Quick answer

If a lending app, financing company, or collector posts your name, photo, loan details, contacts, or insulting accusations online to shame or pressure you into paying, preserve the post before requesting removal. Then report it through the platform and to the regulator with jurisdiction:

SEC for unfair collection by a lending or financing company;
National Privacy Commission (NPC) for misuse or disclosure of personal data;
BSP if the lender is a bank, e-wallet provider, or another BSP-supervised financial institution; and
PNP, NBI, or a lawyer/prosecutor if the post includes threats, impersonation, extortion, or potentially defamatory accusations.

A valid debt does not authorize public shaming, threats, deception, or indiscriminate contact with people in your phone. Reporting abusive collection also does not automatically cancel the loan. Payment, interest, and contract disputes must be addressed separately.

Preserve the evidence before the post disappears

Do this before blocking the account, uninstalling the app, or asking the platform to remove the material:

Take full-screen screenshots showing:
- the complete post, comment, story, message, or profile;
- the account name, username, profile URL, and profile photo;
- the date and time visible on the device;
- reactions, shares, comments, and any tagged people; and
- the browser address or direct link, if available.
Make a screen recording showing how you reached the post from the profile or page. Open the account information and the post’s direct link where possible.
Save the original URL. Copy links to the post, profile, page, group, or advertisement.
Download or preserve related messages, call logs, emails, voice recordings, and collection notices. Do not edit the original files.
Ask affected relatives, coworkers, or friends to preserve what they received. Request screenshots showing the sender, recipient, number or account, date, time, and complete conversation.
Keep the loan records:
- loan agreement and disclosure statement;
- app name and download-page link;
- lender’s corporate name;
- SEC registration and Certificate of Authority numbers shown in the app;
- amount released, charges, due dates, and payment history;
- receipts and account statements; and
- the names and numbers used by collectors.
Write a short timeline while events are fresh. Separate what you personally saw from what another person reported to you.

Screenshots are useful, but additional material connecting the account to the lender or collector can be important. Avoid deleting the app until you have saved the agreement, privacy notice, permissions, transaction history, and collection messages. You may then review and revoke unnecessary permissions in your phone settings.

When an online collection post may violate the rules

Not every unpleasant collection message is automatically unlawful. A lender may demand payment through lawful, proportionate means and may process information when supported by a valid legal basis. The content, audience, purpose, truthfulness, permissions, and manner of collection all matter.

However, SEC Memorandum Circular No. 18, Series of 2019 prohibits lending and financing companies—and their collection agents and service providers—from engaging in specified unfair practices. These include:

using or threatening violence or other criminal means to harm a person, reputation, or property;
threatening action that cannot legally be taken;
using obscenities, insults, or profane language that abuses the borrower or amounts to an offense;
disclosing or publishing the names and other personal information of borrowers who allegedly refuse to pay, except where disclosure is lawfully permitted;
communicating false loan information, including failing to say that a debt is disputed where that qualification is required;
using false representations or deceptive means to collect a debt or obtain information;
contacting a borrower before 6:00 a.m. or after 10:00 p.m., subject to the circular’s exceptions for an account more than 15 days past due or the borrower’s properly recorded express consent; and
contacting people in the borrower’s contact list who were not named as guarantors or co-makers, even if the borrower supposedly consented to access the contact list.

The lender remains responsible for ensuring that collectors, agents, representatives, and third-party service providers follow the applicable rules.

Under the Data Privacy Act of 2012, personal-data processing must satisfy legal requirements, including transparency, legitimate purpose, and proportionality. Consent to use an app—or to process data for a loan application—does not necessarily authorize public disclosure or debt-shaming for collection.

