Quick answer

If a lending app or collector posts your photo, name, loan details, accusations, altered images, threats, or insulting statements online to shame or pressure you into paying, preserve the evidence first, request immediate removal, and report the conduct to the proper regulator.

For most lending and financing companies, file with the Securities and Exchange Commission (SEC). If the post used or exposed personal data without lawful authority, also complain to the National Privacy Commission (NPC). If the lender is a bank or another Bangko Sentral-supervised institution, complain first to the institution and then escalate an unresolved complaint to the Bangko Sentral ng Pilipinas (BSP). Threats, impersonation, fraud, or potentially criminal online conduct may also be reported promptly to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT Cyber Hotline.

A valid debt does not give a lender permission to publicly shame, threaten, deceive, or unlawfully expose a borrower. At the same time, reporting abusive collection does not automatically cancel a legitimate loan.

When an online post may violate the law

A collector may lawfully demand payment and pursue remedies permitted by the loan agreement and the law. Collection crosses the line when it uses prohibited pressure or unlawfully processes personal information.

Public shaming and unfair collection

Under SEC Memorandum Circular No. 18, Series of 2019, lending and financing companies—including their collection agencies, representatives, and agents—must not employ unfair debt-collection practices.

Depending on the facts, prohibited conduct may include:

threatening violence or another criminal act against the borrower, the borrower’s reputation, or property;
threatening action that cannot legally be taken;
using insults, obscenities, or profane language;
falsely representing the collector’s identity, authority, or legal powers;
communicating or threatening to communicate false credit information;
disclosing or publishing the borrower’s name and other personal information, subject to limited lawful disclosures;
contacting persons in the borrower’s contact list to shame or pressure the borrower; and
using deceptive means to collect or obtain information about the borrower.

A lender cannot convert a private collection dispute into a social-media humiliation campaign merely because payment is overdue.

Misuse of photographs, contacts, and personal information

The Data Privacy Act of 2012 requires personal data to be processed for a lawful, declared, and proportionate purpose. It also grants data subjects rights concerning access, correction, objection, erasure or blocking in appropriate cases, and damages.

NPC Circular No. 20-01, as amended, specifically regulates personal-data processing for loan transactions. Among other safeguards:

an online lending app must not require unnecessary or excessive permissions;
borrowers’ photographs must not be used to harass or embarrass them;
indiscriminate harvesting or saving of phone, email, or social-media contacts for collection or harassment is prohibited;
a lender remains accountable for personal data handled by its collection agency or other service provider; and
personal data must not be retained indefinitely without a legitimate purpose.

The joint DICT-NPC-SEC March 18, 2026 advisory on online lending platforms further states that contacting people from a borrower’s contact list other than persons who validly consented to act as guarantors is prohibited. A mere character reference is not automatically a guarantor.

A post may therefore raise privacy issues even when part of its content—such as the existence of a loan—is true. Truth does not by itself establish that publishing private loan information to the public was necessary, proportionate, or legally authorized.

Defamation, threats, impersonation, and other possible offenses

A false and defamatory accusation published online may potentially constitute cyberlibel under the Revised Penal Code in relation to the Cybercrime Prevention Act of 2012. Threatening bodily harm, fabricating official documents, impersonating police or court personnel, hacking an account, or using another person’s identity may implicate other laws.

Criminal liability is fact-specific. Not every offensive statement is automatically libel, and not every collection warning is a criminal threat. The exact words, truth or falsity of the allegation, audience, purpose, authorship, surrounding communications, and available defenses all matter.

What to do immediately

1. Preserve the post before requesting its removal

Do not rely on a single cropped screenshot. Capture enough information to establish what was published, where, when, by whom, and to whom it was visible.

Preserve:

full-page screenshots showing the account name, profile, post, date, time, comments, reactions, and surrounding context;
the post’s direct URL;
a screen recording opening the profile and navigating to the post;
copies of the photograph, video, or altered image used;
messages linking the post to the lending app or collector;
notifications sent to relatives, coworkers, employers, or friends;
the names and statements of people who received or saw the content;
app-store details, app developer information, privacy notice, and requested permissions;
the loan agreement, disclosure statement, statement of account, payment receipts, and collection notices;
call logs, text messages, email headers, usernames, telephone numbers, payment accounts, and QR codes used by the collector; and
proof of harm, such as workplace communications, lost transactions, medical records, or counseling expenses, if relevant.

Keep original files. Avoid editing, annotating, or repeatedly compressing the only copy. Record the date and time you discovered the publication. If possible, export account data or download the post using the platform’s legitimate tools.

