never signed up for the loan and have no connection to it, that interest completely falls apart. People have a reasonable expectation that their personal data won’t be dragged into someone else’s debt.
Using someone’s contact list to harass people for debt recovery breaches the core principles of purpose limitation and data minimization [16]. Under purpose limitation, data collected for credit
evaluation or identity verification cannot later be weaponized for debt recovery, public shaming, or third-party pressure. Likewise, data minimization requires lenders to collect only what is strictly necessary. Scrapping up hundreds of uninvolved contacts to evaluate a simple consumer loan fails this standard automatically.
Data collected for identity verification or credit scoring cannot subsequently be repurposed for public shaming or third-party harassment.
Legally, a distinction must be drawn between unlawful processing and a statutory personal data breach. Under Section 65 of the NDPA[17], a personal data breach specifically refers to a security failure leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data. While contact scraping constitutes unlawful processing in every instance, it may additionally trigger the separate statutory data breach regime where security failures lead to unauthorized third-party exposure.
Indiscriminate contact scraping and debt-shaming offends fundamental constitutional protections. In Incorporated Trustees of Digital Rights Lawyers Initiative (DRLI) v. NIMC (2021)[18], the Court of Appeal affirmed that data protection rights fall squarely within the constitutional right to privacy under Section 37 of the 1999 Constitution of the Federal Republic of Nigeria (as amended)[19].
Where debt-shaming tactics cross the line into severe harassment or public degradation, they may separately infringe upon the right to dignity of the human person under Section 34 of 1999 Constitution (as amended)[20]. However, enforcement actions must be properly structured: privacy and dignity represent distinct constitutional rights, and fundamental rights enforcement proceedings must be brought before a court of competent jurisdiction over both the parties and the subject matter.
While Form 002 of the FCCPC DEON Regulations still references the Nigeria Data Protection Regulation (NDPR) 2019, the Nigeria Data Protection Commission (NDPC) now applies the NDPA 2023 and GAID 2025 as the primary regulatory framework, preserving prior regulatory acts through the statutory transitional framework.
International Context: The Broader Picture
Nigeria’s regulatory framework on coercive debt recovery aligns with established international standards governing consumer protection and data privacy.
In the United States, the Fair Debt Collection Practices Act (FDCPA) provides a clear precedent. Under 15 U.S.C. § 1692c(b)[21], debt collectors are generally barred from discussing a debtor’s obligations with third parties. Additionally, Section 1692d[22] specifically prohibits harassment, including the publication of lists naming consumers who allegedly refuse to pay, which is similar to the contact-shaming tactics seen locally.
Similarly, the European Union’s General Data Protection Regulation (GDPR) sets out baseline principles under Articles 5 and 6[23], requiring fairness, purpose limitation, data minimization, and a valid lawful basis for processing personal data. These concepts now form the core of Nigeria’s Data Protection Act (NDPA) 2023.
Though foreign statutes carry only persuasive value in Nigerian courts, these similarities demonstrate that Nigeria’s regulatory framework is part of an international movement to curb reputational abuse and unauthorized data processing in consumer lending.
LEGITIMATE AVENUES FOR DEBT RECOVERY IN NIGERIA
Creditors seeking to enforce payment without breaking the law must adhere to structured judicial processes:
a. Issuance and Service of a Formal Demand Letter
A formal demand letter serves as official legal notice to the debtor, detailing the precise principal sum, agreed interest, and a definite timeline for settlement.
Beyond putting the debtor on notice, issuing a demand letter is frequently a necessary preliminary step before initiating legal proceedings. However, pre-action requirements are not uniform across Nigeria; they depend on the applicable court rules, contractual terms, and procedural track. Under Small Claims regimes, such as Article 2 of the Practice Directions on Small Claims under the Magistrates’ Courts Law, serving a prescribed Letter of Demand (Form SCA 1) is an express requirement before filing a suit.
For High Court actions, the effect of pre-action protocol compliance varies by state jurisdiction and the nature of the claim. Non-compliance does not automatically or universally strip a court of jurisdiction. As the Court of Appeal clarified in Spog Petrochemicals Ltd v. Pan Peninsula Logistics Ltd (2017) LPELR-41853(CA)[24] when interpreting the Lagos State pre-action requirements, procedural defaults must be weighed against the specific rules of court and do not operate as an absolute bar in every instance.
Creditors must therefore assess the specific procedural rules and contractual provisions of their transaction rather than relying on a one-size-fits-all approach to pre-action demand letters.
- Instituting Court Proceedings:
If a debtor refuses to pay after receiving a formal demand letter, the lender’s lawful remedy is to file a civil action in court (e.g., through the Summary Judgment Procedure, Undefended List, or Small Claims Court). Once judgment is secured, it can be lawfully enforced through courtsanctioned mechanisms such as Garnishee Orders, writs of execution, or attachment of properties.
