Quick answer

If a lending app, lending company, financing company, or debt collector posts your name, photograph, loan information, contact details, workplace, or accusations online to shame or pressure you into paying, preserve the evidence first and then report the conduct to the proper regulator or law-enforcement agency.

The government’s 18 March 2026 joint advisory on online lending platforms specifically identifies harassment, intimidation, public shaming, unlawful use of personal data, unauthorized or excessive processing of contact lists, and certain threatening collection practices as prohibited conduct. For debt collection, lending and financing companies—and persons acting for them—may contact a borrower’s guarantor, but not simply everyone found in the borrower’s contact list.

For most SEC-regulated lending and financing companies, unfair debt-collection complaints may be filed with the SEC Financing and Lending Companies Department (FINLEND) through the SEC iMessage system. If the collector improperly used or disclosed personal data, a separate complaint may be appropriate before the National Privacy Commission (NPC). Threats, coercion, scams, hacking, or potentially criminal defamatory posts may also be reported to the NBI Cybercrime Division or PNP Anti-Cybercrime Group.

A genuine unpaid debt does not give a lender or collector unlimited freedom to shame the borrower publicly, misuse personal data, threaten unlawful acts, or harass unrelated third persons. At the same time, reporting abusive collection practices does not automatically erase a valid loan or excuse a legitimate payment obligation.

What kinds of online collection posts may be reportable?

Not every communication about a debt is unlawful. A lender may pursue a legitimate obligation using lawful collection methods. The problem arises when collection crosses legal and regulatory limits.

Under Republic Act No. 11765, the Financial Products and Services Consumer Protection Act, financial service providers are prohibited from using abusive collection or debt-recovery practices and must respect the privacy and protect the data of their clients. (Lawphil)

The March 2026 DICT-NPC-SEC advisory further identifies prohibited practices involving online lending platforms, including:

processing personal information in a way that leads to harassment;
excessive or disproportionate access to a borrower’s contacts;
using personal data to collect from people other than the borrower’s guarantors;
threats of violence or other criminal means intended to harm a person, reputation, or property;
threats to take an action that cannot legally be taken; and
contacting people in the borrower’s contact list, other than properly designated guarantors, for purposes of debt collection.

A character reference is not automatically a guarantor. Current government guidance requires online lending platforms to distinguish between character references used for identification or verification and guarantors who have expressly consented to assume responsibility for the loan in case of default.

Examples that should prompt closer legal review include a collector:

posting the borrower’s photograph with statements such as “scammer,” “estafador,” or “fraudster”;
publishing the amount allegedly owed to embarrass the borrower;
tagging the borrower’s relatives, friends, employer, coworkers, or customers;
posting screenshots containing the borrower’s mobile number, identification document, address, account information, or other personal data;
creating a social-media post designed to shame the borrower into payment;
sending the same defamatory or humiliating message to numerous contacts;
threatening to publish embarrassing information unless immediate payment is made; or
publishing information taken from phone contacts, photographs, messages, or other app permissions that were not legitimately necessary for the loan transaction.

Whether a particular act violates the Data Privacy Act, SEC regulations, the Revised Penal Code, the Cybercrime Prevention Act, or another law depends on the actual content, how the information was obtained, who received it, the collector’s purpose, and the surrounding circumstances.

Step 1: Preserve the evidence before asking for removal

Do this before blocking the collector or causing the post to disappear, unless immediate safety concerns make that impractical.

Preserve:

screenshots showing the entire post, not merely the offensive sentence;
the poster’s profile or account name;
the profile URL and direct post URL, where available;
the date and time you discovered the post;
comments, reactions, tags, shares, and replies that help show publication;
screenshots or screen recordings showing how the post appeared on the platform;
text messages, chat messages, emails, or calls threatening publication;
the telephone numbers, usernames, email addresses, and account names used by collectors;
copies of posts or messages received by your relatives, coworkers, employer, or other contacts;
the loan agreement, disclosure statement, account statement, payment records, and receipts;
the lending-app name and, importantly, the actual corporate lending or financing company identified in the loan documents;
privacy notices and relevant app-permission screens, if still available; and
any communication in which you previously objected to the disclosure or harassment.

