Quick answer

A lending app or collector may demand payment through lawful, private means, but it may not use public shaming, intimidation, threats, or unlawful disclosure of personal data. A real unpaid debt does not give anyone the right to post your name, photograph, loan status, contacts, address, or accusations such as “scammer” on social media.

Act in this order:

Preserve the post and related evidence before requesting removal.
Send the lender and its Data Protection Officer a written demand to remove the post, stop further disclosure, preserve records, and identify the collector.
Report the post to the social-media platform for harassment, privacy violation, impersonation, or sharing of personal information.
File an unfair-collection complaint with the Securities and Exchange Commission (SEC).
File with the National Privacy Commission (NPC) if personal data was accessed, used, or disclosed improperly.
Contact law enforcement immediately if there are threats, extortion, impersonation of authorities, doxxing, or other possible crimes.

These remedies may be pursued through different agencies because each addresses a different issue. However, disclose related cases when a complaint form or certification against forum shopping requires it.

Why public debt-shaming may be unlawful

The Financial Products and Services Consumer Protection Act, or Republic Act No. 11765, prohibits financial service providers from using abusive collection or debt-recovery practices. It also requires respect for client privacy and makes providers responsible for the conduct of their officers, employees, and agents. A provider may also be solidarily liable with an accredited third-party service provider involved in debt collection.

For SEC-regulated financing and lending companies, SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair collection practices such as:

Threatening violence or other criminal means against a person, reputation, or property;
Threatening an action that cannot legally be taken;
Using insults, obscene language, or deceptive representations;
Disclosing or publishing borrower information as a means of humiliation or pressure;
Communicating information known or reasonably expected to be false; and
Using other oppressive or abusive methods to force payment.

The Data Privacy Act of 2012 and NPC Circular No. 20-01 on loan-related transactions separately require lawful, transparent, necessary, and proportionate processing of personal data. A borrower’s photograph may not be used to embarrass or harass the borrower. Harvesting social-media contacts or copying contact lists for harassment or improper collection is prohibited.

The DICT, NPC, and SEC reiterated these rules in their 18 March 2026 Joint Advisory on Online Lending Platforms, which covers lending and financing entities operating through online platforms, whether recorded or unrecorded.

Character references are not automatically guarantors

For debt collection, the 2026 Joint Advisory says a lender or collector may contact a person who actually consented to be a guarantor. A character reference is provided only for identification or verification and does not become responsible for the loan merely because the borrower listed that person.

Contacting other people in the borrower’s phone list to disclose the debt, shame the borrower, or pressure them to pay is prohibited. Limited access that lets a borrower select a reference or guarantor, or derives proportionate metadata for a specified legitimate purpose, does not authorize unrestricted copying, disclosure, or harassment.

Not every legitimate disclosure is prohibited

A lender may process information that is necessary and supported by a lawful basis—for example, to service the account, establish or defend a legal claim, comply with a regulator or court order, or work with an authorized service provider subject to privacy safeguards. A genuine guarantor may be contacted about the obligation.

That is different from publishing the debt to the general public, messaging unrelated contacts, tagging an employer or relatives, or using a borrower’s photograph and personal details for humiliation. Consent hidden in a broad permission screen is not automatically valid for every use; the 2026 Joint Advisory warns that deceptive design and manipulative consent interfaces may invalidate consent.

Preserve evidence before the post disappears

Electronic evidence must be shown to be authentic and reliable. The Supreme Court Rules on Electronic Evidence place the burden of authenticating a private electronic document on the party presenting it.

Preserve the following:

Full screenshots showing the post, account name, profile photograph, date and time, comments, reactions, shares, group or page name, and visible web address;
The exact post URL and profile URL;
A screen recording that starts from the account or group and navigates to the post;
The original image, video, message, or downloaded file, without editing or annotation;
Screenshots of direct messages, text messages, call logs, emails, and threats connected to the post;
Messages received by relatives, coworkers, references, or other contacts;
Names and contact details of people who personally saw the post;
The loan agreement, disclosure statement, account number, payment receipts, statement of account, and collection notices;
The app’s privacy notice, permission screens, terms, and displayed corporate operator;
Evidence connecting the poster to the lender, such as collection instructions, payment account, account details known only to the lender, telephone numbers, email domains, or the collector’s identification;
Proof of when you first discovered the post; and
Copies of every report, demand, acknowledgment, ticket number, and response.

Keep an incident timeline. Record the date and time the post appeared, when you discovered it, who informed you, when you requested removal, and whether the content was reposted.

Do not rely only on cropped screenshots. Do not add arrows, captions, filters, or other edits to the sole copy. If you need marked-up copies for explanation, retain the untouched originals separately.

Send a written removal and preservation demand

Write to the lender’s customer-assistance channel and Data Protection Officer. If a collection agency is identified, send it there as well. Email is useful because it records transmission and receipt.

