Quick answer

Yes. If a lending app, financing company, or collector publicly shames you, posts your name or photo, reveals your loan to other people, publishes false accusations, threatens your reputation, or uses your contact list to pressure you, preserve the evidence and report it promptly.

The main routes are:

The Securities and Exchange Commission (SEC) for unfair collection by lending and financing companies and their collection agencies.
The National Privacy Commission (NPC) when personal data, photos, contacts, or loan information were unlawfully accessed, disclosed, or used.
The platform itself to request removal of the post or account.
The NBI Cybercrime Division, police, or a prosecutor when the conduct may involve cyber libel, threats, identity theft, or another crime.
The Bangko Sentral ng Pilipinas (BSP) instead of the SEC when the creditor is a bank or another BSP-supervised institution.

Save the post before asking anyone to remove it. Paying or disputing the loan is a separate issue: a genuine unpaid debt may still be collected through lawful means, but it does not authorize harassment or public shaming.

What collection practices are prohibited?

Under SEC Memorandum Circular No. 18, Series of 2019, lending companies, financing companies, and the third-party collectors they hire must act in good faith and use only reasonable and legally permissible collection methods.

Prohibited practices include:

Using or threatening violence or another criminal means to harm a person, reputation, or property.
Threatening action that cannot legally be taken.
Using obscenities, insults, or abusive language that may amount to an offense.
Publishing the names or other personal information of people who allegedly refuse to pay.
Giving—or threatening to give—others false loan information, including failing to state that a debt is disputed when that fact should be disclosed.
Using false representations or deceptive methods to collect.
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., subject to the circular’s limited exceptions for accounts overdue by more than 15 days or properly documented borrower consent.
Contacting people taken from the borrower’s contact list when they were not named as guarantors or co-makers.

The lender cannot avoid responsibility simply by blaming an outside collection agency. SEC rules treat the collector as the lender’s agent and leave ultimate responsibility for compliant collection practices with the lending or financing company.

The circular also requires collection personnel to disclose their full name or true identity to the borrower.

Are all disclosures about a debt prohibited?

No. A creditor may make certain confidential disclosures for legitimate purposes—for example, with the borrower’s written or recorded consent; to authorized collection agents, counsel, service providers, credit information entities, or financial institutions; or pursuant to a lawful court or government order.

Those limited exceptions do not automatically justify a Facebook post, group-chat announcement, altered “wanted” image, employer-wide message, or contact-list blast intended to embarrass or pressure a borrower. A broad clause in an app’s terms or a phone permission also does not automatically make harassment lawful. The wording, scope, purpose, necessity, and manner of the processing must still comply with privacy and collection rules.

What SEC penalties may apply?

For violations of SEC Memorandum Circular No. 18, the stated administrative fines are:

Lending companies: ₱25,000 for a first offense and ₱50,000 for a second offense.
Financing companies: ₱50,000 for a first offense and ₱100,000 for a second offense.
For a third offense, depending on its gravity, the SEC may impose a higher fine of up to ₱1 million, suspend lending or financing activities for 60 days, or revoke the company’s Certificate of Authority.

Other sanctions or liability under privacy, criminal, civil, and corporate laws may apply independently. A complaint does not guarantee that any particular penalty will be imposed.

How privacy law applies

The Data Privacy Act of 2012 requires personal data processing to have a lawful basis and to comply with transparency, legitimate purpose, and proportionality. Liability depends on the actual data used, how it was obtained, why it was disclosed, who received it, and what authority or consent existed.

Under NPC Circular No. 2020-01, as amended by NPC Circular No. 2022-02:

A borrower’s photo must not be used to harass or embarrass the borrower.
Unnecessary or excessive app permissions and personal-data processing are prohibited.
Unrestrained or disproportionate processing of contact lists—including processing that leads to harassment, unfair collection, or collection from people other than the borrower’s guarantors—is prohibited.
An app may have only the limited access necessary for the borrower to select a chosen character reference or guarantor.
For debt collection, the lender may contact a guarantor who separately consented to that role. A character reference is not automatically a guarantor.
A character reference may be contacted to verify the borrower’s identity or the truth of information supplied in the application, but not treated as liable for the debt.
The lender remains accountable for personal data processed by an outsourced collector.

The NPC circular applies to lending or financing activities even when the entity lacks the required SEC authority. Banks and other excluded financial institutions remain subject to the Data Privacy Act even if the loan-specific circular does not apply to them in the same way.

Preserve evidence before the post disappears

Collect evidence as soon as possible. Keep unedited originals and a backup in another secure location.

