Receiving a message from an online lending app saying it will post your photo, expose you on social media, or contact your family can feel frightening and humiliating. Do not panic, pay an unverified collector, or immediately delete the app. Philippine law allows a lender to collect a legitimate debt, but it does not give the lender or its collection agency the right to publicly shame you, misuse your photos, harvest your phone contacts, threaten unlawful action, or harass people who did not sign the loan.

Your priorities are to preserve evidence, secure your phone and accounts, warn your family not to engage, send a written demand to stop the misconduct, and report the lender to the correct government agency.

Can an Online Lending App Post Your Photo or Contact Your Family?

In most cases, an online lender cannot lawfully use your photo, contact list, social media connections, or loan information to shame or pressure you into paying.

The National Privacy Commission has specifically stated that online lenders must not harvest borrowers’ phone contacts or social media contacts for debt collection or harassment. Access to a device camera may be justified for legitimate identity verification, commonly called “Know Your Customer” or KYC, but a photo obtained for verification cannot later be used to embarrass or harass the borrower. (National Privacy Commission)

The official National Privacy Commission guidance on online lenders and contact-list harvesting explains that app permissions must be suitable, necessary, and proportionate to a legitimate purpose. Giving an app technical permission to access your contacts does not give it unlimited authority to copy, store, disclose, or use them for public shaming.

When may a lender contact another person?

A lender may generally communicate with someone who is genuinely liable for the loan, such as a signed:

Co-maker
Co-borrower
Guarantor
Surety

A person does not become legally responsible merely because the borrower listed that person as an “emergency contact,” “reference,” relative, friend, employer, or phone contact.

Under Securities and Exchange Commission rules, contacting people in the borrower’s contact list—other than guarantors or co-makers—is considered an unfair debt collection practice. This remains prohibited even when the lender claims that the borrower consented to contact-list access.

A lender may sometimes make a limited effort to locate a borrower through a third person. That does not justify:

Revealing the amount or details of the debt
Accusing the borrower of being a criminal or scammer
Repeatedly calling relatives or co-workers
Telling an employer to deduct the debt from wages
Pressuring family members to pay
Sending the borrower’s ID, selfie, or edited “wanted” poster
Posting in group chats or on social media
Threatening relatives who have no obligation under the loan

Philippine Laws That Protect Borrowers from Online Lending Harassment

Several laws and regulations may apply to the same incident. A borrower may file an administrative complaint with a regulator while also reporting possible criminal conduct to the police or National Bureau of Investigation.

Data Privacy Act of 2012

The Data Privacy Act of 2012, Republic Act No. 10173, requires personal data to be processed transparently, for a legitimate purpose, and only to an extent proportionate to that purpose.

Personal data may include your:

Name and mobile number
Identification documents
Selfie or profile photo
Home and workplace details
Contact list
Messages and call records
Loan balance and payment history
Information about relatives, friends, and co-workers

Using information collected for identity verification to create a humiliating social media post is fundamentally different from using it to verify identity. Likewise, copying an entire phonebook to pressure unrelated people can be excessive even when some access was initially permitted.

Depending on the facts, you may exercise rights to request access to your data, correct inaccurate information, object to certain processing, and seek blocking or deletion when legally appropriate. Deletion is not absolute: a lender may retain records needed to comply with law, prove a transaction, defend a legal claim, or pursue a legitimate collection case. It still cannot use those records for harassment.

The National Privacy Commission has previously acted on complaints involving online lenders that allegedly accessed contact lists, communicated false or excessive information to family members and co-workers, threatened borrowers, and posted personal information on social media. (National Privacy Commission)

SEC rules against unfair debt collection

The SEC’s Memorandum Circular No. 18, Series of 2019 prohibits lending and financing companies from using unfair collection methods.

Prohibited conduct includes:

Threatening violence or other criminal means
Threatening action that cannot legally be taken
Using insults, obscenities, or profane language
Publishing or disclosing borrowers’ names and personal information
Making false statements about the debt
Using deceptive representations or collection methods
Contacting people in the borrower’s contact list who are not guarantors or co-makers
Communicating at unreasonable hours, generally before 6:00 a.m. or after 10:00 p.m., subject to limited exceptions

The lender remains responsible when it hires an outside collection agency. It cannot avoid accountability simply by saying that the messages came from an independent collector. Collectors are also expected to disclose their true identity and the company they represent.

