If an online lending app has threatened to post your photo, called your family and co-workers, sent “shame” messages to your contacts, or published your personal details online to force payment, the issue is no longer just about an unpaid loan. In the Philippines, abusive online debt collection may involve unfair debt collection practices, data privacy violations, and in serious cases, cybercrime or criminal harassment. The practical goal is to preserve evidence, identify the lender behind the app, and file the right complaint with the right agency before the messages disappear or the app changes names.

What Counts as Public Shaming by an Online Lending App?

“Public shaming” usually means a lender, collector, or online lending app uses embarrassment, fear, or reputational damage to pressure a borrower to pay. Common examples include:

Posting your name, photo, loan details, or alleged debt on Facebook, Messenger groups, TikTok, Viber, Telegram, or other platforms
Sending messages to your relatives, friends, employer, co-workers, neighbors, or school contacts saying you are a “scammer,” “criminal,” “estafador,” or “magnanakaw”
Editing your photo into a fake wanted poster or defamatory graphic
Threatening to report you to your office, barangay, immigration, police, or NBI for non-payment
Contacting people in your phone contact list who were never guarantors or co-makers
Using obscene language, insults, threats, or fake legal notices to force immediate payment

A lender may collect a legitimate debt, but it must do so lawfully. The fact that a borrower is delayed in payment does not give the lending app permission to expose private information, harass third parties, or damage the borrower’s reputation.

The Main Philippine Laws and Rules That Protect Borrowers

SEC rules on unfair debt collection

The Securities and Exchange Commission (SEC) regulates lending companies and financing companies under the Lending Company Regulation Act of 2007, Republic Act No. 9474, and the Financing Company Act of 1998, Republic Act No. 8556. RA 9474 places lending companies under SEC regulation, while RA 8556 gives the SEC authority over financing companies and prohibits entities from holding themselves out as financing companies without authority. (Lawphil)

The key rule for online lending harassment is SEC Memorandum Circular No. 18, Series of 2019, which expressly covers financing companies, lending companies, and their third-party service providers or collection agents. It prohibits, among others, threats of violence or criminal means, threats to take action that cannot legally be taken, obscene or insulting language, disclosure or publication of borrower information, false representations, unreasonable collection hours, and contacting people in the borrower’s contact list other than those named as guarantors or co-makers.

This is important because many online lending apps try to blame “outside collectors.” Under SEC MC 18, outsourcing collection does not remove responsibility from the financing or lending company; the third-party collector is treated as the company’s agent, and ultimate responsibility remains with the company.

SEC MC 18 also provides administrative penalties. For lending companies, the first offense is ₱25,000 and the second offense is ₱50,000. For financing companies, the first offense is ₱50,000 and the second offense is ₱100,000. A third offense may result in a fine of up to ₱1,000,000, suspension of lending or financing activities for 60 days, or revocation of the Certificate of Authority, depending on the facts.

Data privacy rules on contact lists, photos, and personal information

Public shaming by lending apps often involves misuse of personal data. The Data Privacy Act of 2012, Republic Act No. 10173, requires personal data processing to follow the principles of transparency, legitimate purpose, and proportionality. In simple terms, a company must clearly explain what data it collects, use it only for lawful and declared purposes, and avoid collecting or using more data than necessary. (National Privacy Commission)

The National Privacy Commission (NPC) specifically addressed online lending abuse through NPC Circular No. 20-01, later amended by NPC Circular No. 2022-02. The NPC has stated that online lenders are prohibited from harvesting phone contacts, email lists, or social media contacts to harass borrowers or their contacts, and that camera access may be used only for legitimate know-your-customer purposes, not to embarrass a borrower. (National Privacy Commission)

The amended NPC guidelines make a crucial distinction between a character reference and a guarantor. A character reference is only someone whose contact details are used to verify identity or information. A guarantor is someone who separately and expressly agrees to answer for the debt if the borrower defaults. The NPC has said lenders may not treat a character reference as a guarantor, and for debt collection, they may contact only guarantors, not random people in the borrower’s contact list. (National Privacy Commission)

A 2026 joint advisory of the DICT, NPC, and SEC repeats the same rule: contacting persons in the borrower’s contact list other than named guarantors is prohibited, and online lending platforms may access contact lists only for narrow legitimate purposes such as selecting character references or guarantors, or deriving proportional metadata where allowed.

