In the Philippines, a collection agency generally cannot text your entire contact list to shame you, pressure you, or force payment of a loan. Collectors may pursue payment through lawful and reasonable means, but mass-texting your relatives, friends, officemates, clients, or Facebook contacts about your debt crosses into data privacy violation, unfair debt collection, harassment, and possibly civil or criminal liability depending on the message. This article explains what Philippine law says, what collectors are allowed to do, what is clearly prohibited, and how to document and report abusive collection tactics.

Quick Answer: Can a Debt Collector Text Everyone in Your Contacts?

Usually, no.

A lender or collection agency may contact you about a valid debt. In limited situations, it may contact a properly named guarantor, co-maker, or character reference for a lawful and specific purpose.

But it cannot simply harvest your phonebook and send messages such as:

“Si Juan may utang, ayaw magbayad.”
“Please tell Maria to pay her loan or we will file a case.”
“Your friend is a scammer / estafador / debtor.”
“You were listed as co-maker, pay now.”
Group texts to your family, employer, coworkers, clients, or church/community contacts
Threats to post your face, ID, or debt details online

The National Privacy Commission (NPC), Securities and Exchange Commission (SEC), and Department of Information and Communications Technology (DICT) specifically reiterated in a 2026 public advisory that unnecessary or excessive processing of personal data through online lending platforms is prohibited, especially access to borrowers’ contact lists for harassment, public shaming, or debt collection outside lawful limits.

Why This Is Illegal Even If You Really Owe Money

A real debt does not give a collector unlimited power.

Under Philippine law, the creditor may demand payment, send statements, offer restructuring, endorse the account to a legitimate collection agency, report to lawful credit channels when allowed, or file a civil collection case. But the collector must still respect your privacy, dignity, and lawful rights.

The key distinction is this:

Collector action	Usually allowed?	Why
Texting or calling the borrower about the debt	Yes, if reasonable	This is normal collection
Contacting a true guarantor or co-maker	Yes, within limits	They may have a legal obligation
Calling a character reference only to verify identity or information	Limited	A reference is not automatically liable
Texting your entire contact list	No	Excessive and unlawful processing of personal data
Telling your boss, relatives, or friends that you owe money	Generally no	Disclosure of debt information can violate privacy and collection rules
Threatening jail for ordinary unpaid debt	No	The Constitution prohibits imprisonment for debt, though fraud-related crimes are different
Posting your face, ID, or debt on social media	No	Possible privacy, civil, and criminal consequences

The 1987 Philippine Constitution states that no person shall be imprisoned for debt or non-payment of a poll tax. This does not protect fraud, bouncing checks, or other crimes, but it does mean a collector cannot honestly threaten jail simply because a borrower cannot pay an ordinary loan. (Supreme Court E-Library)

Key Terms: Contact List, Character Reference, Guarantor, and Co-Maker

Many abusive collectors blur these terms on purpose. They are not the same.

Contact list

Your contact list is your phonebook, email contacts, social media contacts, or any list of people you can communicate with. NPC Circular No. 2022-02 expressly includes phone contact lists, email lists, and social media contacts in this concept.

A loan app may not treat your whole contact list as a collection weapon.

Character reference

A character reference is someone whose contact details are provided to verify your identity or the truthfulness of information in your loan application. The NPC states that character references are for verification of identity and veracity of information, not for debt collection, marketing, cross-selling, or forcing that person to pay.

A character reference is not automatically liable for your loan.

Guarantor

A guarantor is someone who expressly binds themselves to answer for the borrower’s obligation if the borrower fails to pay. NPC Circular No. 2022-02 says separate consent must be obtained from the guarantor, and for debt collection purposes, lending and financing companies may contact only the guarantor; contacting other persons in the borrower’s contact list is prohibited.

Co-maker

A co-maker is usually a person who signs the loan documents as a direct co-obligor. If someone never signed or knowingly agreed to be a co-maker, a collector should not simply invent that status through a text message.

Legal Basis Under Philippine Law

Data Privacy Act: Your Contacts Are Personal Data

Republic Act No. 10173, or the Data Privacy Act of 2012, protects personal information in both government and private-sector information systems. The law recognizes privacy as a fundamental right and requires personal data to be processed lawfully, fairly, and securely. (National Privacy Commission)

For loan-related transactions, NPC Circular No. 20-01 treats lending and financing companies as personal information controllers. This means they are responsible for how borrower data is collected, stored, used, shared, and protected. The Circular covers loan solicitation, evaluation, granting, repayment, debt collection, and remedial measures.