Financial Products and Services Consumer Protection Act

The Financial Products and Services Consumer Protection Act, Republic Act No. 11765, gives financial consumers the right to fair and respectful treatment and prohibits abusive debt collection or recovery practices.

A covered financial service provider must maintain a free consumer assistance mechanism. It may also be held responsible for the acts of its employees, agents, and accredited third-party service providers involved in collection. A consumer who is dissatisfied with the provider’s response may elevate the matter to the appropriate financial regulator. (Supreme Court E-Library)

Possible criminal offenses

A threatening message is not automatically one particular crime. The exact offense depends on the words used, the circumstances, whether the threat was conditional, and whether information was actually published.

Possible offenses under the Revised Penal Code may include:

Grave threats or other threats, when a person threatens harm that may amount to a crime or another legally punishable wrong
Grave coercion, when intimidation or violence is used to force someone to do something against their will
Unjust vexation, for conduct that causes unjustified annoyance, distress, or irritation
Libel, when defamatory statements are communicated to another person

When defamatory material is posted online, the Cybercrime Prevention Act of 2012, Republic Act No. 10175, may become relevant.

An abusive private message sent only to the borrower is not necessarily libel because libel ordinarily requires publication to a third person. It may still support a complaint for threats, coercion, unjust vexation, unfair collection, or a privacy violation.

Special laws may also apply when the threatened material is sexual or intimate:

The Anti-Photo and Video Voyeurism Act of 2009, Republic Act No. 9995, covers certain recordings or images involving sexual acts or private areas where there was a reasonable expectation of privacy.
The Safe Spaces Act, Republic Act No. 11313, may apply to gender-based online sexual harassment.

RA 9995 does not automatically cover an ordinary ID picture or selfie. Its application depends on the intimate nature of the image and the circumstances in which it was taken or shared. (Lawphil)

Civil damages for invasion of privacy and dignity

Articles 19, 20, 21, and 26 of the Civil Code of the Philippines may support a civil case when a lender or collector willfully causes injury, abuses a right, humiliates a borrower, intrudes into private life, or disturbs family relations and peace of mind.

Depending on the evidence, a court may be asked for damages or an order preventing continuing publication. Civil litigation, however, involves filing fees, formal pleadings, evidence, and potentially lengthy proceedings. (Lawphil)

What to Do Immediately After Receiving a Threat

1. Assess whether anyone is in immediate danger

Go directly to the nearest police station or contact emergency services when the message includes:

A credible threat of physical harm
Stalking or knowledge of your current location
A threat involving your child
Extortion involving intimate images
A weapon or specific plan of attack
An attempt to enter your home or workplace

Do not wait for the lender’s internal complaint process or the usual privacy-complaint period when immediate safety is involved.

2. Preserve the evidence before blocking, uninstalling, or reporting the account

Capture more than a cropped screenshot of the threat. Preserve enough information to identify who sent it and when.

Save the following:

Screenshots showing the complete message, sender’s number or username, profile, date, and time.
A screen recording scrolling through the full conversation.
The original chat export or downloaded message history, when the platform allows it.
Call logs, voicemail recordings, and text messages.
The app’s name, app-store page, developer name, privacy notice, permissions screen, and app version.
The loan agreement, disclosure statement, statement of account, payment receipts, and transaction references.
Any post, group-chat message, or fake profile containing your image or personal information.
The exact web address or URL of every public post.
Screenshots received by your family, employer, or friends from their own devices.
A written chronology listing the date, time, number used, threat made, and person contacted.

Keep the original files unchanged. Create copies for highlighting or annotation, but do not crop, write over, or edit the originals. Back them up to secure cloud storage or another device.

Deleting the app too soon may remove access to its permissions screen, terms, in-app messages, transaction history, and company details. Preserve these first.

3. Revoke unnecessary app permissions

After capturing the evidence, review your phone settings and disable the lending app’s access to:

Contacts
Photos and videos
Files or storage
Camera
Microphone
Call logs
SMS
Location

Revoking permission may prevent further access from your device, but it cannot retrieve data that the app already copied.

Change important passwords from a trusted device, especially when the app had broad access or was installed from outside an official app store. Enable two-factor authentication, review active login sessions, and tighten the privacy settings of your social media accounts.

4. Tell your family, friends, and employer what happened

A simple warning can prevent panic and further manipulation:

Do not pay the collector.
Do not click links or install an app.
Do not provide your address, workplace schedule, identification, or financial details.
Save all messages and call logs.
Do not argue with or threaten the collector.
Block the sender only after preserving the evidence.

