Quick answer

If a lending app, financing company, or collector posts your name, photo, loan details, contact information, accusations, or altered images online to shame or pressure you into paying, preserve the evidence first and then report the conduct through the appropriate channels:

Report the post and account to the social-media platform and request removal.
Send a written takedown and complaint demand to the lender and its data protection officer or authorized representative.
Report an SEC-regulated lending or financing company through the SEC iMessage portal.
File a privacy complaint with the National Privacy Commission if personal data was accessed, used, or disclosed improperly.
If the post includes threats, extortion, impersonation, cyberlibel, or other suspected crimes, promptly approach the NBI Cybercrime Division, the PNP Anti-Cybercrime Group, or another proper law-enforcement office.

A real unpaid loan does not give a lender or collector a free hand to publicly shame a borrower. At the same time, reporting abusive collection does not cancel a valid debt. Keep the collection complaint and any dispute over the amount, charges, or payment history clearly separated.

Preserve the evidence before seeking removal

Online material can be edited or deleted quickly. Before blocking the collector or reporting the content, preserve enough information to establish what appeared, where it appeared, when it was accessible, and who appears to have posted it.

Save:

Full-page screenshots showing the post, account or page name, profile details, date and time, caption, comments, reactions, and visible URL;
A screen recording that opens the profile, post, comments, and account information in one continuous sequence;
The direct link to the post, profile, group, video, or message;
Copies of photographs, videos, voice messages, emails, texts, call logs, and chat histories;
The app’s name, developer, download-page link, privacy notice, terms, permission requests, and collection messages;
Your loan agreement, disclosure statement, payment receipts, account ledger, and any settlement or restructuring correspondence;
Proof that the lender or collector contacted relatives, co-workers, employers, friends, or people taken from your phone;
Messages showing the collector’s name, number, agency, payment instructions, or claimed connection to the lender;
A list of people who saw or received the post, together with their screenshots and, if they agree, written accounts;
Your platform-report confirmation, case number, and removal response; and
Every complaint sent to the lender, SEC, NPC, BSP, or law-enforcement agency and every reply received.

Keep the original files. Do not crop, annotate, rename, or repeatedly resave your only copies. Make separate working copies if you need to hide unrelated personal information. Record dates in Philippine time and write a short chronological account while events are still fresh.

For a serious or contested case, ask a lawyer about an affidavit of the person who captured or saw the content and other ways to authenticate electronic evidence. A screenshot is useful, but its weight may depend on whether its source and integrity can be established.

Why public debt-shaming may violate Philippine law

Unfair debt collection

SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair collection practices by financing and lending companies. Prohibited conduct includes specified forms of harassment, abusive or insulting language, false or deceptive collection methods, improper disclosure or publication of borrowers’ information, and communicating loan information to people in the borrower’s contact list other than those legally or contractually connected to the obligation.

The exact finding will depend on the post, the identity of the publisher, the lender’s authority, and the documents. A legitimate private demand for payment is not automatically unlawful. Publicly displaying a borrower’s photo, labeling the person a scammer or criminal, publishing the debt to friends or co-workers, or using humiliating images to force payment raises much more serious concerns.

A lender generally remains accountable for collectors or service providers it engages. It should not be enough for the company simply to say that an outsourced collector made the post.

Data privacy violations

The Data Privacy Act of 2012 requires personal-data processing to have a lawful basis and to comply with transparency, legitimate-purpose, and proportionality requirements. It also gives data subjects rights that include access, correction, objection in appropriate cases, erasure or blocking under the statutory conditions, damages, and the right to complain to the NPC.

Under NPC Circular No. 2020-01:

Lending apps may not require unnecessary or excessive permissions.
A borrower’s photograph must not be used to harass or embarrass the borrower to collect a delinquent loan.
Accessing contact lists or email lists, harvesting social-media contacts, or copying and saving those contacts for collection or harassment is prohibited.
The app must instead provide a separate interface for references or co-makers chosen by the borrower.
Lenders remain accountable for personal data under their control, including processing outsourced to collectors.
Personal data should not be retained indefinitely after a rejected application or fully settled loan without a defined lawful purpose.