Save:

Full-page screenshots showing the post, caption, comments, account name, profile link, date, and time.
The exact post URL and the profile or page URL.
A screen recording showing how you reached the post from the account or page.
Copies of images, videos, voice messages, texts, emails, and direct messages.
Call logs and the collector’s phone numbers.
The lending app’s name and store listing, plus the lender’s displayed corporate name, SEC registration number, and Certificate of Authority number, if shown.
The loan agreement, disclosure statement, repayment history, receipts, and account statement.
Proof that you disputed the debt, amount, fees, identity of the creditor, or collector’s authority.
Messages sent to your relatives, employer, co-workers, friends, or other contacts.
Written statements or affidavits from people who received the post or message.
Proof of harm, such as an employer’s notice, cancelled transaction, medical record, or documented expenses, if relevant.
Your report to the platform and its acknowledgment or case number.
Your written complaint to the lender and proof of delivery.

Do not crop away the account name, date, URL, or surrounding context in the only copy you preserve. You may make a separate redacted copy for sharing, but keep the original securely.

Take these steps in order

1. Secure your accounts and phone

After preserving evidence:

Revoke unnecessary access to contacts, photos, storage, location, microphone, and camera.
Change the password for the lending app and any reused passwords.
Enable multi-factor authentication on your email and social-media accounts.
Tell affected contacts not to click links, send money, provide codes, or argue with the collector.
Do not give an OTP, PIN, password, card security code, or remote access to your device.
Verify payment instructions through the lender’s official channel; do not pay a collector’s personal account without confirmation.

Revoking permissions does not necessarily erase data already copied by the app.

2. Send a written notice to the lender and collector

Send the notice to the lender’s customer-service unit and data protection officer, if identified in its privacy notice. Copy the collection agency when its identity is known.

A concise notice may say:

I am formally notifying you that on [date and time], the account [name/URL/number] published or transmitted [brief description] concerning me and my alleged loan. Copies are attached.

I demand that you preserve the relevant records, remove the unlawful post, stop further public disclosure and contact with persons who are not valid guarantors or co-makers, identify the collector and collection agency involved, and confirm the source and recipients of the personal data used. Please also state what corrective action you have taken.

[If applicable:] I dispute the following loan information: [state the precise dispute]. This notice is not an admission of the amount claimed and does not waive any right or remedy.

Use an email address, helpdesk, or delivery method that provides proof of receipt. Keep the ticket number, sent email, delivery receipt, and replies.

3. Report through the appropriate channels

Where to report	Best used for	How to proceed
SEC	Public shaming, threats, abusive messages, contact-list harassment, false collection claims, or misconduct by a lending/financing company or its collector	File a complaint through the SEC’s official iMessage ticketing system. Identify the app, corporate lender, collector, loan, dates, and exact prohibited acts; attach your evidence and prior complaint.
NPC	Unauthorized or excessive access, use, or disclosure of your name, photo, contacts, loan details, messages, or other personal data	Follow the NPC process below and use its current complaint form.
Social-media or hosting platform	Fast removal of a post, image, page, or account	After preserving evidence, use the platform’s harassment, privacy, doxxing, imperson impersonation, or personal-information reporting option. Save the report number and result.
NBI, police, or prosecutor	Possible cyber libel, threats, extortion, impersonation, hacking, identity theft, or immediate safety risks	Use the NBI’s online complaint page or seek assistance from the NBI Cybercrime Division. Bring originals, identification, URLs, devices when requested, and a chronological statement.
BSP	The collector acts for a bank or another BSP-supervised institution	Complain first through the institution’s consumer-assistance mechanism. If unresolved, escalate through the BSP Consumer Assistance Mechanism.

These remedies can run separately. An SEC or NPC complaint does not replace a criminal complaint, and a platform report does not decide legal liability.

How to file a privacy complaint with the NPC

As a general rule, you must first notify the lender, collector, or other responsible entity in writing about the privacy violation. The entity must be given an opportunity to act. You may proceed when it fails to take timely or appropriate action or does not respond within 15 calendar days from receipt of your written notice.

Attach proof of the notice and its receipt. The NPC may waive this exhaustion requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm, the absence of an adequate remedy from the respondent, or patently illegal conduct. Explain and prove why a waiver is necessary; do not simply omit the prior notice without explanation.

Use the NPC’s current Complaint-Affidavit form. A formal complaint generally must be signed and verified or notarized and should include:

Your identity and contact information.
The respondent’s identity and address or available identifying details.
A clear chronological narration.
The specific personal data involved.
How the data was collected, accessed, disclosed, or used.
Copies of correspondence, screenshots, and other documentary evidence.
Witness affidavits, when available.
The relief you are requesting.
A certification against forum shopping.
A valid government-issued ID.

The NPC’s official filing instructions allow submission personally, by courier or registered mail, or by scanning and emailing the completed form and attachments to complaints@privacy.gov.ph. Filing fees may apply under the NPC’s current schedule, although the rules recognize exemptions or possible waiver for qualifying complainants, including indigent complainants.

Incomplete, unverified, unsupported, or improperly prepared complaints may be dismissed. Follow the current form instead of relying on an old copy found elsewhere online.

