Quick answer

A lending app, financing company, or collector may demand payment through lawful means, but it may not use online posts to shame, threaten, deceive, or improperly expose a borrower’s personal information. Publicly posting your name, photograph, loan details, ID, contact list, or accusations meant to damage your reputation may violate Securities and Exchange Commission (SEC) debt-collection rules, the Data Privacy Act, or—depending on the exact words and circumstances—criminal laws on threats, harassment, or cyber libel.

Act quickly:

Preserve the post and its identifying details before asking anyone to remove it.
Report the post to the social-media platform.
Send a written takedown and privacy complaint to the lender or collector.
Report a lending or financing company and its collection agency to the SEC.
File with the National Privacy Commission (NPC) if personal data was misused.
Contact law enforcement promptly if there are threats, extortion, impersonation, stalking, or potentially defamatory accusations.

These complaints do not automatically erase a valid loan. The amount owed, the legality of the charges, and the collector’s conduct are separate issues.

What collectors are not allowed to do

SEC Memorandum Circular No. 18, Series of 2019 applies to SEC-regulated lending and financing companies and to third-party collectors acting for them. It prohibits unfair practices such as:

threatening violence, criminal acts, or harm to a person’s reputation or property;
threatening action that cannot legally be taken;
using insults, obscenities, or profane language;
using false representations or deceptive methods to collect or obtain information;
publicly disclosing or publishing borrowers’ personal information, subject to lawful disclosures recognized by applicable rules;
communicating loan information to people who are not legally entitled to receive it; and
using other conduct intended to shame or humiliate the borrower.

A lender generally remains responsible for a collection agency it engaged. It cannot avoid regulatory responsibility simply by saying that an outside collector made the post.

The rules do not prevent reasonable collection efforts. A creditor may contact the borrower, send lawful demands, negotiate payment, report information through legally authorized credit-reporting channels, or file an appropriate court action. The line is crossed when collection becomes threatening, deceptive, abusive, publicly humiliating, or unlawfully intrusive.

Special rules for contact lists, photographs, and references

The NPC’s amended rules for loan-related data processing prohibit unrestrained or disproportionate processing of a borrower’s contact list. Processing that leads to harassment, collection from persons other than the borrower’s guarantors, or unfair collection practices is specifically prohibited.

Important distinctions include:

A character reference is not automatically a guarantor.
A guarantor must have expressly agreed to undertake that role.
For debt collection, the lender may contact the guarantor, but it may not contact arbitrary people from the borrower’s phone, email, or social-media contacts.
Access to a camera or photo gallery may be allowed for a legitimate, limited purpose such as identity verification or payment verification. A borrower’s photograph must not be used to harass or embarrass the borrower.
Consent to data processing is not a blanket license to publish personal data or use it for an incompatible, excessive, or unlawful purpose.

Even if the app’s terms mention collection, contacts, or data sharing, the lender must still comply with the principles of transparency, legitimate purpose, and proportionality under the Data Privacy Act of 2012. Whether a particular disclosure was lawful will depend on what was disclosed, why, to whom, and what notice or lawful basis existed.

Preserve evidence before the post disappears

Capture the evidence first. A screenshot alone may not show who posted the material, when it appeared, or whether it was public.

Preserve:

full-page screenshots showing the post, account name, date, time, comments, reactions, and surrounding context;
the post’s direct URL;
a screen recording opening the account profile and then the post;
the account’s username, profile URL, page name, phone number, and other identifiers;
copies of images, videos, captions, comments, stories, group posts, and private messages;
the date and time you first discovered each post;
names and contact details of people who saw or received it;
screenshots from relatives, employers, co-workers, or contacts who were messaged;
call logs, text messages, email headers, and voice recordings lawfully in your possession;
the loan agreement, disclosure statement, payment history, receipts, and account ledger;
the app’s privacy notice and permissions displayed when you applied;
the lender’s corporate name—not just the app or brand name;
the collector’s name, agency, number, email address, and claimed relationship with the lender;
your complaints, delivery receipts, case numbers, and every response.

Keep original, unedited files. Do not crop away usernames, URLs, timestamps, or device details. Save copies in a second secure location. Avoid reposting the material publicly “for awareness,” because doing so can spread your own data and complicate removal.

Report the post to the platform

Use the report function on the social network, group, page, marketplace, or messaging service. Select the most accurate category, such as harassment, bullying, threats, impersonation, privacy violation, doxxing, or disclosure of personal information.

In the report:

identify the exact personal information exposed;
state that the post is being used for debt-collection harassment;
explain any threat or false accusation briefly;
request removal of the post and preservation of relevant account records; and
save the report confirmation or reference number.

If the post includes an ID, financial information, home address, telephone number, intimate material, or a threat of physical harm, say so expressly. Platform removal helps limit the damage, but it does not replace a complaint to the appropriate Philippine authority.

