Quick answer

A lending app or collector may demand payment through lawful, reasonable means, but it may not use public shaming, threats, insults, deceptive statements, or improper disclosure of your personal information. A real unpaid debt does not give anyone permission to post your name, photo, loan details, contacts, or humiliating accusations online.

Act in this order:

Preserve the post and related evidence before it disappears.
Report the specific post to the platform and request removal.
Send a written complaint and takedown demand to the lender, its data protection officer, and its consumer-assistance unit.
Report an SEC-regulated lending or financing company—and its collector—through the SEC iMessage portal.
File with the National Privacy Commission if personal data was misused.
Contact the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or a prosecutor promptly if the conduct may be criminal.

These remedies can be pursued separately or together. Reporting abusive collection does not erase a valid loan, but the lender must handle the debt lawfully.

What lenders and collectors are—and are not—allowed to do

The general rule is that a financing company, lending company, or its third-party collector may use reasonable and legally permissible collection methods, provided it acts in good faith and with reasonable conduct.

Under SEC Memorandum Circular No. 18, Series of 2019, prohibited practices include:

Using or threatening violence or other criminal means to harm a person, reputation, or property;
Threatening legal action that cannot lawfully be taken;
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense;
Disclosing or publishing the names and other personal information of borrowers who allegedly refuse to pay;
Communicating loan information known, or that should be known, to be false—including failing to say that a debt is disputed;
Using false representations or deceptive means to collect a debt or obtain information;
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., unless the account has been past due for more than 15 days or the borrower expressly agreed, through written, electronic, or recorded means, that those are the only reasonable times for contact; and
Contacting people in the borrower’s contact list who were not named as guarantors or co-makers, even if the borrower supposedly consented to contact-list access.

The exceptions allowing confidential disclosure to authorized collection agents, credit institutions, government agencies, courts, insurers, and service providers do not ordinarily authorize a collector to publish the debt to the general public. Whether a particular disclosure was legally justified depends on its purpose, audience, content, and lawful basis.

The Financial Products and Services Consumer Protection Act, or Republic Act No. 11765, separately prohibits abusive collection and debt-recovery practices. A regulated financial service provider may also be held solidarily liable with an accredited third-party service provider for acts or omissions involving debt collection. A lender therefore cannot automatically avoid responsibility by blaming an outside collection agency.

A neutral, private request to contact the lender is not automatically unlawful. The stronger warning signs are public identification, humiliation, disclosure of loan details, mass messaging of unrelated contacts, false accusations, threats, impersonation, or use of a borrower’s photo as a “shame poster.”

Personal-data rules for online lending

The Data Privacy Act of 2012 requires personal information to be processed lawfully, fairly, securely, and only to an extent proportionate to a legitimate purpose.

Under NPC Circular No. 2022-02, which amended the rules for loan-related data processing:

A borrower’s photo may not be used to harass or embarrass the borrower when collecting a delinquent loan.
Unconstrained, excessive, or disproportionate processing of contact lists is prohibited.
Contact-list processing that leads to harassment, unfair collection, or collection from people outside the guarantors provided by the borrower is prohibited.
An app may use only limited access needed for a borrower to select character references or guarantors of the borrower’s own choosing.
Lending companies remain accountable for personal data handled by outsourced collectors and service providers.

These privacy rules cover lending and financing companies, third-party processors, and persons acting as lenders even when they lack the required SEC authority.

Signing a loan agreement does not automatically make every disclosure lawful. Consent must still satisfy privacy-law requirements, and contractual terms cannot waive the statutory rights of financial consumers. A lender may retain information necessary to administer an existing debt, meet legal obligations, or establish legal claims, but that is different from publishing the information to shame the borrower.