Keep the original electronic files. Avoid editing, drawing on, compressing, or repeatedly resaving your only copy. Make a separate annotated copy if you need to highlight something.

If another person received the malicious post or message, ask that person to preserve their own copy. A contemporaneous statement identifying when and how the person received or saw it may later be useful.

Also record when you first discovered an allegedly defamatory online post. That date can be legally significant because the Supreme Court has held that cyberlibel prescribes in one year from discovery by the offended party, the authorities, or their agents, subject to the rules governing interruption of prescription. (Lawphil)

Step 2: Identify the real lender and collector

Do not assume that the app name is the legal name of the company responsible for the loan.

Check your:

loan agreement;
disclosure statement;
payment instructions;
privacy notice;
terms and conditions; and
collection messages.

Identify separately:

the app or online lending platform;
the lending or financing company that extended the credit;
the collection agency, if one is named; and
the individual collector or social-media account responsible for the post.

This matters because a lender generally cannot avoid responsibility merely by outsourcing collections. Under Section 13 of Republic Act No. 11765, a financial service provider is responsible for acts or omissions of its employees and agents and may be solidarily liable with an accredited third-party service provider for acts or omissions that include debt collection. (Lawphil)

If the collector refuses to identify the company represented, preserve that refusal and include it in the complaint.

Step 3: Send a written demand to stop the posting and misuse of your data

Send the lender, collection agency, and, where available, the company’s data protection officer or consumer-assistance unit a concise written complaint.

Identify the offending posts and request appropriate action, such as:

immediate cessation of public-shaming posts;
removal of specific posts containing your personal information;
cessation of debt-collection contacts to persons who are not guarantors;
cessation of unauthorized disclosure of your loan information;
preservation of collection logs, account records, call recordings, messages, and instructions given to collectors;
identification of the collection agency or collector involved;
correction of inaccurate personal information; and
a written response explaining what corrective action was taken.

Keep proof that the complaint was received.

This written notice is particularly important for a later NPC complaint. The NPC’s current complaint rules require exhaustion of remedies: the complainant must first inform the respondent in writing of the privacy violation or personal data breach and give the respondent an opportunity to address it. The NPC states that the requirement is satisfied when the respondent fails to take timely or appropriate action, or when there is no response within 15 calendar days from receipt of the written notice. Proof must be attached to the NPC complaint. (National Privacy Commission)

That 15-day requirement concerns the NPC complaint process. It does not mean that a person facing threats, extortion, violence, hacking, fraud, or another urgent criminal situation should wait 15 days before reporting the matter to law enforcement.

Step 4: Report unfair collection practices to the SEC

For lending companies, financing companies, and their online lending platforms under SEC jurisdiction, the March 2026 government advisory directs complaints regarding unfair debt collection to the SEC Financing and Lending Companies Department (FINLEND).

The current stated channel is:

SEC iMessage: use the online complaint system and select the appropriate financing/lending-company complaint category.
SEC hotline: 1-4732 (1-4SEC).

SEC iMessage complaint portal

Your complaint should clearly identify:

your full name and contact information;
the corporate name of the lender, if known;
the name of the app;
the collection agency or collector, if known;
your loan or account reference, without unnecessarily publishing sensitive information;
what was posted or sent;
where and when it occurred;
who received or saw the material;
why you believe the conduct was abusive or unauthorized; and
the evidence attached to your complaint.

If you believe the app or company is unlicensed, unrecorded, or is concealing the identity of the lender, state that expressly. The March 2026 advisory reiterates the applicable restrictions for entities offering or facilitating loans through online lending platforms, whether the platforms are recorded or unrecorded.

