Quick answer

A lending app or collector generally cannot publish your name, photo, loan details, workplace, phone number, contacts, or other personal information online to shame or pressure you into paying. Even when the debt is real and overdue, collection must remain lawful, fair, and respectful.

Preserve the post before it disappears, report it to the platform, send the lender a written takedown and privacy complaint, and file with the proper regulator:

SEC for a lending or financing company and its collection agency;
National Privacy Commission (NPC) for misuse or disclosure of personal data;
BSP if the lender is a bank, digital bank, e-money issuer, or another BSP-supervised institution; and
Police or the NBI when the post involves threats, extortion, identity theft, account intrusion, or possible cyberlibel.

Reporting abusive collection does not automatically erase a valid loan. The lender may still demand payment, negotiate, or sue through lawful channels. However, public shaming is not a lawful substitute for collection. The Constitution also prohibits imprisonment for debt alone, although separate acts such as fraud or issuing a bad check may raise different legal issues. See the 1987 Constitution, Article III, Section 20.

When an online post may violate the rules

SEC Memorandum Circular No. 18, Series of 2019 applies to financing companies, lending companies, and their third-party service providers. It permits reasonable and legally permissible collection but prohibits unfair practices, including:

Threatening violence, reputational harm, property damage, or action that cannot legally be taken;
Using obscenities, insults, or profane language to abuse a borrower;
Disclosing or publishing borrowers’ names and other personal information because they allegedly refuse to pay, except for narrowly permitted disclosures;
Communicating loan information known, or which should be known, to be false—including failing to say that a debt is disputed when applicable;
Using false representations or deceptive means to collect;
Contacting people in the borrower’s contact list who were not named as guarantors or co-makers, notwithstanding the borrower’s consent; and
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., subject to the circular’s exceptions when the account is more than 15 days past due or the borrower expressly agreed, through written, electronic, or recorded means, that those hours are the only reasonable opportunities for contact.

The Financial Products and Services Consumer Protection Act, or Republic Act No. 11765, separately prohibits abusive collection or debt-recovery practices. It requires financial service providers to respect client privacy and provide a free consumer-assistance mechanism. A provider is responsible for the acts or omissions of its employees and agents and may be solidarily liable with an accredited third-party service provider involved in debt collection.

The NPC’s rules are particularly relevant when a post uses information taken from a loan application or the borrower’s phone. Under NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02:

A borrower’s photo must not be used to harass or embarrass the borrower;
Unconstrained, excessive, or disproportionate processing of contact lists is prohibited;
Contact-list processing that leads to harassment, unfair collection, or debt collection outside the borrower’s guarantors is prohibited; and
Access to contacts must be limited to what is necessary for the borrower to select character references or guarantors through a separate interface.

The Data Privacy Act of 2012 also requires personal data to be processed fairly, lawfully, and consistently with transparency, legitimate purpose, and proportionality. Lack of consent is not the only test because the law recognizes other lawful grounds for processing. Even so, a lender must be able to justify the specific disclosure and cannot use an otherwise lawful collection purpose as a license for excessive or humiliating publication.

Depending on the evidence, the NPC or a prosecutor may consider whether the conduct amounts to unauthorized processing, processing for an unauthorized purpose, unauthorized disclosure, or malicious disclosure. These are fact-dependent findings; a threatening or offensive post does not automatically establish every offense under the Data Privacy Act.

Important exceptions

Not every communication about a loan is prohibited. A lender may, when legally permitted and only to the necessary extent, disclose information privately to an authorized collection agency, lawyer, service provider, insurer, credit information entity, court, or government agency. A borrower may also give written or recorded consent to a particular disclosure.

These exceptions ordinarily do not justify an open Facebook post, a public “borrower blacklist,” tagging the borrower’s employer or relatives, or publishing an ID, selfie, address, phone number, or account details to cause embarrassment.

Likewise, not every negative online statement is automatically cyberlibel. Cyberlibel generally requires a defamatory imputation, publication, identification of the person concerned, and malice, subject to defenses and privileges. The Supreme Court discusses the elements of libel in Disini v. Secretary of Justice. Privacy and unfair-collection violations may still exist even when the underlying debt is genuine.