LEGAL REMEDIES AVAILABLE TO VICTIMIZED BORROWERS
Borrowers subjected to illegal harassment, unauthorized data exposure, or character assassination have both regulatory and judicial options for redress:
a. Complaints via the FCCPC
Under the Limited Interim Regulatory Framework for Digital Lending, aggrieved borrowers can report predatory digital money lenders to the Joint Regulatory Task Force via lenderstaskforce@fccpc.gov.ng. Following an investigation, the FCCPC can impose administrative penalties, including fines, operational suspension, app delisting, or complete revocation of regulatory approval.
b. Statutory Complaints before the NDPC
Victims of data privacy violations can utilize the statutory complaint mechanism under the Nigeria Data Protection Act 2023 to petition the Nigeria Data Protection Commission (NDPC). The Commission can investigate breaches, issue binding compliance orders, and enforce regulatory fines against non-compliant lenders.
c. Constitutional Fundamental Rights Enforcement
Borrowers can enforce their constitutional rights to human dignity and privacy, guaranteed under Sections 34 and 37 of the 1999 Constitution (as amended) by filing an application under the Fundamental Rights (Enforcement Procedure) Rules 2009 in a court of competent jurisdiction.
d. Civil Action for Defamation
Victims can sue for libel in civil court to claim general damages and seek injunctive relief against further defamatory communications. Where actual, quantifiable financial loss has occurred, special damages may be claimed and strictly proved. Exemplary damages may also be awarded, though they do not flow routinely from every defamatory message; the borrower must satisfy established judicial criteria showing a high-handed conduct by the lender.
CONCLUSION
Damage to character is rarely undone by a bank receipt. Once a borrower has been publicly branded a fraudster, lost business opportunities and damaged personal relationships do not simply reappear upon full discharge of the debt
At the same time, unlawful collection methods do not erase the debt. A lender’s contractual right to seek repayment remains intact. What disappears is any legal justification for using extrajudicial coercion to collect it.
Nigerian law offers creditors clear remedies through formal demand procedures, civil litigation, and judgment-enforcement mechanisms. Section 124 of the FCCPA strictly limits how commercial leverage can be exercised against consumers, while the NDPA protects personal data, civil actions safeguard reputation, and criminal law applies where statutory thresholds are met.
The core rule is simple: a creditor is entitled to pursue what it is owed through lawful channels. It is not entitled to fabricate crimes, drag uninvolved third parties into a private dispute, or use a person’s reputation as collateral.
[1] Praise Olasupo, LL.B (Hons); B.L(Hons); AICMC; olasupopraise.1@gmail.com
[2] Criminal Code Act 1916, s373
[3] C.S.S. & D.F. Ltd. v. Schlumberger (Nig.) Ltd. (2018) 15 NWLR (Pt. 1642) 238 (Pp. 253, para.
F; 257, paras. C-E)
[4] Guardian Newspapers Ltd v. Ajeh (SC.234/2005) <https://nigerianlawforum.com/caselaw/guardian–newspapers–ltd–v–ajeh–2011/#court–findings> accessed September 9, 2026.
[5] Federal Competition and Consumer Protection Act 2018, s124
[6] Supra
[7] Wireless Application Service Providers Association of Nigeria Ltd/Gte v. Federal Competition and Consumer Protection Commission, FHC/L/CS/760/2026 <https://fccpc.gov.ng/wirelessapplication–service–providers–association–of–nig–ltd–gte–waspan–v–fccpc/> accessed September 9, 2026.
[8] United Bank for Africa Plc v. FCCPC, FHC/ABJ/CS/1972/2025 <https://fccpc.gov.ng/banksanswerable–to–fccpc–court–rules/> accessed September 10, 2026.
[9] Criminal Code Act 1916, s375
[10] CCA, s376
[11] Theophilus Kure v. Commissioner of Police (2020) <https://nigerianlawforum.com/caselaw/theophilus–kure–v–commissioner–of–police–2020/> accessed September 10, 2026
[12] Cybercrimes (Prohibition, Prevention, Etc.) Act 2015, (as amended, 2024) s24 13 Supra
[13] Nigeria Data Protection Act (NDPA) 2023, s24
[14] NDPA, s26S
[15] NDPA, s25
[16] Ganesh, P., Tran, C., Shokri, R., & Fioretto, F. The Data Minimization Principle in Machine
Learning (2024) <https://prakharg24.github.io/files/data_minimization.pdf> accessed September 9, 2026
[17] Nigeria Data Protection Act (NDPA) 2023, s65
[18] Incorporated Trustees of Digital Rights Lawyers Initiative v NIMC (2021) LPELR-
55623(CA)
[19] Constitution of the Federal Republic of Nigeria, 1999 (as amended), s37
[20] CFRN 1999, s34
[21] Fair Debt Collection Practices Act (FDCPA), 15 U.S.C. § 1692c(b).
<https://www.ftc.gov/legal–library/browse/rules/fair–debt–collection–practices–act–text> accessed September 16, 2026.
[22] FDCPA, s1692d
[23] The General Data Protection Regulation (GDPR), Arts 5-6
[24] Spog Petrochemicals Ltd v. Pan Peninsula Logistics Ltd (2017) LPELR-41853(CA).
<https://legalnaija.com/the–court–of–appeals–decision–on–pre/> accessed September 16, 2026.
[A MUST HAVE] Evidence Act Demystified With Recent And Contemporary Cases And Materials
Available now for NGN 40,000 at ASC Publications, 10, Boyle Street, Onikan, Lagos. Beside High Court, TBS. Email publications@ayindesanni.com or WhatsApp +2347056667384. Purchase Link: https://paystack.com/buy/evidence-act-complete-annotation
______________________________________________________________________ “Enhance Legal Practice With Authoritative Reports” — Alexander Payne Offers Comprehensive Law Reports, Spanning Over A Century Of Nigerian Jurisprudence
Interested buyers are encouraged to place their orders and enquiries via:
0704 444 4777, 0704 444 4999, 0818 199 9888
Website: www.alexandernigeria.com
