Quick answer

A lending app or collector may demand payment through lawful means, but it may not publicly shame you, disclose your debt to unrelated people, post your photo or personal details to embarrass you, threaten harm, use insults or obscene language, or contact people in your phone or social-media list who are not your guarantors.

Act quickly:

Preserve the post and all related messages.
Report the content to the social-media platform and request removal.
Send a written takedown and privacy complaint to the lender or its data protection officer.
Report a lending or financing company to the Securities and Exchange Commission (SEC).
File with the National Privacy Commission (NPC) if personal data was misused or disclosed.
If the lender is a bank or another BSP-supervised institution, first complain to the institution, then escalate an unresolved complaint to the Bangko Sentral ng Pilipinas (BSP).
Report threats, impersonation, hacking, extortion, or potentially criminal posts to the police or National Bureau of Investigation (NBI).

These remedies can be pursued separately because they address different conduct. Reporting abusive collection does not automatically erase a valid loan, change its terms, or stop lawful collection.

What collectors are not allowed to do

Under SEC Memorandum Circular No. 18, Series of 2019, financing and lending companies—and collection agencies or other persons acting for them—must observe fair and reasonable collection practices.

Conduct that may be reportable includes:

Posting your name, photograph, debt, identification details, contacts, or allegations about you to shame or pressure you;
Telling your employer, co-workers, relatives, friends, or other unrelated persons about the debt merely to embarrass you;
Threatening violence, arrest, imprisonment, or another consequence that the collector has no lawful basis or authority to impose;
Using profane, insulting, humiliating, or abusive language;
Falsely representing that the collector is a police officer, court employee, lawyer, or government representative;
Using deceptive documents or messages made to look like court orders, warrants, summonses, or official notices;
Threatening to publish your information or actually publishing it as leverage for payment; or
Repeatedly communicating at unreasonable hours or in a manner intended to harass.

A collector may generally contact a borrower and may pursue lawful remedies, including an appropriate civil action. A genuine demand letter or court document should not be ignored. The issue is not simply whether the collector discussed an unpaid account, but who received the information, what was disclosed, why it was disclosed, and how the communication was made.

Using your contacts for debt collection

The Data Privacy Act of 2012 requires personal-data processing to have a lawful basis and to comply with transparency, legitimate purpose, and proportionality.

Under NPC Circular No. 2020-01, as amended by NPC Circular No. 2022-02:

Unconstrained, excessive, or disproportionate processing of a borrower’s contact list is prohibited.
Processing that leads to harassment is specifically treated as “unbridled processing.”
For debt collection, a lender, financing company, or person acting for it may contact a guarantor.
Contacting other people in the borrower’s contact list who were not named as guarantors is prohibited.

A “character reference” is not automatically a guarantor. A person normally becomes a guarantor through an actual agreement or undertaking, not merely because the borrower entered that person’s name or number in an app.

Consent to app permissions also does not give unlimited authority to harvest contacts, publish a debt, or use personal information for harassment. Whether a specific act violated the Data Privacy Act still depends on the information processed, the lender’s stated purpose and privacy notice, the legal basis claimed, and the actual use or disclosure.

Preserve evidence before seeking removal

Online content can be edited, deleted, hidden, or transferred to another account. Preserve it before blocking the sender or uninstalling the app.

Keep:

Full screenshots showing the post, account name, date and time, comments, reactions, and surrounding context;
A screen recording that opens the account, post, profile, and comments;
The post’s direct URL and the profile or page URL;
Copies of photographs, videos, voice recordings, emails, text messages, and chat threads;
The collector’s phone numbers, usernames, email addresses, payment instructions, and account details;
Notifications received by your relatives, employer, co-workers, or other contacts;
Signed statements or affidavits from people who saw or received the content;
The app’s name, developer, download-page URL, privacy policy, permissions, and screenshots of permission requests;
Your loan agreement, disclosure statement, repayment history, receipts, and account statement;
Any demand letter and your written replies;
Your complaint to the lender and proof that it was delivered; and
Platform report numbers, SEC or NPC ticket numbers, and agency acknowledgments.

Do not crop away details needed to identify the post. Keep original files and make a backup. Write a short chronology while events are fresh, identifying what happened, when, where, who saw it, and what harm or threat followed.

If someone else received the post or message, ask that person to preserve the original on their device. Forwarded screenshots alone may omit important information about the sender and transmission.

Step 1: Report the post to the platform

Use the platform’s reporting tools to flag the content under the closest applicable category, such as:

Harassment or bullying;
Privacy violation or sharing personal information;
Impersonation;
Threats or violence;
Fraud or deception; or
Non-consensual intimate imagery, if applicable.

Identify the exact content rather than reporting only the general page. Save the confirmation and report number. If the first report is rejected, use any available review or appeal option and explain specifically that the post discloses personal data or debt information for harassment.

Platform removal is useful but does not replace a complaint to the regulator or law-enforcement authorities.

Step 2: Send a written demand to the lender

Send the complaint to the company’s official customer-service channel and data protection officer, if listed in its privacy notice. Avoid negotiating solely with the collector’s personal account.

