Quick answer

Generally, no. A lending app may contact the borrower directly and, for debt collection, a person who separately and validly agreed to be a guarantor. It must not search the borrower’s phone contacts and message relatives, an employer, coworkers, friends, neighbors, or a former partner merely to demand payment, pressure the borrower, or disclose the debt.

A person identified only as a character reference may be contacted for the limited purpose of verifying the borrower’s identity and the truthfulness of information supplied during the loan application. A character reference is not automatically a guarantor and should not be pursued for payment.

The rules do not erase a valid debt. The lender may send lawful demands, negotiate payment, report credit information when authorized by law, engage an authorized collection agency, or bring a proper court action. What it cannot do is use third parties, personal data, humiliation, threats, or public exposure as collection weapons.

The rules apply even if the borrower really owes money

The existence of an unpaid loan does not give a lender unlimited authority to disclose it.

Under the Data Privacy Act of 2012, personal information must be processed transparently, for a legitimate purpose, and only to a proportionate extent. Data must also be relevant and not excessive for the declared purpose.

The National Privacy Commission’s rules specifically cover lending companies, financing companies, online lending platforms, collection agencies, and other persons processing personal data for loan-related transactions. They apply even to a person or entity acting as a lender without the required SEC authority.

The controlling guidelines are:

NPC Circular No. 20-01, on processing personal data for loan-related transactions;
NPC Circular No. 2022-02, which amended and clarified the rules on contact lists, character references, and guarantors; and
SEC Memorandum Circular No. 18, Series of 2019, prohibiting unfair debt-collection practices by financing and lending companies.

In March 2026, the DICT, NPC, and SEC jointly reiterated that contacting persons in a borrower’s contact list other than guarantors is prohibited. The agencies’ Public Advisory on Online Lending Platforms states that lenders may contact only a guarantor for debt-collection purposes.

When may another person lawfully be contacted?

The answer depends on that person’s actual legal role—not merely on how the lending app labels the person.

The person is a character reference

A character reference supplies information for verification of the borrower’s identity and the truthfulness of information in the loan application.

The lender must tell the person:

that the borrower identified them as a character reference;
how the lender obtained their contact information; and
that they may request removal of their personal data as a reference.

After the 2022 amendment, contacting a character reference is limited to identity and information verification. The lender must not use the reference for debt collection, marketing, cross-selling, or unrelated disclosures.

A message such as “Please tell the borrower to pay today or we will expose both of you” is not an identity-verification call. It is a collection and intimidation tactic.

The person is a guarantor

A guarantor is someone who expressly binds themselves to answer for the borrower’s obligation if the borrower fails to pay. The person’s separate consent is required, subject to the Civil Code rules on guaranty.

Merely typing a relative’s name or telephone number into an app does not, by itself, make that relative a guarantor. Nor does receiving an automated verification code necessarily establish a valid guaranty. The actual agreement, consent process, disclosures, and electronic records must be examined.

A valid guarantor may be contacted regarding the guaranteed debt. The lender must still avoid harassment, deception, threats, public shaming, excessive disclosure, and other unfair practices.

The person is a co-maker, co-borrower, or solidary debtor

A genuine co-maker or co-borrower may be contacted because that person may be directly liable under the loan documents. The label alone is not conclusive. Liability depends on what the person knowingly signed or validly accepted and on the wording and enforceability of the agreement.

A lender cannot convert an uninformed reference into a co-maker simply by describing the person that way in its internal records.

Contact is required through a lawful proceeding

A court, sheriff, or other authorized officer may serve documents or implement lawful processes involving third parties. For example, garnishment of a debtor’s wages or credits ordinarily requires an enforceable judgment and proper court process. A collection agent cannot imitate a court order or demand that an employer deduct wages merely because a loan is overdue.

Can the app contact the borrower’s relatives?

Not merely because they are relatives.

Parents, siblings, children, spouses, cousins, and other family members do not become responsible for a borrower’s personal loan solely because of their relationship. Contacting them to announce the debt, demand that they pay, shame the borrower, or pressure the family is generally prohibited unless the particular relative is a valid guarantor, co-borrower, or other person legally liable for the obligation.