Consent to use data for processing a loan is not necessarily consent to publish it on Facebook, TikTok, a group chat, or another public or semi-public forum. Similarly, allowing an app to use a camera for identity verification does not authorize it to turn the resulting photograph into a debt-shaming poster.

The Data Privacy Act also defines criminal offenses, including unauthorized processing, processing for unauthorized purposes, malicious disclosure, and unauthorized disclosure. Whether a particular post satisfies every element of an offense is a matter for the NPC, prosecutors, and courts—not something that can be concluded from the post alone.

Cyberlibel and other possible offenses

A false or defamatory online post may potentially fall within Article 353 of the Revised Penal Code and Section 4(c)(4) of the Cybercrime Prevention Act of 2012. A successful complaint requires proof of all legal elements and consideration of defenses, including privileged communication and lack of malice where applicable. An upsetting, aggressive, or inaccurate post is not automatically cyberlibel.

Threats, demands for money accompanied by threats to publish damaging material, impersonation, unauthorized account access, or fabricated documents may raise other criminal issues. Because criminal filing periods and the proper charge can depend on the offense and facts, seek legal advice promptly rather than waiting for the post to disappear or assuming one deadline applies to every case.

Step 1: Report the content to the platform

Use the platform’s reporting tools for the most accurate available category, such as:

Harassment or bullying;
Privacy violation or disclosure of personal information;
Impersonation or fake account;
Threats or violent content;
Scam or fraud; or
Non-consensual intimate imagery, if applicable.

Include the direct URL and identify the specific information disclosed. If the platform has a separate privacy, impersonation, or legal-removal form, use it in addition to the ordinary report.

Ask trusted people who actually received or saw the material to preserve their own copies and submit truthful reports. Do not organize false reports or ask anyone to make claims they cannot personally verify.

Removal limits continuing harm, but it does not determine legal liability. Preserve evidence before submitting the report.

Step 2: Send a written demand to the lender and collector

Write to the company using contact details in the loan documents, app, privacy notice, SEC records, or official website. Address the message to customer service, complaints handling, and the data protection officer if one is identified.

Your demand should:

Identify the account without unnecessarily repeating sensitive data;
Provide the URL, account name, date, and screenshots;
State which information is false, private, excessive, or unrelated to legitimate collection;
Demand immediate removal and an end to further publication or third-party contact;
Ask the company to identify the collector and confirm whether the collector was authorized;
Request preservation of relevant account, access, call, message, and posting records;
Exercise applicable data-subject rights, including access to the source and recipients of your data;
Ask for a complete statement of account if the balance is disputed; and
Set a reasonable, short response period appropriate to the ongoing harm.

Keep the wording factual. Do not threaten violence, post the collector’s personal information, or make accusations you cannot support.

Written prior contact is particularly useful for an NPC complaint. The NPC’s current complaint form asks whether the complainant contacted the respondent in writing and, if not, why this was not done. If contacting the respondent could expose you to immediate danger, explain that circumstance rather than placing yourself at risk.

Step 3: File with the SEC when it regulates the lender

Lending and financing companies are generally regulated by the Securities and Exchange Commission. Submit a ticket through the SEC iMessage system and choose the service concerning lending or financing companies or public assistance, as the portal directs.

Provide:

Your name and reliable contact details;
The lender’s corporate and app names;
The collector’s name, account, number, and agency, if known;
Your loan or account reference;
A concise chronology;
Copies of the malicious posts and collection messages;
Proof of communications with the company;
The loan agreement, disclosure statement, and payment records relevant to the complaint; and
The exact relief requested, such as investigation, cessation of unfair collection, and correction of company records.