The Data Privacy Act also gives data subjects rights, including the right to access information, object to processing, request blocking/removal/destruction of unlawfully obtained or unauthorized data, and claim damages for unauthorized use of personal information. (National Privacy Commission)

NPC Rules on Loan Apps and Contact Lists

The NPC has specific rules for online lending and loan-related transactions.

NPC Circular No. 2022-02 says:

Loan apps must not require unnecessary permissions.
Access to personal data through app permissions must be suitable, necessary, and not excessive.
Accessing contact lists must be limited.
Unbridled processing of contact lists is prohibited.
Processing that leads to harassment, debt collection outside guarantors, or unfair collection practices is prohibited.
Contact lists may be used only in limited ways, such as allowing the borrower to choose character references or guarantors.

This is important because many borrowers clicked “Allow Contacts” during a loan application. That does not mean the lender may shame the borrower by texting everyone. Consent must be specific, informed, and tied to a legitimate purpose. The NPC’s rules also require just-in-time notices before obtaining consent, so borrowers understand how a specific piece of information will be processed.

SEC Rules on Unfair Debt Collection

For lending companies and financing companies, SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair debt collection practices by financing companies, lending companies, and third-party service providers hired by them. It allows reasonable and legally permissible collection, but requires good faith, reasonable conduct, and restraint from unscrupulous acts.

The SEC circular treats the following as unfair collection practices:

Use or threat of violence or criminal means to harm a person, reputation, or property
Threats to take action that cannot legally be taken
Use of obscenities, insults, or profane language amounting to a criminal act or offense
Disclosure or publication of names and personal information of borrowers who allegedly refuse to pay
Communicating false loan information, including failure to say that a debt is disputed
False representation or deceptive means to collect a debt
Contacting borrowers at unreasonable times, defined as before 6:00 a.m. or after 10:00 p.m., subject to limited exceptions
Contacting persons in the borrower’s contact list other than those named as guarantors or co-makers

The SEC circular also makes the lending or financing company responsible for the conduct of its outsourced collectors. A lender cannot escape liability by saying, “Collection agency lang po iyon.”

If the Debt Is from a Bank or Credit Card

If the debt is from a bank, credit card issuer, or other BSP-supervised financial institution, Bangko Sentral ng Pilipinas rules apply. BSP Circular No. 1003 provides that banks and their collection agents may communicate through acceptable and reasonable modes, but they must not harass, abuse, oppress, or engage in unfair practices in collecting credit card debt. The BSP rules also prohibit disclosure of the names of credit cardholders who allegedly refuse to pay, threats to take unlawful action, false credit information, deceptive collection means, and contact before 6:00 a.m. or after 10:00 p.m. unless allowed by the rules.

Credit card issuers must also notify cardholders in writing at least seven business days before endorsing an account to a collection agency or transferring it from one collection agency to another, and the notice must include the collection agency’s name and contact details.

Civil and Criminal Consequences for Abusive Collection

A borrower may have remedies beyond an administrative complaint.

Under the Civil Code, every person must act with justice, give everyone their due, and observe honesty and good faith. A person who willfully causes loss or injury in a manner contrary to morals, good customs, or public policy may be liable for damages. Article 26 also protects a person’s dignity, personality, privacy, and peace of mind, and recognizes relief for acts such as meddling with private life, intriguing to alienate someone from friends, or vexing or humiliating a person because of personal condition. (Lawphil)

Depending on the facts, abusive collectors may also face criminal complaints for threats, coercion, unjust vexation, or libel. The Revised Penal Code punishes grave threats, grave coercions, unjust vexations, and libel under separate provisions. A message falsely calling someone a criminal, scammer, estafador, or immoral person may create a different legal issue from a simple payment reminder. (Lawphil)

What To Do If a Collection Agency Texted Your Contacts

1. Preserve evidence before deleting anything

Do this first, because agencies often deny the messages later.

Save:

Screenshots of every text, Viber, Messenger, WhatsApp, Telegram, email, or social media message
The sender’s number, profile name, username, or email address
Date and time stamps
Call logs
Screen recordings showing the message thread
Messages received by your relatives, coworkers, boss, clients, or friends
The loan app name, Google Play/App Store link, company name, and SEC registration details if available
Your loan agreement, disclosure statement, privacy notice, and screenshots of app permissions
Proof that the collector falsely called someone a guarantor or co-maker

Ask affected contacts to forward screenshots to you without editing the image. If possible, ask them to include the sender’s number and the full message thread.

