Quick answer

A lending app or collector may demand payment through lawful, respectful, and confidential means. It generally may not shame you online, publish your name, photo, loan details, or other personal information, threaten your reputation, use false loan information, or harvest your phone or social-media contacts for harassment.

Preserve the post before reporting it. Then:

Send a written takedown and preservation request to the lender and collection agency.
Report the post and account through the social-media platform.
Report an SEC-regulated lending or financing company to the Securities and Exchange Commission.
File a privacy complaint with the National Privacy Commission if personal data was exposed or misused.
Contact law enforcement promptly if there are threats, impersonation, extortion, stalking, sexual content, or potentially defamatory accusations.

Reporting abusive collection does not automatically cancel a valid debt. Conversely, the existence of a debt does not give a lender permission to conduct public shaming.

What collection practices are prohibited?

SEC Memorandum Circular No. 18, Series of 2019 applies to financing companies, lending companies, and third-party service providers they hire. It treats the following as unfair collection practices:

Using or threatening violence or other criminal means against a person, property, or reputation
Threatening action that cannot legally be taken
Using obscenities, insults, or profane language that abuses the borrower
Disclosing or publishing the names and personal information of people alleged to have refused payment, except for limited lawful disclosures
Communicating loan information known, or that should be known, to be false—including failing to say that a debt is disputed
Using false representations or deceptive means to collect or obtain information about the borrower
Contacting the borrower before 6:00 a.m. or after 10:00 p.m., subject to the circular’s limited exceptions
Contacting people harvested from the borrower’s contact list other than those named as guarantors or co-makers

The circular also requires collectors to disclose their full name or true identity to the borrower. Outsourcing collection does not free the lender from responsibility.

The Financial Products and Services Consumer Protection Act, or Republic Act No. 11765, separately prohibits abusive collection or debt-recovery practices and requires financial service providers to protect client data. A provider is responsible for the acts or omissions of its employees and agents and may be solidarily liable with an accredited third-party collector.

Even a real debt must be kept confidential

A true statement is not automatically a lawful disclosure. Posting that a named person owes money, attaching the person’s photo, tagging relatives or employers, or circulating the person’s loan application may still violate collection and privacy rules even if a loan exists.

SEC rules permit limited disclosures in situations such as:

Disclosure with the borrower’s valid written or recorded consent
Exchange of customer information with authorized financial institutions, credit information bureaus, or lenders
Compliance with a court order or an authorized government-agency request
Disclosure to collection agencies, counsel, or service providers that need the information to perform legitimate work
Certain insurance-related disclosures

These exceptions do not create a general right to post the debt publicly or humiliate the borrower. Whether purported consent in an app or loan contract is valid, informed, specific, and broad enough to cover a particular disclosure depends on the actual language and circumstances.

Special privacy rules for lending apps

Under NPC Circular No. 2020-01, lenders must limit collection to information that is adequate, relevant, necessary, and not excessive for legitimate loan-processing purposes.

An online lending app may not:

Require unnecessary access to personal or sensitive information
Use a borrower’s photo to harass or embarrass the borrower
Harvest phone contacts, email lists, or social-media contacts for debt collection or harassment
Copy or save those contacts for such purposes
Use personal data to engage in unfair collection practices

An app may provide a separate field where the borrower voluntarily names a character reference or co-maker. That is different from copying the borrower’s entire address book. Contact with a properly supplied reference must still follow privacy and fair-collection requirements and does not authorize public disclosure.

What to do immediately

1. Preserve the complete evidence

Do this before blocking the account, uninstalling the app, or asking the platform to remove the post.

Save:

Full screenshots showing the post, account name, profile URL, date, time, captions, images, comments, and reactions
The direct URL of every post, profile, page, group, video, or shared copy
A screen recording showing how you reached the post and the surrounding context
Copies of private messages, texts, call logs, emails, and voice recordings lawfully in your possession
Notifications showing who was tagged or contacted
Messages received by relatives, co-workers, friends, references, or other witnesses
The app-store listing, developer name, privacy notice, permissions screen, and app version
Loan agreement, disclosure statement, payment records, receipts, account statement, and any written dispute about the amount
The collector’s name, phone number, email address, social-media account, agency, and claimed relationship with the lender
The date and time you first discovered each post

Keep the original files. Avoid editing, annotating, or cropping your only copies. Make a second backup. Ask witnesses to preserve what they personally received and to note when and how they received it.