Violations may expose lending or financing companies to administrative sanctions, depending on the findings and applicable law.

Do not assume, however, that an SEC harassment complaint automatically cancels your loan. The legality of collection conduct and the existence or amount of the underlying debt are separate issues.

Step 5: File a privacy complaint with the NPC when personal data was misused

Consider the NPC route when the lender or collector improperly obtained, used, disclosed, or disseminated personal information—for example:

your photograph;
telephone number;
home or work address;
identification documents;
loan information;
contact-list information;
information about relatives, friends, or coworkers; or
other information taken through unnecessary app permissions.

The March 2026 advisory prohibits unnecessary processing and unauthorized, excessive, or disproportionate processing of personal data in loan transactions. It also states that online lending platforms may not engage in unbridled processing of borrowers’ contact lists.

After complying with the NPC’s exhaustion requirement, a complainant may file a filled-out and notarized Complaint-Assisted Form or a verified complaint, together with supporting evidence and witness affidavits. The NPC presently identifies personal filing, registered mail, courier, or electronic mail as may be authorized by the Commission as filing methods. Because formal and electronic filing requirements matter, use the NPC’s current instructions and forms rather than relying on an old template circulating online. (National Privacy Commission)

NPC complaint mechanics and current filing requirements

A privacy complaint can be relevant even where some debt is genuinely due. The issue is not simply whether the lender possessed information about the borrower, but whether its collection, use, disclosure, retention, and sharing of that information had a lawful purpose and complied with applicable data-protection rules.

There can also be lawful reasons for retaining information—for example, where data remains necessary for the establishment, exercise, or defense of legal claims or is required by law. The government’s 2026 advisory expressly recognizes this. Accordingly, a borrower should not assume that every request for deletion must result in immediate destruction of every loan record.

Step 6: Report threats, fraud, coercion, or other possible cybercrimes

The joint advisory identifies the following current reporting channels for other forms of harassment, threats, fraud, and scams:

DICT Cyber Hotline

Email: 1326@dict.gov.ph

NBI Cybercrime Division

Email: ccd@nbi.gov.ph
Telephone: (02) 8523-8231 to 38

PNP Anti-Cybercrime Group

Email: acg@pnp.gov.ph
Email: onlinecims.ocs@gmail.com
Telephone: (02) 8723-0401, local 7491

Report promptly if the collection conduct involves credible threats of violence, extortion, unauthorized access to an account or device, impersonation, fraud, or other conduct suggesting a criminal offense.

A report does not establish that a crime was committed. Investigators and prosecutors must still determine whether the facts satisfy all statutory elements and whether admissible evidence supports a case.

What if the collector calls you a “scammer” or “estafador” online?

A false or defamatory accusation published online can potentially raise a cyberlibel issue, but liability is not automatic.

Republic Act No. 10175 treats as cyberlibel the unlawful acts of libel under Article 355 of the Revised Penal Code when committed through a computer system or similar means. (Lawphil) Among other matters, a libel case ordinarily requires analysis of the allegedly defamatory imputation, publication to another person, identifiability of the offended party, malice, and any applicable defenses or privileges.

The Supreme Court’s 2026 resolution in Causing v. People confirms that cyberlibel presently carries a one-year prescriptive period, reckoned from discovery by the offended party, the authorities, or their agents under Articles 90 and 91 of the Revised Penal Code. Filing of the proper complaint or information may affect the running of prescription under Article 91. (Lawphil)

Because prescription, discovery, publication, identity, malice, and possible defenses can be fact-sensitive, obtain legal advice promptly rather than assuming that a social-media platform report alone protects your legal remedies.

Also remember that the defamation question is separate from unfair collection and privacy law. Whether a statement is true, privileged, or otherwise defensible in a libel case does not necessarily give a debt collector permission to use public shaming, excessive personal-data processing, or prohibited third-party collection contacts.

