Quick answer

If a lending app or collector posts your name, photo, loan details, contact information, accusations, or insulting content online to shame or pressure you into paying, preserve the evidence first, report the post to the platform, and send a written complaint and takedown demand to the lender. You may then complain to:

The Securities and Exchange Commission (SEC) for unfair collection by a lending or financing company or its collection agent;
The National Privacy Commission (NPC) if personal data was unlawfully used, disclosed, or taken from your phone or contact list;
The Bangko Sentral ng Pilipinas (BSP) if the creditor is a BSP-supervised bank, electronic-money issuer, financing institution, or other supervised financial service provider; and
The police, NBI, or a prosecutor when the posts involve credible threats, extortion, impersonation, hacking, stalking, or potentially criminal defamation.

A genuine unpaid loan does not give a lender permission to conduct public shaming. Reporting abusive collection also does not automatically cancel a valid debt, change the loan contract, or stop lawful collection or court action.

Preserve the post before asking for removal

Online content can be edited, deleted, or moved to a private group. Before confronting the collector, preserve enough information to show what appeared, where it appeared, who posted it, and when it was accessible.

Keep:

Full-page screenshots showing the post, account or page name, date, time, captions, comments, and reactions;
The post’s direct URL and the profile, page, or group URL;
A screen recording showing how you reached the post;
Copies of the posted photograph, graphic, or video in its original available quality;
Screenshots of messages in which the collector threatened to post—or admitted posting—the material;
The collector’s phone number, email address, account name, and claimed company or agency;
The lending app’s name, developer, download page, privacy notice, and permissions;
Your loan agreement, disclosure statement, account number, payment records, and account history;
The names and statements of relatives, co-workers, employers, or friends who received or saw the material;
Platform acknowledgments, report numbers, and takedown decisions; and
Your written complaints and proof that the lender received them.

Do not crop away identifying details. Keep an unedited master copy and make separate redacted copies for ordinary correspondence. Avoid publicly reposting the material yourself, especially if it contains government numbers, addresses, children’s information, or intimate images.

Why public shaming can be unlawful

SEC rules on unfair debt collection

SEC Memorandum Circular No. 18, Series of 2019 applies to SEC-regulated lending and financing companies and to third-party service providers collecting for them. It prohibits practices that include:

Threatening violence or other criminal means against a person, reputation, or property;
Threatening action that cannot legally be taken;
Using obscenities, insults, or abusive language;
Disclosing or publishing the names and other personal information of borrowers who allegedly refuse to pay, except within the rule’s limited confidentiality exceptions;
Communicating false loan information, including failing to state that a debt is disputed when that fact should be disclosed;
Using false representations or deceptive methods to collect or obtain information;
Making contact before 6:00 a.m. or after 10:00 p.m., subject to the circular’s stated exceptions; and
Contacting people in the borrower’s contact list who were not named guarantors or co-makers.

The lender remains ultimately responsible when it outsources collection. A company generally cannot avoid responsibility merely by saying that an outside collector made the post.

The circular permits certain limited disclosures—for example, disclosures authorized by the borrower in writing or by recording, required by a court or authorized government agency, or necessary for specified dealings with credit institutions, collection agents, counsel, service providers, or insurers. Those exceptions are not a blanket license to publish a borrower’s debt on social media or expose it to uninvolved relatives, friends, co-workers, or the public.

Data-privacy rules for online lending

Under the Data Privacy Act of 2012, processing personal information must have a lawful basis and comply with transparency, legitimate purpose, and proportionality. “Processing” includes collecting, using, disclosing, storing, and destroying personal information.

NPC Circular No. 2022-02, which amended the NPC rules for loan-related transactions, specifically provides that:

App permissions and personal data must be suitable, necessary, and not excessive for a legitimate purpose;
Unrestrained or disproportionate processing of contact lists is prohibited;
A borrower’s photo must not be used to harass or embarrass the borrower in collecting a delinquent loan;
For collection, the lender may contact a properly identified guarantor, but not other people in the borrower’s contact list;
A character reference is not automatically a guarantor; and
A person must have separately consented to undertake the legal obligation of a guarantor.

A lender may have a lawful reason to retain and use some information to administer or enforce a loan. That does not necessarily authorize a public “warning post,” a shame graphic, or messages revealing the debt to uninvolved contacts. The precise privacy violation still depends on what data was used, its source, the audience, the privacy notice, any valid consent, and other lawful grounds claimed by the lender.