Preserve evidence before requesting removal

Online evidence can be edited or deleted quickly. Before blocking an account, uninstalling the app, or reporting the post, preserve:

Full-page screenshots showing the post, caption, images, comments, date and time, account name, handle, and platform;
The post’s direct URL and the poster’s profile URL;
A screen recording that starts from the account profile and opens the post;
The original image, video, or audio file, if downloadable;
Messages, call logs, voice recordings lawfully received by you, emails, and collection notices;
The names and numbers used by individual collectors;
Screenshots of shares, tags, mentions, group names, audience settings, and reactions;
Screenshots from relatives, employers, co-workers, or friends who received the post or message;
The loan agreement, disclosure statement, payment history, official receipts, and any written dispute over the amount;
The app’s store listing, developer name, privacy notice, permission requests, and the legal name of the creditor shown in the loan documents;
Previous complaints sent to the lender and the lender’s replies;
Platform report numbers, email acknowledgments, and takedown decisions; and
A short chronology stating when you first discovered each post and what happened afterward.

Keep unedited originals. Do not crop, annotate, rename, or repeatedly forward the only copy. Store backups in at least two secure locations. When seeking help from friends, blur unnecessary account numbers and identification details, but retain an unredacted copy for the proper authority.

Ask witnesses to preserve what they personally saw and, if a formal case is contemplated, to prepare an affidavit based on their own knowledge.

Send a written demand to the lender and collector

Use the official email address or complaint channel shown in the contract, app, or company website. Send the complaint to the lender’s consumer-assistance unit and data protection officer, and copy the collection agency if its identity is known.

State:

Your name and enough information to identify the loan without exposing passwords, PINs, OTPs, or complete card credentials;
The app name, creditor’s legal name, collection-agency name, and collector’s identity or number;
The URL and date of every post;
Exactly what information was published and why you dispute or object to it;
Whether relatives, employers, clients, or unrelated contacts were approached;
Whether the post contains false statements, threats, sexual remarks, impersonation, or your location;
The harm and continuing risk caused by the publication; and
The action you want.

Request, as appropriate:

Immediate cessation of public or third-party collection activity;
Removal of the post and correction of false information;
Preservation of relevant account, access, collector-assignment, and communication records;
Identification of the collection agency and collector;
An explanation of the source, purpose, lawful basis, and recipients of the personal data;
Blocking or removal of unlawfully processed data;
Confirmation that unrelated contacts will no longer be contacted; and
A written response and complaint reference number.

Do not include abusive language or threaten to expose the collector in return. Keep the dispute factual. If you acknowledge a debt, distinguish the debt from the unlawful collection conduct and discuss repayment or restructuring only through verified official channels.

Report the post to the platform

After preserving evidence, report each post, image, comment, fake account, or private message through the platform’s reporting function. Select the category that best matches the facts, such as harassment, bullying, privacy violation, impersonation, threats, or non-consensual intimate imagery.

In the report:

Identify the precise content rather than reporting only the entire page;
Explain that the content was posted for debt collection;
Identify the exposed personal information;
State whether the account is impersonating you or the lender;
Request removal and preservation of relevant records; and
Save the report confirmation.

Ask friends and relatives not to argue with the collector, comment on the post, or reshare it “for awareness.” Reposting can widen the harm and complicate evidence.

A platform report may remove content quickly, but it is not a substitute for an SEC, NPC, or criminal complaint.

Choose the correct government agency

Situation	Where to report	Important first step
Lending or financing company, online lending platform, or its collection agency	SEC iMessage, directed to the Financing and Lending Company Division	Include the creditor’s legal name, app name, collector, chronology, URLs, screenshots, loan documents, and your prior complaint
Bank, digital bank, or other BSP-supervised institution	Institution’s own Financial Consumer Protection Assistance Mechanism, then BSP Consumer Assistance	Complain to the institution first; if unresolved, escalate through BSP Online Buddy or the official CIR form
Misuse or unlawful disclosure of personal data	National Privacy Commission	Normally give the lender or concerned entity written notice and an opportunity to act
Cooperative extending the loan	Cooperative’s complaint mechanism and the Cooperative Development Authority	Verify whether the actual creditor is the cooperative or a separate lending company
Threats, cyberlibel, hacking, identity theft, sexual-image abuse, or other possible crime	PNP Anti-Cybercrime Group, NBI Cybercrime Division, local police, or prosecutor	Preserve evidence and report promptly; do not wait for the regulator’s administrative case
Immediate danger	Unified 911 or the nearest police station	Prioritize physical safety and disclose the threatened location or person

Check the loan contract—not merely the app logo—to identify the actual creditor. You may also use Check with SEC to verify whether a company is registered and has relevant authority. Registration as a corporation alone is not necessarily authority to operate as a lending or financing company.