A relative who was named only as a character reference may be approached for the limited verification purpose allowed by NPC rules—not for collection.

The lender also cannot justify mass messaging by saying that the borrower granted access to the phone’s contact list. Each contact is a separate data subject with privacy rights. The borrower generally cannot give unlimited consent on everyone else’s behalf.

Can the app contact the borrower’s employer or coworkers?

Generally, it may not disclose the loan to the employer, human-resources department, supervisor, or coworkers simply to collect or embarrass the borrower.

An employer’s telephone number supplied as employment information may potentially be used for a legitimate and proportionate verification step during the application. That does not authorize the lender to:

announce that the employee is delinquent;
ask HR or a supervisor to pressure the employee;
circulate a collection notice in the workplace;
threaten the employee’s job;
demand payroll deductions without a lawful basis; or
repeatedly call coworkers to locate or shame the borrower.

The analysis may differ if the employer itself signed as guarantor, is a party to a legitimate salary-loan arrangement, received a valid voluntary payroll authorization enforceable under applicable law, or is served with lawful court process. Those situations require examination of the documents and the legal basis for the disclosure.

Can the app contact a former partner?

A former boyfriend, girlfriend, spouse, or live-in partner cannot ordinarily be contacted for collection simply because the person appears in an old application, social-media account, emergency-contact field, or phone contact list.

The same distinctions apply:

If the former partner was only a reference, contact is limited to permitted verification.
If the former partner separately consented to a valid guaranty or signed as a co-borrower, lawful collection may be directed to that person within the scope of the obligation.
If the former partner never agreed to liability, the lender should not demand payment or use that person to pressure the borrower.

A past relationship does not create liability for another person’s private loan.

Access to the borrower’s contact list is tightly restricted

An online lending platform must not engage in “unbridled processing” of a contact list—processing that is unconstrained, excessive, or disproportionate. Prohibited uses include processing that causes harassment, collects a debt from persons other than the borrower’s guarantors, or produces unfair collection practices.

An app may have limited access allowing the borrower to select a character reference or guarantor. NPC rules require separate interfaces for those roles. Limited, proportionate metadata may also be processed when genuinely necessary for a specified and legitimate purpose.

This does not permit an app to:

copy the entire address book for later collection;
harvest email or social-media contacts;
message all saved contacts after default;
upload or store contacts indefinitely;
use photographs to create a shaming poster;
threaten to notify family members or an employer; or
retain permissions after their legitimate purpose has ended without an applicable lawful basis.

When access is no longer needed, the app should turn it off by default or prompt the borrower to revoke the permission.

“You agreed to our privacy policy” is not always a valid defense

Consent under the Data Privacy Act must be freely given, specific, and informed. A broad statement buried in lengthy terms does not automatically validate every later use of personal data.

Consent is especially questionable where the app:

uses pre-ticked permissions;
makes consent easy to give but difficult to withdraw;
conceals the privacy-protective option;
seeks access unrelated to evaluating or servicing the loan;
fails to explain who will receive the data and why; or
uses data to threaten, humiliate, or harass.

Even valid consent does not authorize an act otherwise prohibited by law. Processing must still comply with transparency, legitimate-purpose, proportionality, security, and accountability requirements.

Conduct that may amount to unfair debt collection

Apart from unauthorized third-party contact, SEC rules prohibit practices such as:

using or threatening violence or criminal means against a person, reputation, or property;
using insults, obscenities, or profane language;
threatening an action that cannot legally be taken;
communicating false or deceptive information;
falsely representing that the collector is a lawyer, police officer, court employee, or government representative;
using documents made to resemble court orders or official processes;
disclosing or publishing borrowers’ personal information as a shame campaign;
contacting people who are not legally answerable for the debt to exert pressure; and
communicating at unreasonable or inconvenient times, subject to the qualifications in the applicable rules.

