Quick answer

A lending app or collector may demand payment through lawful, reasonable methods, but it may not use social media to shame, threaten, deceive, or publicly disclose a borrower’s name, photo, loan information, contacts, or alleged nonpayment as a collection tactic. This can remain unlawful even when a debt is real.

Preserve the post before it disappears, report the post and account to the platform, send a written takedown and privacy demand to the lender, and file with the proper regulator:

For a lending or financing company: report through the SEC iMessage portal.
For misuse of personal data: follow the National Privacy Commission complaint process.
For threats, extortion, fraud, impersonation, doxxing, or potentially criminal posts: contact the DICT Cyber Hotline, NBI Cybercrime Division, or PNP Anti-Cybercrime Group.
If the app is operated by a bank or another BSP-supervised institution, complain first to its consumer-assistance channel, then escalate through the BSP Consumer Assistance Mechanism.

These reports address the abusive conduct. They do not automatically erase a valid loan or settle a disputed balance.

What collectors are not allowed to do

SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair debt-collection practices by financing and lending companies. Prohibited conduct includes:

Using or threatening violence or other criminal means to harm a person, reputation, or property;
Threatening action that cannot legally be taken;
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense;
Disclosing or publishing borrowers’ names or other personal information because they allegedly refuse to pay;
Communicating false loan information, or failing to disclose that a debt is disputed when communicating about it;
Using false representations or deceptive collection methods;
Making contact before 6:00 a.m. or after 10:00 p.m., subject to the circular’s limited exceptions; and
Contacting people in the borrower’s contact list who were not named as guarantors or co-makers.

The SEC has reproduced these prohibitions in an official cease-and-desist order involving online lenders. Republic Act No. 11765 also requires fair and respectful treatment and prohibits abusive collection or debt-recovery practices by financial service providers. It further requires providers to protect client data and maintain a free consumer-assistance mechanism. See the Financial Products and Services Consumer Protection Act.

Examples that should be documented and reported include:

A “wanted,” “scammer,” or “estafa” graphic showing the borrower’s face;
A public post announcing a loan, balance, due date, alleged refusal to pay, or ID details;
Tagging or messaging an employer, coworkers, relatives, neighbors, or social-media contacts to pressure the borrower;
Posting edited photos, funeral images, sexualized material, threats, or insults;
Creating a fake account in the borrower’s name;
Publishing phone numbers, addresses, identification documents, or other information that creates a safety risk;
Falsely claiming that an arrest warrant, criminal case, barangay action, or court order already exists; or
Threatening to publish personal information unless money is sent to an unofficial account.

A private, lawful demand addressed to the borrower is different from public shaming. Communications with a genuine guarantor or co-maker may also be treated differently, depending on the signed documents. A character reference is not automatically a guarantor. The March 2026 joint government advisory states that a guarantor must have separately consented to assume responsibility for the loan and that people in the borrower’s contact list who are not guarantors may not be contacted for collection. See the DICT–NPC–SEC Advisory on Online Lending Platforms.

Lawful disclosures required by a court, regulator, or applicable law are also different from posting the debt to embarrass someone. Whether a particular private disclosure was lawful depends on its purpose, recipient, necessity, and supporting documents.

Preserve the evidence before requesting removal

Do this immediately. A post may be edited, deleted, hidden, or moved to a private group after the collector learns of a complaint.

Copy the exact URL of every post, comment, image, video, profile, page, group, or account involved.
Take uncropped screenshots showing:
- The full post;
- Account or page name and username;
- Profile URL or account ID, if visible;
- Date and time;
- Caption, images, comments, reactions, and share count; and
- The browser address bar or platform context.
Make a screen recording showing how you opened the account and navigated to the post.
Save the original messages, emails, call logs, voicemails, notification emails, and downloadable attachments.
Ask people who received the post or collection message to preserve their copies. Record when and how they received it.
Save the loan agreement, disclosure statement, payment schedule, receipts, account ledger, dispute correspondence, app privacy notice, and screenshots of the permissions requested by the app.
Record the app’s name and developer, the lender’s legal corporate name, SEC registration and Certificate of Authority numbers, collection-agency name, collector’s number, and payment account used.
Keep platform report numbers, SEC or NPC ticket numbers, email delivery receipts, and every response.
Back up the originals in at least two secure locations. Do not edit or annotate the only copy.

Avoid reposting the material publicly “for awareness.” That can increase the harm, expose more personal data, and complicate later proceedings. Give copies only to the platform, the respondent, authorities, your lawyer, and other people who genuinely need them.

Report the post to the platform

After preserving the evidence, use the post’s menu to report both the content and, when appropriate, the account or page. Available categories differ by platform, but the closest grounds may include:

Harassment or bullying;
Threats or violence;
Sharing private or personal information;
Impersonation;
Fraud or scam;
Non-consensual intimate imagery; or
Hate, sexual exploitation, or child-safety violations, when applicable.

