Quick answer

If a lending app or collector posts your name, photo, loan details, contacts, or insulting accusations online to shame or pressure you into paying, preserve the evidence first, report the post to the platform, demand its removal in writing, and complain to the appropriate government agency:

Securities and Exchange Commission (SEC): for unfair debt-collection practices by lending or financing companies and their collection agents.
National Privacy Commission (NPC): when personal data was accessed, used, or disclosed improperly.
NBI Cybercrime Division, DOJ Office of Cybercrime, or the police: when the post includes threats, identity misuse, possible cyberlibel, hacking, extortion, or immediate danger.

A genuine unpaid loan does not give a lender or collector unlimited authority to expose or humiliate a borrower. At the same time, reporting abusive conduct does not erase a valid debt. Dispute the collection method separately from the amount legally due.

What conduct may be reportable?

Not every reminder or demand for payment is unlawful. A creditor may use reasonable and legally permissible collection measures. The problem arises when collection becomes threatening, deceptive, humiliating, invasive, or directed at people who are not responsible for the debt.

Under SEC Memorandum Circular No. 18, Series of 2019, lending companies, financing companies, and their third-party collectors must act in good faith and refrain from unfair practices. Prohibited conduct includes:

threatening violence or other criminal means against a person, reputation, or property;
threatening action that cannot legally be taken;
using insults, obscenities, or other abusive language;
publicly disclosing borrowers’ names and personal information;
communicating loan information to persons other than those legally permitted to receive it;
making false representations or using deceptive collection methods;
contacting people in the borrower’s phone contacts who were not named as guarantors or co-makers; and
contacting a borrower at an unreasonable time—generally before 6:00 a.m. or after 10:00 p.m.—subject to the circular’s stated exceptions.

The SEC lists the circular among its official financing and lending company issuances.

The NPC’s rules for loan-related transactions are also important. An online lender may not use a borrower’s photograph to harass or embarrass the borrower. Unrestrained or excessive processing of a phone, email, or social-media contact list is prohibited, including processing that leads to harassment, collection from people other than guarantors, or other unfair collection practices. A character reference is not automatically a guarantor, and contacting character references for debt collection is not permitted merely because their names were supplied during the application. See NPC Circular No. 2022-02.

Examples that warrant prompt documentation and possible reporting include:

a Facebook post calling you a scammer or criminal because of an overdue loan;
a public post showing your government ID, address, workplace, phone number, account balance, or private messages;
an edited “wanted,” “fraud,” or funeral-style image using your photograph;
posts or messages sent to your employer, relatives, friends, or social-media contacts to embarrass you;
threats to publish intimate images or other private material unless you pay;
impersonation through an account created in your name; or
posts threatening physical harm, arrest without lawful process, or seizure of property without a court order.

Whether a particular statement amounts to cyberlibel, a privacy offense, a threat, or another violation depends on its exact words, context, audience, source, and supporting evidence. A post is not automatically cyberlibel simply because it is offensive or untrue.

Preserve the evidence before asking for removal

A collector may delete a post or account after receiving a complaint. Capture the evidence before blocking the sender or requesting takedown.

Keep the following:

Full-page screenshots. Include the account name, profile or page, complete text, photographs, comments, reactions, date, and time.
The exact URL. Copy the link to the post, comment, account, group, or video. A screenshot without a URL may be harder to trace.
A screen recording. Record yourself opening the app or browser, showing the profile, navigating to the post, and displaying its details.
Original files. Preserve downloaded images, voice messages, videos, emails, text messages, call logs, and notification emails. Do not edit or crop the only copy.
Account identifiers. Note usernames, page IDs, phone numbers, email addresses, payment accounts, app name, developer name, and app-store listing.
Loan documents. Save the agreement, disclosure statement, repayment schedule, receipts, account history, collection notices, and the lender’s privacy notice.
Proof of disclosure to others. Ask recipients to preserve what they received and, if willing, provide a signed statement describing when and how they received it.
Proof of harm. Keep employer notices, medical records, counseling receipts, lost-business records, or messages showing harassment or reputational harm.
A chronology. List each event by date, time, platform, sender, recipient, and action taken.

Back up the evidence in at least two secure locations. Do not repost the abusive material publicly “for awareness,” because doing so may spread your own personal information and complicate the dispute.

Step 1: Secure your accounts and limit further access

If the app still has access to your phone:

review and revoke unnecessary permissions for contacts, photos, camera, microphone, location, SMS, and storage;
change passwords for your email, social-media, and financial accounts;
enable multi-factor authentication;
check for unfamiliar sessions, recovery details, posts, or messages;
ask contacts not to engage with the collector and to preserve any communications; and
contact your bank or e-wallet immediately if account credentials or unauthorized transactions may be involved.

Preserve the app’s name, version, permissions, and privacy notice before uninstalling it. Uninstalling the app may stop some access, but it does not necessarily delete data already collected.

Step 2: Report the content to the platform

Use the platform’s reporting function for the most accurate category available, such as:

harassment or bullying;
threats or violence;
privacy violation or disclosure of personal information;
impersonation;
non-consensual intimate imagery; or
fraud or scam.