Step 7: Report the post to the social-media platform

After preserving sufficient evidence, use the platform’s own reporting tools when the content violates rules against matters such as:

harassment;
bullying;
privacy violations;
doxxing;
impersonation;
threats; or
fraudulent accounts.

Request removal where appropriate.

Platform removal can reduce continuing harm, but it does not replace an SEC, NPC, or law-enforcement complaint where government action is warranted.

Avoid responding by reposting the offending material repeatedly to “expose” the collector. Doing so can unnecessarily spread your own personal information and may complicate later factual questions about who republished what.

What if the lender is a bank or another BSP-supervised institution?

Jurisdiction depends on the actual financial service provider, not merely on the appearance of the app.

For a BSP-supervised financial institution, the consumer should generally first raise the complaint through the institution’s own consumer-assistance mechanism. Unresolved complaints may then be escalated through the Bangko Sentral ng Pilipinas Consumer Assistance Mechanism, including its BSP Online Buddy or other current BSP channels.

BSP consumer complaint and assistance channels

Standalone lending and financing companies ordinarily fall under SEC jurisdiction rather than BSP supervision. Privacy or criminal issues may still separately fall within NPC or law-enforcement jurisdiction regardless of which financial regulator supervises the lender.

What should you ask the authorities to investigate?

A useful complaint focuses on specific acts and evidence rather than broad statements such as “they harassed me.”

Ask the appropriate authority to examine, as applicable:

who created or authorized the post;
whether the poster was an employee, agent, or collection contractor;
what personal information was used;
where the information came from;
whether the lender accessed the borrower’s contact list or other phone data;
whether people contacted for debt collection were actually guarantors;
whether a purported guarantor expressly consented to that status;
whether the lender had a lawful basis and legitimate purpose for processing or disclosing the information;
whether the lender or collection agency has similar collection records concerning the incident;
whether threats or defamatory statements were made; and
whether the company took corrective action after receiving written notice.

For privacy matters, you may also request appropriate correction, blocking, deletion, or cessation of processing, but the precise relief available will depend on the Data Privacy Act, NPC rules, legal-retention obligations, pending claims, and the facts of the case.

Evidence worth preserving

A well-supported complaint is usually more useful than a large collection of disorganized screenshots. Preserve and organize:

The original online post — full screenshot, URL, account name, date, and time.
Proof of publication — comments, shares, recipients, tagged people, or witnesses.
Threats before publication — especially messages saying that information will be posted unless payment is made.
Third-party messages — copies received by family, coworkers, employers, or friends.
Loan documents — showing the actual lending company.
Payment history — especially if the collector made inaccurate statements about the account.
Collector identity — telephone numbers, usernames, email addresses, collection-agency names, and IDs.
Privacy evidence — app permissions, privacy notices, or messages showing use of contact-list information.
Your written complaint to the company — including proof of receipt.
The company’s response — or evidence that no response was received.
A chronology — dates of borrowing, alleged default, collection calls, threats, publication, discovery, takedown, and government complaints.

Keep sensitive evidence private. Give it only to the authorities, your lawyer, or other persons who legitimately need it.

Common mistakes to avoid

Deleting everything before collecting evidence

Blocking the collector may stop immediate messages but can also make usernames, conversations, URLs, and account details harder to recover. Preserve what you reasonably can first.

Filing only against the app name

Identify the corporate lender and any collection agency whenever possible. An app can be only the platform through which another legal entity provides the loan.

Sending heavily cropped screenshots

A screenshot that removes the account name, date, URL, conversation context, or surrounding publication can be much less useful.