Cybercrime, libel, threats, and civil damages

If the app or collector posts defamatory statements online, the facts may also be assessed under cyber libel rules. The Cybercrime Prevention Act of 2012, Republic Act No. 10175, covers crimes under the Revised Penal Code and special laws when committed through information and communications technology, with the applicable cybercrime consequences. (Lawphil)

A public post saying “this person is a criminal,” “scammer,” or “estafador,” when used to shame a borrower and damage reputation, may raise libel issues depending on the exact words, publication, identification of the person, and malice. In Causing v. People, the Supreme Court discussed cyber libel as libel under the Revised Penal Code committed through a computer system. (Lawphil)

For civil damages, the Civil Code of the Philippines is also relevant. Articles 19, 20, and 21 require people to act with justice, honesty, good faith, and to compensate others for willful or negligent acts contrary to law, morals, good customs, or public policy. Article 26 protects dignity, personality, privacy, and peace of mind. (Lawphil)

Where to File a Complaint

Different agencies handle different parts of the problem. In many public shaming cases, it is practical to file with more than one office because the same facts may involve both SEC rules and privacy rights.

Problem	Main office to approach	What it can address
Unfair collection, harassment, threats, public shaming by a lending or financing company	SEC Financing and Lending Companies Department / FINLEND through SEC iMessage	Administrative investigation, penalties, suspension, or revocation of authority
Misuse of contact list, photos, IDs, phone data, or messages to third parties	National Privacy Commission	Data privacy complaint, orders, penalties, privacy-related relief
Threats, cyber libel, hacking, identity misuse, fake posts, scam tactics	CICC / DICT Cyber Hotline, NBI Cybercrime Division, or PNP Anti-Cybercrime Group	Cybercrime assistance, investigation, evidence preservation, referral for prosecution
Claim for damages or injunction	Proper court, usually through a lawyer-assisted civil case	Monetary damages, court orders, injunctions
Criminal prosecution	City or provincial prosecutor, often after NBI/PNP assistance	Preliminary investigation and possible filing of criminal case

The 2026 DICT-NPC-SEC advisory identifies the SEC iMessage portal for unfair debt collection complaints and lists official cybercrime reporting channels, including DICT Cyber Hotline email, NBI Cybercrime Division email and telephone, and PNP Anti-Cybercrime Group contacts.

Step-by-Step Guide to Filing a Complaint

1. Preserve evidence before blocking, deleting, or uninstalling

Before you block numbers or uninstall the app, preserve evidence. Many complaints fail because the borrower has only a story but no proof.

Save the following:

Screenshots of all threatening messages, including the sender name, number, username, date, and time
Full screen recordings scrolling through the conversation
Screenshots of public posts, group chats, comments, edited photos, or fake “wanted” posters
URLs or profile links of Facebook pages, TikTok accounts, Telegram channels, or websites
Call logs showing repeated calls, especially before 6:00 a.m. or after 10:00 p.m.
Names and contact details of relatives, co-workers, or friends who received messages
Screenshots from your contacts showing what they received
The app name, app store link, website, package name if available, and developer name
Loan agreement, disclosure statement, repayment schedule, proof of disbursement, and payment history
Privacy notice, consent screens, app permissions, and any screenshot showing the app requested contacts, camera, gallery, SMS, or location access
Proof that the contacted person was only a character reference and not a guarantor
Proof of payment if you already paid

For social media posts, capture the entire page, not only the offending words. Include the account name, profile photo, URL, timestamp, and comments showing people actually saw the post.

