Quick answer

Usually, no. A lending app cannot contact a borrower’s relatives, employer, friends, co-workers, or former partner to collect or publicize the debt merely because their numbers appear in the borrower’s phone, social-media contacts, application form, or character-reference list.

For lending and financing companies regulated by the Securities and Exchange Commission (SEC), contacting people in the borrower’s contact list for collection—other than valid guarantors or co-makers—is an unfair debt-collection practice. The National Privacy Commission (NPC) likewise prohibits using contact lists to collect from anyone outside the borrower’s guarantors.

The main exceptions are when the person:

expressly agreed to be a guarantor, surety, co-maker, or co-borrower;
was named as a character reference and is contacted only to verify the borrower’s identity or application information—not to collect the debt;
is the borrower’s duly authorized representative for the particular matter; or
must receive information because of a court order, lawful government process, or another specific legal requirement.

A relative, employer, or former partner does not become liable simply because the lender found that person’s number or because the borrower listed the person as a reference.

The rule for relatives, employers, and former partners

Person contacted	What is generally allowed	What is generally prohibited
Relative or friend	Verification if the person was knowingly selected as a character reference; collection if the person validly agreed to be a guarantor or co-maker	Asking the person to pressure the borrower, revealing the overdue loan, threatening embarrassment, or demanding payment from a non-guarantor
Employer, supervisor, HR, or co-worker	Limited employment or identity verification during a loan application when lawful and necessary; communication required by valid legal process	Reporting the debt to shame the borrower, threatening dismissal, repeatedly calling the office, or asking staff to collect from the borrower
Former boyfriend, girlfriend, or unmarried partner	Contact only if the person has a separate lawful role, such as an expressly consenting guarantor	Treating the former relationship as permission to disclose or collect the loan
Former or current spouse	Contact if the spouse signed as co-borrower, co-maker, guarantor, or authorized representative; other property issues may require document-specific legal advice	Assuming marriage alone makes the spouse personally liable or permits public disclosure
Character reference	Identity and information verification connected with evaluating the application	Debt collection, marketing, cross-selling, or automatically treating the reference as a guarantor
Guarantor or co-maker	Collection within the scope of the signed undertaking and applicable law	Harassment, false threats, public shaming, or demands beyond the person’s actual undertaking

The exact result depends on the loan contract, guaranty or co-maker document, privacy notice, consent records, source of the contact information, and what the collector actually communicated.

Why access to a phone’s contacts is not blanket permission

The Data Privacy Act of 2012 requires personal-data processing to be transparent, lawful, connected to a legitimate purpose, and proportionate. Data must be adequate and relevant, but not excessive.

Under NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02:

an online lending app cannot require unnecessary permissions;
access must begin only when the information is actually necessary for a lawful purpose;
the app should tell the user when a permission may be revoked;
access to a contact list must be limited and proportionate;
“unbridled” contact-list processing—including processing that causes harassment, unfair collection, or collection outside the borrower’s guarantors—is prohibited; and
the app should provide a separate interface through which the borrower chooses any character reference or guarantor, instead of copying or using the entire contact list indiscriminately.

The circular permits limited processing of proportional contact-list metadata and limited access needed to select a reference or guarantor. It does not authorize mass messaging, text blasts, public shaming, or collection calls to everyone in the phone.

Clicking “Allow contacts” or accepting a long privacy policy therefore does not automatically legalize every later use. A privacy notice is also not the same thing as valid consent. Even borrower consent does not turn an uninvolved third party into a debtor or guarantor.

A character reference is not a guarantor

A character reference is used to verify the borrower’s identity or the truthfulness of information supplied during the loan application.

The lender must tell the reference:

that the borrower selected them as a reference;
how the lender obtained their contact details; and
that they may request removal of their personal data as a character reference.

The lender may not contact that person for unrelated purposes such as debt collection, marketing, cross-selling, or offering products to third parties. A character reference cannot automatically be treated as a guarantor.

A guarantor, by contrast, expressly undertakes to answer for the borrower’s obligation if the borrower fails to perform. NPC rules require the guarantor’s separate consent. Article 2055 of the Civil Code also states that a guaranty is not presumed: it must be express and cannot extend beyond what was stipulated.

Writing someone’s name and number in an app does not, by itself, prove that the person agreed to guarantee the loan.

Contacting the borrower at work is different from contacting the employer

A collector may use a legitimate channel to communicate directly and reasonably with the borrower. But calling a workplace does not give the collector permission to discuss the loan with HR, a supervisor, receptionist, or co-worker.

Once the collector learns that a number belongs to a third party, the collector should not reveal:

that the borrower has a loan;
the amount or due date;
an allegation that the borrower refuses to pay;
threats of a case, arrest, barangay action, or employment consequences; or
other account information.

Even a seemingly neutral request such as “Tell your employee to pay us” can be improper when it uses a non-guarantor third party as collection leverage. Repeated office calls may also become harassment.