Send a written complaint to the lender and collector

Write to the lender’s customer-service channel and data protection officer, if one is identified in its privacy notice. Copy the collection agency when its identity is known.

Your notice should contain:

your name and account or loan reference number;
the URL and date of each post;
screenshots or a secure evidence link;
the names or account handles of the persons involved;
a concise explanation of why the processing or collection conduct is improper;
a demand to remove the material and stop further publication or contact with unauthorized third parties;
a request to preserve relevant records, including collector assignments, instructions, access logs, call logs, and account information;
a request to identify the company and collector responsible;
a request for correction or erasure of unlawfully processed data, where legally applicable; and
a reasonable deadline for acknowledgment and action.

Keep proof that the company received the notice. This step is especially important for an NPC complaint because the NPC generally requires prior written notice to the respondent and proof that the respondent failed to take timely and appropriate action or did not respond within 15 calendar days.

Do not include account passwords, one-time PINs, or unnecessary copies of IDs. Redact unrelated personal information where possible.

File a complaint with the SEC

Complaints involving financing companies, lending companies, online lending apps or platforms, and their collection agencies should generally be directed to the SEC’s Financing and Lending Company Division.

The BSP’s current official consumer guidance directs complainants to the SEC I-Message Mo Portal. The SEC’s listed contact points for lending complaints include:

Financing and Lending Company Division Corporate Governance and Finance Department Securities and Exchange Commission SEC Headquarters, 7907 Makati Avenue, Salcedo Village, Barangay Bel-Air, Makati City 1209
Telephone: (02) 8818-5990 or 0929-626-3095

Attach or provide:

the lender’s corporate and app names;
the collector or agency’s identity;
your loan and payment documents;
the posts, messages, URLs, and witness evidence;
a timeline of events;
proof that you complained to the lender;
the relief requested, such as investigation and cessation of the conduct; and
any facts suggesting that the app is operating under another company’s name or without authority.

Describe facts rather than conclusions alone. Instead of merely writing “the collector harassed me,” identify the statement, where it appeared, who could see it, and why it was threatening, deceptive, or a disclosure of private loan information.

File a privacy complaint with the NPC

Use this route when the lender or collector accessed, used, or disclosed personal data improperly—for example, by publishing your photograph or loan details, messaging unrelated contacts, scraping your contact list, or refusing to correct or remove unlawfully processed data.

The NPC’s complaint instructions require a filled-out and notarized Complaint-Assisted Form or a properly verified complaint, together with supporting evidence and witness affidavits where available. The form is available on the NPC’s official forms page.

Before filing, ordinarily:

Notify the lender or collector in writing of the privacy violation.
Allow it an opportunity to act.
If it fails to take timely and appropriate action—or gives no response within 15 calendar days after receiving your notice—attach proof of that fact to the NPC complaint.

NPC complaints may be submitted personally, by registered mail, by courier, or through electronic means authorized by the Commission. The NPC currently lists complaints@privacy.gov.ph for complaints, but check its official contact page and filing instructions immediately before submission. Electronic documents must comply with the NPC’s requirements, including signature, verification, and PDF formatting where practicable.

A data-subject request for erasure is not absolute. Information may sometimes be retained when required by law, necessary for a valid legal claim, or supported by another lawful basis. That does not necessarily justify continued public display or harassment.

When to contact the BSP instead

The BSP Consumer Assistance Mechanism is for complaints involving a BSP-supervised financial institution, such as a bank, digital bank, non-stock savings and loan association, or certain other regulated financial institutions. It is a second-level remedy: first complain through the institution’s own consumer-assistance channel.

If the lender is BSP-supervised and the complaint remains unresolved, use the BSP Consumer Assistance channels, including the BSP Online Buddy or the official complaint form sent to consumeraffairs@bsp.gov.ph.

A stand-alone financing or lending company and its online lending platform are ordinarily under SEC—not BSP—supervision. Confirm the legal entity behind the app because a brand name alone may not reveal the correct regulator.

When to report to law enforcement

Go to the PNP, NBI, CICC, or a prosecutor promptly if the posts or accompanying messages involve:

threats of injury, death, abduction, or property damage;
demands for money backed by unlawful threats;
stalking or publication of your live location or home address;
impersonation or use of a fake account in your name;
fabricated arrest warrants, court orders, or government notices;
account hacking or unauthorized access;
sexually explicit or intimate material;
repeated conduct creating an immediate safety risk; or
potentially criminal defamation.

Official government guidance lists the following reporting contacts:

PNP Anti-Cybercrime Group: acg@pnp.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph
Cybercrime Investigation and Coordinating Center: report@cicc.gov.ph

The addresses and telephone contacts appear in the BSP’s official referral guide. Verify contact details before visiting or sending sensitive documents.