2. Identify the company behind the app

Online lending apps often use one brand name while the actual lender has a different corporate name. Check:

The app’s “About,” privacy policy, loan agreement, disclosure statement, or terms and conditions
The name of the corporation, SEC registration number, Certificate of Authority number, address, and customer service email
The payment recipient in GCash, Maya, bank transfer, or remittance receipts
The developer name on Google Play or Apple App Store
Any SMS sender ID or email domain used by the lender

Under SEC disclosure rules, financing and lending companies operating online lending platforms must disclose their corporate name, SEC registration number, and Certificate of Authority number in advertisements and online platforms, and must report/register online lending platforms as business names. (ACCRALAW)

If the app does not show a real company name, uses only personal wallet accounts, or keeps changing app names, include that fact in your complaint. It may indicate an unrecorded or unauthorized online lending platform.

3. File with the SEC for unfair debt collection

For SEC complaints, use the SEC iMessage ticketing system. The SEC iMessage page allows the public to open a new ticket and check ticket status; the SEC’s 2026 advisory specifically directs unfair debt collection complaints to the SEC Financing and Lending Companies Department through imessage.sec.gov.ph. (Securities and Exchange Commission)

In your SEC complaint, include:

Your full name, contact number, email, and address.
The app name and corporate name, if known.
The loan amount, date borrowed, amount received, due date, and amount being demanded.
A short timeline of harassment.
The exact unfair collection acts, such as:
- public posting of your name or photo;
- threats to contact your employer;
- messages to relatives or co-workers;
- obscene language;
- calls before 6:00 a.m. or after 10:00 p.m.;
- threats of police, NBI, immigration, or barangay action that appear legally baseless;
- contacting people who were not guarantors or co-makers.
Attach screenshots, screen recordings, call logs, loan documents, and statements from affected contacts.

A simple complaint narrative can be written this way:

I am filing a complaint for unfair debt collection practices against [App Name / Company Name]. On [date], its collectors sent messages to my relatives and co-workers stating that I am a scammer and threatening to post my photo online unless I paid immediately. These persons were not guarantors or co-makers. Attached are screenshots, call logs, and copies of messages received by third parties. I request investigation under SEC Memorandum Circular No. 18, Series of 2019, and appropriate action to stop the harassment and sanction the responsible company and collectors.

4. File with the NPC for data privacy violations

File with the NPC when the app used or exposed your personal data, photo, ID, contact list, employer details, address, or information about your loan.

The NPC requires a formal complaint in a specific format. Its official complaint page instructs complainants to download the form, print and fill it out, have it notarized, then submit it in person, by courier, or by scanned email to the NPC. (National Privacy Commission)

For an NPC complaint, prepare:

Filled-out NPC complaint form
Notarized complaint-affidavit or verified complaint
Valid ID
Evidence of the lending app’s collection and misuse of personal data
Screenshots of app permissions and privacy notice
Messages sent to your contacts
Statements or screenshots from affected contacts
Proof that contacts were not guarantors
Proof of damage, if claiming damages

NPC Circular No. 2023-01 lists a ₱500 filing fee for complaints, additional fees for claims of damages, a ₱500 motion for reconsideration fee, and possible fees or bonds for cease-and-desist or temporary ban applications. It also provides exemptions for qualified indigent litigants who submit the required barangay certificate of indigency and supporting affidavits.

If the harassment is ongoing, clearly state that continuing access to your contacts, photos, or personal details creates continuing harm. Ask the NPC to order appropriate relief based on its rules and the evidence.

5. Report cybercrime-related acts to CICC, NBI, or PNP ACG

Use cybercrime channels when there are threats, fake posts, defamatory online publications, identity misuse, hacking, account takeover, scam payment channels, or coordinated online harassment.

The 2026 DICT-NPC-SEC advisory lists these reporting channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; telephone (632) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph; onlinecims.ocs@gmail.com; telephone (632) 8723-0401 local 7491

When reporting, attach your evidence and ask how to preserve digital proof properly. For serious threats, do not wait for an agency email reply before seeking police assistance, especially if the collector has threatened physical harm, doxxing, or workplace disruption.

