Quick answer

A lending app or collector may pursue a valid debt through lawful, reasonable means, but it may not publicly shame you, publish your personal information, threaten you, spread false loan information, use deceptive collection tactics, or contact people in your phonebook who are not genuine guarantors.

Act quickly:

Preserve the post and related messages before they disappear.
Report the content to the social-media platform.
Send a written takedown and privacy complaint to the lender and its data protection officer.
Report unfair collection to the Securities and Exchange Commission (SEC).
File with the National Privacy Commission (NPC) if personal data was exposed or misused.
Report threats, fraud, extortion, impersonation, or other possible crimes to cybercrime authorities.

If there is an immediate threat to anyone’s safety, call Unified 911 or go to the nearest police station. Do not meet the collector alone.

Harassment does not automatically cancel a valid loan. Deal with the debt separately through the lender’s verified payment and dispute channels.

When an online post may be unlawful

“Malicious post” is not a single legal category. The same post may involve unfair debt collection, a privacy violation, defamation, threats, identity misuse, or several of these at once.

Public shaming and abusive collection

SEC Memorandum Circular No. 18, series of 2019, requires lending and financing companies—and collectors acting for them—to use only reasonable and legally permissible collection methods. Prohibited practices include:

Using or threatening violence or other criminal means to harm a person, reputation, or property;
Threatening an action that cannot legally be taken;
Using obscenities, insults, or profane language that abuses the borrower or may constitute an offense;
Publishing a borrower’s name or other personal information to shame the borrower for allegedly refusing to pay;
Communicating loan information known, or which should be known, to be false, including failing to disclose that a debt is disputed;
Using false representations or deceptive means to collect or obtain information; and
Contacting a borrower at unreasonable or inconvenient hours, generally before 6:00 a.m. or after 10:00 p.m., unless a legally recognized exception applies.

The March 18, 2026 joint advisory of the DICT, NPC, and SEC specifically reiterates that harassment, intimidation, public shaming, and unlawful use of personal data by online lending platforms are prohibited.

The lending or financing company cannot necessarily avoid responsibility by blaming an outside collection agency. Under the Financial Products and Services Consumer Protection Act, a financial service provider is responsible for its employees and agents and may be solidarily liable with an accredited third-party service provider for debt-collection acts or omissions.

Contacting relatives, friends, coworkers, or employers

A character reference is not automatically a guarantor.

Under the amended NPC loan-processing rules and the 2026 joint advisory:

A character reference may be used for legitimate identification or verification purposes.
A guarantor must have separately and expressly consented to assume responsibility if the borrower defaults.
For debt collection, the lender or collector may contact the guarantor.
Contacting other people merely because their numbers appeared in the borrower’s phonebook is prohibited.
Harvesting, copying, or saving phone, email, or social-media contacts for harassment or debt collection is prohibited.

Posting in a workplace group, tagging coworkers, messaging relatives about the debt, or sending a borrower’s photograph and loan details to non-guarantors can therefore support an SEC and/or NPC complaint. Narrow disclosures required by law—such as disclosures to a court, an authorized government agency, counsel, or an authorized service provider for legitimate enforcement—are different from public shaming.

Misuse of photos, contact lists, and other personal data

Names, photographs, phone numbers, employment details, loan information, account status, IDs, and contact-list information may be personal data. Collecting data for a loan does not give a lender unlimited authority to publish or weaponize it.

The Data Privacy Act of 2012 requires a lawful basis for processing and observance of transparency, legitimate purpose, and proportionality. NPC Circular No. 2020-01, as amended by NPC Circular No. 2022-02, prohibits unnecessary or excessive app permissions and unconstrained processing of contact information.

These protections apply to entities acting as lenders even when they lack the required registration or authority. An illegal or unrecorded app does not gain permission to misuse personal data.

False accusations and cyberlibel

A false online accusation that identifies a person and tends to dishonor or discredit that person may raise issues of libel or cyberlibel. A case is not established merely because a post is offensive: the exact words, context, publication to another person, identity of the author, identification of the victim, malice, truth or falsity, and possible privileges or defenses all matter.

Cyberlibel under the Cybercrime Prevention Act has a short limitation period. The Supreme Court has affirmed that it prescribes in one year from discovery by the offended party, the authorities, or their agents. See Causing v. People and the Court’s 2026 confirmation of the rule. Record the date you first discovered the post and seek legal advice promptly if defamation charges are being considered.

