Quick answer

If a lending app, financing company, or collector posts your name, photo, loan details, contacts, or insulting accusations online to shame or pressure you into paying, preserve the post before asking for its removal. Then send a written takedown and privacy complaint to the lender, report the content to the platform, and file with the appropriate regulator:

Securities and Exchange Commission (SEC): for lending companies, financing companies, online lending platforms, and their collection agencies.
National Privacy Commission (NPC): when personal information, photos, contacts, or loan details were improperly collected, used, or disclosed.
Bangko Sentral ng Pilipinas (BSP): when the creditor is a BSP-supervised institution, such as a bank or another financial institution under BSP supervision.
PNP or NBI: when the conduct includes credible threats, impersonation, account hacking, extortion, or potentially criminal online defamation.

A real unpaid debt does not give a lender permission to publicly shame a borrower. At the same time, reporting abusive collection does not cancel a valid debt. Continue disputing or arranging payment through documented, official channels.

What online collection conduct may be prohibited?

SEC Memorandum Circular No. 18, Series of 2019 prohibits financing and lending companies—and collection agencies and other representatives acting for them—from engaging in unfair debt-collection practices.

Prohibited conduct includes:

Using or threatening violence or other criminal means against a person, reputation, or property.
Threatening action that cannot legally be taken.
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense.
Publishing the names or other personal information of borrowers who allegedly refuse to pay, except where disclosure is legally permitted.
Communicating loan information known, or which should be known, to be false, including failing to disclose that a debt is disputed where the rule applies.
Using false representations or deceptive means to collect a debt or obtain information about the borrower.
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., subject to the circular’s exceptions for accounts more than 15 days past due or for properly documented consent regarding convenient contact times.
Contacting people in the borrower’s phone contact list who were not named as guarantors or co-makers, even if the borrower supposedly consented to access the contact list.

The SEC rules generally protect loan information as confidential. Limited disclosure may still be lawful—for example, to persons authorized by the borrower, credit-information entities or bureaus where legally permitted, a court or government authority acting under law, or other persons to whom disclosure is authorized or required. Those exceptions do not create a general right to post the debt on Facebook, TikTok, group chats, or other public or semi-public channels.

The lender may remain responsible for a collector or outsourced collection agency acting on its behalf. A company should not dismiss a complaint merely by saying that the post came from an independent collector.

Privacy rules for lending apps

The Data Privacy Act of 2012 requires personal data to be processed lawfully, fairly, and only for legitimate and proportionate purposes. Borrowers also have rights to be informed, access their data, object in appropriate cases, seek correction, and pursue remedies for unlawful processing.

Under NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02:

A borrower’s photograph must not be used to harass or embarrass the borrower during collection.
Unnecessary or excessive app permissions are prohibited.
Unbridled processing of phone, email, or social-media contact lists is prohibited.
Contact-list processing that leads to harassment, reaches people other than borrower-provided guarantors, or results in unfair collection practices is prohibited.
An app may use only limited access necessary to let the borrower choose a character reference or guarantor.
The lender remains accountable for personal data under its control, including processing outsourced to a collector or service provider.

These rules apply to covered loan-processing activities even when the person or business acting as a lender lacks the required SEC authority. An unregistered or unauthorized operator does not escape data-privacy obligations.

Preserve evidence before the post disappears

Do this immediately, preferably using another device as well as your own:

Take full screenshots showing the post, account name, profile or page, date and time, comments, reactions, and surrounding context.
Copy the complete post, profile, and conversation URLs. A cropped screenshot alone may not establish where the content appeared.
Make a screen recording that opens the account profile and proceeds to the post.
Save the original messages, call logs, emails, notifications, and voice recordings lawfully in your possession.
Download copies of images or videos without editing their original files.
Record when you first discovered the post and who informed you about it.
Ask recipients to preserve what they received and provide their own screenshots or sworn statements if needed.
Save the loan agreement, disclosure statement, payment history, receipts, account ledger, demand letters, and any written dispute over the amount.
Preserve proof connecting the poster to the lender: names used by the collector, phone numbers, email addresses, payment instructions, employee identification, and messages referring to the account.
Keep copies of every complaint, acknowledgment, ticket number, and response.

Do not publicly repost the material more widely just to document it. That can increase the exposure of your own information and may affect other people’s privacy.

Send a written demand to the lender

Write to the lender’s official customer-service channel and data protection officer, if identified in its privacy notice. Copy the collection agency if its identity is known.

Your notice should state:

Your name and account reference, sharing only what is necessary.
The URL, account name, date, and description of each post.
Which information was disclosed, such as your photograph, loan balance, phone number, workplace, ID, or contact-list information.
Why you believe the post is false, excessive, threatening, defamatory, or an unauthorized disclosure.
Whether you dispute the debt or amount.
The harm or immediate risk caused by the post.
Your requested action: preserve relevant records, remove the post, stop further disclosures, identify the responsible collector and recipient list, correct inaccurate data, restrict unnecessary processing, and confirm the action in writing.