If the app appears unregistered, still report it. Lack of registration does not remove SEC, privacy, or criminal-law concerns.

Filing an SEC complaint

Open a ticket through the SEC iMessage portal and route it to the office handling financing and lending companies. Name both the lender and collection agency when known.

A useful submission includes:

App name and creditor’s complete corporate name;
SEC registration or certificate-of-authority details, if available;
Collector’s name, number, account, and agency;
Loan and payment documents;
A dated factual narrative;
Post URLs and preserved copies;
Proof that unrelated contacts received messages;
Your written complaint to the company and its response; and
The specific relief requested, such as investigation, cessation of unfair collection, and correction or removal of the publication.

Do not send passwords, OTPs, or unnecessary complete financial credentials. If the SEC needs an unredacted document, transmit it only through an official, verified channel.

Filing a National Privacy Commission complaint

The NPC ordinarily requires proof that you first informed the lender, collector, or other responsible entity in writing and gave it an opportunity to address the violation. If it takes no timely or appropriate action, or does not respond within 15 calendar days from receipt, you may proceed with the complaint.

The NPC may waive that requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm, the absence of a plain and adequate remedy, or patently illegal conduct. The governing requirements appear in the 2021 NPC Rules of Procedure, as amended in 2024.

Use the current Complaint-Affidavit template available from the NPC website. The previous template was replaced effective July 1, 2025. A formal complaint generally must be verified and accompanied by:

Evidence and witness affidavits, if any;
Correspondence showing exhaustion of remedies or facts supporting a waiver;
The respondent’s identity or information that can lead to its identification;
A clear account of the privacy violation;
The relief requested; and
A sworn certification against forum shopping.

The NPC’s published fee schedule lists a ₱500 filing fee, plus applicable charges. Government complainants and qualified indigent complainants may be exempt, while the rules also allow waiver for good cause in appropriate cases. Confirm current payment instructions before filing through the NPC’s official complaint page.

When the post may be a crime

Do not assume that every insulting or false post is automatically cyberlibel. Criminal liability depends on the exact words, who was identified, publication to another person, malice, available defenses, and other evidence.

Possible offenses may include:

Cyberlibel: Libel committed through a computer system under Section 4(c)(4) of the Cybercrime Prevention Act;
Computer-related identity theft: Misuse of another person’s identifying information, such as creating a fake account in the borrower’s name;
Illegal access: Entering an account or computer system without right;
Threats or other Revised Penal Code offenses: Depending on the words and surrounding acts;
Gender-based online sexual harassment: When the conduct falls within the gender-based and sexual-harassment acts covered by the Safe Spaces Act; or
Photo or video voyeurism: Where sexual images or recordings are covered by Republic Act No. 9995.

Describe the facts and provide the evidence rather than insisting on a single offense. Investigators and prosecutors must determine the proper legal classification.

The NBI accepts complaints through its online complaint portal and handles cybercrime matters through its Cybercrime Division. The BSP’s official complaint guide also identifies acg@pnp.gov.ph, ccd@nbi.gov.ph, and report@cicc.gov.ph as reporting contacts for possible criminal activity involving online financial services. Verify addresses on the agencies’ official websites before transmitting sensitive documents.

Do not miss the cyberlibel deadline

Report suspected cyberlibel urgently. In 2026, the Supreme Court, sitting en banc, affirmed that cyberlibel prescribes in one year from discovery of the defamatory publication. See Causing v. People, G.R. No. 258524, and the Supreme Court’s 2026 en banc ruling.