Ask anyone contacted to write a brief account of what happened. A dated affidavit may later be useful, particularly when the collector disclosed the debt, made false accusations, or sent your photo.

5. Send a written cease-and-preserve notice

Send the notice through the lender’s official email, in-app customer service channel, Data Protection Officer, and consumer assistance desk. Keep proof of sending.

I object to any use or disclosure of my photos, contacts, family information, or loan information for public shaming or third-party collection. Stop contacting anyone who is not a signed guarantor or co-maker. Send all lawful collection communications directly to me through [email or mobile number].

Preserve all messages, call recordings, access logs, contact-list extraction records, collector instructions, and records identifying every recipient of my personal data.

Please confirm the identity of the collector and company, the personal data you hold about me, its source, the purpose and legal basis for processing it, and the persons or entities to whom it was disclosed. I also request a complete statement of account.

I dispute the following amount or charge: [state the specific disputed item]. I demand the immediate cessation of threats, harassment, public posting, and contact with unrelated third persons.

Be specific when disputing the debt. Do not merely say, “I do not owe anything,” if your actual dispute concerns hidden charges, an incorrect payment credit, excessive interest, or an account you never opened.

6. Verify the lender’s real identity

The app’s brand name may be different from the corporation operating it. Look for:

Corporate name
SEC registration number
Certificate of Authority to operate as a lending or financing company
Official website and customer-service details
Name of the online lending platform
Data Protection Officer’s contact information
Name of any collection agency

Do not send money to a collector’s personal e-wallet or to a newly supplied account without confirming the payment channel through the lender’s independently verified official contact details.

7. Report the threat to the correct agencies

More than one agency may have jurisdiction.

Problem	Where to report it
Lending or financing company using abusive collection methods	Securities and Exchange Commission
Misuse of photos, contacts, messages, or other personal data	National Privacy Commission
Threats, extortion, impersonation, cyberlibel, or other possible crimes	Philippine National Police, NBI Cybercrime Division, or prosecutor’s office
Bank, digital bank, credit-card issuer, or another BSP-supervised provider	Provider’s consumer assistance mechanism, then Bangko Sentral ng Pilipinas
Lender operating as a cooperative	Cooperative Development Authority, plus the NPC or law enforcement when applicable
Public post on Facebook, TikTok, messaging groups, or another platform	Platform reporting or takedown system, in addition to government complaints

8. Handle the debt separately from the harassment

A collection violation does not automatically cancel a valid loan. Continue to request an accurate statement of account and negotiate only through a verified company channel.

Paying an unverified collector because of a threat can create another problem: the payment may not be credited to your account, and the harassment may continue.

How to File Complaints Against an Online Lending App

Filing with the Securities and Exchange Commission

Use the SEC’s official iMessage ticketing portal for complaints against lending and financing companies and their online lending platforms. The system creates a trackable ticket for the submission. (Securities and Exchange Commission)

Include:

Your name and contact information
Corporate name and app name, if known
Collector’s name, number, and claimed agency
Loan agreement and disclosure statement
Statement of account and payment receipts
Screenshots and recordings
Evidence from family members or co-workers
Copy of your written complaint to the company
A clear description of the remedy you are requesting

The SEC may investigate and impose administrative sanctions, including fines, suspension, or revocation, when warranted. An SEC complaint does not automatically determine criminal liability or erase the debt.

Filing with the National Privacy Commission

Before filing a standard NPC complaint, the complainant is generally expected to inform the respondent in writing of the privacy violation and allow 15 calendar days for an appropriate response. Proof of the notice should be attached. Urgent cases and situations in which the respondent cannot reasonably be contacted may be treated differently, subject to the NPC’s evaluation. (National Privacy Commission)

Follow the current instructions on the NPC’s official complaint-filing page. The usual submission includes:

The current NPC Complaint-Affidavit
A valid government-issued ID
A notarized signature
Proof that the lender was first notified
Screenshots, exported messages, call logs, contracts, and other evidence
Witness statements or affidavits, when available
A chronology of events

Electronic evidence should be attached in an organized form. Failure to submit supporting evidence may result in dismissal or difficulty establishing the violation.