What to do immediately

1. Preserve the post before reporting it

Do this before blocking the account, deleting the app, or asking the platform to remove the material:

Take full-screen screenshots showing the post, account name, profile photo, date and time, comments, shares, and visible URL.
Make a screen recording that starts from the account or page and opens the post. This helps show where the screenshots came from.
Copy the exact post, profile, page, or group URL.
Save the original image, video, message, email, or notification where possible.
Record the date and time you first discovered the post.
Capture comments or replies showing who received or understood the accusation.
Ask people who were tagged or sent the post to preserve their own copies, notifications, and messages.
Keep call logs, text messages, collection chats, emails, payment demands, and voice messages.
Preserve the loan agreement, disclosure statement, repayment schedule, receipts, account ledger, app privacy notice, and screenshots of requested app permissions.
Write a short chronology identifying each incident, account, phone number, collector name, and complaint reference number.
Keep the original phone and unedited files. Back them up without changing filenames or metadata.

Electronic evidence must still be authenticated. A screenshot is useful, but its weight improves when its source, integrity, and surrounding facts can be shown. The governing standards appear in the Supreme Court’s Rules on Electronic Evidence.

If the post has already disappeared, preserve cached previews, notifications, platform emails, messages from people who saw it, and any copy showing the URL or account. Ask witnesses to write down what they personally saw while their memory is fresh.

2. Limit further exposure

After preserving evidence:

Use the platform’s Report function and select the most accurate category, such as harassment, bullying, threats, privacy violation, impersonation, or sharing personal information.
Request removal of copies, comments, and reposts where the reporting tool permits.
Save the platform’s confirmation, case number, and response.
Revoke unnecessary access to contacts, photos, storage, microphone, camera, and location in the phone’s settings.
Change passwords if the app or collector may have accessed an account, and enable two-factor authentication.
Warn affected contacts not to engage with the collector, send money, disclose information, click links, or provide passwords or one-time PINs.
Do not publicly argue with or threaten the collector. A public exchange may spread the post further and complicate the evidence.

3. Identify the responsible company

The app’s brand name may be different from the lender’s registered corporate name. Check:

The loan agreement and disclosure statement;
The app’s privacy notice, terms, “About” page, and developer listing;
Collection emails, payment instructions, receipts, and bank or e-wallet recipient names;
The company’s SEC registration number and Certificate of Authority; and
The name of the collection agency or individual collector.

Use the SEC’s Check with SEC service where available. Corporate registration alone does not necessarily prove that a company has authority to operate as a lending or financing company. Include both the app name and corporate name in complaints.

4. Send a written takedown and privacy complaint

Send the notice to the lender’s official consumer-assistance channel, Data Protection Officer, and collection agency. Use email or another traceable method that shows when it was received.

State:

Your name and whether you are the borrower, guarantor, reference, contact, or another affected person;
The app, lender, and collector involved;
The post’s URL, date, account, and screenshots;
The personal data or loan information disclosed;
Why the information is false, disputed, excessive, or unauthorized;
The harm or continuing risk;
A demand to remove the post, stop further disclosure, preserve relevant records, and confirm the action taken;
A request for the identity and authority of the collector and the lender’s Data Protection Officer;
A request for a copy of the data being processed, its source, recipients, purpose, and legal basis; and
If appropriate, a request to correct, erase, or block inaccurate or unlawfully processed data.

A concise request can say:

I object to the publication and further disclosure of my personal and loan information. Please remove the identified post and all copies under your control, stop contacting unauthorized third parties, preserve the account and collection records relating to this incident, and provide a written response describing the action taken. This notice is without admission of the amount claimed and without waiver of my rights.

If you dispute the debt or amount, say so clearly and request an itemized statement. Keep the payment dispute separate from the takedown demand.

This written notice is also important for an NPC complaint. Under the NPC’s 2021 Rules of Procedure, as amended, a complainant ordinarily must first notify the personal information controller, processor, or concerned entity in writing. The NPC may act after the entity fails to take timely or appropriate action or does not respond within 15 calendar days from receipt. The NPC may waive this requirement for proven good cause or a serious violation, including grave and irreparable harm that only NPC action can prevent or mitigate.