Call 911 or go to the nearest police station if there is immediate danger. Tell trusted household members or workplace security personnel when a threat identifies your home, family, employer, or daily movements.

Could a malicious post be cyber libel?

Possibly, but not every insulting, embarrassing, or inaccurate post is automatically cyber libel. Liability depends on the exact statement, its meaning and context, whether it identified the complainant, whether it was communicated to another person, and whether the required elements of libel—including malice where legally required—can be proved.

Cyber libel is covered by Section 4(c)(4) of the Cybercrime Prevention Act of 2012, together with the Revised Penal Code provisions on libel. The Supreme Court has explained that liability for online libel principally concerns the person who authored the libelous statement; merely reacting to or sharing content should not automatically be treated as aiding or abetting cyber libel.

Time is important. In Causing v. People, the Supreme Court held that cyber libel prescribes in one year from discovery by the offended party, the authorities, or their agents. Prescription can involve procedural and factual questions, so obtain legal advice promptly instead of waiting for the post to disappear or assuming that a platform report stops the legal deadline.

Truth, privileged communication, good intention, justifiable motive, identification, publication, and authorship can become significant issues in a defamation case. Do not label a post criminal in your complaint without accurately reproducing and preserving what was said.

What result can you request?

Depending on the forum and facts, you may request:

immediate removal or disabling of the post;
cessation of public shaming and unauthorized third-party contact;
correction of false or inaccurate personal information;
identification of the responsible collector and its principal;
preservation of relevant electronic and business records;
investigation and regulatory sanctions;
appropriate action on unlawfully processed personal data; and
referral or prosecution where a criminal offense is supported by evidence.

Compensation, damages, criminal liability, or cancellation of the loan is never automatic. Those outcomes require the proper proceedings and sufficient proof.

Common mistakes to avoid

Deleting the evidence too soon. Preserve complete records before blocking an account or seeking removal.
Naming only the app. Identify the corporation operating it and the collection agency, if possible.
Sending one vague complaint everywhere. Tailor the SEC complaint to collection conduct, the NPC complaint to personal-data processing, and the law-enforcement report to suspected crimes.
Assuming relatives or references owe the debt. A character reference does not become a guarantor without the required agreement.
Posting your own counterattack. Threats, doxxing, or defamatory accusations can expose you to a separate complaint.
Ignoring legitimate court papers. Harassment is unlawful, but a real summons, subpoena, or court order requires prompt attention.
Paying an unknown collector without verification. Confirm its authority and obtain an official receipt and updated account statement.
Assuming harassment cancels the loan. Challenge unlawful fees or the debt separately and keep paying or disputing through documented, lawful channels as appropriate.
Waiting too long. Posts, account records, and potential legal remedies may be time-sensitive.

Frequently asked questions

Can a collector post that I have an unpaid loan?

Publicly exposing a borrower or loan details as a collection tactic may violate SEC unfair-collection rules and data-privacy requirements. The answer can depend on the post’s contents, audience, purpose, and lawful basis. Reporting to an authorized credit-information system is different from posting the debt on social media.

Can the app message everyone in my contacts?

Not for ordinary debt collection. NPC rules prohibit unbridled contact-list processing and prohibit contacting people from the borrower’s contact list other than persons properly named as guarantors for collection purposes. A character reference is not automatically a guarantor.

What if the post is true?

Truth does not automatically make public debt-shaming a lawful collection practice or lawful personal-data processing. For defamation, however, truth and other defenses require separate legal analysis based on the statement and circumstances.

Should I report first or request takedown first?

Preserve the evidence first, then do both as soon as practical. A platform report may remove the content quickly; the written complaint to the lender also helps establish the record required for regulatory action.

Can I complain even if the collector used a fake account?

Yes. Preserve the fake profile, URLs, messages, phone numbers, payment instructions, and facts connecting it to the loan. State clearly which parts are proven and which are your inference.

Can my relative or employer file the complaint?

A person whose own data was disclosed or who personally received threats may have an independent basis to complain. For an NPC complaint filed solely as your representative, the NPC generally requires proper authority, such as a special power of attorney.

Should I stop paying after the harassment?

Not solely because of the harassment. Unfair collection conduct does not by itself extinguish a valid debt. Ask for an account statement, dispute questionable charges in writing, and obtain advice if the amount, lender’s authority, or contract is contested.

When should I speak to a lawyer immediately?

Seek prompt legal assistance if there is a credible threat, publication of sensitive or intimate material, contact with your employer, identity theft, a large or disputed debt, an actual court document, significant financial or reputational harm, or a possible cyber-libel claim approaching the one-year period.

This article provides general Philippine legal information, not legal advice or a prediction of any case outcome. Application of the rules depends on the complete posts, loan documents, identities of the parties, and surrounding facts. Official sources and complaint channels were checked as of August 27, 2026.