2. Revoke unnecessary app permissions

After preserving evidence, check your phone settings and revoke unnecessary permissions such as Contacts, SMS, Photos, Camera, Microphone, Location, and Files if the loan app no longer needs them.

Do not assume uninstalling the app ends the problem. The lender or collector may already have copied or processed data. Still, revoking permissions helps stop further access.

3. Send a written objection to the lender or collector

Send a clear written objection by email, in-app support, or registered channel. Keep proof of sending.

A practical message can say:

I object to the processing and disclosure of my personal data and my contacts’ personal data for debt collection outside lawful purposes. I also object to contacting persons who are not guarantors or co-makers. Please stop contacting my phone contacts, remove unlawfully processed contact-list data, identify the source of the data used, and provide the name, address, and authority of the collection agency handling my account.

This creates a paper trail. It also helps show regulators that you raised the issue directly.

4. Identify the correct agency to report to

Different agencies handle different parts of the problem.

Situation	Main agency	What to file
Loan app harvested contacts or used personal data for harassment	National Privacy Commission	Data privacy complaint
Lending/financing company or its collector used abusive debt collection	Securities and Exchange Commission	Unfair debt collection complaint
Bank or credit card collector harassed you	BSP, after using the bank’s consumer assistance channel	Financial consumer complaint
Threats, scams, hacking, impersonation, cyber harassment	PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT cyber channels	Criminal/cybercrime report
Defamatory posts or messages causing damage	Prosecutor’s office or court route, depending on the case	Criminal/civil action

The 2026 DICT-NPC-SEC advisory lists SEC iMessage for unfair debt collection complaints, DICT Cyber Hotline 1326@dict.gov.ph, NBI Cybercrime Division at ccd@nbi.gov.ph, and PNP Anti-Cybercrime Group contact channels for other harassment, threats, fraud, or scams.

5. File a complaint with the National Privacy Commission

For data privacy violations, the NPC requires a formal complaint in a specific format. The NPC complaint page says the complainant should download the form, print and fill it out, have it notarized, and submit it in person, by courier, or by scanned email. (National Privacy Commission)

Prepare these attachments:

Notarized complaint form
Valid ID
Screenshots and screen recordings
Loan agreement or app screenshots
Privacy notice or consent screen, if available
Proof of app permissions requested
Names/numbers of people contacted, if they consent to being included
Written objection or demand sent to the lender/collector
Any reply from the company

The NPC may investigate, facilitate settlement, issue orders, or recommend prosecution to the Department of Justice for certain Data Privacy Act offenses. The Data Privacy Act authorizes the NPC to receive complaints, investigate, adjudicate, award indemnity on matters affecting personal information, and recommend prosecution for specified offenses. (National Privacy Commission)

6. File with the SEC for unfair debt collection

For lending companies, financing companies, and online lending platforms, file with the SEC. The SEC iMessage portal accepts complaints and reports, and the 2026 advisory identifies SEC’s Financing and Lending Companies Department as the channel for unfair debt collection practices. (Securities and Exchange Commission)

Useful attachments include:

Borrower’s full name and contact details
Respondent company name and app name
Collection agency name, if known
Loan account number, if available
Screenshots of messages sent to you and your contacts
Screenshots showing threats, insults, false claims, or disclosure of debt
Proof that contacted persons were not guarantors or co-makers
SEC registration or online lending platform listing, if found

The SEC circular provides administrative penalties for violations, including fines and possible suspension or revocation of authority depending on the offense and circumstances.

7. If it is a bank or credit card debt, use the bank’s complaint channel first

For BSP-supervised institutions, raise the complaint with the bank or credit card issuer’s financial consumer protection assistance mechanism first. If unresolved, escalate to BSP through BSP Online Buddy or by submitting the Complaints, Inquiries, and Requests form by email. BSP’s consumer assistance page states that BOB can give a case reference number, while email and mail channels require supporting documents and may involve evaluation by BSP. (Bureau of Soils and Water Management)

Attach:

Statement of account
Collection notice
Proof of endorsement to the collection agency, if any
Screenshots of harassment or disclosure
Your complaint to the bank and the bank’s reply, if any
Your requested resolution

Common Scenarios

“I clicked Allow Contacts. Did I consent?”

Not necessarily. Consent under data privacy rules must be informed, specific, and tied to a legitimate purpose. The NPC has made clear that unbridled contact-list processing is prohibited, especially if it leads to harassment or debt collection outside guarantors.

“They texted my employer. Is that allowed?”

Usually not if the purpose is to shame you, reveal your debt, or pressure your employer to make you pay. If your employer was not a guarantor or co-maker, debt collection messages to your employer may violate SEC and NPC rules.