Your notice should:

Identify the app, lender, collection agency, account, and collector;
Provide the URLs, screenshots, dates, and recipient names;
State which personal information or debt details were disclosed;
Explain that the recipients were not guarantors, if that is the case;
Demand that the company stop further disclosure and collection-related harassment;
Request immediate preservation and removal of the posts;
Ask the company to identify the legal basis, purpose, source, recipients, and processors involved in using your data;
Request appropriate restriction, blocking, erasure, or correction, where legally available; and
Ask for a written response and confirmation that its collector and service providers have complied.

Keep the message factual. Do not admit an amount you genuinely dispute, threaten the collector, or publish the collector’s private information in retaliation.

For an NPC complaint, prior written notice is ordinarily important. The NPC’s amended Rules generally require proof that you informed the personal information controller, processor, or concerned entity in writing and that it failed to take timely appropriate action or did not respond within 15 calendar days. The NPC may waive this requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm, no plain and adequate remedy, or patently illegal action. See the 2021 NPC Rules of Procedure, as amended in 2024.

Do not wait 15 days before contacting police or seeking emergency protection when there is an immediate threat.

Step 3: Report the lender to the SEC

The SEC regulates lending and financing companies. First identify the company behind the app; the app’s brand name may differ from its registered corporate name. Check the app’s loan documents, disclosure statement, privacy notice, receipts, and store listing.

Use the SEC’s official complaint instructions for lending and financing companies or open a ticket through SEC iMessage.

The SEC instructs complainants to:

Complete its complaint form fully and accurately;
File one complaint form for each respondent company;
Attach supporting evidence; and
Provide a valid government-issued ID.

State that the complaint concerns unfair debt-collection practices and identify every post, disclosure, threat, or contact with third parties. Attach the loan documents and evidence connecting the app or collector to the registered company.

The SEC may evaluate the complaint, seek the company’s answer, refer data-privacy issues to the NPC, or commence an administrative case when sufficient grounds exist. The SEC’s published procedure gives the respondent lending or financing company 10 days from receipt to submit its answer or comment.

The SEC cannot, through this complaint process alone, cancel the loan, rewrite its payment terms, declare the contract void, or settle the account for you.

Step 4: File a privacy complaint with the NPC

The NPC is the appropriate regulator when the complaint involves:

Accessing or using your contacts for collection;
Contacting non-guarantors;
Publishing your name, photograph, debt, phone number, address, ID, or other personal data;
Excessive app permissions or data harvesting;
Refusal to honor applicable data-subject rights; or
Other unauthorized, excessive, or harmful processing of personal information.

Use the NPC’s current Complaints-Assisted Form and filing instructions. The NPC says the form should be completed, notarized, and submitted personally, by courier, or as a scanned copy to complaints@privacy.gov.ph.

A formal complaint should identify the parties, narrate the material facts, state the relief requested, and attach:

Documentary evidence and witness affidavits, if any;
Your prior correspondence with the lender and its response, if any;
Proof of the unlawful or improper processing; and
The required certification against forum shopping.

NPC rules provide for filing fees, subject to stated exceptions for qualifying indigent complainants, government complainants, or a waiver granted for good cause. Check the current form and NPC schedule of fees before filing.

If continued processing presents serious harm, ask a lawyer whether the facts support an application for a temporary ban on processing. Such relief has specific requirements and should not be assumed to issue automatically.

Step 5: Use the BSP process when the lender is BSP-supervised

If the creditor is a bank, digital bank, e-money issuer, or another BSP-supervised financial institution, first file a complaint through the institution’s consumer-assistance mechanism.

If it remains unresolved, escalate it through the BSP Consumer Assistance Mechanism. You may use the BSP Online Buddy or send the BSP Complaints, Inquiries and Requests form to consumeraffairs@bsp.gov.ph.

Include:

A summary of the complaint and the remedy requested;
Your daytime contact details;
A copy of the complaint sent to the institution;
The institution’s response, if any; and
Supporting documents.

Do not send an ordinary SEC-registered lending-company complaint to the BSP merely because the transaction involves a loan. The correct regulator depends on the entity that issued or serviced the credit.

Step 6: Report possible crimes or immediate threats

Contact the nearest police station, the PNP’s cybercrime unit, or the NBI when the conduct includes credible threats of violence, extortion, account hacking, identity theft, impersonation, fabricated official documents, or other potentially criminal acts. Call 911 if someone is in immediate danger.

The NBI identifies its Cybercrime Division as the unit handling matters including cyber libel and other offenses within the Cybercrime Prevention Act. Its official directory lists ccd@nbi.gov.ph, and the NBI also maintains an online complaint page and information on investigative assistance for victims of computer crimes.

Bring or preserve:

A government-issued ID;
Original devices when investigators request them;
URLs and unedited digital files;
Screenshots and screen recordings;
The collector’s identifying details;
Witness information;
Proof linking the account to the lender or collector; and
Copies of your reports to the platform, lender, SEC, NPC, or BSP.