Where and how to report

Securities and Exchange Commission

Use the SEC route when the respondent is a lending company, financing company, online lending platform, or its collection agency.

You may submit a ticket through the SEC iMessage portal or follow the SEC’s lending and financing complaint instructions. The SEC also publishes flcd_complaints@sec.gov.ph for lending complaints.

Prepare:

One complaint form for each respondent company;
A copy of a valid government-issued ID;
The post, URLs, screenshots, and screen recording;
The loan agreement, disclosure statement, receipts, payment history, and collection messages;
The app and registered company names; and
A clear chronology and the relief requested.

The SEC states that complaints insufficient in form or substance may be dismissed. Once accepted, the complaint may be furnished to the company for an answer or comment; its published procedure gives the respondent 10 days from receipt to answer. The SEC may investigate and bring administrative action, but it does not use this complaint process to rewrite the loan, declare the contract void, or cancel the obligation.

National Privacy Commission

Use the NPC route when the post disclosed or misused personal information, accessed contacts, used a borrower’s photo for shaming, or continued processing data despite a valid objection.

Before filing, send the written notice described above and retain proof of receipt. If the violation is serious and continuing, explain in the complaint why the NPC should waive the 15-day exhaustion requirement or why urgent relief may be necessary.

Use the NPC’s current Complaint-Affidavit template, effective since July 1, 2025. The complaint must generally be verified and notarized and should include:

The complainant’s and respondent’s identities and contact details;
A factual narration;
Supporting documents and witness affidavits, when available;
Correspondence with the respondent;
The relief requested; and
A sworn certification against forum shopping.

The complaint may be submitted personally, by courier or registered mail, or—when authorized—by scanned email to complaints@privacy.gov.ph. Check the NPC’s complaint page and current contact advisory before filing.

The current published schedule sets a ₱500 base complaint filing fee, plus a legal research fee of 1% of the filing fee but not less than ₱10. Additional fees apply when claiming damages. Indigent complainants may qualify for exemption, and the NPC may waive fees for good cause under its rules. See NPC Circular No. 2023-01.

Depending on the evidence and due process, the NPC may impose administrative fines, order compliance, award indemnity on personal-data matters, impose a temporary or permanent ban on processing, or recommend prosecution to the Department of Justice. Filing does not guarantee any particular remedy or amount.

Bangko Sentral ng Pilipinas

Use BSP channels only if the lender is a BSP-supervised institution, such as a bank, digital bank, non-bank e-money issuer, pawnshop, money service business, or operator of a payment system—not an ordinary SEC-regulated lending company.

First file a formal complaint through the institution’s own Financial Consumer Protection Assistance Mechanism. If unresolved or the response is unsatisfactory, escalate through the BSP Online Buddy or BSP Consumer Assistance channels. If BOB is unavailable, the BSP permits submission of its complaint form and proof that the institution’s internal mechanism was used to consumeraffairs@bsp.gov.ph.

NBI, police, or prosecutors

Seek law-enforcement assistance when the incident involves a credible threat of harm, extortion, stalking, impersonation, hacking, identity theft, fraudulent payment instructions, or potentially criminal online publication.

You may use the NBI’s online complaint page or approach its Cybercrime Division or a regional office. The DOJ Office of Cybercrime also publishes cybercrime reporting guidance. Bring the original device when requested, together with copies of the post, URLs, account details, chronology, IDs, and supporting records.

For an immediate danger, call 911 or go to the nearest police station. Do not arrange an in-person meeting with a threatening collector on your own.

If cyberlibel may be involved, obtain legal advice promptly. In its final ruling in Causing v. People, G.R. No. 258524, the Supreme Court held that cyberlibel prescribes in one year from discovery by the offended party, the authorities, or their agents. Determining the discovery date, interruption of prescription, proper respondent, venue, and sufficiency of the publication requires review of the actual evidence.

