Quick answer

A lending app or collector may lawfully demand payment of a valid debt, negotiate a settlement, or file a proper court case. It may not use public humiliation as a collection method.

Immediately preserve the post and its identifying details, then:

Report the post to the social-media platform and request removal.
Send a written complaint and takedown demand to the lender’s consumer-assistance unit and data protection officer.
Report a lending or financing company—and its collector—to the Securities and Exchange Commission (SEC).
File with the National Privacy Commission (NPC) if the post disclosed or misused your name, photograph, contact details, loan information, phone contacts, or other personal data.
If the lender is a bank, e-money issuer, pawnshop, or another Bangko Sentral-supervised institution, escalate the complaint to the Bangko Sentral ng Pilipinas (BSP).
Report threats, impersonation, extortion, hacking, or potentially criminal online defamation to the NBI or PNP. For an immediate threat to life or safety, call 911.

These remedies may be pursued at the same time because they address different violations. A regulatory complaint does not automatically erase a valid loan, award damages, remove the post, or commence a criminal case.

What collectors are prohibited from doing

The Financial Products and Services Consumer Protection Act prohibits abusive collection or debt-recovery practices and requires financial service providers to respect client privacy, maintain a free consumer-assistance mechanism, and remain responsible for agents acting for them.

For lending and financing companies, SEC Memorandum Circular No. 18, Series of 2019 identifies unfair collection practices that include:

Threatening violence, injury, reputational harm, property damage, or action that cannot legally be taken.
Using obscenities, insults, or profane language amounting to abuse.
Publishing borrowers’ names or personal information to shame them for allegedly refusing to pay.
Communicating loan information known—or reasonably expected—to be false, including failing to state that a debt is disputed when disclosure is otherwise permitted.
Using false representations or deceptive means, such as pretending to be a court officer, government employee, or lawyer.
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., unless the account is more than 15 days past due or the borrower expressly agreed that those are the only reasonable contact times.
Contacting people in the borrower’s contact list other than named guarantors or co-makers, even when the borrower supposedly consented to contact-list access.

The lender cannot avoid responsibility merely by outsourcing collection to an agency, call center, lawyer, contractor, or individual collector.

Character references are not guarantors

Under NPC Circular No. 2022-02, a character reference is used to verify the borrower’s identity or information. A character reference is not automatically a guarantor.

For debt collection, the NPC rule allows the lender or financing company to contact a guarantor—someone who separately and expressly agreed to answer for the debt. It prohibits collection contact with other people found in the borrower’s phone, email, or social-media contact list. A co-maker may have a separate contractual obligation, but that depends on the document the person actually signed.

Limited disclosure is not the same as public shaming

Borrower information may be disclosed in narrow lawful situations—for example, pursuant to a valid court or government order, a legally authorized credit-reporting process, or another disclosure permitted by law. A general permission buried in an app’s terms does not automatically authorize harassment, contact-list blasting, or a public shaming campaign.

Even where a debt is real, public disclosure may still violate collection and privacy rules. Whether the same post also constitutes cyberlibel is a separate, fact-specific question.

Privacy rules for lending apps

The NPC Guidelines on Personal Data for Loan-Related Transactions, as amended, apply to lending and financing companies, persons acting as lenders, online lending apps, and their data processors or collection providers—even when the lender lacks the required SEC authority.

Among other restrictions:

Personal data must be processed lawfully, transparently, and only to the extent necessary for a legitimate purpose.
App permissions must not be excessive.
A borrower’s photograph must not be used to harass or embarrass the borrower.
Unrestricted or disproportionate processing of contact lists is prohibited.
Access to contacts may be narrowly used to let the borrower select a reference or guarantor, but not to harvest the list for collection or harassment.
A lender remains accountable for personal data processed by an outsourced collector.
A character reference must be told why the information was obtained and must be given an option to request removal where applicable.

A post containing your name, photograph, mobile number, address, employer, loan balance, alleged delinquency, identification document, or messages may therefore support an NPC complaint even if a cyberlibel case is uncertain.