What to do, step by step

1. Protect your accounts and phone

Revoke any lending-app permissions that are no longer needed, especially access to contacts, photos, storage, camera, microphone, location, and social-media accounts. Uninstalling the app does not necessarily erase information already copied by the lender.

Change passwords if the collector appears to have entered an account or obtained private content. Enable multi-factor authentication, review logged-in devices, and warn contacts not to open suspicious links or send money.

Do not surrender an OTP, password, PIN, or remote access to your phone. A legitimate payment arrangement does not require giving a collector control of your device or financial account.

2. Report the post to the platform

Use the platform’s reporting tools for the most accurate available category, such as:

Harassment or bullying;
Sharing private or personal information;
Impersonation;
Threats or violence;
Fraud or extortion; or
Non-consensual intimate imagery, if applicable.

Report the individual post and, when justified, the account, page, or group. Ask people who directly received the post to preserve their own copies and submit truthful reports. Do not organize false or misleading mass reports.

A platform report may secure quick removal, but it does not replace a complaint to the lender or government regulator.

3. Send a written notice to the lender and collector

Address the notice to the company’s customer-service unit and data protection officer, if listed. Identify the post precisely and request:

Immediate removal and an end to further publication or third-party disclosure;
Preservation of relevant records, including collector instructions, access logs, and communications;
Identification of the lender, collection agency, and responsible collector;
Confirmation of where your personal data came from and to whom it was disclosed;
Correction of false information;
A copy or explanation of any consent or lawful basis relied upon;
Restriction of future communications to a reasonable, designated channel; and
A written response.

State whether you dispute the debt, the amount, particular charges, or the identity of the creditor. A complaint about collection conduct is not necessarily a denial of the debt.

Keep proof of delivery. For an eventual NPC complaint, proof that the respondent received written notice is particularly important.

4. File an SEC complaint when the creditor is a lending or financing company

Use the SEC’s official complaints page for lending and financing companies. Follow the current instructions and download the current complaint form from that page.

The SEC presently instructs complainants to:

Complete the complaint form accurately;
Submit one complaint form for each respondent company;
Attach supporting evidence; and
Provide a valid government-issued ID.

Identify both the lender and the collection agency if known. Include screenshots, URLs, messages, loan documents, payment records, and your written takedown request. If only the app’s brand name is visible, provide its app-store page, developer name, privacy notice, payment destination, and every corporate name appearing in the agreement or messages.

The SEC may regulate the company’s collection conduct and impose administrative consequences. Its complaints guidance expressly notes that the SEC cannot, through this process, rewrite payment terms, declare the contract or interest void, or cancel or settle the loan obligation.

The SEC also operates the SEC iMessage portal for concerns and complaints. Check the official complaint page before filing because forms, addresses, and channels can change.

5. File an NPC complaint for misuse or disclosure of personal data

Ordinarily, you must first notify the lender or collector in writing and give it an opportunity to address the privacy violation. Under the NPC’s published complaint mechanics, you may proceed when the respondent fails to take timely or appropriate action or does not respond within 15 calendar days from receiving your written notice. Attach proof of receipt and any response.

The NPC currently requires a completed and notarized complaint-assisted form or another verified complaint, together with evidence and relevant witness affidavits. Follow the NPC’s current filing instructions, including its requirements for electronic documents. The NPC website publishes the current template and authorized channels.

Explain:

What personal data was posted or sent;
How you believe the lender obtained it;
The audience or recipients;
Why the use or disclosure was unnecessary, excessive, inaccurate, or unauthorized;
When you notified the respondent;
What response, if any, you received; and
What relief you seek, such as removal, correction, restriction of processing, or appropriate sanctions.

The 15-day period is part of the NPC’s ordinary exhaustion requirement; it is not a reason to wait before reporting an immediate threat to law enforcement or requesting emergency removal from a platform.

6. Use the BSP process if the creditor is BSP-supervised

If the creditor is a bank or another BSP-supervised financial institution, first file a formal complaint through that institution’s consumer-assistance mechanism. If the matter remains unresolved, escalate it through the BSP Consumer Assistance Mechanism, including the BSP Online Buddy or another currently listed channel.

Attach the complaint you sent to the institution, its response if any, and the evidence of the malicious posts. Some businesses have related companies under different regulators, so identify the exact corporate entity named as creditor in the agreement—not merely the app or wallet brand.

7. Consider law-enforcement or legal action when the conduct may be criminal

A malicious online post may raise issues beyond regulatory collection rules. Depending on its exact words, context, author, and supporting evidence, possible offenses may include threats, extortion, identity-related offenses, unlawful access, or libel committed through a computer system under the Cybercrime Prevention Act of 2012.