A post can still violate privacy and collection rules even if the debt itself is real. “Totoo naman ang utang” is not a blanket defense for public shaming.

What to do immediately

1. Protect yourself first

If the post includes a threat of physical harm, stalking, doxxing, a threat to visit your home or workplace, or demands backed by intimidation:

Call Unified 911 or contact the nearest police station.
Tell household members, building security, or workplace security what happened.
Do not meet the collector alone.
Do not open unknown links or files sent by the collector.
Change compromised passwords and enable multifactor authentication.
If an app still has unnecessary access to contacts, photos, location, microphone, or storage, document the permissions and then revoke them.

A threat to have someone arrested solely for ordinary nonpayment should also be documented. The Constitution states that no person may be imprisoned for debt. This does not protect a person from liability for a separate, properly alleged crime such as fraud.

2. Preserve the post before requesting removal

Keep the strongest available copy of the evidence:

Full screenshots showing the post, account or page name, date and time, caption, photograph, comments, reactions, and visible audience;
The direct URL or “copy link” address;
A screen recording showing how you reached the post from the account or page;
The profile URL, username, page ID, phone number, and other identifiers of the poster;
Screenshots of edits, reposts, group posts, tags, private messages, and threats;
Notifications showing when you first learned of the post;
Text messages, emails, call logs, and voicemails;
Screenshots received by relatives, coworkers, or other recipients;
Names and contact details of witnesses who personally saw or received the content;
The app’s name, developer, app-store page, version, privacy notice, requested permissions, and loan account number;
The loan agreement, disclosure statement, statement of account, payment receipts, and any written dispute over the balance; and
Proof of financial or personal harm, such as lost-work records, medical records, counseling receipts, or messages from an employer.

Keep original files. Do not crop, annotate, edit, or repeatedly convert the only copy. Back up the evidence in another secure location and prepare a simple timeline.

Do not secretly record a private telephone or in-person conversation without legal advice and the authorization required by the Anti-Wiretapping Act. Philippine jurisprudence recognizes that even a participant may violate the law by secretly recording a private conversation without the other party’s knowledge. Written messages, call logs, and recordings intentionally left as voicemail are safer evidence to preserve.

3. Identify every responsible party

The app’s brand name may be different from the corporation that granted the loan. Look for the legal entity in:

The loan agreement and disclosure statement;
The app’s privacy notice and terms;
Payment receipts and bank or e-wallet transaction descriptions;
Collection emails and text signatures; and
The app-store developer information.

Record the names of:

The lending or financing company;
The online lending platform;
The collection agency;
The individual collector, if known;
The owner or controller of the posting account; and
Any bank, e-money issuer, or other institution that actually provided the credit.

Name all relevant parties in the complaint, while clearly distinguishing what each one did. If the individual poster is unknown, describe the account, phone number, messages, and circumstances that may identify the person.

4. Report the post to the platform

After preserving evidence, use the platform’s reporting function. Select the most accurate category available, such as harassment, bullying, privacy violation, impersonation, threats, non-consensual disclosure of personal information, or fraud.

In the report:

Identify the exact personal information exposed;
Explain that the post was made to collect a debt or shame a borrower;
State whether the information is false or disputed;
Mention any threats or contact with non-guarantors; and
Save the platform’s report number and response.

Platform removal can limit further harm, but it does not replace a regulator or criminal complaint.

5. Send a written notice to the lender and its data protection officer

Use the official customer-service and data-protection contact details in the app, privacy notice, loan contract, or company website. Send a concise notice that:

Identifies the post and collector;
Lists the data used or disclosed;
States why the disclosure or collection method is disputed;
Demands immediate removal and an end to contact with non-guarantors;
Requests preservation of account, access, collection, and posting logs;
Asks the company to identify the collector and collection agency;
Requests restriction or deletion of unlawfully processed data where legally appropriate;
Asks for a corrected statement of account if the amount is disputed; and
Requests a written response and complaint reference number.

Attach copies, not your only originals. Keep proof of delivery and receipt. Do not post your ID, account number, home address, or full loan documents publicly.