The NPC’s amended rules for loan-related transactions specifically prohibit unnecessary or excessive processing. NPC Circular No. 2022-02 provides, among other things, that:

a borrower’s photo must not be used to harass or embarrass the borrower to collect a delinquent loan;
unconstrained, excessive, or disproportionate processing of contact lists is prohibited;
contact-list processing that causes harassment, supports collection outside the borrower’s chosen guarantors, or results in unfair collection is prohibited; and
access for selecting character references or guarantors must be limited to the minimum necessary.

A character reference is not automatically a guarantor or co-maker. Whether someone is legally liable for a loan depends on the documents and applicable law, not merely on being listed in a phone or named as a reference.

Send a written removal and privacy demand

Send the lender, collector, and the company’s data protection officer a written notice. Use an email address, in-app support channel, or other method that produces proof of delivery.

State:

your name and account or loan reference number;
the exact post, account, URL, date, and collector involved;
what personal data or false statements were disclosed;
who received or could view the material;
that you object to public disclosure and unfair collection;
whether the debt or amount is disputed;
that you demand preservation of relevant records, immediate removal of the post, cessation of improper disclosure, and a written explanation; and
that future lawful communications should be sent directly to your specified channel.

Ask the company to identify the legal basis and purpose for the disclosure, the source of the data, the recipients or categories of recipients, and the collector or service provider responsible.

Keep the demand factual. Do not threaten, insult the collector, publish private information in return, or falsely deny a debt. If you dispute the balance, identify the disputed amount and request an itemized statement and supporting documents.

For an NPC complaint, written notice to the company is especially important. Under the NPC 2021 Rules of Procedure, a complainant generally must first inform the concerned entity in writing and allow it to act. Ordinarily, the NPC may proceed when the entity does not take timely or appropriate action or gives no response within 15 calendar days after receiving the notice. The NPC may waive this requirement for proven good cause or a serious violation involving significant risk of harm, including grave and irreparable damage, lack of an adequate remedy, or patently illegal action. Explain and prove any reason for requesting a waiver.

Report the post to the social-media platform

Use the report function on the specific post and on the account when appropriate. Select the category that accurately fits the material, such as harassment, bullying, threats, impersonation, privacy violation, or sharing personal information.

Include the direct URL and a short explanation that the account is publishing personal or loan information to shame or pressure a borrower. If the post contains an identification card, phone number, home address, private photograph, financial information, or another sensitive detail, identify it precisely.

Platform removal is separate from a government complaint. A platform may remove content under its own rules without deciding whether Philippine law was violated. Conversely, failure to remove a post does not establish that it is lawful.

Do not rely solely on the report button. Preserve evidence and pursue the appropriate official complaint.

File an SEC complaint

The SEC regulates lending and financing companies and receives complaints involving their operations and unfair collection practices.

Use the SEC’s official complaint guidance for lending and financing companies and current complaint form. The SEC instructs complainants to:

complete the form accurately;
submit one complaint form for each respondent company;
attach a valid government-issued ID; and
include supporting evidence.

Describe the company’s legal name as well as the app or brand name. Attach the post, URLs, communications, loan documents, payment records, written demand, proof of delivery, and any company response. Explain how the collector is connected to the lender.

The SEC’s published procedure allows personal filing and email filing through the channel shown on its complaint page. Because addresses and submission systems can change, confirm the current channel on that page or through the SEC iMessage portal before sending personal documents.

The SEC states that, after receiving a complete complaint, it evaluates the submission and may furnish it to the company for an answer or comment. Its published procedure gives the company 10 days from receipt to answer or comment.

The SEC can investigate regulatory violations, but it expressly says that this complaint process cannot itself change the loan terms, void the contract, cancel or settle the debt, or declare an interest rate void for being excessive. Those issues may require a different proceeding or legal advice.

If the app does not display a corporate name, SEC registration number, and Certificate of Authority number, include that fact and screenshots in the complaint. Do not assume that appearing in an app store means the lender is authorized to operate.

File an NPC complaint for misuse of personal data

Use the NPC route when the post or collection activity involves unauthorized, excessive, or improper processing of your name, photograph, loan information, contacts, messages, identification documents, address, or other personal data.