Your notice should:

Identify the post by URL, account, date, and screenshot;
State which personal information was disclosed;
Explain whether the post was false, misleading, threatening, or intended to shame you;
Demand immediate removal and cessation of further disclosure;
Object to unnecessary or unauthorized processing of your personal data;
Ask who obtained, used, and received the information;
Ask the lender to identify the collector and confirm whether that person or agency was authorized;
Require preservation of account records, access logs, collection instructions, messages, call recordings, and communications with the platform; and
Request a written response and reference number.

Do not admit an amount you genuinely dispute merely to request removal. At the same time, do not make false statements about the loan. The collection conduct and the existence or amount of the debt are separate issues.

This written notice is particularly important for an NPC complaint. As a general rule, the NPC requires proof that the concerned entity was notified in writing and either failed to take timely and appropriate action or did not respond within 15 calendar days of receiving the notice. The NPC may waive this requirement for good cause or a serious violation, including grave and irreparable harm, lack of an adequate remedy, or patently illegal conduct.

Report the individual post to the platform

After preserving evidence, use the platform’s built-in reporting tools. Select the most accurate ground, which may include:

Harassment or bullying;
Sharing personal information;
Privacy violation;
Impersonation;
Threats or violence;
Fraud or deceptive conduct; or
Non-consensual intimate content, if applicable.

Report both the post and the responsible account when appropriate. Save the confirmation screen, report number, and platform response. If the first report is rejected, use the appeal or privacy-request process and identify the precise information exposed.

Platform removal is useful for limiting harm, but it is not a legal finding and does not replace an SEC, NPC, or criminal complaint.

File an unfair-collection complaint with the SEC

For lending companies, financing companies, online lending platforms, and their collection agencies, use the SEC’s official iMessage ticketing portal. The SEC’s iMessage User Guide instructs users to sign in through an eSECURE account, create a ticket, and select the appropriate service. The relevant service is “Complaints on Financing and Lending Companies” under the Financing and Lending Companies Department.

Attach:

A complete factual chronology;
The app’s name and the lender’s registered corporate name, if known;
The collector’s name, agency, telephone number, account, and profile;
Screenshots, URLs, recordings, and messages;
Your loan documents and relevant payment records;
Your written removal demand and the responses;
Evidence of messages sent to people who were not guarantors;
A valid government-issued ID as required by SEC complaint guidance; and
The specific relief requested, such as investigation, removal, cessation of improper contact, identification of the collector, correction of records, or appropriate sanctions.

The SEC advises complainants to provide complete information and supporting evidence and, where applicable, use one complaint form per respondent company. Follow all instructions and deadlines sent through the ticket.

Report the conduct even if the app appears unlicensed or its corporate operator is unclear. State every identifying detail available and explain that the true operator is unknown. The latest Joint Advisory expressly addresses recorded and unrecorded online lending platforms.

An SEC complaint does not automatically cancel the debt, rewrite the contract, stop a lawful collection case, or declare the interest invalid. Continue to request a proper statement of account and pay only through a verified channel if payment is due.

File a privacy complaint with the NPC

An NPC complaint is appropriate when the collector or lending app:

Posted your name, photograph, address, identification document, loan status, or other personal information;
Accessed or copied contacts beyond what was necessary;
Messaged people who were neither borrowers nor genuine guarantors;
Used a photograph obtained for identity verification to shame you;
Refused to remove or correct unlawfully processed information;
Disclosed personal data through a fake profile, group, page, text blast, or messaging app; or
Continued processing after the relevant purpose ended without another lawful basis.

After the written-notice requirement has been satisfied—or when requesting a justified waiver—prepare a formal complaint under the 2021 NPC Rules of Procedure, as amended. The complaint generally must be:

In writing and signed;
Verified;
Clear about the complainant and respondent;
Supported by a factual narration and documentary or testimonial evidence;
Accompanied by correspondence with the respondent;
Specific about the relief requested; and
Accompanied by a sworn certification against forum shopping.

A representative ordinarily needs a special power of attorney. If the affected person is a minor or legally represented person, attach the relationship or guardianship documents required by the amended rules.

Use the NPC’s Complaints-Assisted Form and check the agency’s complaint page for the current filing and payment instructions. The NPC rules allow filing at an NPC office personally, by registered mail or courier, or by email when authorized by the Commission.

The NPC’s May 2025 fee schedule lists a ₱500 complaint filing fee, plus a legal research fee and possible additional fees when damages are claimed. Government and qualifying indigent complainants may be exempt, and the NPC may waive fees for good cause upon motion. Obtain an official assessment before paying.

If the disclosure is continuing and threatens grave harm, ask the NPC about the separate procedure for a temporary ban on processing or other urgent relief. Additional verification, fees, and a bond may apply.

When to contact the BSP instead

If the lender is a bank, digital bank, credit-card issuer, electronic-money issuer, or another BSP-supervised institution, first complain through that institution’s Financial Consumer Protection Assistance Mechanism. If the response is unsatisfactory, elevate the matter through the BSP Consumer Assistance Mechanism.

The BSP’s current complaint guide directs consumers to the BSP Online Buddy on the BSP website or official Facebook page. Consumers without access to the chatbot may use the BSP complaint form and the channel identified in the guide, with proof that they first complained to the institution.