Do not assume that a platform report, SEC ticket, private demand letter, or NPC complaint satisfies the steps needed to preserve a criminal case. Whether a particular filing interrupts prescription—and how discovery or republication affects the calculation—requires fact-specific legal advice.

Other privacy, administrative, civil, and criminal claims have different prescriptive rules. Prompt filing is safest.

When help is urgent

Contact law enforcement immediately—and call Unified 911 if there is immediate danger—when a collector:

Threatens violence, abduction, arrest without legal basis, or damage to property;
Publishes or threatens to publish your home location or real-time whereabouts;
Stalks you or appears at your home or workplace aggressively;
Hacks or takes over an account;
Creates an account impersonating you;
Threatens to release intimate images;
Targets a child or exposes a child’s information;
Encourages others to attack you; or
Continues a rapidly spreading post that creates a credible safety risk.

A lawyer’s help is especially important if the one-year cyberlibel period is running, the poster is anonymous, a subpoena or preservation request may be needed, several agencies or lenders are involved, or you need an injunction or damages.

Common mistakes to avoid

Reporting the post before saving a complete copy;
Keeping only cropped screenshots without a URL, date, or account identity;
Deleting the app, messages, or account before preserving evidence;
Publicly fighting with or threatening the collector;
Resharing the post and increasing its reach;
Complaining only to the app’s brand name without identifying the legal creditor;
Sending regulators a long narrative with no chronology or labeled attachments;
Assuming that a platform takedown ends the legal issue;
Assuming that an SEC complaint automatically starts a criminal case;
Giving PINs, passwords, OTPs, or full payment-card credentials to a supposed investigator;
Paying a collector through a personal e-wallet without verifying authority and obtaining an official receipt; or
Ignoring the debt entirely because the collection method was abusive.

Frequently asked questions

Can a collector post my name or photo if I really owe money?

Generally, it may not publish your name or personal information to shame you into paying. The truth or existence of the debt does not by itself authorize public disclosure. Cyberlibel is a separate question, but SEC and privacy rules can apply even when a debt is genuine.

Can the lender contact everyone in my phone?

No. Contacting people in your contact list who were not named guarantors or co-makers is an unfair collection practice under SEC rules. Privacy rules also prohibit excessive contact-list processing, harassment, and collection from people outside the guarantors provided by the borrower.

A properly named guarantor or co-maker may be contacted about the obligation, subject to applicable law. A character reference is not automatically liable for the debt.

Does reporting the collector cancel my loan?

No. The debt and the collection misconduct are separate issues. Continue disputing incorrect charges or arranging payment through the lender’s verified official channel.

Should I pay before I report harassment?

Payment is not a prerequisite to reporting unlawful conduct. If payment is due, use a verified corporate channel and obtain an official receipt. Do not send money merely because someone threatens immediate arrest or public humiliation.

Can I ask the lender to delete all my data?

You may request access, correction, blocking, or removal of unlawfully processed information. The lender may still retain data needed for an existing contract, legal compliance, accounting, fraud prevention, or legal claims. Target the unlawful post, disclosure, or excessive processing rather than assuming every record must be erased immediately.

What if the collector used a fake social-media account?

Preserve the profile URL, handle, numeric account ID if visible, messages, and links. Report impersonation to the platform and include the account in complaints to the lender, SEC, NPC, and law enforcement. Investigators may need formal legal process to identify the operator.

What if the company does not appear to be licensed?

Report it to the SEC anyway and state that you could not verify its authority. The NPC’s loan-data rules can apply to persons acting as lenders even without SEC authority, and possible crimes remain reportable.

How quickly will the post be removed?

No agency or platform can guarantee a fixed takedown time. A well-documented platform report and written demand may produce faster removal, while formal regulatory or criminal proceedings usually take longer. Preserve evidence first and escalate immediately when harm is continuing.

Official references

This article provides general Philippine legal information, not legal advice for a particular case. Outcomes depend on the exact post, loan documents, identities, evidence, and filing dates. Official sources and procedures were checked as of August 3, 2026.