6. Consider a prosecutor’s complaint for criminal acts

A criminal complaint is usually supported by:

Complaint-affidavit, signed and notarized
Affidavits of witnesses who received messages or saw posts
Screenshots, links, call logs, and recordings where legally obtained
Certification or report from NBI/PNP ACG if available
IDs of complainant and witnesses
Printed copies and electronic copies of evidence

The prosecutor evaluates whether there is probable cause. The exact offense depends on the evidence. Possible issues may include cyber libel, unjust vexation, grave threats, coercion, identity-related offenses, or Data Privacy Act violations, depending on what was done and how it was proven.

7. Follow up and keep your evidence organized

Create one folder for each agency:

SEC Complaint
NPC Complaint
NBI or PNP Report
Witness Screenshots
Loan Documents
Payment Proof
Timeline

Keep a spreadsheet or written timeline with columns for date, time, sender, platform, message, person affected, and file name of evidence. This makes it easier for investigators to understand the pattern.

Required Documents, Fees, and Practical Timelines

Filing route	Common documents	Fees	Practical timeline
SEC complaint	Complaint narrative, screenshots, loan documents, app/company details, proof of third-party contact	Usually filed through SEC iMessage; check current SEC instructions for any required payment	Ticket acknowledgment may be quick; investigation and enforcement can take weeks to months depending on volume and evidence
NPC complaint	NPC form, notarized complaint, ID, screenshots, privacy notice, app permissions, witness screenshots	₱500 filing fee; additional fees for damages or urgent relief; indigent exemption may apply	Initial evaluation may take weeks; mediation, orders, or investigation can take longer
NBI/PNP cybercrime report	ID, screenshots, links, device, account details, witness statements	Initial reporting is generally not treated like a civil filing fee; bring funds for printing, notarization, or certification needs	Urgent threats may be acted on faster; technical tracing depends on available data and platform cooperation
Prosecutor complaint	Notarized complaint-affidavit, affidavits of witnesses, evidence, investigation report if any	No ordinary court filing fee at preliminary investigation stage, but notarization and document costs apply	Preliminary investigation often takes months, depending on docket and respondent participation
Civil damages case	Complaint, affidavits, evidence, proof of damages, identity of defendant	Court filing fees depend on damages claimed	Often months to years; injunction applications may move faster if urgent and well-supported

Practical Issues That Often Decide Whether a Complaint Succeeds

The strongest cases show third-party harm

A complaint is stronger when you can show that the app contacted real people who were not guarantors. Ask those people to send you screenshots showing:

the sender;
the message;
the date and time;
how they know you;
whether they ever agreed to be a guarantor.

If a co-worker, supervisor, client, or relative received a message, their screenshot may matter more than your own statement.

A “character reference” is not automatically liable for the loan

Many lending apps pressure borrowers by telling contacts that they are “co-makers.” Under NPC guidance, a character reference is only for verification. A guarantor must separately and expressly agree to answer for the obligation. (National Privacy Commission)

Consent does not legalize harassment

Some apps argue that the borrower “consented” to contact access. But under Philippine data privacy rules, consent must still be tied to a legitimate, specific, and proportional purpose. The DICT-NPC-SEC advisory states that unnecessary, unauthorized, excessive, or disproportionate processing of personal data through lending apps is prohibited, especially where it leads to harassment or unfair collection practices.

Do not rely only on Facebook posts about the app

Posting your own accusations online may create a separate defamation or privacy problem. It is safer to preserve evidence and file with the SEC, NPC, CICC, NBI, PNP ACG, or prosecutor. You can warn close contacts privately, but avoid publishing unverified personal details of collectors or employees.

Non-payment of a loan is usually different from estafa

Collectors often say, “Pay today or we will file estafa.” Non-payment alone is generally a civil debt issue. Estafa requires specific criminal elements, such as deceit or abuse of confidence, depending on the provision involved. If a collector threatens automatic arrest, imprisonment, or police action solely because you missed a due date, include that threat in your SEC complaint as a possible unfair collection practice.

Pay only through verifiable official channels

If you choose to pay, pay only through official company channels and keep receipts. Avoid sending money to a collector’s personal wallet unless the company confirms in writing that it is an authorized payment channel. Save proof of every payment.