For an NPC complaint, this written notice is normally important because the complainant must first inform the personal information controller, processor, or concerned entity and give it an opportunity to act. Under the amended NPC Rules of Procedure, the usual requirement is satisfied when the entity fails to take timely or appropriate action or does not respond within 15 calendar days from receiving the written notice.

The NPC may waive exhaustion for good cause or a serious violation, including circumstances involving grave and irreparable harm, lack of an adequate remedy, or patently illegal conduct. Do not wait if there is an immediate safety risk.

Report the post to the platform

Use the platform’s reporting function after preserving the evidence. Select the most accurate category available, such as:

Harassment or bullying
Privacy violation or disclosure of personal information
Threats or violence
Impersonation
Scam or deceptive conduct
Non-consensual intimate imagery, if applicable

Request review of both the individual post and the account. Keep the platform’s confirmation, case number, and decision. Platform removal can reduce harm but does not replace a regulatory or criminal complaint.

If an intimate image, a child’s information, or a home address creating an immediate threat is involved, state that clearly and use any emergency reporting option offered by the platform.

File a complaint with the SEC

For a lending company, financing company, online lending platform, or collection agency acting for one, file through the SEC’s iMessage portal and select the category for complaints involving financing or lending companies. The SEC Financial and Lending Company Division may also be reached at flcd_complaints@sec.gov.ph or (02) 8818-5990, as listed in current official government consumer-assistance guidance.

Include:

The lender’s corporate and app names.
Its SEC registration and Certificate of Authority numbers, if shown.
The collector’s name and contact information.
A clear chronological account.
Screenshots, URLs, messages, call logs, loan documents, payment records, and prior complaint.
An explanation of any false statement or disputed balance.
The relief requested and any continuing risk.

The app’s brand may differ from the corporate entity that operates it. Check the loan contract, disclosure statement, privacy notice, app-store listing, payment recipient, and SEC details instead of naming only the app.

If the company appears unauthorized, say so and provide the facts supporting that concern. Do not assume that an SEC company registration alone authorizes lending; lending and financing companies require the appropriate authority for that regulated activity.

File a privacy complaint with the NPC

Use the NPC’s current formal-complaint instructions and Complaint-Assisted Form. The complaint must generally be written, signed, verified, and properly notarized. It should include supporting evidence, prior correspondence with the respondent, the respondent’s action or failure to act, the relief requested, and the required certification against forum shopping.

The NPC currently accepts complaints personally, by registered mail, by courier, or through authorized electronic submission. Its official site instructs complainants submitting electronically to send the completed form and attachments to complaints@privacy.gov.ph.

Attach proof that:

You sent the lender or concerned entity a written privacy complaint.
The entity received it.
Fifteen calendar days passed without a response, or its response was not timely or appropriate.

If you cannot safely wait, explain and document the grounds for requesting a waiver. Filing fees may apply under NPC rules, subject to stated exemptions or a waiver for good cause.

A platform report, SEC complaint, or police blotter does not automatically satisfy the NPC’s formal filing requirements. Follow the NPC form and current instructions carefully.

If the creditor is supervised by the BSP

First complain through the financial institution’s own consumer-assistance mechanism and retain its final response or proof that it did not resolve the matter.

If the institution is BSP-supervised, escalate through the BSP Consumer Assistance Mechanism. The BSP accepts concerns through its online assistance channels or the official Complaints, Inquiries and Requests form sent to consumeraffairs@bsp.gov.ph.

Ordinary lending and financing companies and their online lending platforms are generally regulated by the SEC, not the BSP. Identify the actual creditor before choosing the regulator. More than one complaint may be appropriate when the facts involve both unfair collection and unlawful personal-data processing.

When to involve the PNP, NBI, or a prosecutor

Seek law-enforcement assistance promptly when the collector:

Threatens physical harm, kidnapping, sexual violence, property damage, or harm to family members.
Demands money through threats to expose private information.
Hacks or takes over an account.
Creates a fake account in your name.
Publishes fabricated documents or altered images.
Repeatedly reveals your location or other information creating a safety risk.
Posts potentially defamatory accusations beyond a legitimate and lawful collection communication.

The Cybercrime Prevention Act covers libel committed through a computer system. Whether a particular post is criminal cyber libel depends on all its elements, defenses, the identity of the author, publication, wording, context, and applicable deadlines. A post is not automatically criminal merely because it is harsh, embarrassing, or called “malicious.”

For investigative assistance, you may approach the nearest PNP station or cybercrime office, or the NBI Cybercrime Division. The NBI also provides an online complaint page. Bring government identification and both electronic and printed copies of the evidence when possible.

If anyone is in immediate danger, call 911 and go to a safe place. Do not arrange an in-person meeting with a threatening collector merely to gather more evidence.