Criminal liability is not automatic merely because a post is offensive or damaging. Online libel, for example, has specific elements and defenses that require legal assessment. Do not label a collector a criminal in your own public posts; give the evidence to counsel or authorities.

Consult a Philippine lawyer promptly about a complaint-affidavit and the correct venue. Criminal and civil claims have prescriptive periods, and delay can affect evidence and available remedies.

When help is urgent

Contact law enforcement immediately when there is:

A credible threat of physical harm, abduction, sexual violence, or damage to property;
A demand for money accompanied by a threat to expose private information;
Publication of your home address or real-time location creating a safety risk;
Hacking, account takeover, identity theft, or unauthorized financial transactions;
Publication or threatened publication of intimate images;
Content involving a child; or
Impersonation of a court, prosecutor, police officer, or other government official using apparently fabricated legal documents.

If safety is at risk, move to a secure location and inform trusted people. Preserve evidence, but do not continue a confrontation simply to obtain more proof.

Common mistakes to avoid

Deleting the post before preserving it. A bare screenshot without the account name, URL, date, or context may be difficult to verify.
Complaining only to the individual collector. Notify the creditor’s customer-service unit and data protection officer as well.
Naming only the app brand. Identify the corporate lender, financing company, collection agency, and payment recipient whenever possible.
Assuming the complaint erases the debt. Unlawful collection conduct and the validity or amount of the debt are separate issues.
Posting your own accusation campaign. Retaliatory posts can expose private information, weaken negotiations, or create a separate legal dispute.
Paying an unverified personal account. Confirm the creditor, balance, payment channel, and authority of the collector in writing.
Sending unredacted IDs everywhere. Provide identification only through an official, secure channel and redact information not required for informal correspondence.
Using old forms or unofficial addresses. Download forms and confirm filing channels on the regulator’s official website at the time of submission.
Waiting for a regulator before securing the account. Change passwords, revoke permissions, and report the content to the platform immediately.
Making unsupported claims. Separate what you personally saw from what another witness saw, and obtain that witness’s statement where possible.

Frequently asked questions

Can a lender post my name and photo because I have not paid?

As a general rule, an SEC-regulated lender or financing company may pursue reasonable and lawful collection, but SEC rules prohibit publishing borrowers’ names and other personal information as a collection tactic except within narrowly defined confidentiality exceptions. Using a borrower’s photo to harass or embarrass the borrower is also expressly prohibited by the NPC’s loan-related privacy rules.

What if the post is true?

Truth does not automatically make public debt-shaming a lawful collection method. SEC confidentiality and collection rules, as well as data-protection requirements, may apply even when a debt exists. A defamation claim, however, involves separate elements and defenses that should be assessed by a lawyer.

Can the collector contact my family, employer, or friends?

A lender may communicate with a genuine guarantor or co-maker within lawful limits. NPC rules state that a character reference is not automatically a guarantor, and the lender may not contact other people in the borrower’s contact list for debt collection. Whether a particular communication was permissible depends on the recipient’s role, the information disclosed, and the applicable rule.

Does giving the app access to my contacts mean it may message everyone?

No. App permission is not unlimited consent to use every contact for collection. NPC rules prohibit unrestrained, excessive, or disproportionate contact-list processing and prohibit contacting people other than properly identified guarantors for debt collection.

Should I pay first before reporting?

You may report abusive or unlawful conduct regardless of whether the account is unpaid. If the debt is legitimate, request a written balance and use a verified payment channel. Reporting the collector does not by itself suspend payment obligations or legal remedies under the loan.

What if the lender is unregistered or uses several app names?

Give the SEC all identifying information you have: app-store links, developer names, privacy policies, agreements, phone numbers, bank or e-wallet payment destinations, websites, and screenshots. An apparently unregistered operation may require enforcement action in addition to an unfair-collection complaint.

Can the SEC order Facebook or another platform to remove the post?

The platform has its own content-removal system. The SEC’s principal role here is regulation of lending and financing companies and their collection practices. Report the content directly to the platform while pursuing the regulatory complaint.

Do I need a lawyer?

A lawyer is not always necessary to submit an administrative complaint, but legal help is advisable when there are threats, extensive reputational or financial harm, disputed identity, fabricated court documents, possible criminal charges, or contemplated damages or injunction proceedings.

Official sources

This article provides general Philippine legal information, not advice for a particular case. Outcomes and proper remedies depend on the post, loan documents, parties, evidence, and applicable regulator. Official sources and procedures were checked as of 2 September 2026.