Complaints about ordinary SEC-regulated lending or financing companies and their collection agencies should go to the SEC, not the BSP.

When the post may also be a crime

An embarrassing disclosure is not automatically cyberlibel. Cyberlibel requires a defamatory imputation published through a computer system, identification of the person affected, communication to another person, and the other legal elements. Defenses, privileged communications, context, and evidence of malice can be decisive. A privacy or unfair-collection violation may exist even when a cyberlibel charge does not.

A post falsely accusing a borrower of being a thief, swindler, scammer, criminal, or dishonest person may justify immediate legal assessment. In its 8 April 2026 resolution in Causing v. People, the Supreme Court held that cyberlibel prescribes in one year from discovery by the offended party, authorities, or their agents. Publication online does not by itself create a presumption that the offended person discovered the post that day. See the Supreme Court decision in G.R. No. 258524.

Document the exact discovery date and consult a lawyer or prosecutor immediately. Do not assume that a platform, SEC, or NPC report stops the criminal prescriptive period.

For threats, extortion, fraudulent demands, impersonation of police or court personnel, doxxing, or other possible crimes, the 2026 Joint Advisory identifies these official channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph; (02) 8723-0401 local 7491

The NBI also provides investigative assistance for victims of computer crimes and an online complaint page. If there is an immediate threat to life or safety, contact emergency services or the nearest police station without waiting for an agency response.

Common mistakes to avoid

Deleting or blocking before preserving evidence. Preserve first, then secure the account.
Arguing in the comments. Public replies can spread the post further and create new legal issues.
Reposting the accusation. Share evidence privately with authorities and counsel.
Reporting only the app’s trade name. Include the corporate lender, collector, payment channel, and every known identifier.
Submitting cropped or unreadable screenshots. Show the account, URL, date, context, and complete post.
Ignoring the NPC’s written-notice requirement. Keep proof of receipt and count the 15 calendar days unless requesting a justified waiver.
Failing to disclose related proceedings. The NPC requires a certification against forum shopping.
Uploading an unredacted ID publicly. Submit identification only through the secure channel that requires it.
Paying an unknown collector. Verify the lender, account balance, authority of the collector, and payment destination.
Assuming the complaint erases the debt. A lawful balance remains separately enforceable unless paid, settled, or legally set aside.
Ignoring a real summons. A collector’s fake warning is different from an authentic court document. Have any summons reviewed immediately.

When legal help is urgent

Seek a lawyer, prosecutor, the NBI, or the PNP promptly when:

The post includes your home address, identification documents, children’s information, intimate material, or financial credentials;
The collector threatens physical harm, arrest by impersonated officers, or destruction of property;
Payment is demanded in exchange for not publishing or for deleting information;
The campaign is spreading rapidly through workplaces, schools, community groups, or contact lists;
You cannot identify the lender or the poster uses multiple fake accounts;
The one-year cyberlibel period may be running;
You want damages, an injunction, a temporary ban on processing, or criminal charges; or
You receive an authentic demand from a prosecutor, court, or regulator.

Frequently asked questions

Can a lender post my name if the debt is genuine?

No. A genuine debt permits lawful collection, not public humiliation, abusive conduct, or unnecessary disclosure of personal data.

Can the lender contact everyone in my phone?

No. For debt collection, the 2026 Joint Advisory allows contact with a person who separately consented to be a guarantor. A character reference is not automatically a guarantor, and unrelated contacts may not be used to pressure or shame the borrower.

Should I complain to both the SEC and NPC?

Often, yes. The SEC handles unfair collection and conduct by lending or financing companies; the NPC handles unlawful personal-data processing. Describe any related cases honestly in each filing.

Must I wait 15 days before going to the SEC?

The specific 15-calendar-day exhaustion rule belongs to the NPC complaint process. A prior written complaint is still useful evidence for the SEC. Urgent threats should be reported to law enforcement immediately.

What if the post has already been deleted?

You may still report it if you preserved sufficient evidence. Keep screenshots, URLs, witness details, platform confirmations, and proof linking the poster to the lender.

Does filing a complaint suspend my payments?

Not automatically. Continue addressing the legitimate account separately. Ask for a statement of account and negotiate only through verified channels.

Can a relative or coworker file the privacy complaint?

A person whose own personal data or privacy rights were affected may complain in that capacity. A representative filing for someone else ordinarily needs the authorization required by the NPC rules.

Will the government keep my identity secret from the lender?

Do not assume anonymity. Formal proceedings generally require identification, and the respondent may receive the complaint and supporting evidence so it can answer. Tell the agency if particular information creates a safety risk and ask about available protective measures.

Is a report enough for cyberlibel?

No. A regulatory or platform report is not necessarily the proper criminal complaint and should not be assumed to stop prescription. Obtain legal help promptly because the current Supreme Court rule gives cyberlibel a one-year prescriptive period from discovery.

This article provides general Philippine legal information, not advice for a particular case. Outcomes depend on the post’s exact words, audience, source, loan documents, consent records, and evidence connecting the poster to the lender or collector. Official sources and procedures were checked as of 11 August 2026.