Step 1: Preserve the evidence before reporting the post

A platform may delete the post after a report, and the account owner may edit, rename, deactivate, or block you. Preserve the evidence first.

Capture:

Full-screen screenshots showing the post, account or page name, profile photograph, date and time, captions, comments, and visible URL.
A screen recording showing how you reached the post from the account or page.
The exact post URL, post ID if visible, profile URL, username, phone number, email address, and page-transparency information.
Copies of images, videos, voice messages, direct messages, emails, and text messages in their original form.
Comments, shares, reactions, tags, group name, and the approximate audience or privacy setting.
Notifications showing that friends, relatives, co-workers, clients, or employers received or saw the material.
The app’s store listing, developer name, privacy notice, permissions, and terms in effect when you applied for the loan.
Your loan agreement, disclosure statement, account number, payment history, receipts, collection notices, and any written dispute over the balance.
The corporate name appearing in the agreement or disclosure statement—not only the app’s brand name.
Earlier complaints, takedown requests, ticket numbers, delivery receipts, and responses.

Ask each third-party recipient to preserve the message on their device and provide an uncropped screenshot showing the sender, recipient, date, time, and complete message. A short affidavit from a recipient may later help prove publication and authenticity.

Keep the original files and device. Store backup copies in at least two secure locations. Avoid adding annotations to the only copy or repeatedly forwarding compressed screenshots. If you need a marked-up copy, retain the untouched original.

Do not secretly record a private live call without legal advice. The Anti-Wiretapping Act generally requires authorization from all parties for recording a private communication. Preserve recordings or voice messages the collector itself sent you.

Step 2: Report the post to the platform

Use the platform’s reporting tool and choose the most accurate ground, such as harassment, bullying, privacy violation, impersonation, threats, doxxing, or disclosure of personal information. Save the report confirmation and reference number.

If the post reveals identification documents, home addresses, children’s information, intimate material, account credentials, or an immediate safety threat, use any expedited privacy or safety channel offered by the platform.

Request removal without publicly posting more personal information. Do not upload your full ID, loan agreement, account number, or payment records into a public comment thread. Provide sensitive documents only through a legitimate private reporting channel.

Platform removal does not prevent an SEC, NPC, civil, or criminal complaint if you preserved reliable evidence.

Step 3: Send a written complaint to the lender and collector

Send the complaint to the lender’s official consumer-assistance channel and data protection officer. Copy the collection agency if its identity is known. Obtain the addresses from the loan documents, privacy notice, app listing, or verified official website—not from the collector’s unsolicited message.

Your complaint should state:

Your name and loan reference, with unnecessary digits redacted.
The corporate lender, app brand, collector, and collection agency involved.
The post’s URL, account name, date, time, and exact objectionable content.
Which information was false, disputed, excessive, or disclosed without authority.
Who received or viewed it.
Whether the app accessed your contacts, photographs, files, or social-media information.
The harm or continuing risk caused by the post.
The action you require: immediate takedown, cessation of third-party contact, correction of false information, preservation of records, identification of the responsible collector, and a written response.
A request that the company preserve account-access logs, collector assignments, call and message logs, post records, app-permission records, and instructions given to its third-party provider.

State clearly if you dispute the debt, amount, interest, fees, payment history, identity of the lender, or authority of the collector. A complaint about collection conduct is separate from any valid obligation to pay; continue addressing an undisputed debt through documented, official payment channels.

Keep proof that the company received your complaint. This is particularly important for an NPC case.

Step 4: File a complaint with the SEC

Use the SEC route when the respondent is a lending company, financing company, online lending platform, or collector acting for one. Include the corporate lender and any separately identifiable collection company.

The SEC’s current iMessage portal includes a service for complaints against financing and lending companies. The SEC’s published complaint guidance also provides its complaint form and checklist.