This written notice is especially important for an NPC complaint. As a general rule, the NPC requires proof that the complainant first informed the respondent in writing and that the respondent failed to take timely and appropriate action or did not respond within 15 calendar days from receipt. The NPC may waive this requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm, no adequate remedy, or patently illegal conduct.

6. Handle the debt through a separate, verified channel

Ask for a written statement showing principal, interest, fees, payments, and current balance. If you recognize the debt, negotiate only with the verified lender through its official channel.

Do not:

Pay a collector’s personal bank or e-wallet account without written verification;
Give an OTP, PIN, password, card number, or account password;
Sign an admission or settlement you do not understand;
Agree that harassment was lawful in exchange for a takedown; or
Assume that paying immediately will erase evidence or end regulatory liability.

Where to report

Problem	Primary channel	Important first step
Public shaming or unfair collection by a lending or financing company	SEC Financing and Lending Companies Department	Preserve evidence and identify the company behind the app
Misuse or disclosure of personal data, harvested contacts, photos, or loan information	National Privacy Commission	Generally notify the respondent in writing and allow 15 calendar days, unless grounds for waiver exist
Conduct by a bank, e-money issuer, or other BSP-supervised institution	Institution’s consumer-assistance mechanism, then BSP	Complain to the institution first
Threats, fraud, extortion, identity misuse, impersonation, or other possible cybercrime	PNP Anti-Cybercrime Group, NBI Cybercrime Division, or local police	Report urgently and preserve account and device evidence
Immediate danger	Unified 911	Prioritize physical safety

SEC complaint

For a lending company, financing company, online lending platform, or its collector, submit a complaint through the SEC’s official iMessage ticketing system. The 2026 joint advisory directs unfair-debt-collection complaints to the SEC Financing and Lending Companies Department. The SEC hotline listed in that advisory is 1-4732 (1-4SEC).

Include:

Your contact details;
The app and company names;
The collector or agency, if known;
A chronological account of what happened;
Copies of the post, messages, call logs, and witness screenshots;
The loan agreement or proof connecting the app to the company;
The amount claimed and whether it is disputed;
Your prior complaint to the lender and its response; and
The specific action requested, such as investigation, takedown, cessation of third-party contact, or correction of records.

Keep the electronic ticket number and follow up through the same ticket.

National Privacy Commission complaint

Use the NPC’s current complaint-filing instructions and Complaint-Affidavit template effective July 1, 2025.

A formal complaint generally must be complete, verified or made using the prescribed form, notarized, and supported by:

A valid government-issued ID;
The identity and contact details of the respondent, if known;
A clear statement of the personal data processed;
A factual timeline;
Copies of the post, messages, permissions, and other evidence;
Witness affidavits, when available;
All correspondence with the respondent;
Proof that the respondent received your written privacy complaint;
The respondent’s reply, or proof that 15 calendar days passed without an adequate response;
The relief requested; and
The required certification against forum shopping.

The NPC accepts complaints personally, by registered mail, by courier, or through authorized electronic submission. Its filing page currently identifies complaints@privacy.gov.ph for scanned submissions. Filing fees may apply under the NPC’s current schedule, subject to recognized exemptions or waiver.

Incomplete complaints or complaints unsupported by evidence may be dismissed outright. Follow the 2021 NPC Rules of Procedure, as amended, rather than sending only an informal narrative email.

BSP complaint when the provider is BSP-supervised

If the creditor is a bank, non-bank electronic-money issuer, money-service business, or another BSP-supervised institution, first use that institution’s Financial Consumer Protection Assistance Mechanism.

If the response is unsatisfactory, escalate through the BSP Online Buddy chatbot on the BSP website. Continue until you receive a BSP reference number. If BOB is inaccessible, the BSP’s current complaint guide instructs consumers to complete a Complaint/Inquiry/Reply form and email it, with proof of the first-level complaint, to consumeraffairs@bsp.gov.ph.

Do not send your PIN, password, OTP, full card number, or other credentials. The BSP states that these are not required to process a complaint.

Threats, fraud, scams, and other possible crimes

The 2026 joint advisory lists these channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; (02) 8723-0401 local 7491

For immediate danger, call Unified 911. For a criminal complaint, law enforcement may direct you to execute a complaint-affidavit and submit evidence to the proper prosecutor. A platform report, email tip, or police blotter does not necessarily complete that legal process, so ask for a reference number and the exact next step.

