Quick answer

A lending app or collector may demand payment through lawful, reasonable means, but it generally may not shame you online, publish your name or personal information to pressure you, threaten unlawful action, use false statements, or contact people in your phonebook who are not your declared guarantors.

Preserve the post before requesting removal. Then complain in writing to the lender, report the post to the platform, and send the appropriate complaint to the Securities and Exchange Commission (SEC), National Privacy Commission (NPC), or Bangko Sentral ng Pilipinas (BSP). Report threats, extortion, impersonation, or possible cyberlibel to the police or National Bureau of Investigation (NBI) without waiting for an administrative case.

Reporting abusive collection does not automatically cancel a valid debt. Keep the collection misconduct and the accuracy or payment of the loan as separate issues.

What collectors are not allowed to do

For SEC-regulated financing and lending companies, SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair practices by the company and any third-party collector it hires. These include:

Threatening violence, criminal acts, or harm to any person, reputation, or property.
Threatening action that cannot legally be taken.
Using obscenities, insults, or abusive language.
Publishing a borrower’s name or other personal information because the borrower allegedly refuses to pay, except for disclosures specifically allowed by law.
Communicating loan information known—or reasonably expected—to be—false, including concealing that the debt is disputed.
Using false representations or deceptive means to collect or obtain information.
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., unless the account is over 15 days past due or the borrower has given recorded, written, or electronic consent that those are the only convenient times.
Contacting people in the borrower’s contact list who were not named as guarantors or co-makers. This remains prohibited notwithstanding the borrower’s consent.

The time exception does not authorize public shaming or contact with non-guarantors. The lender also remains ultimately responsible when it outsources collection.

The Financial Products and Services Consumer Protection Act, Republic Act No. 11765, separately prohibits abusive collection or debt-recovery practices and requires financial service providers to maintain a free consumer-assistance mechanism.

Privacy rules for lending apps

The Data Privacy Act of 2012 requires personal-data processing to be transparent, for a legitimate purpose, and proportionate. A lender may process information reasonably needed to administer or collect a loan, but a collection purpose is not a blanket license to expose a borrower to the public.

Under NPC Circular No. 2022-02, which amended the rules for loan-related transactions:

Unconstrained, excessive, or disproportionate processing of contact lists is prohibited.
Processing that leads to harassment, unfair collection, or collection from anyone other than the borrower’s declared guarantors is prohibited.
A character reference is not automatically a guarantor.
A character reference may be contacted to verify the borrower’s identity or the truthfulness of application information—not to demand payment.
For debt collection, the lender may contact only a person who expressly consented to be a guarantor.
A borrower’s photograph may not be used to harass or embarrass the borrower into paying.

An app’s privacy policy or permission screen is not necessarily valid consent to public shaming. Consent under privacy law must be evaluated according to its purpose, scope, wording, and how it was obtained. Other lawful grounds for limited loan processing may also exist, so requesting deletion does not always require a lender to erase records it must retain for a valid outstanding account, legal claim, or regulatory obligation.

Preserve evidence before asking for removal

Collect evidence while the material is still accessible. Do not rely only on a cropped screenshot.

Save:

Full-page screenshots showing the post, account name, profile address, publication date and time, caption, photographs, comments, reactions, and shares.
The post’s direct URL and the account or page URL.
A screen recording showing how you reached the post from the account.
Copies of messages sent to your relatives, employer, co-workers, or other contacts.
Screenshots from recipients’ own devices, if they are willing to provide them.
Call logs, text messages, email headers, voice messages, and the numbers used by collectors.
The app’s name, download-page URL, privacy notice, permission screens, and version number.
Your loan agreement, disclosure statement, repayment schedule, receipts, account statement, and any written dispute over the balance.
The collector’s name, claimed company, telephone number, email address, and any identification supplied.
Proof of emotional, employment, financial, or reputational harm, where relevant.
Copies of every complaint and proof that it was received.

Keep the original files. Do not edit, annotate, compress, or repeatedly forward the only copy. Make a backup in a separate account or device. After documenting the app’s permissions, revoke unnecessary access to contacts, photographs, camera, microphone, location, and social-media accounts. Change compromised passwords and enable multi-factor authentication.

Identify the lender behind the app

An app’s brand name may be different from the corporation that issued the loan. Check the agreement, disclosure statement, privacy notice, payment instructions, and app-store listing for:

The complete corporate name.
SEC registration number.
Certificate of Authority to operate as a lending or financing company.
Business and email addresses.
Consumer-assistance and data-protection contacts.
The name of the collection agency.