2. Identify the responsible lender

The app name may differ from the corporate lender’s registered name. Check:

the loan agreement and disclosure statement;
the app’s “About,” privacy, and terms pages;
collection messages and payment instructions;
the developer listed in the app store;
the company named in official receipts; and
whether the company has SEC authority to operate as a lending or financing company.

Save evidence even if the app or company appears unregistered. The 2026 government advisory applies relevant privacy safeguards to entities acting as lenders through online platforms, whether recorded or unrecorded. An unlicensed operation should be reported rather than treated as a reason to ignore the harassment.

3. Send a written demand to the lender and collector

Write to the company’s official customer-service channel, complaints unit, and data protection officer, if identified. State:

the URLs and accounts involved;
the date and nature of the posts;
which statements are allegedly false;
which personal data was disclosed or misused;
why the processing is unauthorized, excessive, or unrelated to legitimate collection;
the persons contacted or exposed;
the relief requested; and
a demand that relevant account records, instructions, access logs, and collector communications be preserved.

Request:

immediate removal of the posts;
cessation of public shaming and third-party contact;
correction of false information;
identification of the collection agency or authorized collector;
an explanation of the source and lawful basis for using your data;
restriction, blocking, or deletion of unlawfully processed data where legally appropriate; and
written confirmation of the corrective action taken.

Keep proof that the company received the notice. This is particularly important for an NPC complaint because the 2021 NPC Rules of Procedure generally require the complainant first to inform the responsible entity in writing and give it an opportunity to act. Ordinarily, the requirement is satisfied when the entity fails to take timely or appropriate action or does not respond within 15 calendar days from receipt. The NPC may waive exhaustion for good cause or a serious violation, including grave and irreparable harm, lack of an adequate remedy, or patently illegal conduct.

4. Report the content to the platform

Use the platform’s reporting tools for harassment, bullying, threats, impersonation, non-consensual disclosure of personal information, or manipulated media, as applicable. Include the direct URL and specify the exact policy violation.

Ask affected friends or relatives to preserve what they received before reporting or deleting it. Do not organize false reports or encourage anyone to misstate what happened.

A platform takedown may stop further exposure, but it does not replace a regulatory or criminal complaint.

Where to file the government complaint

SEC: lending or financing company and its collector

For unfair collection by an SEC-regulated lending or financing company, submit a complaint to the SEC Financing and Lending Companies Department through the SEC’s official iMessage portal. The March 2026 joint advisory also lists the SEC hotline 1-4732 (1-4SEC).

Prepare one complete complaint for each respondent company and attach:

your valid government-issued ID;
the loan documents and payment history;
the complete screenshots, URLs, and recordings;
communications identifying the collector;
your written demand and proof of receipt;
the company’s response, if any; and
a clear chronology and requested action.

The SEC can investigate and impose administrative sanctions where warranted. However, an SEC complaint does not itself erase the debt, rewrite the loan contract, or automatically award damages.

NPC: unlawful use or disclosure of personal data

Use the NPC’s official complaint guidance and complaint-assisted form. A formal complaint is generally a notarized complaint-assisted form or verified complaint supported by evidence and witness affidavits.

The complaint should identify the respondent, narrate the material facts, specify the relief requested, attach the prior written notice and response or proof of non-response, and include the required certification against forum shopping. Filing may be made personally, by registered mail, by courier, or by electronic mail when authorized by the NPC. Check the NPC page immediately before filing for the current form, filing instructions, fees, and permitted electronic format.

If publication is continuing and likely to cause grave or irreparable harm, obtain prompt legal advice about requesting urgent NPC relief, including a possible temporary ban on processing. Such relief is not automatic and may require a summary hearing, pleadings, and a bond.

BSP: if the lender is a bank or BSP-supervised institution

First submit the complaint to the financial institution through its own consumer-assistance mechanism. If it remains unresolved, escalate it through the BSP Consumer Assistance Mechanism, including the complaint sent to the institution, its reply, and supporting documents.

BSP’s current channels include its Online Buddy or a completed Complaints, Inquiries and Requests form sent to consumeraffairs@bsp.gov.ph. BSP Circular No. 1160 implements consumer-protection standards covering fair treatment, protection of client information, and effective recourse for consumers of BSP-supervised institutions.

Do not send an ordinary SEC lending-company complaint to the BSP merely because payment passed through a bank or e-wallet. Identify the institution that actually granted or serviced the loan.

Cybercrime and law-enforcement channels

Report promptly when the conduct includes threats, extortion, account intrusion, impersonation, fabricated legal documents, fraud, or other potentially criminal activity.

The March 2026 government advisory lists:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; (02) 8723-0401 local 7491

For immediate danger, contact the police or emergency services instead of waiting for an administrative complaint. Bring your device and original evidence if investigators request examination, but retain a backup and obtain a receipt for anything surrendered.