“They told my mother she is my co-maker even though she never signed.”

A person is not a co-maker or guarantor just because the borrower listed their number or the collector says so. A guarantor must have separately consented to be bound, and a character reference is not automatically treated as a guarantor.

“The collector said they will post my ID and photo online.”

That is a serious red flag. NPC Circular No. 2022-02 specifically says a borrower’s photo must not be used to harass or embarrass the borrower to collect a delinquent loan or for unfair collection practices.

“The loan app is not SEC-registered. Can I still complain?”

Yes. NPC Circular No. 20-01 applies to lending or financing companies and persons acting as such, whether or not they have SEC authority, as far as the processing of personal data is concerned.

Documents and Evidence Checklist

Evidence	Why it matters
Screenshots of texts to you and your contacts	Shows disclosure, threats, or harassment
Sender number, account name, and profile URL	Helps identify the collector
Loan agreement and disclosure statement	Shows the creditor and loan terms
App name and app store link	Helps regulators trace the online lending platform
Privacy notice and consent screen	Shows what consent was actually requested
App permissions screenshot	Shows access requested by the app
Written objection to the company	Shows you objected and requested removal/blocking
Statements from contacted persons	Shows third-party harassment
Proof they were not guarantors/co-makers	Refutes the collector’s excuse
Bank/credit card endorsement notice	Important for BSP-supervised debts

Frequently Asked Questions

Can a collection agency text my family about my debt?

Generally, no. A collector may not disclose your debt to family members just to shame or pressure you. If the family member is not a guarantor, co-maker, or properly contacted reference for a limited verification purpose, the message may violate privacy and unfair collection rules.

Can an online lending app access my contacts in the Philippines?

Only in a very limited way. NPC rules allow limited access when suitable, necessary, and not excessive, such as letting you choose your own character references or guarantors. Unrestricted harvesting and use of your contact list for harassment or debt collection is prohibited.

Can a character reference be forced to pay my loan?

No. A character reference is for identity or information verification. The NPC expressly says a character reference is not automatically treated as a guarantor.

Can a collector contact my guarantor?

Yes, if that person is truly a guarantor and gave separate consent to be bound. For debt collection purposes, NPC rules allow contacting the guarantor, but not random people from your contact list.

What if the collector says I will go to jail if I do not pay?

For ordinary unpaid debt, that threat is misleading. The Philippine Constitution prohibits imprisonment for debt. However, separate criminal issues may exist if there was fraud, falsified documents, bouncing checks, or another offense. (Supreme Court E-Library)

Can I sue for damages if my reputation was harmed?

Possibly. The Civil Code protects dignity, privacy, peace of mind, and good-faith conduct. If the collector’s actions caused reputational harm, emotional distress, business loss, or other damage, civil remedies may be available depending on the evidence. (Lawphil)

Should I still pay the loan if the collector violated my privacy?

A privacy violation does not automatically erase a valid debt. These are separate issues. You may still dispute the amount, ask for a statement of account, negotiate payment, or challenge illegal charges while separately reporting unlawful collection practices.

Where do I report loan app harassment in the Philippines?

Report data misuse to the NPC, unfair debt collection by lending or financing companies to the SEC, bank or credit card collection abuse to the BSP after using the provider’s complaint channel, and threats/scams/cyber harassment to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DICT cyber hotline channels.

Can foreigners in the Philippines complain?

Yes, if their personal data is processed in the Philippines or the lender/collector has a Philippine link. The Data Privacy Act also has extraterritorial provisions covering certain acts done outside the Philippines when they relate to personal information about Philippine citizens or residents, or where the entity has links with the Philippines. (National Privacy Commission)

Key Takeaways

A collection agency generally cannot text your entire contact list to collect a debt.
Giving an app contact permission does not authorize harassment, public shaming, or unrestricted contact-list processing.
A character reference is not automatically a guarantor or co-maker.
For debt collection, lenders may generally contact only the borrower and true guarantors/co-makers, subject to legal limits.
SEC rules prohibit abusive, deceptive, threatening, and privacy-invasive collection practices by lending and financing companies and their collectors.
NPC rules prohibit unbridled contact-list processing and allow complaints for data privacy violations.
Banks and credit card issuers are also responsible for the conduct of their collection agents under BSP rules.
Preserve screenshots, messages, call logs, app permissions, loan documents, and complaints before deleting anything.
A valid debt may still be collected, but it must be collected lawfully and without violating privacy, dignity, or consumer protection rules.