Forgetting the NPC’s written-notice requirement

A formal NPC complaint generally requires proof that you first informed the respondent in writing and gave it an opportunity to address the violation. The current NPC rule refers to failure to take timely or appropriate action or no response within 15 calendar days. (National Privacy Commission)

Waiting too long because the post remains online

Do not assume that a continuing online post gives you an unlimited period to pursue cyberlibel. Current Supreme Court doctrine applies a one-year period from discovery, subject to the statutory rules on prescription. (Lawphil)

Assuming the complaint eliminates the debt

A borrower can contest unlawful collection conduct while still having a valid underlying obligation. Determine the actual balance and contractual rights separately.

Fighting publicly with the collector

Public arguments may spread the offending information further, create additional factual disputes, and reveal information that should have remained private.

Paying someone who promises to “erase” the complaint or blacklist

Use official government channels and verify anyone claiming to represent a regulator or law-enforcement agency.

When professional help is urgent

Seek prompt legal or law-enforcement assistance when:

the collector threatens death or physical injury;
someone demands money while threatening to publish damaging or private material;
the collector appears to have hacked or taken control of an account;
intimate or highly sensitive material is being threatened or disseminated;
false accusations of criminal conduct are being circulated to your employer, customers, or the public;
the collector is impersonating you;
numerous relatives, coworkers, or customers are being contacted;
the disclosure is causing serious and continuing business or employment harm;
you need immediate court or administrative relief to stop continuing conduct; or
an allegedly defamatory online publication is approaching the one-year cyberlibel prescriptive period.

For immediate threats or suspected criminal activity, reporting to the police, PNP Anti-Cybercrime Group, or NBI should not be postponed merely because an administrative or privacy complaint is also being prepared.

Frequently asked questions

Is it legal for a lending app to post my unpaid loan on Facebook?

Public disclosure of a borrower’s debt as a means of harassment or public shaming can violate applicable lending, consumer-protection, and data-privacy rules. The government’s March 2026 advisory expressly addresses public shaming and unlawful use of personal data in online lending collection practices. The exact legal consequences depend on what was posted, why, and how the information was obtained and disclosed.

Can the collector message my family, friends, employer, or character references?

For purposes of debt collection, the current joint government advisory states that lending and financing companies and persons acting for them may contact the guarantor, not other persons in the borrower’s contact list. A character reference supplied only for identification or verification is not automatically a guarantor; the person must have expressly consented to be one.

Do I have to wait 15 days before reporting the collector?

The 15-calendar-day rule applies to the NPC’s exhaustion-of-remedies requirement for a privacy complaint: you must first notify the respondent in writing and attach proof that the respondent did not take timely or appropriate action or did not respond within that period. (National Privacy Commission) You do not need to wait 15 days to seek immediate police assistance for threats, violence, fraud, hacking, or another urgent criminal matter, and the 2026 joint advisory tells the public to report abusive behavior immediately to the proper authorities.

What if the collector posted a false accusation that I am a scammer or committed estafa?

The post may potentially raise cyberlibel or other legal issues, but the precise words, context, publication, identifiability, malice, defenses, and supporting evidence must be examined. Because the Supreme Court currently applies a one-year prescriptive period from discovery to cyberlibel, obtain advice promptly. (Lawphil)

Is the lender still responsible if an outside collection agency made the post?

Potentially, yes. Republic Act No. 11765 makes a financial service provider responsible for acts or omissions of its agents and provides for solidary liability with accredited third-party service providers for acts or omissions that may include debt collection. The exact relationship between the lender and collector should still be established by evidence. (Lawphil)

Does filing an SEC, NPC, or cybercrime complaint cancel my loan?

No. A complaint about harassment, data misuse, or criminal conduct does not by itself invalidate an otherwise enforceable debt. Questions about the loan balance, interest, charges, validity, payment, or defenses to collection should be addressed separately.

Official sources

This article provides general legal information, not legal advice for a particular case. The appropriate remedy depends on the lender’s identity, the exact post or message, how personal information was obtained and disclosed, the evidence available, and applicable procedural deadlines. Laws, regulations, agency procedures, and online filing channels were checked against official sources as of 23 August 2026.