Prepare:

One complaint for each respondent company.
A copy of a valid government-issued ID.
The loan agreement, disclosure statement, promissory note, amortization schedule, payment receipts, and account records.
The preserved posts, messages, URLs, and recipient screenshots.
Your written complaint to the company and its response, if any.
The app brand, corporate name, SEC registration number, Certificate of Authority information if known, and the collector’s identity.
A chronological narration identifying each post or collection act, with dates and times.
The specific relief requested, such as investigation, takedown or cessation of unfair collection, and appropriate regulatory action.

Do not identify only the app’s trade name if the agreement shows a different corporate lender. If the lender appears unregistered or its Certificate of Authority cannot be verified, say so and attach the documents showing how it represented itself.

The SEC can investigate and impose regulatory sanctions, but its published guidance explains that it cannot simply rewrite the loan, declare it void, cancel the debt, or settle the account for the borrower. A copy of the complaint may be sent to the company for comment; the SEC guidance states that the company is ordinarily given 10 days from receipt to respond.

Step 5: File a privacy complaint with the NPC

First send written notice and allow 15 calendar days

Under the NPC’s amended Rules of Procedure, a formal complaint generally will not be given due course unless:

You first informed the lender, collector, or other responsible entity of the privacy violation in writing; and
It failed to take timely and appropriate action, or did not respond within 15 calendar days after receiving your notice.

The NPC may waive these requirements for proven good cause or a serious violation, including situations involving grave and irreparable harm, the absence of a plain and adequate remedy, or patently illegal conduct. If urgent, explain and document why you are requesting a waiver instead of simply omitting the prior-notice requirement.

Use the current form

Use the Complaint-Affidavit form effective July 1, 2025. The complaint must generally be completed, signed, verified and notarized, and accompanied by:

A valid government-issued ID.
A clear statement of material facts.
Documentary evidence and witness affidavits, where available.
All relevant correspondence with the respondent.
The relief requested.
The required certification against forum shopping.
Information about any related SEC, BSP, court, prosecutor, or other proceeding.

The NPC’s formal-complaint page permits personal filing, courier filing, or submission of a scanned notarized complaint to complaints@privacy.gov.ph. Follow the current payment-assessment instructions rather than sending money to an account supplied by a collector or unofficial intermediary.

The standard NPC complaint filing fee is ₱500, plus a legal research fee of 1% of the filing fee but not less than ₱10. Additional fees apply when damages or special interim relief are claimed. Qualified indigent litigants may seek exemption subject to the income, property, and documentary requirements in NPC Circular No. 2023-01.

Step 6: Use the BSP route when the lender is BSP-supervised

Use the BSP process if the creditor itself is a bank, non-bank electronic-money issuer, pawnshop, money-service business, or another BSP-supervised institution. Merely receiving loan proceeds through an e-wallet does not necessarily make the lending app BSP-regulated.

First complain through the institution’s own Financial Consumer Protection Assistance Mechanism. If the response is unsatisfactory, escalate through the BSP Online Buddy chatbot or the other BSP Consumer Assistance channels.

Attach the complaint sent to the institution, its response, and the posts and collection evidence. BSP Circular No. 1160 confirms that BSP-supervised institutions and their collection agents must use only reasonable and legally permissible collection methods and must avoid abusive or unscrupulous conduct.

Step 7: Report possible crimes promptly

A malicious post may support a criminal complaint when the facts establish cyberlibel, threats, coercion, extortion, identity misuse, unauthorized account access, or another offense. The correct offense depends on the exact words, conduct, authorship, evidence, and surrounding circumstances.

Cyberlibel generally requires a defamatory imputation, identification of the person affected, publication to a third person, and malice, together with use of a computer system. The governing provisions are Article 353 in relation to Article 355 of the Revised Penal Code and section 4(c)(4) of the Cybercrime Prevention Act. A post can violate SEC or privacy rules even when all elements of cyberlibel cannot be proved.

You may seek investigative assistance through the NBI online complaint channel, the NBI Cybercrime Division, or the PNP cybercrime unit. The DOJ Office of Cybercrime reporting page also lists official cybercrime-reporting contacts.