2. Identify the legal company behind the app

An app’s brand name may differ from the corporation that made the loan. Check:

The loan agreement and disclosure statement
The app’s terms and privacy notice
The developer information in the app store
Payment instructions and official receipts
Collection messages identifying the creditor or agency
SEC registration and Certificate of Authority details

Record both the app name and the corporation’s complete legal name. If the operator is unclear, include every available identifier in your reports and ask the SEC to verify the entity.

3. Send a written takedown and preservation request

Send the notice to the lender’s consumer-assistance unit, data protection officer, official customer-service address, and collection agency. Use a channel that produces proof of delivery.

Include:

The post’s URL and date
The account that posted it
The personal information or allegedly false statements disclosed
Why you believe the post came from the lender or its collector
A request for immediate takedown and cessation of further disclosure
A request to preserve account records, access logs, collection instructions, communications, and the collector’s identity
A request for a written response and incident reference number
Any separate dispute about the loan amount, clearly labeled as disputed

A concise notice may read:

I discovered the post at [URL] on [date and time]. It identifies me and discloses [describe the loan information, photo, contact details, or other data]. I request its immediate removal, the cessation of further disclosure or contact with third parties, and preservation of all records identifying the person or agency responsible. Please confirm the takedown, identify the lender and collection agency involved, and provide your written action on this complaint. This notice is not an admission of the amount claimed and does not waive any of my rights or remedies.

For an NPC complaint, written notice to the respondent is normally important. Under the 2021 NPC Rules of Procedure, the respondent ordinarily must be given an opportunity to act. If it provides no timely or appropriate action—or no response within 15 calendar days from receipt—the matter may be elevated to the NPC. The NPC may waive this requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm or patently illegal conduct.

4. Report the content to the platform

Use the platform’s reporting tools for the post and, where appropriate, the account. Select the most accurate category, such as:

Harassment or bullying
Privacy violation or sharing personal information
Impersonation
Threats or violence
Non-consensual intimate imagery
Scam or deceptive conduct

Preserve the platform’s confirmation, report number, and response. If other people received the material, they may submit their own truthful reports. Do not organize false or misleading mass reports.

A platform takedown limits exposure, but it does not decide whether the lender violated Philippine law and does not replace a government complaint.

Where to file a government complaint

Situation	Appropriate office
Lending or financing company, online lending platform, or its collector used unfair collection practices	Securities and Exchange Commission
Personal data, contacts, photo, loan information, or other private information was unlawfully processed or disclosed	National Privacy Commission
Lender is a bank, e-money issuer, or other BSP-supervised institution	The institution’s consumer-assistance mechanism, then the Bangko Sentral ng Pilipinas
Lender is a cooperative that is not a cooperative bank	Cooperative Development Authority
Threats, extortion, impersonation, stalking, cyberlibel, account compromise, or another possible crime	Police, NBI Cybercrime Division, prosecutor, or private counsel

More than one office may have jurisdiction over the same incident.

Filing with the SEC

For an SEC-regulated lending or financing company, prepare a complaint identifying both the lender and collection agency. Attach the preserved posts, messages, loan documents, valid government-issued ID, and proof connecting the collector to the lender.

The SEC’s complaint guidance for lending and financing companies instructs complainants to complete the form accurately, attach evidence, provide valid identification, and submit one complaint form per respondent company. The SEC may furnish the respondent with a copy for its answer, so attach only information relevant to the complaint and redact unnecessary account credentials.

Use the current SEC iMessage system to open and track a complaint ticket or confirm the latest accepted filing channel. State clearly if the company appears unregistered or if the app’s legal operator cannot be identified.

The SEC can investigate and impose regulatory remedies, but an SEC complaint does not by itself cancel a loan, rewrite payment terms, or automatically declare the debt or contract void.

Filing with the National Privacy Commission

Use the NPC’s current Complaint-Affidavit/Reklamong Salaysay form. The form asks for:

Complainant and respondent information
The personal data processed or disclosed
Proof that the respondent was notified in writing, or the reason notice was not possible
A chronological narration
Supporting evidence
The relief requested
Verification and certification against forum shopping
A valid government-issued ID

The complaint generally must be notarized or otherwise properly verified. Follow the NPC’s current filing instructions for personal, courier, or electronic filing, applicable fees, document format, and payment procedure. The NPC currently identifies complaints@privacy.gov.ph as its complaints address, but a casual email without the required form and supporting documents may not constitute a sufficient formal complaint.