A collection agency’s conduct remains relevant to the lender’s responsibility. Outsourcing collection does not allow the lending company to escape its data-protection and regulatory obligations.

What the borrower should do immediately

Preserve the evidence before blocking anyone

Save the material in its original form where possible:

screenshots showing complete messages, sender accounts, telephone numbers, dates, and times;
screen recordings of posts, group chats, or app notifications;
call logs and available recordings made lawfully;
messages received by relatives, coworkers, the employer, or former partner;
sworn or written accounts from those contacted;
the app’s name, developer, download page, and package details;
loan agreement, disclosure statement, receipts, and payment history;
privacy notice and terms accepted when the loan was obtained;
permission settings showing access to contacts, camera, storage, or location;
collection notices and the collector’s claimed name or company; and
proof of any workplace consequence, reputational harm, financial loss, or threat.

Ask each affected person to preserve their own copy. Forwarding everything to one account may lose metadata or context, so retain the original devices and conversations where practicable.

Secure the phone and accounts

After documenting the evidence:

Revoke the app’s access to contacts, photos, camera, microphone, location, files, and other unnecessary resources.
Change passwords if there is reason to suspect unauthorized account access.
Enable multifactor authentication.
Review connected devices and active sessions.
Remove the app if it is no longer needed, but first preserve relevant records.
Warn contacts not to click links, send money, disclose codes, or engage with impersonators.

Revoking permissions does not cancel a valid loan. Continue dealing with the debt through a documented and legitimate channel.

Send a written demand to stop the unlawful contact

Write to the lender and its data-protection officer, if identified. State:

your loan or account reference without unnecessarily sending sensitive credentials;
the numbers, accounts, or collection agents involved;
the dates and identities of third parties contacted;
that those people are not guarantors or co-borrowers, if true;
that you object to unauthorized or excessive processing;
that you require third-party collection contacts to stop;
that you request the source, recipients, purpose, and legal basis for the processing;
that unlawfully obtained or unnecessary contact data should be blocked or deleted; and
that future communications should be directed to a specified private channel.

Keep proof of delivery and any response. Do not admit an inaccurate balance or waive defenses merely to stop harassment.

Verify who operates the app

Identify the corporate lender, not just the app’s brand name. Review the SEC’s official information and lists for lending and financing companies and the app’s disclosures.

Registration as a corporation is not necessarily the same as having authority to operate as a lending or financing company. If the operator or collector refuses to identify the creditor, document that refusal.

Where complaints may be filed

Securities and Exchange Commission

For unfair collection by an SEC-regulated lending or financing company, submit a complaint through the SEC’s official i-Message Mo facility. The March 2026 joint advisory directs unfair-collection complaints to the SEC Financing and Lending Companies Department and identifies 1-4732 (1-4SEC) as an SEC hotline.

Attach organized evidence and identify both the lender and collection agency, if known.

National Privacy Commission

A borrower or an unlawfully contacted relative, coworker, employer representative, or former partner may have a privacy complaint based on the processing of that person’s own data.

The NPC’s current complaint guidance requires a filled-out and notarized complaint-assisted form or a verified complaint, together with evidence and witness affidavits. Filing may be made personally, by registered mail, by courier, or by electronic mail when authorized by the Commission. A representative generally needs a special power of attorney.

Before filing, check the complete procedural requirements in the NPC’s 2021 Rules of Procedure. A defective or unsupported submission may be dismissed without prejudice.

Police, NBI, or DICT

Seek immediate law-enforcement assistance if the conduct includes credible threats, extortion, stalking, account takeover, impersonation, fabricated intimate images, or other possible crimes.

The March 2026 government advisory lists these channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph
PNP Anti-Cybercrime Group: acg@pnp.gov.ph

Confirm current contact details through the agency’s official website before sending sensitive evidence.

Does harassment cancel the loan?

Usually, no. An unlawful collection method does not automatically extinguish the principal debt, interest, or other valid obligations.

The borrower may dispute unauthorized charges, unlawful interest, defective disclosures, identity theft, payments not credited, or the validity of the loan itself. Those are separate issues that must be evaluated from the contract, disclosure statement, transaction records, and governing law.