A malicious online statement is not automatically cyber libel. Libel generally requires a defamatory allegation, publication to another person, identification of the person defamed, and malice, subject to defenses and privileged communications. Truth, context, opinion, privilege, identity of the author, and available evidence can materially affect the case.

Under Section 4(c)(4) of the Cybercrime Prevention Act, libel committed through a computer system may constitute cyber libel. In its 2026 ruling in Causing v. People, G.R. No. 258524, the Supreme Court held that cyber libel prescribes in one year. Anyone considering that remedy should obtain legal advice promptly rather than wait for platform or administrative complaints to finish.

If the post is true but humiliating

A truthful statement is not automatically lawful in every context. Even when a debt exists, publicly disclosing it may still raise separate issues under data-privacy and fair-collection rules if the disclosure was unnecessary, disproportionate, directed to unrelated persons, or used to harass or shame.

Conversely, not every mention of a debt is prohibited. Disclosure may have a lawful basis in a court proceeding, to a properly designated guarantor, or in another legally justified setting. The exact document, audience, purpose, and manner of disclosure matter.

If you are not the borrower

You may still have a privacy complaint if a lender accessed or used your number, name, messages, or other personal data merely because you appeared in another person’s contact list.

Tell the collector in writing that:

You are not the borrower;
You did not agree to guarantee the loan, if true;
You object to further use of your data for collection;
You want to know where the company obtained your information; and
You require the company to stop contacting you, subject to any lawful reason it can establish.

Preserve the messages before blocking the number. If the lender claims you are a guarantor, ask for the document bearing your agreement or authority and obtain legal advice if the document appears forged.

Common mistakes to avoid

Deleting the post before preserving the URL and complete context;
Keeping only cropped screenshots with no account name or date;
Uninstalling the app before documenting its permissions, privacy notice, and developer;
Reporting only the app’s brand name instead of the company and collection agency behind it;
Treating a platform report as a substitute for a regulator or police complaint;
Filing an NPC complaint without proof of prior written notice or without explaining why the requirement should be waived;
Omitting the notarization, certification against forum shopping, ID, or required attachments;
Sending different versions of the facts to different agencies;
Publicly retaliating with accusations or the collector’s private information;
Paying through an unverified personal account simply to stop the posts; or
Assuming that abusive collection automatically cancels a valid debt.

Continue documenting lawful payment or dispute-resolution efforts. If you pay, use a verified channel and keep an official receipt and updated statement of account.

When legal help is urgent

Speak with a Philippine lawyer or the Public Attorney’s Office, if eligible, as soon as possible when:

A post contains a credible threat of physical harm;
Intimate images, a child’s information, medical information, IDs, or financial credentials were disclosed;
The collector accessed or took control of your account or device;
A false criminal accusation is spreading rapidly;
Your employer, customers, or professional regulator received the post;
You received a summons, subpoena, court order, or prosecutor’s notice;
The lender claims you signed a guaranty that you did not sign;
You are considering a cyber-libel complaint and the one-year period may be running; or
You need urgent relief to prevent continued publication or processing.

Frequently asked questions

Can a collector post my photograph and call me a scammer?

A collector should not use your photograph or personal information for public shaming. Calling someone a scammer may also create possible defamation issues depending on the wording, facts, audience, authorship, and available defenses. Preserve the post and seek fact-specific legal advice.

Can the lender message everyone in my contacts?

For debt collection, NPC rules prohibit contacting people in the borrower’s contact list other than those named as guarantors. Unbridled or excessive contact-list processing that leads to harassment is also prohibited.

Is a character reference responsible for my loan?

Not merely because the person was listed as a reference. Liability as a guarantor depends on an actual legally effective undertaking and its terms.

Should I complain to the SEC or NPC?

Use the SEC for unfair practices by an SEC-regulated lending or financing company. Use the NPC for misuse or unauthorized disclosure of personal data. The same incident may justify complaints to both agencies.

What if the lender is a bank?

Use the bank’s internal consumer-assistance process first. Escalate an unresolved complaint to the BSP through its Consumer Assistance Mechanism.

Will reporting the collector cancel my debt?

No. A regulatory, privacy, or criminal complaint addresses the collector’s conduct. A valid loan generally remains payable unless it is settled, paid, or modified or invalidated through an appropriate legal process.

Should I pay immediately to make the post disappear?

Do not send money to an unverified account. Confirm the creditor, amount, fees, and payment channel. If you agree to a settlement, obtain written terms and proof of payment. Report the post separately.

Can I file even if the post has been deleted?

Yes, but proof becomes more difficult. Preserve screenshots, URLs, notifications, witness statements, platform records, and related messages. Investigators or the platform may have additional records, but their availability should not be assumed.

How long do I have to file cyber libel?

The Supreme Court held in 2026 that cyber libel prescribes in one year. Determining when that period began and whether a particular complaint is timely requires fact-specific legal advice, so act promptly.

Official sources

This article provides general Philippine legal information, not legal advice or a prediction of the outcome of any complaint. Rights and procedures depend on the particular posts, documents, parties, and evidence. Official sources and current procedures were checked on 28 August 2026.