If the disclosure is continuing and causing serious harm, ask the NPC or a lawyer whether an application for a temporary ban on processing is appropriate. That is a formal remedy with specific requirements and is not granted automatically.

If the lender is BSP-supervised

First complain through the institution’s Financial Consumer Protection Assistance Mechanism. If the response is unsatisfactory, use the BSP Consumer Assistance Mechanism, including the BSP Online Buddy or the official complaint form sent through the channel stated by BSP.

Do not send PINs, passwords, one-time passwords, or complete card credentials with a complaint.

When to contact law enforcement or a lawyer

Report promptly if the posts or messages involve:

A credible threat of physical harm
A threat to publish more material unless money or another benefit is provided
Impersonation or a fake account using your identity
Publication of your home address or real-time location alongside threats
Account hacking or unauthorized access
Sexual images, fabricated intimate content, or material involving a child
Persistent stalking or coordinated harassment
False accusations that may constitute cyberlibel

The NBI online complaint page accepts reports, while the NBI’s Cybercrime Division assistance procedure explains that complainants may be interviewed, execute sworn statements, submit supporting documents, and present relevant devices for examination. For immediate danger, contact emergency services or the nearest police station instead of waiting for an administrative complaint.

Not every false, rude, or embarrassing post is automatically cyberlibel. The exact words, identification of the person, publication to another person, context, malice, evidence, and possible privileged communication all matter.

Act quickly if cyberlibel may be involved. In its April 8, 2026 en banc ruling in Causing v. People, G.R. No. 258524, the Supreme Court confirmed that cyberlibel prescribes in one year from discovery by the offended party, the authorities, or their agents. A social-media report, demand letter, or informal inquiry should not be assumed to preserve that deadline. Obtain legal advice on the proper complaint and filing office as soon as possible.

Common mistakes to avoid

Reporting before preserving evidence. The post may disappear along with information needed to identify the account.
Keeping only cropped screenshots. Preserve the URL, account, timestamp, complete caption, comments, and surrounding context.
Uninstalling the app immediately. Back up evidence and record permissions first. Afterward, revoke unnecessary permissions and secure your accounts.
Naming only the app brand. Include the corporate lender, app developer, collection agency, and collector whenever known.
Arguing publicly with the collector. Public exchanges may spread the post, expose more information, or complicate the evidence.
Sending passwords or OTPs. Regulators and legitimate investigators do not need them to receive a complaint.
Combining unrelated allegations without a timeline. Present a short chronological account and connect each attachment to a specific fact.
Assuming the complaint cancels the debt. Continue addressing any valid obligation through documented and lawful channels.
Waiting for the post to go viral. Report early, especially where personal safety, identity misuse, or a one-year cyberlibel period may be involved.

Frequently asked questions

Can a collector post my name if I really owe money?

Generally, public naming and shaming is not a lawful collection method. SEC rules prohibit disclosure or publication of the names and personal information of alleged nonpaying borrowers, subject only to limited lawful disclosure exceptions.

Can the lender contact my family, friends, or employer?

A lender may communicate with you and may make limited lawful contact with properly designated guarantors, co-makers, or references. Harvesting your contact list and contacting people for harassment is prohibited. Telling relatives, co-workers, or an employer about your debt, tagging them in a shaming post, or sending them abusive material may violate confidentiality, privacy, and fair-collection rules.

What if I never borrowed from the app?

State this clearly in every report. Preserve evidence of identity misuse, request the underlying application and transaction records, and report possible impersonation or unauthorized processing to the NPC and law enforcement. Do not pay merely to stop threats without first verifying the alleged account.

What if the collector deletes the post?

Keep your saved evidence and record when it disappeared. A deletion may limit further harm but does not necessarily resolve the completed disclosure. Continue with the complaint if appropriate.

Can I revoke the app’s permissions?

Yes. After preserving the relevant evidence, revoke unnecessary access to contacts, photos, storage, camera, microphone, and location. Change reused passwords and enable multi-factor authentication. Revoking access does not erase information the app may already have copied, so include the earlier access in your complaint.

Do I need a lawyer?

A lawyer is not always required for an SEC or NPC complaint, but legal help is advisable when there are threats, large or disputed amounts, identity theft, intimate content, serious reputational harm, multiple respondents, or a possible criminal case. It is especially urgent when a prescriptive deadline may be running.

Official legal sources

This article provides general legal information, not advice for a particular case. The correct remedy depends on the post, loan documents, identity of the lender and collector, evidence, and applicable deadlines. Official sources and procedures were checked as of August 6, 2026.