Important deadlines

Do not wait for every agency to act before consulting counsel.

NPC pre-filing step: Generally allow the respondent 15 calendar days from receipt of your written privacy notice, unless the NPC waives exhaustion for a properly alleged and proven reason.
Cyberlibel: One year from discovery by the offended party, the authorities, or their agents.
Financial-consumer claims: Republic Act No. 11765 generally provides five years from consummation of the financial transaction, or five years from discovery of deceit or nondisclosure of material facts, with an outside limit of ten years from the violation. The correct trigger depends on the claim.
Other criminal, civil, privacy, and administrative cases: Different periods and interruption rules may apply. Obtain case-specific advice rather than assuming an SEC or NPC report preserves every possible court claim.

Common mistakes to avoid

Taking only a cropped screenshot without the URL, account, date, and surrounding context;
Arguing publicly with the collector and unintentionally spreading the post further;
Deleting messages, uninstalling the app, or resetting the phone before documenting evidence;
Reporting only the app’s brand name and not the corporation or collector behind it;
Treating a character reference as if that person consented to be a guarantor;
Sending an informal NPC email without the required complaint form, verification, evidence, and proof of exhaustion;
Filing only with the platform and assuming government authorities were notified;
Secretly recording private calls without considering the Anti-Wiretapping Act;
Paying through an unverified personal account to obtain a promised takedown;
Sharing an OTP, PIN, password, or full financial credentials with a collector or supposed investigator;
Assuming harassment erased the debt; and
Waiting close to the one-year cyberlibel period before seeking legal help.

When legal help is urgent

Consult a Philippine lawyer, the Public Attorney’s Office if eligible, or another qualified legal-aid provider promptly when:

The post contains a credible threat, home address, live location, workplace details, or information about children;
Intimate, altered, or humiliating images were used;
The collector is impersonating a court, police officer, lawyer, or government agency;
Money is demanded under threat of exposure or harm;
The post is spreading quickly or has caused job, business, medical, or safety consequences;
The lender denies responsibility for a collector acting in its name;
You want an injunction, damages, cyberlibel complaint, or another court remedy;
The author’s identity is concealed and subscriber or platform records may need prompt legal preservation; or
A prescriptive period may be approaching.

FAQ

Can a collector post my name and photo if the debt is real?

Generally, no. A valid debt permits lawful collection, not public shaming. Publishing identifying and loan information to pressure payment may violate SEC collection rules and data-privacy requirements even when the debt exists.

Can the app contact everyone in my phone?

No. Unconstrained harvesting and use of contact lists are prohibited. For collection, the lender may contact a genuine guarantor who separately consented to assume the obligation—not every saved contact and not a character reference merely used for verification.

What if I gave the app permission to access my contacts or photos?

Consent is not unlimited. Processing must still have a lawful, specific, necessary, and proportionate purpose. Deceptive consent interfaces, excessive permissions, and later use of photos or contacts for harassment may be unlawful.

Does filing a complaint stop collection?

Not automatically. The lender may continue reasonable and lawful collection unless restrained by an appropriate order or agreement. Continue disputing or arranging the account through official written channels.

What if the app is unregistered?

Report it to the SEC and, where threats, fraud, or identity misuse are present, to cybercrime authorities. Privacy protections still apply. Provide the app-store listing, developer name, payment destination, phone numbers, and every document that may identify the operators.

Should I file with both the SEC and NPC?

Often, yes. The SEC addresses unfair collection and the conduct of regulated lending or financing companies. The NPC addresses unlawful processing or disclosure of personal data. The same incident can fall within both jurisdictions, but disclose any related proceedings accurately in required certifications.

Can the collector have me arrested for not paying?

Ordinary nonpayment of debt does not by itself justify imprisonment. A properly alleged independent crime is different and must be handled through lawful investigation and court process. Treat threats of instant arrest, warrantless seizure, or police action arranged by a collector as red flags and preserve them.

Official sources

This article provides general legal information, not advice for a particular case and not an attorney-client relationship. Outcomes depend on the exact post, loan documents, parties, evidence, and applicable procedure. Official sources and complaint channels were checked as of 7 August 2026.