Complaints may be filed through the methods currently listed by the NPC, which may include personal filing, courier delivery, or email submission of scanned documents. Check the official page for the latest form, address, fee schedule, and filing instructions. (National Privacy Commission)

Reporting possible crimes to the NBI or police

For threats, extortion, impersonation, cyberlibel, unauthorized account access, or intimate-image abuse, file a complaint with the nearest police station or the NBI Cybercrime Division.

The NBI provides an online complaint channel and publishes its procedure for assisting victims of computer-related crimes. Intake commonly involves a complaint form, presentation of documents and electronic evidence, and a sworn statement. The investigation itself may take substantially longer than the initial intake. (National Bureau of Investigation)

A barangay blotter can help document what happened, but it does not replace a complaint with the SEC, NPC, police, NBI, or prosecutor. Barangay conciliation is not always applicable, particularly when the collector is an unknown person, a corporation, someone outside the locality, or when urgent criminal conduct is involved.

Complaints involving a BSP-supervised provider

When the lender is a bank, digital bank, credit-card issuer, or another institution supervised by the Bangko Sentral ng Pilipinas, complain first through the institution’s Financial Consumer Protection Assistance Mechanism.

If the matter remains unresolved, it may be escalated through the BSP’s consumer assistance process, including the BSP Online Buddy or the channels in the BSP guide for filing consumer complaints. Keep the institution’s complaint reference number and proof of its response or failure to respond.

Documents, Costs, and Realistic Timelines

Item	Practical expectation
Evidence preservation	Do it immediately, preferably on the same day
Written notice to lender	Send as soon as evidence is secured
NPC pre-complaint response period	Generally 15 calendar days
Notarization	Required for the current NPC Complaint-Affidavit; cost varies
SEC iMessage submission	Online submission; retain the ticket number
Police or NBI intake	May begin on the day of filing, but investigation can take months
Platform takedown request	Sometimes acted on within hours or days, but no fixed result is guaranteed
Administrative investigation	Often takes months and may take longer when the operator is unregistered or difficult to identify
Prosecutor or court proceedings	May take several months or longer, depending on evidence, service, hearings, and workload
Civil case	Filing fees, service costs, and possible legal expenses apply

Common delays arise when:

The app uses a different brand name from its corporate operator.
Collectors use rotating prepaid numbers or anonymous accounts.
The post is deleted before its URL and account details are preserved.
Screenshots are cropped and do not show the sender or timestamp.
The borrower uninstalls the app before saving the agreement and permissions.
Family members delete messages after blocking the collector.
The operator is based abroad or has no easily identifiable Philippine office.

What If the Lender Says You Will Be Arrested?

The Philippine Constitution provides that no person shall be imprisoned merely for debt. A lender may file a civil collection case, and a borrower must not ignore a genuine summons from a court. But a collector cannot create an arrest warrant, dispatch police officers, or imprison someone through a text message. (Lawphil)

Separate criminal liability can arise when there is evidence of an independent offense, such as fraud committed when obtaining the loan. Mere inability or failure to pay on time is not automatically estafa.

Warning signs of a deceptive collection message include:

A supposed “warrant” with no court name or case number
A demand to pay within minutes to prevent arrest
A collector pretending to be a police officer, judge, prosecutor, or lawyer
A threat to send police without any filed case
A fake court logo or fabricated legal document

Preserve the message and verify any claimed case directly with the named court or government office using independently obtained contact information.

What to Do If Your Photo Has Already Been Posted

Act quickly, but preserve evidence before requesting removal.

Capture the entire post, account name, date, comments, reactions, shares, group name, and URL.
Make a screen recording showing how the post is accessed.
Ask trusted recipients to preserve what they received.
Report the post through the platform’s privacy, harassment, impersonation, or intimate-image channel.
Send a written takedown and preservation demand to the lender and platform.
File with the NPC and SEC when the post concerns debt collection and personal-data misuse.
Report to law enforcement when the post contains threats, extortion, defamatory accusations, intimate images, or fabricated criminal allegations.

Do not repeatedly repost the material to “expose” the lender. Doing so can increase the circulation of your own personal information and complicate efforts to contain it.

Important Considerations for OFWs and Foreign Borrowers

Philippine privacy and consumer-protection rules may still apply when the borrower is abroad if the lender operates in the Philippines or the relevant personal-data processing is connected to the Philippines.

An overseas complainant can often send written notices and begin agency submissions electronically. However, affidavits may need proper notarization or authentication.