After sending the written notice and observing the applicable 15-calendar-day requirement—or explaining why it should be waived—prepare the NPC complaint. The official NPC complaint mechanics require a filled-out and notarized Complaint-Assisted Form or another verified complaint, together with supporting evidence and any witness affidavits.

The NPC’s published filing modes include:

personal filing;
registered mail;
courier; or
electronic mail when authorized by the Commission.

Check the NPC page and form immediately before filing for the current address, authorized email procedure, copy requirements, and digital-signature instructions. A defective, unsigned, unverified, or inadequately supported complaint may be dismissed.

Identify the respondent if possible. If the collector’s identity is unknown, give all circumstances that may lead to identification: phone numbers, usernames, profile URLs, payment accounts, app details, email headers, and the lender’s information.

Explain:

what data was processed or disclosed;
how the lender obtained it;
why the processing was unnecessary, excessive, unauthorized, misleading, or disproportionate;
who saw or received it;
the harm or continuing risk;
what you asked the company to do; and
how and when the company responded.

If the lender is regulated by the BSP

The BSP complaint mechanism applies to concerns against BSP-supervised financial institutions, such as banks and certain non-bank financial institutions. It is not the general regulator for every standalone lending app.

First complain through the institution’s own consumer-assistance channel and preserve its acknowledgment and final response. If the institution does not resolve the issue, use the official BSP Consumer Assistance channels. The BSP accepts escalated concerns through BSP Online Buddy and the Complaints, Inquiries and Requests form using the channels listed on that page.

If you are unsure who regulates the lender, check its disclosures and registration. The same incident may properly involve more than one regulator—for example, the BSP for the supervised institution’s conduct and the NPC for personal-data processing.

When to report to law enforcement or seek a lawyer

Contact the nearest police station, the PNP’s cybercrime unit, the NBI, or a lawyer promptly if the collector:

threatens violence, abduction, sexual harm, property damage, arrest without lawful basis, or harm to relatives;
demands money through threats to publish intimate, fabricated, or highly damaging material;
impersonates a police officer, court, government agency, lawyer, or another person;
creates a fake account in your name;
alters your photograph or identification document;
publishes your home address or encourages others to confront you;
accesses an account or device without authority; or
continues conduct that creates an immediate safety risk.

For an immediate threat, move to a safe place and contact 911 or the nearest police station. Do not meet a collector alone.

A malicious online accusation may potentially involve cyber libel under Section 4(c)(4) of the Cybercrime Prevention Act, read with the Revised Penal Code. But an insulting or harmful post is not automatically cyber libel. The prosecution must establish the legal elements, and defenses or privileged communications may apply.

Timing is critical. In its April 8, 2026 ruling in Causing v. People, G.R. No. 258524, the Supreme Court maintained that cyber libel prescribes in one year. The proper starting date and the effect of particular procedural acts can depend on the facts. Obtain legal advice immediately rather than waiting until the end of the period.

A lawyer can also assess other possible criminal, civil, regulatory, or protective remedies. Do not label the collector publicly as a criminal unless supported by a final legal determination; report the facts and evidence to the proper authorities.

Protect yourself while the complaint is pending

Change passwords for your email, social-media, banking, and app-store accounts. Use unique passwords and enable two-factor authentication.
Review app permissions and revoke access that is no longer necessary. Save evidence first.
Warn affected contacts briefly that they may receive improper collection messages. Ask them not to argue with the collector and to preserve everything.
Tighten social-media privacy settings and review unknown logins, linked devices, recovery addresses, and active sessions.
Communicate with the lender in writing. If calls continue, keep a dated call log.
Pay only through a verified company channel and obtain a receipt. Do not send money to a collector’s personal account without confirming its authority.
If you intend to pay or negotiate, ask for an updated, itemized balance and written settlement terms. A complaint about collection conduct does not suspend an otherwise valid due date unless the lender or a competent authority says so.
Keep copies of every submission, attachment, acknowledgment, ticket number, and delivery record.