A different rule may apply when an employer receives genuine legal process after a court case. That is not the same as a collector informally threatening to call the borrower’s boss.

What collectors are still allowed to do

The prohibition on third-party harassment does not cancel a valid loan. A legitimate lender may generally:

contact the borrower through reasonable, disclosed channels;
send accurate payment reminders and demands;
offer restructuring or a payment arrangement;
refer the account to an authorized collection agency or lawyer;
disclose necessary information to its authorized agents, subject to confidentiality and data-protection duties;
report information through legally authorized credit-information systems;
collect from a valid guarantor, surety, co-maker, or co-borrower according to the governing documents; and
file a civil action.

Money claims not exceeding ₱1,000,000, exclusive of interest and costs, may fall under the Supreme Court’s current small-claims procedure, depending on the nature of the claim. See the Rules on Expedited Procedures in the First Level Courts.

The Constitution prohibits imprisonment for debt. However, separate conduct—such as an independently established offense involving fraud or a dishonored check—may have separate legal consequences and requires proper legal process. A collector cannot truthfully claim that an arrest warrant already exists when none has been issued.

Conduct that should raise an immediate red flag

Preserve evidence and consider reporting the incident if the lender or collector:

messages multiple phone contacts about the loan;
posts the borrower’s name, photograph, ID, or alleged debt in a group chat or on social media;
calls relatives, an employer, or a former partner to pressure or shame the borrower;
demands payment from a person who never signed as guarantor or co-maker;
threatens violence, arrest without legal basis, fabricated criminal charges, dismissal from work, or public humiliation;
impersonates police, court, barangay, NBI, SEC, NPC, or another government office;
sends altered photographs or defamatory messages;
continues after being told that the number belongs to an unrelated person;
refuses to identify the legal company operating the app; or
asks for payment to an unverified personal account.

The Financial Products and Services Consumer Protection Act prohibits abusive debt-recovery practices and requires financial service providers to respect client privacy. For SEC-regulated lending and financing companies, SEC Memorandum Circular No. 18, Series of 2019 specifically addresses unfair collection. The SEC’s current online-lending framework under SEC Memorandum Circular No. 20, Series of 2026 does not turn app access into permission to pursue non-guarantor contacts.

What to do if third parties are being contacted

1. Preserve evidence before blocking or uninstalling

Keep:

screenshots showing the full message, sender, date, and time;
call logs, voicemail, emails, chat threads, and social-media posts;
screenshots from each relative, employer, or other recipient;
the app-store listing, website, privacy notice, and permission screens;
the loan agreement, disclosure statement, payment records, and account ledger;
the lender’s corporate name, SEC registration number, Certificate of Authority number, app name, and collection-agency name;
copies of every complaint and proof of delivery; and
a written chronology identifying who was contacted, when, what was said, and how the information was obtained.

Ask third-party recipients to preserve their original copies instead of merely forwarding cropped images. Do not publicly repost unredacted IDs, account numbers, phone numbers, or private messages.

Be cautious about secretly recording live calls. The Anti-Wiretapping Act can apply to unauthorized recording of private communications. Preserve call logs and contemporaneous notes, and use recordings only if lawfully made.

2. Revoke unnecessary app permissions

After preserving evidence, disable access to contacts, photos, storage, location, microphone, and other resources that are not necessary. Consider uninstalling the app after saving the documents needed to manage or dispute the account.

Revoking permission does not necessarily delete information already copied. Send a separate written privacy request.

3. Send a written complaint to the lender and its data protection officer

Identify the account and incidents precisely. A concise notice may say:

I object to the use or disclosure of my personal data for contacting persons who are not my guarantors, co-makers, co-borrowers, or authorized representatives. Stop all such contact immediately and direct lawful account communications to me through [channel]. Please identify the source, purpose, lawful basis, recipients, and dates of disclosure of the personal data involved; preserve all relevant collection and access logs; and erase or block third-party contact data used unlawfully or for an unauthorized purpose. This request does not waive my right to dispute the account, charges, or collection conduct.

A borrower may request access to information about the sources, purposes, recipients, reasons for disclosure, access dates, retention period, and the lender’s data protection officer. Under the NPC’s Guidelines on Data Subject Rights, a personal information controller should act without undue delay and generally within 30 working days after receiving the request and necessary documents. A complex or numerous request may be extended by up to 15 working days if the requester is notified of the reason.

Erasure is not absolute. The lender may retain information genuinely necessary to service the loan, comply with law, or establish or defend a legal claim. That does not justify continuing to use unrelated third-party data for collection pressure.

4. Address the debt separately

If the debt is valid, request:

an itemized statement;
the principal, interest, fees, penalties, payments, and remaining balance;
the legal name and authority of the collecting entity;
official payment instructions; and
any available restructuring proposal.

Disputing harassment does not require admitting an amount that is incorrect. Conversely, paying or promising to pay does not waive a privacy or unfair-collection complaint.

Never send money to a collector’s personal account without independently confirming that the channel is authorized.