When the post may be cyber libel

A malicious online post may constitute cyber libel when the evidence establishes the required elements of libel—including a public and malicious imputation tending to cause dishonor, discredit, or contempt—and publication through a computer system. Context, identification of the person, authorship, publication, privilege, truth, motive, and the precise words or images all matter. An insulting or inaccurate collection message is therefore not automatically cyber libel, although it may violate other laws or SEC rules.

Under the Supreme Court’s April 8, 2026 resolution in Causing v. People, G.R. No. 258524, cyber libel prescribes in one year from discovery of the defamatory publication by the offended party, the authorities, or their agents.

Treat that as an urgent deadline. Do not assume that a platform report, demand letter, SEC ticket, or NPC complaint stops the criminal prescriptive period. Consult a lawyer, the prosecutor’s office, or a cybercrime investigator promptly about the correct complaint, evidence, and venue.

Threats, impersonation, unauthorized data processing, or other conduct may involve different offenses and deadlines. The Cybercrime Prevention Act and Data Privacy Act contain offense-specific penalties, but liability and the applicable penalty can be determined only after the required elements and responsible persons are established.

Keep the debt issue separate

Reporting abusive collection does not cancel a valid loan. Continue to:

Ask for a written, itemized statement showing principal, interest, penalties, payments, and the identity of the creditor.
Pay only through a verified official channel.
State any dispute precisely and in writing.
Propose a documented payment arrangement if you accept the debt but cannot pay immediately.
Keep every receipt and request written confirmation when the account is settled.

The Constitution prohibits imprisonment merely for nonpayment of debt. That rule does not prevent a creditor from filing a lawful civil action, and it does not protect conduct that independently constitutes fraud or another offense. A collector’s threat of automatic arrest merely because a loan is unpaid should be documented and reported.

Common mistakes to avoid

Reporting the post before saving its URL and complete screenshots.
Deleting the app, messages, or account before preserving evidence.
Reposting the material publicly and exposing your own data to more people.
Naming only the app while omitting the corporate lender and collection agency.
Sending an emotional complaint without dates, URLs, documents, or a clear timeline.
Filing an NPC complaint without first giving written notice or explaining why waiver is justified.
Assuming that a character reference agreed to guarantee the loan.
Paying an unknown personal account simply to stop the harassment.
Retaliating with threats, defamatory accusations, or disclosure of the collector’s private data.
Waiting for the platform or lender to reply while a criminal deadline is running.
Treating an SEC, NPC, platform, or police report as interchangeable; each serves a different purpose.

When help is urgent

Seek immediate police or legal assistance when:

The post contains a credible threat of physical harm.
Your home address, children’s information, workplace access details, identification documents, or financial credentials were exposed.
Someone is impersonating you or using your identity to obtain money or accounts.
The collector is demanding payment under threat of violence, arrest, or publication.
The post is spreading rapidly and causing serious employment, safety, health, or financial consequences.
You discovered a potentially defamatory post close to the one-year cyber-libel deadline.
You receive a subpoena, prosecutor’s notice, court paper, SEC order, or NPC order.

For immediate danger, contact emergency services or the nearest police station. If you cannot afford private counsel, ask the Public Attorney’s Office whether you qualify for assistance.

Frequently asked questions

Can I report the collector even if I really owe the money?

Yes. A valid debt does not authorize threats, public shaming, deceptive statements, or unlawful use of personal data. The debt and the collection misconduct are separate matters.

Can a collector post my name and photo to warn other people?

Public posting for the purpose of humiliation or pressure is generally inconsistent with SEC unfair-collection rules and may also violate privacy, civil, or criminal law. A different result may apply to a narrowly authorized and lawful disclosure, but ordinary social-media shaming is not the same as a confidential disclosure to an authorized institution, guarantor, lawyer, or government agency.

Can they contact my relatives, friends, or co-workers?

A person who separately agreed to be a guarantor or co-maker may be contacted within the scope of that obligation. A character reference is not automatically a guarantor. Processing or contacting people harvested from your phone merely to pressure them—or to make them pressure you—is prohibited.

What if the collector uses a fake or anonymous account?

Preserve the URL, username, account ID, profile details, messages, phone numbers, payment instructions, and links to the lending app. Report both the anonymous account and the lender it claims to represent. Investigators may use lawful processes to seek account information; do not attempt to hack or expose the account yourself.

Should I ask for removal before taking screenshots?

No. Preserve the complete evidence first. Then request removal and save proof of the request and the platform’s action.

Does deleting the post end the case?

Not necessarily. Deletion may reduce continuing harm, but preserved evidence can still support an administrative, civil, or criminal complaint. The outcome depends on the evidence and applicable law.

Can I demand deletion of all my loan records?

Not automatically. A lender may need to retain some records to administer the account, comply with law, establish legal claims, or meet regulatory obligations. You may demand that unlawful disclosure and excessive processing stop, that inaccurate information be corrected, and that data no longer lawfully needed be deleted or disposed of under applicable retention rules.

Official sources

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. The correct remedy depends on the post, loan documents, identities of the parties, evidence, and applicable deadlines. Official sources and procedures were checked as of August 6, 2026.