A certificate of incorporation alone is not authority to conduct a lending business. A lending company needs a valid SEC Certificate of Authority under the Lending Company Regulation Act and its implementing rules.

Name both the app and its corporate operator in your complaint. If the collector’s identity is unknown, provide the numbers, account handles, screenshots, payment accounts, and other facts that could identify it.

Send a written takedown and preservation demand

Write to the lender’s consumer-assistance unit and data protection officer. Copy the collection agency if its address is known.

State:

Your name and loan or complaint reference, while avoiding unnecessary sensitive information.
The exact post, account, URL, date, and time involved.
What information was disclosed and why you dispute the disclosure or statements.
Who received or saw the material, if known.
Whether the post is ongoing and whether it contains threats, your address, an ID, a child’s information, or other high-risk data.
That you request immediate cessation of public disclosure, removal or appropriate correction of the post, and instructions to all collectors to stop unlawful contact.
That all relevant posts, messages, access logs, account records, call recordings, collector assignments, and internal instructions must be preserved.
That you want the lender to identify the collector and confirm whether that person or agency was authorized.
That you want a written explanation of the action taken.

If the debt or amount is disputed, say so clearly and request an itemized statement. Avoid wording that unintentionally admits an amount you genuinely contest. Keep proof of delivery because both SEC and NPC complaint processes may require evidence that you first raised the issue with the provider.

Where to report the post

Report it to the social-media or hosting platform

After preserving evidence, use the platform’s reporting tools for harassment, privacy violations, bullying, impersonation, threats, or publication of personal information. Ask affected contacts to report the original post from their own accounts rather than reposting it.

A platform report may secure faster removal, but it is not a substitute for an SEC, NPC, or criminal complaint. Save the platform’s acknowledgment, case number, and decision.

File with the SEC

Use the SEC route when the lender is a lending or financing company, including complaints about a collector acting for it.

The SEC’s official intake system is iMessage. Include:

The lender’s corporate and app names.
Its registration and Certificate of Authority numbers, if available.
The collector’s details.
A chronological account of what happened.
The post, URLs, messages, loan documents, and internal complaint.
Proof of receipt and the lender’s response or failure to respond.
The specific relief requested, such as stopping unfair collection and investigating the lender and its collector.

Under the SEC’s financial-consumer rules, an unresolved complaint may be elevated after 30 days from its initial submission. When the provider has taken action that the consumer finds unsatisfactory, the rules provide a 15-day period from that determination for elevation. Follow the current iMessage instructions and do not let an internal process delay an urgent police, NPC, or court-related deadline.

The SEC may investigate and impose regulatory sanctions, but filing does not guarantee removal, damages, cancellation of the debt, or a particular outcome.

File with the National Privacy Commission

Use the NPC route when the post or collection activity involves misuse, excessive processing, or unauthorized or malicious disclosure of personal data. Borrowers, guarantors, character references, relatives, co-workers, and other people whose own information was misused may each have privacy rights.

Ordinarily, the complainant must first notify the lender or other responsible entity in writing. The NPC may entertain a formal complaint if the entity fails to take timely appropriate action or gives no response within 15 calendar days of receiving that notice. The NPC may waive this exhaustion requirement for good cause or serious violations, including circumstances involving grave and irreparable harm. See the 2021 NPC Rules of Procedure, as amended.

Use the NPC’s current Complaint-Affidavit form, not an old form downloaded elsewhere. Complete it, attach the evidence and prior correspondence, have it notarized, and submit it personally, by courier, or by scanned email as directed on the NPC complaint page. The current complaints email is complaints@privacy.gov.ph.

A formal NPC complaint generally carries a ₱500 filing fee, plus a legal research fee equal to 1% of the filing fee but not less than ₱10. Additional fees apply when damages are claimed. Qualified indigent complainants may seek exemption by submitting the required proof. Confirm payment instructions against the NPC’s current schedule of fees.

File with the BSP when the provider is BSP-supervised

If the loan provider is a bank, e-wallet operator, or another BSP-supervised institution, complain first through that institution’s Financial Consumer Protection Assistance Mechanism.

If its response is unsatisfactory, elevate the matter through the BSP Online Buddy chatbot on the BSP website. If the chatbot is unavailable to you, the BSP’s complaint instructions allow submission of the prescribed form and proof of the first-level complaint to consumeraffairs@bsp.gov.ph.

Do not send passwords, PINs, full card details, or unnecessary identification documents.

Report possible crimes to law enforcement

Go promptly to your local police station, the PNP Anti-Cybercrime Group, or the NBI if the conduct includes:

Threats of physical harm.
Extortion or demands backed by threats.
Impersonation of a police officer, lawyer, court, or government agency.
Fabricated warrants, summonses, or criminal accusations.
Account hacking or unauthorized access.
Identity theft.
Repeated threatening publication of private information.
A potentially defamatory online post.