Where to complain

SEC-regulated lending or financing company

Use the SEC’s iMessage ticketing system and select the service for complaints on financing and lending companies. Attach the loan documents, messages, chronology, company details, and prior written complaint.

An app’s brand name may differ from its corporate operator. Obtain the legal name from the loan agreement, disclosure statement, privacy notice, website, or app-store listing.

National Privacy Commission

A borrower or contacted third party may complain about the processing of their own personal data. For example, a relative can complain about the lender’s collection and use of the relative’s phone number, while the borrower can complain about disclosure of the borrower’s loan information.

Before filing, the complainant must ordinarily notify the lender or other responsible entity in writing and allow it to act. If there is no response within 15 calendar days, or the response is not timely or appropriate, a formal NPC complaint may be filed. The NPC may waive this exhaustion requirement for good cause or serious situations, including grave and irreparable harm, lack of an adequate remedy, or patently illegal conduct.

The complaint must generally be written, verified, supported by evidence and correspondence, and accompanied by a certification against forum shopping. The NPC’s current filing page provides the complaint form, fee information, and submission options. Review the 2021 NPC Rules of Procedure, as amended before filing.

BSP-supervised lender

If the app is operated by a bank or another Bangko Sentral-supervised institution, complain first through the institution’s Financial Consumer Protection Assistance Mechanism. If the response is unsatisfactory or the institution does not act within a reasonable period, escalate through the BSP Online Buddy or the channels in the BSP’s current complaint guide.

BSP Circular No. 1160 prohibits abusive collection and requires fair treatment, protection of client information, and a consumer-assistance mechanism.

Law enforcement

Seek immediate police, NBI, or cybercrime assistance when there is a credible threat of violence, extortion, stalking, identity theft, account takeover, impersonation of authorities, or publication that creates an urgent safety risk. Preserve the original communications and avoid confronting a potentially dangerous sender alone.

Common mistakes to avoid

Assuming a character reference is legally responsible for the loan.
Believing that accepting app permissions waives all privacy rights.
Deleting messages or uninstalling the app before preserving evidence.
Ignoring genuine court papers because earlier collector threats were false.
Paying an unverified collector or personal e-wallet account.
Posting unredacted evidence publicly and exposing more personal data.
Sending only a verbal complaint when written proof is needed.
Demanding deletion of every loan record when some records may lawfully be retained.
Letting relatives argue with collectors instead of preserving evidence and clearly stating that they are not guarantors.
Assuming that outsourcing excuses the lender. The lender’s obligations are not avoided merely by using a collection agency or third-party service provider.

When legal help is urgent

Consult a Philippine lawyer promptly if:

court papers, a summons, or an actual subpoena have been received;
the lender claims a relative or former partner signed a guaranty that the person disputes;
an employer is threatening discipline or dismissal because of the collection activity;
private photographs, IDs, or sensitive information have been published;
the harassment caused documented financial, employment, medical, or reputational harm;
the collector is using several corporate names or the responsible entity cannot be identified;
a payment settlement includes a broad waiver or admission;
there are allegations of fraud, falsified documents, or a dishonored check; or
immediate injunctive or protective relief may be needed.

Frequently asked questions

Can a lending app call my mother or sibling just to ask them to remind me?

For an SEC-regulated lending or financing company, using a non-guarantor contact for collection is generally prohibited even if the message is phrased as a reminder. Revealing that the borrower has an overdue loan makes the privacy issue more serious.

Can my employer be told that I failed to pay?

Not merely to pressure or embarrass you. Direct workplace contact with the borrower is different from disclosing the account to HR, a supervisor, receptionist, or co-worker. Valid court or government process is a separate matter.

Is my former partner responsible because we lived together when I borrowed?

Not on that fact alone. Liability normally requires that the person signed or otherwise validly undertook an obligation as co-borrower, co-maker, guarantor, or surety. Marriage, property-regime, or jointly acquired-benefit issues may require a document-specific legal assessment.

Can a reference ask the lender to remove their number?

Yes. NPC rules require the lender to give a character reference the option to have their personal data removed as a reference. The lender may still retain data when another lawful and necessary basis applies, but it cannot automatically turn the reference into a guarantor.

What if the borrower really has not paid?

The lender may pursue lawful collection and civil remedies. Default does not authorize contact-list blasting, threats, false statements, or public shaming.

Does deleting the app erase information already collected?

No. Revoke permissions, preserve evidence, and send a written access, objection, erasure, or blocking request. Ask the lender to identify any third parties that received the data.

Can a relative or employer file their own complaint?

Yes, if their own personal data was improperly collected, used, or disclosed. They should preserve the messages they personally received and follow the applicable NPC or regulator complaint procedure.

This article provides general Philippine legal information, not legal advice or a prediction of any particular case. Outcomes depend on the contracts, consent records, communications, identity of the lender, and other evidence. Laws, rules, and official procedures were checked against primary government sources as of 6 August 2026.