Include the exact URLs and explain that the content was posted to pressure payment of a loan and discloses personal or financial information. If the first report is rejected, use the platform’s appeal or privacy-report channel and retain the decision.

A platform report may produce the quickest takedown, but it does not replace an SEC, NPC, or law-enforcement complaint.

Send a written demand to the lender and collector

Send the notice to the lender’s consumer-assistance unit and data protection officer, and copy the collection agency if it is separately identifiable. Use an address published in the app, privacy notice, loan documents, or official website. Do not rely only on a phone call.

Your notice should:

Identify the post and attach its URL and a screenshot;
State the date you discovered it;
Identify the personal and loan information disclosed;
Demand immediate removal and an end to further posting or contact with non-guarantors;
Ask the company to preserve the account, audit logs, collector instructions, call recordings, and related records;
Request the identity of the collector or service provider responsible;
If information is false, identify the error and request correction;
If the debt is disputed, clearly state what is disputed and why;
Ask for the source of the data and the recipients to whom it was disclosed;
Request a written explanation of the action taken; and
State that the notice is being made without admitting any disputed amount or waiving any rights.

A concise notice can read:

I discovered on [date] that [account/page] published [URL] containing my [name/photo/loan details/other data] to collect an alleged debt. I demand immediate removal of the post, cessation of further disclosure or contact with non-guarantors, and preservation of all related records. Please identify the responsible collector, the source and recipients of my data, and the action taken. I dispute [describe any inaccurate information]. Please respond in writing.

Under the Data Privacy Act, a data subject may request access to personal data, its sources and recipients, correction of errors, and—upon the conditions stated in the law—blocking, removal, or destruction of unlawfully obtained or unauthorized data. These rights do not necessarily require deletion of legitimate records that must be retained for a valid loan, legal claim, or legal obligation. See Republic Act No. 10173, particularly Section 16.

File an SEC complaint

For a lending or financing company, go to SEC iMessage and select:

Financing and Lending Companies Department → Monitoring and Compliance Division → Complaints on Financing and Lending Companies

The SEC’s 2026 user guide identifies iMessage as its official centralized channel for complaints and tickets. The March 2026 joint advisory also lists the SEC hotline as 1-4732 (1-4SEC).

Submit:

Your completed complaint information and valid government ID as required by the portal;
The app and lender’s legal names;
The collector or collection agency’s details;
URLs, screenshots, recordings, witness information, and platform reports;
Loan agreement, disclosure statement, ledger, receipts, and payment or dispute records;
Your written takedown demand and any response;
A dated timeline; and
A clear request for investigation of unfair debt collection and any apparent unauthorized lending activity.

If the app does not disclose its corporate name, SEC number, or Certificate of Authority number, say so. SEC rules require lending and financing companies to disclose identifying registration information in their advertisements and online platforms.

Name each responsible company instead of reporting only the app’s brand. If several companies are involved, follow the SEC’s instructions for separate respondents. The SEC may investigate and impose regulatory sanctions, but its complaint page explains that it does not itself rewrite payment terms, declare a contract or interest provision void, or cancel and settle the loan. See the SEC lending and financing complaint guidance.

File a National Privacy Commission complaint

Use the NPC route when the post used or exposed personal data, such as a name, face, phone number, address, contacts, ID, loan information, or messages.

NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02, prohibits unnecessary, excessive, or disproportionate processing by online lenders. It specifically prohibits unbridled processing of contact lists and the use of a borrower’s photo to harass or embarrass the borrower in collecting a delinquent loan.

Before a formal NPC complaint will ordinarily be given due course, the complainant must show that:

The lender, collector, or other responsible entity was informed of the privacy violation in writing; and
It failed to take timely and appropriate action, or did not respond within 15 calendar days after receiving the written notice.

The NPC may waive these requirements for good cause or where the allegations involve a serious violation, grave and irreparable harm, no adequate remedy from the respondent, or patently illegal action. Do not assume a waiver will be granted; explain and prove why it is necessary.

Use the current complaint-affidavit available on the NPC filing page. A formal complaint must generally be properly completed, verified and notarized, supported by evidence and witness affidavits when available, and accompanied by the required identification, certification against forum shopping, and applicable filing fee unless an exemption or waiver applies. It may be filed through an authorized NPC channel, including the email specified on the filing page. Review the amended NPC Rules of Procedure before filing.

Report threats, fraud, extortion, or other possible crimes

Do not wait for SEC or NPC action if the posts include a credible threat, demand for payment under threat of harm, impersonation, hacking, sexual images, doxxing, or an immediate safety risk.

The March 2026 joint advisory lists these channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; (02) 8723-0401 local 7491

For an immediate emergency or credible danger, call the nationwide Unified 911 hotline.

An insulting or false post is not automatically cyber libel. Criminal liability depends on the exact words or images, identification of the person targeted, publication, malice, authorship, defenses, and other evidence. The Supreme Court has ruled that cyber libel is libel published through a computer system or information and communications technology. It also held that cyber libel prescribes in one year from discovery of the alleged defamatory post. See the Supreme Court’s April 8, 2026 ruling in Causing v. People, G.R. No. 258524.