What to write in the complaint

A useful complaint is factual and organized. It may follow this structure:

Your identity and relationship to the loan.
The lender’s corporate name, app name, collector, and known contact details.
The loan date, amount, maturity, payments, and disputed balance, if relevant.
A dated chronology of calls, messages, threats, and publications.
The exact post, audience, URL, and personal information disclosed.
Why the publication was false, threatening, excessive, or unnecessary for lawful collection.
Persons contacted and harm caused.
Your written attempts to resolve the matter.
The specific relief requested.
A numbered list of attachments.

Separate what you personally observed from what another person told you. If a relative received the message, obtain that person’s screenshot and affidavit rather than presenting speculation as fact.

Common mistakes to avoid

Deleting evidence immediately. Preserve the original post and metadata before blocking the account or requesting removal.
Submitting only cropped screenshots. Include the URL, account identity, date, context, and proof connecting the account to the lender.
Naming only the app. Identify the corporate lender, collection agency, and individual collector when possible.
Assuming a privacy complaint cancels the loan. Continue addressing any legitimate balance separately and keep proof of payment.
Paying a collector’s personal account without verification. Confirm payment instructions through the lender’s official channel.
Posting the collector’s private information in retaliation. This can create a separate dispute and weaken your position.
Exaggerating the complaint. Distinguish a rude demand from a threat, and identify precisely which statements are false.
Waiting too long. Posts disappear, accounts change names, and platform records may not remain readily available.
Filing with the wrong regulator. SEC generally handles lending and financing companies; BSP handles institutions under its supervision; NPC handles personal-data violations.
Ignoring formal requirements. An incomplete SEC form or an unverified, unsupported NPC complaint may be dismissed or delayed.

When legal help is urgent

Consult counsel promptly when:

the post contains a credible threat of physical harm;
intimate, medical, government-ID, financial-account, or other highly sensitive material was exposed;
the collector impersonates police, a court, a prosecutor, or a lawyer;
your employer, clients, children, or an extensive contact list are being targeted;
the content is spreading rapidly or has been republished by multiple accounts;
you need emergency injunctive or privacy relief;
you intend to pursue a criminal complaint or damages;
the lender denies responsibility for an apparent third-party collector;
a summons, subpoena, or official order has been received; or
there is a dispute over whether the loan, identity, or account is genuine.

Frequently asked questions

Can a lender post that I owe money if the debt is real?

Not automatically. Even truthful personal information must still be processed lawfully, fairly, and proportionately. Publicly exposing a borrower to shame or pressure payment may violate privacy and fair-collection rules.

May the lender contact my relatives or coworkers?

A lender may communicate with a valid guarantor concerning the guaranteed obligation. It cannot indiscriminately contact people harvested from your phone or social-media accounts. A character reference does not become a guarantor merely because the borrower supplied a name or telephone number.

Is a collection agency responsible, or only the lending app?

Both may face consequences depending on their acts and legal relationship. The lender generally remains accountable for personal data under its control and for authorized third parties processing that data. Name the lender, agency, and collector in the complaint when the evidence supports doing so.

Should I stop paying after filing a complaint?

Not solely because you filed. Unfair collection and the underlying debt are separate issues. Pay only through verified channels, request an updated statement of account, and preserve receipts. If you dispute the amount or validity of the loan, obtain advice based on the contract and transaction records.

Can I demand that all my data be deleted?

You may object to unlawful processing and seek erasure or blocking in appropriate circumstances, but deletion is not absolute. A lender may retain information necessary to service an existing loan, comply with law, or establish, exercise, or defend legal claims. It should not retain or publish data indefinitely for an unspecified purpose.

Should I file cyberlibel immediately?

Only after the exact post and surrounding facts have been assessed. A cyberlibel complaint requires more than showing that a post was embarrassing. Falsity or defamatory imputation, publication, identification, malice, authorship, jurisdictional facts, and possible defenses must be evaluated. Prompt evidence preservation remains important.

Can I complain even if the lender is unregistered?

Yes. Report the suspected unlicensed operation and abusive conduct. Privacy obligations may apply to persons acting as lenders whether or not they possess the required SEC authority.

Will reporting the post guarantee removal or compensation?

No. A platform, regulator, prosecutor, or court must evaluate the evidence and applicable rules. Removal, administrative sanctions, criminal prosecution, and damages are distinct remedies with different requirements.

This article provides general Philippine legal information, not legal advice for a specific loan, post, or complaint. Rules and filing channels may change, and the appropriate remedy depends on the lender’s regulatory status, the exact publication, and available evidence. Official sources and procedures were checked as of August 25, 2026.