An investigative report is not always the same as filing the formal criminal complaint required to preserve a case. The Supreme Court has held that cyberlibel prescribes in one year from discovery by the offended party, authorities, or their agents. Filing with a platform, SEC, or NPC does not by itself stop that period. The rule was reaffirmed in the Supreme Court’s 2026 resolution in Causing v. People.

If criminal action is being considered, consult counsel and the proper city or provincial prosecutor well before the one-year mark. The DOJ’s preliminary-investigation checklist requires a complaint-affidavit or sworn statement and supporting evidence, with copies based on the number of respondents. Venue and the proper prosecution office can be fact-sensitive in online cases.

When help is urgent

Contact law enforcement immediately when the post or accompanying messages involve:

A credible death threat or threat of physical violence.
Publication of your home address or real-time location.
Threats against children, elderly relatives, or co-workers.
Hacked accounts, stolen credentials, or unauthorized access to your device.
Demands to pay a collector’s personal account to prevent publication.
Fabricated warrants, summonses, police notices, or court documents.
Impersonation of a judge, sheriff, police officer, prosecutor, or lawyer.
Sexual threats, intimate images, or gender-based harassment.
Continued posting after an account has been compromised or after sensitive information has been exposed.

If an account or device may be compromised, change passwords from a trusted device, enable multi-factor authentication, revoke unnecessary app permissions, notify the affected bank or e-wallet, and preserve security alerts and login records.

Common mistakes to avoid

Reporting the post before saving its URL, account details, and complete context.
Deleting the lending app, messages, or original files before preserving evidence.
Submitting heavily cropped or edited screenshots as the only copies.
Naming only the app and not the corporate lender or collection agency.
Paying through a collector’s personal account without verifying authority.
Publicly replying with an ID, loan contract, account number, or other sensitive information.
Filing an NPC complaint without proof of the required written notice and 15-day opportunity to respond, unless a waiver is properly requested.
Using an obsolete NPC complaint form.
Assuming that an SEC or NPC complaint automatically cancels the debt.
Waiting for a platform decision while the one-year cyberlibel period continues to run.
Stating as fact that the lender created an anonymous account when the available evidence shows only suspicion. Report the connection you can prove and ask investigators to determine attribution.

Frequently asked questions

Can I report the post even if I really owe money?

Yes. A valid debt does not authorize threats, insults, contact-list harassment, deceptive legal claims, or public shaming. The debt and the method used to collect it are separate issues.

Can a collector post my name and photograph because I agreed to the app’s terms?

Not automatically. Consent must satisfy privacy-law requirements and cannot be treated as unlimited authority to harass, embarrass, or contact everyone in your phone. SEC and NPC rules specifically restrict these practices.

What if the collector contacted my employer, family, or friends instead of posting publicly?

Preserve each message and have every recipient save the complete sender details, date, time, and content. Unless the person has a legally relevant role—such as an actual guarantor or co-maker—the contact may support SEC and NPC complaints. A character reference is not automatically a guarantor.

What if the post was already deleted?

You may still complain if you preserved reliable evidence. Keep screenshots, URLs, platform notices, witness messages, and any admission or takedown response from the lender or collector.

Is every false or insulting post cyberlibel?

No. Cyberlibel requires proof of specific legal elements and may be defeated by applicable defenses or evidentiary problems. The same post may nevertheless violate privacy or unfair-collection rules.

Can I file with more than one agency?

Yes, when the facts fall within different agencies’ authority. Disclose related proceedings where the applicable complaint form or certification requires it. Do not falsely state that no related case exists.

Will reporting stop interest or collection?

Not necessarily. Continue requesting a written statement of account and deal only through verified official channels. If the balance is disputed, state the dispute precisely. Regulatory complaints do not automatically suspend or cancel a valid obligation.

Official references

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Rights, offenses, deadlines, venue, and remedies may depend on the documents and complete facts. Official sources and procedures were checked as of 5 August 2026.