A practical written response can therefore do both:

object to harassment and unlawful data processing; and
request a complete statement of account and propose a lawful repayment arrangement without admitting disputed amounts.

Common mistakes to avoid

Deleting the app and messages before preserving evidence. Important records may become difficult to recover.
Assuming every reference is a guarantor. A guaranty requires the person’s own agreement; the borrower cannot create it unilaterally.
Paying a collector through an unverified personal account. Confirm the creditor, balance, authority of the collector, and official payment channel.
Sharing OTPs, passwords, or new identification documents. A legitimate collector does not need account-control credentials.
Replying with threats or defamatory posts. Preserve evidence and use proper complaint channels.
Believing that blocking a number resolves the underlying debt. Address the valid obligation separately.
Relying only on verbal complaints. Send a dated written objection and retain proof.
Posting unredacted screenshots publicly. This may expose personal data, loan details, account numbers, or innocent contacts.
Naming only the collection agent. Include the lending company or financing company that engaged the agent when known.

When legal help is urgent

Consult a lawyer promptly when:

threats refer to physical harm, arrest, workplace dismissal, or public exposure;
private photographs, identification documents, or fabricated images are being circulated;
the lender contacted many people or published the debt online;
an employer has threatened disciplinary action because of the disclosure;
money was demanded from someone who never signed the loan;
the alleged borrower did not take out the loan;
the collector sent papers resembling a summons, warrant, or court order;
a real court pleading, summons, or subpoena has been received;
the app appears unlicensed or conceals the creditor’s identity;
the lender continues after receiving a written privacy objection; or
substantial financial, reputational, employment, or psychological harm has occurred.

Do not ignore genuine court documents. Verify them directly with the named court or through counsel rather than using a telephone number printed in a suspicious message.

Frequently asked questions

May a lender ask my mother to tell me to call?

If your mother is not a guarantor, using her as an intermediary for collection is generally inconsistent with the NPC rule that only guarantors may be contacted for debt-collection purposes. A limited identity-verification contact may be permissible if she was properly named as a character reference, but the lender should not disclose the debt or pressure her to obtain payment.

Is a character reference liable for the loan?

No, not merely by being listed as a character reference. Liability requires an independent legal basis, such as a valid guaranty or co-borrower agreement that the person actually accepted.

Can my employer deduct the loan from my salary?

Not merely because a collector called. A deduction requires a valid legal basis, such as a lawful and applicable authorization or proper court process. The loan documents, employment arrangement, and circumstances must be reviewed.

What if I gave the app permission to access all contacts?

That permission does not automatically legalize unrestricted copying, storage, or collection messaging. Processing must remain necessary, proportionate, transparent, and consistent with NPC rules. Unbridled processing and contacting non-guarantors for collection are prohibited.

Can the lender contact my spouse?

Only if there is an independent lawful basis. Marriage alone does not make every personal loan collectible from the other spouse. Property and marital-liability questions may also depend on when the debt arose, its purpose, the applicable property regime, and the loan documents.

May the lender contact a guarantor repeatedly?

A guarantor may be lawfully contacted about the guaranteed obligation, but harassment, threats, deception, humiliating disclosure, abusive language, and unreasonable communications remain prohibited.

Can both the borrower and a contacted relative complain?

Potentially, yes. The borrower may complain about misuse or disclosure of the borrower’s personal data. The relative or other contacted person may separately complain about the processing of their own contact information and other personal data. Each complainant should document the violation personally experienced.

Can a collection agency blame the lending app?

Outsourcing does not erase accountability. The lender remains responsible for personal data under its control and must ensure that its service providers comply with the Data Privacy Act and applicable NPC rules. The evidence should identify both entities whenever possible.

Official legal sources

This article provides general Philippine legal information, not advice for a particular loan, complaint, or court case. The result may depend on the signed documents, the person’s actual role, the lender’s regulator, and the precise communications made. Sources and procedures were checked as of 24 August 2026.