Special Notes for OFWs, Filipinos Abroad, and Foreign Borrowers

Filipinos abroad and foreign nationals may still file complaints if the online lending app, lender, borrower, affected contacts, or data processing has a Philippine connection. SEC and NPC complaints can often begin online or by scanned submission, but notarized affidavits, foreign documents, or evidence executed abroad may need proper authentication depending on where the document was signed and where it will be used.

For documents issued abroad and intended for use in the Philippines, the usual route is apostille in the country of origin if that country is an Apostille Convention member; if not, Philippine consular authentication may still be required. Philippine DFA apostille services apply to Philippine public documents for use abroad, not to foreign-issued documents. (Apostille Philippines)

Foreign borrowers should also keep copies of passport pages, Philippine address or contact details used in the loan, proof of the Philippine app transaction, and screenshots showing that contacts in the Philippines were harassed.

Frequently Asked Questions

Can an online lending app post my photo online if I do not pay?

No. SEC MC 18 prohibits disclosure or publication of borrower information as an unfair collection practice, and NPC rules prohibit excessive or unauthorized use of personal data for harassment.

Can a lending app message my contacts?

For debt collection, lenders may not contact people in your contact list unless they are proper guarantors. NPC guidance distinguishes character references from guarantors, and the 2026 DICT-NPC-SEC advisory states that contacting persons other than named guarantors is prohibited. (National Privacy Commission)

Should I file with SEC or NPC?

File with the SEC for unfair debt collection, harassment, threats, and public shaming by lending or financing companies. File with the NPC when the app misused your personal data, accessed your contacts, used your photo, exposed your loan details, or contacted third parties using harvested information. Many cases justify filing with both.

What if the online lending app is not registered with the SEC?

Still report it. An unregistered or unrecorded app may create a separate regulatory issue. Include screenshots showing the app name, download page, developer, payment channels, and any missing SEC registration or Certificate of Authority information.

Can my relatives or co-workers file their own complaint?

Yes, especially if they received threats, were falsely called guarantors, or had their own personal data processed. They may be separate data subjects and harassment victims.

Can I get damages for public shaming?

Possibly. Civil Code Articles 19, 20, 21, and 26 may support a civil claim where abusive acts caused reputational, emotional, financial, or employment-related harm. The strength of the claim depends on evidence of the wrongful act, the person responsible, and the damage suffered. (Lawphil)

Is a screenshot enough evidence?

A screenshot helps, but stronger evidence includes the full conversation, URL, sender profile, timestamps, screen recording, witness screenshots, call logs, loan documents, and proof that the contacted persons were not guarantors.

Can I ask the app to stop contacting my employer?

Yes. Put the request in writing through the lender’s official customer service channel and keep proof. Also include employer contact or threats in your SEC and NPC complaints, especially if your employer was never a guarantor or co-maker.

Will filing a complaint erase my loan?

Usually, no. A complaint against harassment does not automatically cancel a valid debt. It addresses illegal collection practices, privacy violations, and abusive behavior. The lender may still use lawful collection methods.

How long does the process take?

Simple ticket acknowledgment may be fast, but investigations can take weeks or months. Cybercrime tracing and formal complaints may take longer, especially if the app uses fake accounts, foreign servers, changing numbers, or unregistered entities.

Key Takeaways

Online lending apps may collect legitimate debts, but they cannot shame borrowers publicly, threaten unlawful action, or misuse contact lists.
SEC MC 18 prohibits unfair debt collection practices, including threats, insults, publication of borrower information, and contacting non-guarantor contacts.
NPC rules prohibit excessive and disproportionate use of personal data, especially contact list harvesting for harassment.
File with the SEC for unfair collection, the NPC for privacy violations, and CICC/NBI/PNP ACG for cybercrime-related threats or online posts.
Preserve screenshots, screen recordings, URLs, call logs, app details, loan documents, and witness evidence before deleting anything.
A character reference is not automatically a guarantor.
Non-payment of a loan does not give collectors the right to threaten arrest, publish your photo, or damage your reputation.