When signing documents abroad:

A Philippine embassy or consulate may provide notarial services for eligible documents.
A document notarized locally may require an apostille when issued in a country that participates in the Apostille Convention.
Documents from a non-Apostille country may require consular authentication.
Evidence in another language may need an English or Filipino translation, and a certified translation may later be requested.

Confirm the receiving agency’s current authentication and electronic-filing requirements before paying for notarization, apostille, translation, or courier services.

Common Mistakes That Can Weaken Your Complaint

Paying a personal account without verification

A threat does not prove that the sender is authorized to receive payment. Confirm the account through the lender’s official channel and obtain a receipt showing that the payment was credited.

Deleting everything immediately

Blocking the number may stop notifications, but deleting messages or uninstalling the app can destroy useful evidence. Preserve first, then secure the device.

Threatening the collector in return

Angry counter-threats can distract from the original misconduct and may be used against you. Keep responses factual, brief, and written.

Assuming a contact is automatically a guarantor

A parent, spouse, sibling, friend, or employer is not liable merely because the lender found the person in your phone. Ask the lender to produce the document allegedly signed by that person.

Ignoring a genuine court document

Harassment should be reported, but a legitimate civil collection case must still be answered. Verify the document with the court and observe the deadline stated in the summons.

Treating a regulator’s complaint process as debt cancellation

The SEC or NPC can investigate collection and data-processing violations. Whether the underlying loan is valid, fully paid, fraudulent, or incorrectly computed is a separate issue that may require account reconciliation or court determination.

Frequently Asked Questions

Can an online lending app legally post my photo because I have not paid?

Generally, no. A lender may use a verification photo for legitimate identity and account purposes, but using it for public shaming, humiliation, or unrelated disclosure may violate privacy law and SEC collection rules.

Can a lending app message everyone in my contacts?

No. SEC rules treat contact with people in the borrower’s contact list as an unfair collection practice unless the person is a genuine guarantor or co-maker. Giving the app contact permission does not make every contact responsible for the debt.

Can the lender call my parents, spouse, or employer?

Not merely to pressure or shame you. A family member or employer who did not sign as a guarantor, co-maker, or co-borrower is generally not liable. Disclosing your loan details or repeatedly harassing that person may support a complaint.

What if I agreed to the app’s privacy policy?

Consent is not unlimited. Personal-data processing must still have a lawful and legitimate purpose and must be proportionate. SEC rules also prohibit contacting unrelated phone contacts even when a lender claims the borrower consented.

Can I be jailed for not paying an online loan?

You cannot be imprisoned merely for debt. The lender may pursue a civil collection case. A separate criminal case would require evidence of an independent offense, not simply late payment or inability to pay.

Should I delete the lending app immediately?

Preserve the agreement, messages, app details, permissions, and transaction records first. After saving the evidence, revoke unnecessary permissions and uninstall the app when appropriate.

Where should I report online lending harassment?

Report unfair lending practices to the SEC, personal-data misuse to the NPC, and possible crimes to the police, NBI, or prosecutor. For a BSP-supervised provider, use its consumer assistance mechanism before escalating to the BSP.

What if the lending app is not registered with the SEC?

Preserve the app-store listing, website, payment instructions, numbers, and messages. Report the operation to the SEC and report threats or possible fraud to law enforcement. An unregistered operator may be more difficult to identify, making complete evidence particularly important.

Does filing a complaint erase the loan?

No. A complaint may stop or penalize unlawful conduct, but a valid loan can remain collectible. Request a correct statement of account and deal only with the verified lender through lawful channels.

What if the post has already been deleted?

Your screenshots, screen recordings, URL, witness copies, notifications, and platform correspondence may still be useful. Ask recipients to preserve their copies and include the date and circumstances in your written chronology.

Key Takeaways

A lender may collect a legitimate debt, but it cannot lawfully use threats, public shaming, or contact-list harassment.
A selfie or ID photo obtained for verification cannot simply be repurposed into a humiliating collection post.
Family members, friends, references, and employers are not automatically liable for your loan.
Preserve complete, unedited evidence before blocking numbers, reporting posts, or uninstalling the app.
Revoke unnecessary permissions, secure your accounts, and warn your contacts not to engage or pay.
Send the lender a written demand to stop, preserve its records, identify the collector, and provide a complete statement of account.
File with the SEC for unfair collection, the NPC for personal-data misuse, and law enforcement for threats or other possible crimes.
Harassment does not automatically cancel a valid debt, but unpaid debt does not give a collector the right to humiliate, deceive, or terrorize you.