Keep the debt issue separate

An abusive post does not by itself prove that the loan is invalid, and deleting the post does not settle the account. Likewise, owing money does not waive your privacy or permit harassment.

For the account itself:

Ask for a written statement of account showing principal, interest, penalties, fees, payments, and the amount claimed.
Compare it with the signed loan agreement and disclosure statement.
Dispute errors in writing and identify the specific entries contested.
Pay only through a verified, authorized channel and obtain a receipt.
Do not send payment to a collector’s personal account without confirming authority.
If negotiating, require the settlement terms and effect of payment to be written before paying.
Do not promise an amount or date you cannot meet simply to stop the calls.

A regulator may address collection conduct without deciding every contractual issue. Questions about the validity of the debt, excessive or unauthorized charges, damages, or court remedies may require separate legal advice or proceedings.

Common mistakes to avoid

Deleting messages, uninstalling the app, or blocking every account before preserving evidence.
Submitting screenshots that omit the URL, date, account identity, or surrounding conversation.
Complaining only to the app’s social-media page instead of the corporate entity and its privacy or customer-assistance channel.
Naming the wrong company because the app, collector, and creditor use different names.
Waiting indefinitely for a promised takedown while harmful posts continue.
Filing an incomplete NPC complaint without proof of prior written notice, notarization, supporting evidence, or certification against forum shopping.
Assuming consent to app permissions authorizes public shaming or unlimited contact-list use.
Posting the collector’s private information as retaliation.
Threatening the collector, fabricating evidence, or making allegations that cannot be supported.
Ignoring court papers or a formal demand because a regulatory complaint has been filed.
Believing that reporting harassment automatically erases the loan.

When legal help is urgent

Consult a Philippine lawyer or the Public Attorney’s Office promptly if:

A threat appears credible or identifies your home, workplace, children, or daily movements.
Intimate images, identity documents, medical details, or a child’s data were disclosed.
The post is spreading rapidly or causing loss of employment, business, housing, or personal safety.
You are considering a cyber-libel, threats, extortion, injunction, or damages case.
You received a subpoena, prosecutor’s notice, summons, collection complaint, or other court document.
Several agencies or lawsuits may involve the same facts, because sworn filings and certifications against forum shopping must be accurate.
A legal deadline may be running. Do not rely on a platform takedown request or agency complaint to suspend a criminal, civil, or procedural deadline.

Frequently asked questions

Can a lender post that I am a “scammer” because I missed a payment?

A missed payment does not automatically establish fraud. Publicly accusing an identifiable borrower of a crime may raise unfair-collection, privacy, and potentially defamation issues. The exact wording, truth or falsity, context, audience, evidence, and identity of the author matter.

Is it legal to message my relatives or officemates?

A collector may communicate with a properly identified guarantor or co-maker within lawful limits. Contacting unrelated people from your phone list is prohibited under the SEC unfair-collection rule. Using contacts to disclose the debt, shame you, or pressure them to pay may also violate privacy rules.

A character reference is not automatically a guarantor or co-maker and does not become liable for the debt merely by being listed as a reference.

What if I allowed the app to access my contacts and photos?

Consent is not a blanket license to process information for any purpose. Collection and use must still be lawful, transparent, necessary, and proportionate. The amended NPC rules prohibit unbridled contact-list processing and the use of photos to harass or embarrass borrowers.

Should I report first or ask for removal first?

Preserve evidence first. You may then request immediate removal from the platform and lender. For a formal NPC complaint, normally send written notice to the concerned entity and document its receipt; allow the required 15-calendar-day response period unless facts justify asking the NPC to waive exhaustion.

Can I complain if the post has already been deleted?

Yes. Deletion does not necessarily resolve an earlier disclosure. File using preserved screenshots, URLs, witness evidence, platform notices, and messages connecting the poster to the lender. Explain when the post appeared and when it was removed.

Can someone who was contacted about another person’s loan complain?

Possibly. A non-borrower whose personal data was improperly obtained or used may have their own privacy complaint. They should preserve the message, sender details, and evidence showing that they were not a guarantor or co-maker.

Can I file with both the SEC and NPC?

Yes, when the facts reasonably involve both unfair collection and unlawful processing of personal data. Each agency has different jurisdiction and filing requirements. Disclose other related proceedings accurately whenever a complaint form or certification requires it.

Will filing a complaint stop collection?

Not automatically. The creditor may continue lawful collection and may pursue remedies allowed by the contract and law. The complaint concerns unlawful methods. Keep responding to legitimate notices, document any dispute, and do not ignore formal legal process.

Official sources

This article provides general legal information, not legal advice, and cannot determine the outcome of a particular complaint. Rules and agency channels were checked against official sources current as of August 1, 2026. Obtain advice from a Philippine lawyer about your documents, deadlines, and specific facts.