Record the report or reference number. If the first report is rejected, use the platform’s appeal or privacy-reporting process and identify the exact information exposed. Platform removal is useful for limiting harm, but it is separate from an SEC, NPC, or criminal complaint.

Step 3: Send a written demand to the lender and collector

Send the complaint to the lender’s official customer-service channel and data protection officer, if identified in its privacy notice. Copy the collection agency when known.

State:

your name and loan or account reference, while avoiding unnecessary sensitive data;
the URL and date of each post;
what personal information was exposed;
why the post is inaccurate, excessive, threatening, or unrelated to lawful collection;
the collector’s name, number, or account;
the action requested, such as removal, cessation of third-party contact, preservation of records, correction, and written confirmation; and
a request for the legal basis, source, purpose, recipients, and retention period for the personal data used.

Do not admit an amount you genuinely dispute. You may state that the complaint concerns the collection conduct and is without prejudice to your rights regarding the loan balance.

For an NPC complaint, written notice to the lender or other entity is normally important. Under the current amended NPC Rules, the complainant must generally show that the entity was informed in writing and either failed to take timely and appropriate action or did not respond within 15 calendar days. The NPC may waive this requirement for good cause or serious violations, including circumstances involving grave and irreparable harm, no adequate remedy, or patently illegal action. See the 2021 NPC Rules of Procedure, as amended.

Step 4: File an SEC complaint

Use the SEC’s official iMessage ticketing system and select the service concerning complaints against lending or financing companies. The system generates a ticket that can be tracked.

Include:

the lending app’s name and app-store link;
the legal company name, if known;
the collection agency and individual collector, if known;
your loan or account reference;
a short chronological statement;
copies of the posts and collection messages;
URLs, phone numbers, email addresses, and account names;
proof that the material was sent or shown to third parties;
your written demand and any response; and
the specific remedy requested.

Check the entity’s identity and authority through the SEC’s Check with SEC service. An app’s brand name may differ from the corporation operating it. If you cannot identify the company, provide every identifier available rather than guessing.

SEC regulation generally covers lending and financing companies and their third-party service providers. Banks and other financial institutions under Bangko Sentral ng Pilipinas supervision may require a complaint through the institution’s consumer-assistance mechanism and the BSP instead. If ownership or jurisdiction is unclear, say so in the complaint and attach the documents that show who issued or collected the loan.

Step 5: File an NPC complaint for misuse of personal data

A privacy complaint is especially relevant when the lender or collector:

posts your name, photograph, ID, address, loan balance, contacts, or messages;
harvests or uses your contact list for harassment;
contacts non-guarantors about your debt;
creates humiliating images from data collected during the loan application;
refuses to explain, correct, erase, or stop improper processing; or
discloses information beyond what is necessary for a legitimate collection purpose.

Download the NPC’s current Complaints-Assisted Form, attach the supporting documents, and follow the filing instructions on the NPC complaint page. The NPC currently directs complainants to submit the completed form and supporting documents to complaints@privacy.gov.ph.

A formal complaint must comply with the NPC Rules. Among other things, it must be written, signed, and verified; identify the complainant and respondent as far as possible; narrate the material facts; state the relief requested; include relevant correspondence and evidence; and contain a sworn certification against forum shopping. Filing fees ordinarily apply unless an exemption or waiver is available. The NPC’s current rules allow filing at any NPC office and recognize personal filing, registered mail, courier, and electronic transmission when authorized.

Use the latest form and instructions displayed by the NPC when filing. Do not rely on an old downloaded form or assume that an informal email alone satisfies every requirement.

The governing statute is the Data Privacy Act of 2012, Republic Act No. 10173. It protects personal information but does not make all debt-related processing unlawful. A lender may process some information when supported by a lawful basis and when the processing is transparent, proportionate, secure, and limited to a legitimate purpose. Liability depends on what information was processed, why, how, by whom, and to whom it was disclosed.

Step 6: Seek law-enforcement help when a crime may be involved

Contact law enforcement promptly if there is:

a credible threat of physical harm;
extortion or a demand tied to threatened exposure;
account hacking or identity theft;
impersonation;
publication of intimate images;
persistent stalking;
possible cyberlibel; or
evidence that the operator is fictitious or engaged in a broader fraudulent scheme.

You may use the NBI’s online complaint page or approach the NBI Cybercrime Division. The NBI’s official division directory lists ccd@nbi.gov.ph. The DOJ Office of Cybercrime also receives cybercrime reports and referrals. You may alternatively approach the nearest police station or appropriate police cybercrime unit.

Online libel is addressed by Section 4(c)(4) of the Cybercrime Prevention Act of 2012, in relation to the Revised Penal Code provisions on libel. The Supreme Court has explained that criminal liability for online libel generally concerns the author of the allegedly libelous material, not everyone who merely reacts to it. Whether the legal elements are present requires review of the actual publication and available defenses.