If you were only a reference or phone contact

Being listed as a character reference does not automatically make you liable for another person’s loan. A guaranty is not presumed; it must be express and cannot extend beyond what was agreed. The Supreme Court discusses this rule in Trade and Investment Development Corporation v. Asia Paces Corporation.

If a collector posts your name, photo, phone number, workplace, or accusations about you:

State in writing that you did not borrow, guarantee, or consent to public disclosure;
Ask for the document supposedly making you a guarantor;
Demand removal and cessation of contact;
Preserve every call, message, and post; and
File your own NPC complaint if your personal data was misused.

The borrower may file separately regarding disclosure of the loan and harassment. Coordinated evidence from both people can help show how the information was obtained and used.

Common mistakes to avoid

Reporting the post before saving the URL, account details, and full context;
Submitting cropped screenshots that hide the sender, date, or platform;
Naming only the app brand and not the registered lender;
Filing an NPC complaint without first sending written notice or explaining why the requirement should be waived;
Sending regulators a long narrative without dates, numbered attachments, or a clear request;
Assuming that app permission amounts to unlimited consent to contact or shame anyone;
Paying a collector through a personal account without verifying the lender and official payment channel;
Deleting the app or resetting the phone before preserving the privacy notice, permissions, messages, and loan records;
Publicly reposting the harmful material, thereby exposing the data again;
Assuming an SEC or NPC complaint automatically suspends repayment or cancels the debt; and
Waiting for regulator action when there is an immediate safety threat or a short prescriptive period.

When legal help is urgent

Consult a lawyer or the Public Attorney’s Office promptly when:

The post includes your ID, signature, bank details, address, children, medical information, intimate material, or other data that creates an immediate risk;
There are threats of violence, arrest without legal basis, workplace disruption, or harm to family members;
The collector is demanding money in exchange for deleting the post;
Your account or device appears to have been accessed without permission;
The post is spreading rapidly or has caused job, business, housing, or financial loss;
You are considering cyberlibel, civil damages, an injunction, or urgent NPC relief;
The lender denies responsibility for a collection agency or dummy account;
Court papers, a subpoena, or a prosecutor’s notice has arrived; or
A filing or prescriptive deadline may be approaching.

FAQ

Does a real unpaid loan allow the lender to post my name or photo?

No. A genuine debt may be collected through lawful demands, negotiation, credit reporting where legally allowed, or a civil case. It does not generally authorize public shaming or excessive disclosure. The validity of the debt and the legality of the collection method are separate issues.

Can I demand deletion even if I originally allowed the app to access my contacts?

Yes. App permission is not unlimited consent. NPC rules prohibit unbridled contact-list processing and restrict access to what is suitable, necessary, and proportionate. Contacting people outside the borrower’s guarantors for debt collection is specifically prohibited.

What if the collector used a dummy or personal account?

Preserve evidence linking the account to the collection effort: identical loan amounts, account numbers, payment instructions, scripts, phone numbers, timing, or admissions. Name the lender, collection agency, and known account operator in the complaint, but distinguish proven facts from suspicions. Attribution and legal responsibility will depend on the evidence.

Should I block the collector?

Preserve everything and provide a written channel for legitimate account communication first. You may then block abusive accounts or numbers, revoke unnecessary app permissions, and instruct the lender to communicate only through its official channel. Blocking does not resolve the debt or replace a written dispute.

Can the regulator remove the post immediately?

A platform report or voluntary takedown may be faster. The NPC has authority, after applicable procedures, to restrict or ban harmful processing and offers a process for temporary relief, but requirements may include proof of urgency, a hearing, fees, and a bond. Seek legal help when continuing publication creates grave or irreparable harm.

Should I report to both the SEC and NPC?

Often, yes. The SEC addresses unfair collection by lending and financing companies, while the NPC addresses unlawful personal-data processing. A police, NBI, or prosecutor complaint may also be appropriate for a separate criminal act. Disclose related proceedings accurately in each complaint and comply with certifications against forum shopping.

This article provides general Philippine legal information, not advice for a particular case. Outcomes depend on the post, loan documents, identities of the parties, evidence, and applicable procedures. Official sources and procedures were checked as of August 6, 2026.