Registration as a corporation is not the same as authority to operate as a lending or financing company. Ask the SEC to verify the responsible corporate entity and its authority if the app uses several names or does not clearly disclose its operator.

Step 4: File a privacy complaint with the NPC

Use the current complaint materials on the NPC’s formal complaint page. The NPC presently requires a properly completed and notarized Complaint-Affidavit or verified complaint, together with supporting evidence and any witness affidavits. Submission may be made through the channels authorized by the Commission, including the method stated on its current filing page.

The NPC’s current form specifically addresses unauthorized processing, processing for unauthorized purposes, malicious disclosure, and unauthorized disclosure. Explain:

What personal data was collected or disclosed;
How the lender obtained it;
What purpose was originally stated;
How the online post exceeded or differed from that purpose;
Who received or could access the information;
What harm resulted;
What written complaint you sent to the respondent and its response; and
What order or relief you seek.

Use the newest form and check the current fee schedule and filing instructions immediately before submission. An incomplete, unsigned, unnotarized, or unsupported complaint may be rejected or dismissed.

A borrower may complain even when the lender lacks SEC authority. NPC Circular No. 2020-01 applies to persons acting as lenders or financing companies whether or not they obtained the required SEC authority. People whose contact details were harvested—even if they were not the borrower—may also have their own privacy rights and claims.

Step 5: Use the BSP route only for a BSP-supervised institution

If the responsible entity is a bank, digital bank, e-wallet provider, or another BSP-supervised financial institution, first use that institution’s Financial Consumer Protection Assistance Mechanism.

If its response is unsatisfactory, escalate through the BSP Consumer Assistance Mechanism, normally through the BSP Online Buddy. The BSP also publishes a Complaint, Inquiry and Reply form and an email alternative for consumers unable to use the chatbot.

The BSP route does not replace an NPC complaint about misuse of personal data or a criminal complaint about threats or online defamation. It also is not ordinarily the regulator for a stand-alone SEC-authorized lending company merely because payments passed through a bank or e-wallet.

Step 6: Report suspected crimes promptly

For threats, extortion, impersonation, unauthorized access, or potentially criminal online publication, bring the preserved evidence and identification documents to an appropriate law-enforcement office. Official starting points include:

The DOJ Office of Cybercrime incident-reporting page;
The NBI online complaint page; and
The NBI Cybercrime Division.

A report is not the same as a filed criminal case. Investigators or prosecutors may require a sworn complaint, witness affidavits, original devices, certified records, or additional evidence linking the account to a person. Do not delete the app, reset the phone, or discard the SIM until you have preserved relevant material and obtained appropriate advice.

If there is a credible threat of immediate violence, stalking, or an attempt to confront you at home or work, prioritize safety and contact local police or emergency services immediately.

If the post is true, can it still be reported?

Yes. Truth does not automatically authorize a lender to expose personal information publicly or use humiliation as a collection method. Privacy and unfair-collection rules may apply even when a debt exists.

For defamation, however, truth, purpose, privilege, and malice can materially affect the analysis. Do not describe every true but invasive post as cyberlibel. Frame the SEC and NPC complaints around the actual collection conduct, disclosure, purpose, audience, and data used.

If you are not the borrower

A relative, friend, co-worker, or phone contact who receives collection messages is not automatically liable for another person’s debt. Liability ordinarily requires a legal basis such as being a borrower, co-maker, guarantor, or another party bound by the relevant agreement.

If your number was taken from a contact list or your name and photo were published:

Tell the collector in writing that you are not the borrower or liable party, if that is true.
Demand the source of your data and cessation of contact.
Preserve the messages and posts.
Ask the lender or collector to remove or block your data, subject to applicable law.
Consider your own NPC complaint if the data was accessed, used, or disclosed unlawfully.

Do not pay merely because a collector threatens to embarrass you. If you signed any loan, guarantee, or co-maker document, obtain a copy before making conclusions about liability.