Do not delay seeking individual legal advice. Criminal and civil claims have prescriptive periods, and identifying an anonymous poster or preserving platform records may require formal legal process.

If violence appears imminent, go to a safe place and call 911.

What your complaint should ask for

Depending on the forum and facts, request specific relief rather than simply stating that you were harassed. Possible requests include:

immediate removal of the post;
an order to stop contacting non-guarantors;
cessation of improper use or disclosure of personal data;
correction of inaccurate information;
preservation of account, access, communication, and collection records;
identification of the company and collector responsible;
investigation and appropriate administrative action;
confirmation of the recipients of disclosed data; and
other relief available under the agency’s authority.

An administrative agency does not automatically award every form of compensation or decide every criminal issue. A lawyer can assess whether a separate civil action, criminal complaint, or application for urgent court relief is appropriate.

Common mistakes to avoid

Deleting everything immediately. Preserve evidence before blocking, uninstalling, or requesting removal.
Saving only cropped screenshots. Capture the URL, account, date, surrounding context, and comments.
Posting the lender’s threats publicly. This can expose more personal data and provoke further circulation.
Threatening or insulting the collector back. Keep communications factual and usable as evidence.
Naming the wrong company. Verify the corporate name and distinguish the app, lender, collection agency, and individual collector.
Assuming a character reference owes the debt. A character reference is not a guarantor merely because the borrower supplied a name or number.
Assuming consent permits public shaming. Consent language does not automatically validate excessive, unfair, or unlawful processing.
Stopping all payment without advice. Abusive collection conduct does not by itself cancel a valid loan.
Paying an unfamiliar personal account. Verify the lender’s official payment channel and demand a receipt.
Waiting for the post to go viral. Early preservation, takedown requests, and reporting may reduce harm.
Using an outdated NPC form. Obtain the latest form and filing instructions from the agency’s official website.

When legal help is urgent

Consult a Philippine lawyer, the Public Attorney’s Office if you qualify, or another recognized legal-aid provider promptly when:

you or your family has been threatened with violence;
intimate images, government IDs, financial credentials, or a home address were exposed;
the post has reached your employer, clients, school, or a large public audience;
you received a subpoena, prosecutor’s notice, court document, or agency order;
the collector claims there is already a criminal case, arrest warrant, or court order;
substantial money or identity theft is involved;
you need to identify an anonymous account or secure electronic records;
you are considering a cyberlibel, damages, or injunction case; or
a deadline may be approaching.

Bring an organized evidence folder and chronology. A lawyer’s assessment will be more reliable when based on the original post, loan documents, privacy notice, messages, and proof of who received the disclosure.

Frequently asked questions

Can a lender post my name and photo because I have not paid?

A lender may pursue lawful collection, but public exposure intended to shame or harass a borrower may violate SEC collection rules and data-privacy requirements. The result depends on the content, purpose, audience, information disclosed, and lawful basis claimed.

Can the collector contact everyone in my phone?

No. NPC rules prohibit unrestrained processing of contact lists and prohibit contacting people in the borrower’s contact list for debt collection unless they were named as guarantors. A character reference is not automatically a guarantor.

What if I gave the app permission to access my contacts and photos?

Device permission is not unlimited authority to use data for any purpose. The processing must still have a lawful basis and comply with transparency, proportionality, purpose limitation, security, and applicable lending rules. NPC rules expressly prohibit using a borrower’s photograph to harass or embarrass the borrower.

Should I complain to the SEC or NPC?

Often both. The SEC addresses unfair practices of regulated lending and financing companies and their collectors. The NPC addresses improper processing or disclosure of personal data. A criminal complaint may also be appropriate when threats, hacking, extortion, impersonation, or possible cyberlibel is involved.

Must I contact the lender before going to the NPC?

Generally, yes. Give written notice and preserve proof of receipt. The current NPC Rules generally require proof that the entity failed to take timely and appropriate action or did not respond within 15 calendar days. The NPC may waive exhaustion in serious or exceptional cases, but waiver should not be assumed.

Does filing a complaint stop collection or cancel the loan?

No. It challenges potentially unlawful conduct; it does not automatically extinguish a valid obligation. Continue requesting an accurate statement of account and use only verified payment channels.

What if the lending app is unregistered or uses a different company name?

Record the app-store developer, website, privacy-policy entity, payment recipient, phone numbers, and all corporate names shown in the documents. Check the SEC database and report the uncertainty. Operating a lending business without the required SEC authority is a separate regulatory concern.

Can I demand that the platform disclose the anonymous poster’s identity?

You may report the account and ask the platform to preserve records, but platforms ordinarily do not release subscriber information merely upon a private request. Disclosure may require lawful process from investigators, prosecutors, or a court.

Is a false “scammer” post automatically cyberlibel?

No. Cyberlibel has specific legal elements, and context and defenses matter. Preserve the exact post and consult counsel or law enforcement rather than relying on the label alone.

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Procedures and legal conclusions may depend on the lender’s regulator, the documents, the exact publication, and subsequent government issuances. Official sources were checked as of 2 August 2026.