An online statement may amount to cyberlibel under Republic Act No. 10175 in relation to Articles 353 and 355 of the Revised Penal Code, but liability depends on the exact words, identification of the person defamed, publication, authorship, malice, context, and available defenses. Not every offensive, inaccurate, or embarrassing post is automatically cyberlibel.

The Supreme Court has affirmed that cyberlibel generally prescribes in one year from discovery. Because delay can affect a criminal case, obtain legal advice promptly rather than waiting for an SEC or NPC case to finish. See the Supreme Court’s 2026 resolution in Causing v. People.

Common mistakes to avoid

Deleting the app or messages before preserving evidence. Document them first, then secure the device and revoke unnecessary permissions.
Submitting only cropped screenshots. Include URLs, account details, dates, surrounding context, and original files.
Reporting only the collector’s nickname. Identify the corporate lender and attach every clue about the collector.
Skipping the written complaint to the lender. This can weaken an SEC escalation and may prevent an NPC complaint from being given due course.
Posting counter-threats or exposing the collector’s personal information. This can create a separate legal problem and may compromise your evidence.
Paying through a personal account supplied in a threatening message. Verify the account through the lender’s official channel.
Assuming a character reference owes the debt. A character reference is not a guarantor unless that person expressly agreed to guarantee the loan.
Ignoring legitimate notices because collection was abusive. Unfair collection does not necessarily invalidate the loan. Respond separately to genuine statements, demands, summonses, or court documents.
Giving regulators more sensitive information than necessary. Redact unrelated account numbers, IDs, children’s data, and third-party information while retaining unredacted originals securely.

When help is urgent

Call 911 or go to the nearest police station if there is an immediate threat of violence, stalking, a collector appearing at your home, or publication of information that puts someone in physical danger.

Consult a lawyer promptly if:

The post identifies your home, workplace, children, government IDs, or financial accounts.
The post is spreading rapidly or has caused job loss or other measurable harm.
The collector is impersonating a court or law-enforcement officer.
You want to seek an urgent court remedy, damages, or criminal prosecution.
You received an actual subpoena, summons, demand from a lawyer, or court document.
The one-year cyberlibel period may be running.

If you cannot afford private counsel, ask the Public Attorney’s Office about eligibility for assistance. Bring a clear timeline, your identification, loan records, original evidence, and proof of prior complaints.

Frequently asked questions

Can a collector post my name and photograph because I am late in paying?

Generally, no—not as a debt-shaming tactic. SEC rules prohibit publication of borrowers’ names and personal information to pressure payment, subject only to limited lawful disclosures. NPC rules also prohibit using a borrower’s photograph to harass or embarrass the borrower.

What if the post says something true about the debt?

A true debt does not automatically make public shaming lawful. Collection must still comply with privacy, consumer-protection, and fair-collection rules. In a libel case, truth is also not automatically conclusive in every situation; context, good intention, and justifiable motive may matter.

Can the lender call my relatives or employer?

For collection, an online lender may contact a person who expressly agreed to be a guarantor. It may not demand payment from random phone contacts. A character reference may be contacted only for proper verification purposes and does not become responsible for the loan merely by being listed.

Does agreeing to app permissions allow the lender to contact everyone?

No. NPC rules prohibit unconstrained or excessive contact-list processing and collection from people other than declared guarantors. Permission to access a device is not unlimited consent to use everything found there for any purpose.

Should I stop paying after filing a complaint?

Not solely because you filed a complaint. Pay any undisputed amount only through a verified official channel, keep receipts, and request an itemized statement if the balance is contested. Seek legal advice before withholding payment under a valid agreement.

Can I complain if an outside collection agency made the post?

Yes. Identify both the collector and the lender. SEC rules treat the collector as the lender’s agent and keep ultimate responsibility for collection practices with the lending or financing company. Republic Act No. 11765 also makes financial service providers responsible for relevant acts or omissions of their accredited third-party providers.

What if I never borrowed from the app?

Dispute the account immediately in writing. Request the application, contract, disbursement record, identity-verification records, account history, and basis for associating your information with the loan. Preserve the post and consider reports to the SEC or BSP, NPC, and law enforcement for possible identity theft, unauthorized processing, or fraud.

Official sources

This article provides general Philippine legal information, not advice for a particular case. Outcomes depend on the post’s exact content, the loan documents, the identities and authority of those involved, and the available evidence. Sources and procedures were checked as of 6 August 2026.