Because that period is short and fact-sensitive, obtain legal advice promptly. Do not assume that a platform, SEC, or NPC report by itself preserves the deadline for a criminal or civil defamation case.

If the app is operated by a bank or BSP-supervised institution

Some digital-loan products are issued by banks or other institutions supervised by the Bangko Sentral ng Pilipinas rather than by an SEC-regulated lending company.

First report the matter to the institution’s Financial Consumer Protection Assistance Mechanism or customer-service channel. If its response is unsatisfactory, escalate through the BSP Online Buddy or another BSP consumer-assistance channel. Attach your complaint to the institution, its response, the malicious posts, and your supporting records.

An NPC complaint and a law-enforcement report may still be appropriate when the conduct also involves personal-data misuse or a possible crime.

Common mistakes to avoid

Paying an unknown personal account because of a threat. Verify the lender, collector, balance, and official payment channel first.
Deleting everything immediately. Preserve the evidence before blocking the account, deleting messages, or uninstalling the app.
Leaving unnecessary app permissions active. After recording the permissions and saving needed loan records, revoke unnecessary access to contacts, photos, camera, microphone, location, and storage. Deleting the app alone does not erase data already obtained.
Arguing publicly with the collector. A public reply can expose more information and spread the original post.
Filing only a vague screenshot. Include the URL, account identity, date, context, loan documents, and a chronological narrative.
Reporting only the app’s trade name. Identify the legal lender, collection agency, and individual account where possible.
Assuming harassment cancels the debt. The collection method and the loan obligation are separate legal issues.
Ignoring a disputed balance. State the dispute in writing, identify the correct amount if known, and preserve proof of payment.
Waiting for the post to go viral. Report and preserve it as soon as discovered.
Sending unredacted IDs through unofficial accounts. Use official portals and disclose only what the receiving authority requires.

When legal help is urgent

Consult a Philippine lawyer or the Public Attorney’s Office, if eligible, without delay when:

A threat identifies your home, workplace, family, or a planned act of violence;
The collector demands money to prevent publication or removal of a post;
Intimate images, sexualized edits, children’s information, or identity documents are involved;
The lender continues posting after written notice;
The account is anonymous or evidence may require formal preservation or disclosure orders;
You suffered job loss, physical danger, severe financial harm, or other measurable damage;
You want an injunction, damages, or a criminal complaint;
A prosecutor, court, SEC, NPC, NBI, or PNP deadline has been issued; or
The one-year cyber-libel period may be running.

Frequently asked questions

What if I really owe the loan?

A real debt does not authorize public shaming, threats, false statements, or indiscriminate disclosure of personal information. Continue addressing any legitimate obligation through documented, official channels while separately reporting abusive collection.

Can a collector message my family, employer, or contacts?

Not merely because their details appeared in your phone or because they were listed as character references. Collection contact with people who are not genuine guarantors or co-makers is prohibited. A guarantor must have actually consented to that legal role.

What if the post is true?

Truth may affect a defamation claim, but it does not automatically make debt-shaming or disclosure lawful. SEC debt-collection rules and the Data Privacy Act separately regulate why, how, and to whom loan information may be disclosed.

Should I uninstall the lending app?

First save your contract, ledger, payment records, privacy notice, and screenshots of its permissions. Then revoke unnecessary permissions. Uninstalling may reduce further device access, but it does not cancel the loan or delete information already copied by the operator.

Must I wait 15 days before reporting to the SEC?

No. The March 2026 government advisory directs the public to report abusive collection immediately to the SEC. The 15-calendar-day rule discussed above concerns the ordinary exhaustion requirement for a formal NPC privacy complaint, subject to the NPC’s power to waive it in serious cases.

Can the SEC order the post removed or cancel my loan?

The SEC may investigate regulatory violations and impose available sanctions. A platform or the person controlling the account may provide the fastest voluntary takedown. Court relief may be necessary in some cases. The SEC complaint process does not itself cancel or settle the loan or rewrite the contract.

Can I complain if I am only a contact, coworker, or relative?

Yes, if your own personal data was accessed, used, or disclosed, or if you received threats or harassment. Preserve what you received and explain that you did not consent to be a guarantor. The borrower may file a separate complaint concerning the collection conduct directed at the borrower.

What if the app appears unregistered?

Preserve the app-store listing, developer information, website, advertisements, payment instructions, and all corporate names used. Report it through SEC iMessage and expressly state that you could not verify its legal identity or authority. Do not treat apparent nonregistration as permission to ignore a genuine court document; have any formal demand or summons independently checked.

Official sources

This article provides general Philippine legal information, not legal advice or a prediction of any complaint’s outcome. The proper remedy depends on the post, loan documents, identities of the parties, evidence, regulator, and applicable deadlines. Sources and procedures were checked as of 2 August 2026.