Common mistakes to avoid

Waiting until the post is deleted

Preserve it first. A bare statement that something was posted is harder to verify than a contemporaneous screenshot, URL, screen recording, and witness evidence.

Reporting only the app’s brand name

Identify the corporate lender, collection agency, individual account, app, and payment recipient wherever possible. A brand may differ from the registered company name.

Sending cropped or edited screenshots

Keep the originals. Cropping can remove the username, URL, date, time, or surrounding context needed to assess the complaint.

Assuming contact permission allowed public shaming

App consent is not unlimited. Data processing must still comply with the law, the declared purpose, and proportionality requirements.

Assuming a reference is responsible for the debt

A person does not become a guarantor or co-maker merely because their details appeared in a contact list or they were named as a character reference. Liability depends on a valid legal undertaking and the relevant documents.

Ignoring the NPC’s prior-notice requirement

Unless a waiver is justified, notify the concerned entity in writing and retain proof of receipt. Record the end of the 15-calendar-day response period.

Claiming that harassment erased the loan

Improper collection can be reported even if money is owed, but it does not by itself extinguish the debt. Keep the collection complaint separate from disputes over the balance, charges, or validity of the agreement.

Retaliating online

Do not publish collectors’ private information, issue threats, fabricate accusations, or encourage harassment. Preserve evidence and use official channels.

Frequently asked questions

Can a lending app post that I have an unpaid loan?

A lender may lawfully communicate with a borrower and use appropriate legal collection methods, but SEC rules prohibit disclosure or publication of the names and other personal information of borrowers who allegedly refuse to pay except where disclosure is legally allowed. Public debt-shaming, threats, false claims, or disclosure to unrelated contacts may also raise data-privacy issues.

What if the post is true?

Truth does not automatically authorize a lender to publish personal loan information for debt-shaming. Privacy and unfair-collection rules can apply independently of whether a balance is genuinely due. A possible defamation claim, however, requires a separate analysis of all legal elements and defenses.

May the collector message my family, employer, or Facebook friends?

Contacting people in the borrower’s contact list who were not named as guarantors or co-makers is an unfair debt-collection practice under SEC Memorandum Circular No. 18. Limited processing involving a borrower-selected character reference or guarantor is subject to the NPC’s proportionality and purpose limitations. The person’s actual legal role and the content of the communication still matter.

Should I block the collector?

Preserve the evidence first. You may then block a harassing account, but keep at least one safe written channel open with the company itself if you need statements, payment instructions, or a response to your complaint.

Can I file with both the SEC and NPC?

Yes, when the facts fall within both agencies’ mandates. The SEC addresses regulated lending or financing conduct; the NPC addresses personal-data processing. If the lender is BSP-supervised, BSP escalation may also be appropriate. Disclose related proceedings when a form or agency rule requires it.

Do I need a lawyer?

A lawyer is not always necessary for an administrative complaint, but legal help is advisable when there are threats, impersonation, disputed identity, large amounts, a summons or court document, possible cyber libel, repeated publication, employment consequences, or uncertainty about whom to name as respondent.

What if I never borrowed from the app?

State that clearly and request the loan application, identity-verification records, agreement, disbursement details, and processing basis. Preserve evidence of possible identity theft or impersonation and report promptly to the company, NPC, relevant regulator, and law enforcement where appropriate. Do not pay merely because a threatening message demands it.

Will reporting remove the post immediately?

Not necessarily. Platform reporting may produce the fastest takedown, while regulatory and legal proceedings can take longer. Submit the removal request and platform report promptly, but preserve the evidence first.

Official references

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. The proper remedy depends on the post, loan documents, identity of the lender and collector, evidence, and applicable deadlines. Official sources and procedures were checked as of August 26, 2026.