Common mistakes to avoid

Deleting the post or conversation before preserving it;
Keeping only a cropped screenshot with no URL, account name, or date;
Publicly reposting the harmful material and spreading the disclosure further;
Posting the collector’s home address, family details, ID, or other personal data in retaliation;
Assuming an app-store listing proves SEC authority;
Sending payment to a personal account without verifying the lender and obtaining an official receipt;
Treating a platform report as a substitute for an SEC, NPC, BSP, or criminal complaint;
Filing against the app’s brand name without identifying the corporation or collector behind it;
Claiming the debt is paid without attaching receipts or a statement of account;
Ignoring a genuine court summons because the collector previously behaved unlawfully;
Signing a waiver, settlement, affidavit of desistance, or acknowledgment without understanding its effect; and
Waiting until accounts, SIMs, logs, and posts can no longer be traced.

When legal help is urgent

Consult a Philippine lawyer promptly if:

The post contains a credible threat of injury, sexual violence, kidnapping, or harm to family;
The collector demands payment in exchange for not publishing or for deleting damaging material;
Intimate images, identity documents, medical information, or a child’s data are involved;
The post has reached your employer, clients, school, or a large public audience;
An anonymous or fake account must be identified through legal process;
You received a subpoena, summons, demand from a prosecutor, or court papers;
The lender disputes that the collector acted for it;
You are considering civil damages or criminal charges;
A filing deadline may be approaching; or
You need to preserve platform or telecommunications records before routine deletion.

The Public Attorney’s Office may be an option for qualified indigent persons. A private lawyer can also assess the loan documents, identify the proper respondents, and determine whether administrative, civil, or criminal remedies can proceed together.

FAQ

Does filing a complaint erase the loan?

No. A valid debt generally remains payable unless it is paid, legally extinguished, restructured, settled, or successfully disputed. Unlawful collection conduct and the underlying obligation are separate issues.

May a lender contact my references?

A lender may use references selected by the borrower within lawful and proportionate limits. NPC rules prohibit harvesting the borrower’s contact or email lists or social-media contacts for debt collection or harassment. A reference does not become liable for the loan merely by being named as a reference.

May the collector contact my employer?

The legality depends on why and how the contact occurred, what was disclosed, and the governing collection rules. Publicly announcing the debt to co-workers or using the workplace to shame a borrower may support an unfair-collection or privacy complaint. Preserve the exact communication and identify every recipient.

Should I uninstall the lending app?

First preserve its name, developer, permissions, privacy notice, messages, account details, and relevant screen recordings. Then review and revoke unnecessary device permissions. Uninstalling the app does not erase data already copied to the lender’s systems or eliminate a valid loan.

Can I demand deletion of all my data?

Not always. Erasure or blocking may be available when processing is unlawful, excessive, outdated, or no longer necessary, but a lender may retain records required by law or reasonably needed to establish, exercise, or defend legal claims. Request deletion of unlawfully harvested contacts and publicly posted material while asking the company to identify the legal basis and retention period for anything it refuses to erase.

What if the lender deletes the post after I complain?

Keep the evidence and record when it was removed. Deletion may reduce continuing harm but does not necessarily resolve a completed disclosure or unfair collection practice.

Can I complain to several agencies?

Potentially, yes, because the SEC, NPC, BSP, platforms, police, NBI, prosecutors, and courts have different functions. Disclose related proceedings when a form or authority requires it, keep your factual account consistent, and avoid seeking incompatible relief without legal advice.

Should I stop paying because the collector harassed me?

Do not stop solely for that reason without reviewing the contract and obtaining advice. Continue to request an accurate statement of account and use a verified official payment channel. Challenge unlawful collection separately.

Official references

This article provides general legal information, not legal advice or a prediction of any complaint’s outcome. Jurisdiction, liability, evidence requirements, and remedies depend on the actual post, loan documents, parties, and surrounding facts. Official sources and procedures were checked as of July 27, 2026; confirm the latest forms and filing instructions with the relevant agency before submitting.