Quick answer

Generally, no. A lending app may contact the borrower and, for debt collection, a person who validly and separately agreed to be a guarantor. It may not use the borrower’s contact list to call, text, shame, threaten, or disclose the debt to relatives, an employer, coworkers, friends, or a former partner merely to pressure the borrower.

Important exceptions are narrow:

A character reference may be contacted only to verify the borrower’s identity or the truthfulness of information supplied during the loan application—not to collect the debt.
A guarantor may be contacted about the obligation if that person expressly agreed to act as guarantor.
A person who actually signed as a co-maker, surety, or joint debtor may have obligations under the loan documents. Liability depends on what was validly signed, not on family or personal relationships.
Limited employment verification during an application may be lawful if it is necessary, transparent, proportionate, and supported by a lawful basis. That does not authorize later disclosure of the debt to HR, a supervisor, or coworkers.
Disclosure required by a court order, law, or lawful government process may be permitted.

The government’s March 2026 joint advisory is explicit: contacting people in the borrower’s contact list other than named, consenting guarantors for debt collection is prohibited. This applies to mobile apps, websites, and other online lending platforms, whether recorded or unrecorded. See the DICT-NPC-SEC Advisory on Online Lending Platforms.

The general rule: the debt must be kept confidential

The borrower’s name, contact details, loan status, balance, due date, and alleged default are personal data. Under the Data Privacy Act of 2012, processing and disclosure must have a lawful basis and must remain transparent, legitimate, necessary, and proportionate.

The lender may pursue lawful collection, but it cannot turn the borrower’s private relationships into a collection network. The following are generally prohibited:

Uploading, copying, or harvesting the borrower’s entire phone, email, or social-media contact list for collection;
Calling relatives, friends, neighbors, coworkers, an employer, or a former partner to demand payment;
Telling third parties that the borrower has an unpaid loan;
Asking third parties to pressure, embarrass, or publicly expose the borrower;
Sending the borrower’s photograph, identification document, loan balance, or insulting “warning” poster to other people;
Posting the borrower’s name or personal information online;
Threatening third parties or falsely claiming that they are liable for the debt; and
Using a collection agency to do anything the lender itself is prohibited from doing.

The lender remains accountable for collectors and other service providers acting for it. Outsourcing collection does not transfer or erase that responsibility.

Who may be contacted—and for what purpose?

Person contacted	What is generally allowed	What is generally prohibited
Borrower	Reasonable, lawful, confidential collection communications	Threats, insults, deception, public shaming, or unreasonable contact
Relative, spouse, friend, or former partner	Application-stage verification if validly named as a character reference; collection only if the person validly became a guarantor or other loan party	Contacting the person merely because of the relationship, revealing the debt, or demanding payment without a valid obligation
Character reference	Verifying the borrower’s identity and the truthfulness of application information	Using the reference for debt collection, marketing, cross-selling, or unrelated disclosures
Guarantor	Communications within the scope of a valid guaranty	Treating someone as a guarantor without separate consent or valid supporting documents
Co-maker, surety, or joint debtor	Communications justified by the person’s actual contractual role	Inventing that status or relying only on a name or phone number entered in the app
Employer, HR, supervisor, or coworker	A proportionate employment-verification inquiry during application, where lawfully justified; direct confidential contact with the borrower through a lawful work channel may be fact-dependent	Disclosing the debt, asking the employer to shame or pressure the borrower, or threatening employment consequences
Court, regulator, or authorized government agency	Disclosure required or authorized by law or lawful order	Voluntary over-disclosure beyond what the lawful request requires

A character reference is not a guarantor

Under NPC Circular No. 2022-02, a character reference is provided to verify the borrower’s identity and the truthfulness of information used to evaluate the loan.

The lender must:

Inform the reference that the borrower identified them as such;
Explain how it obtained the reference’s contact details; and
Offer the person the option to have their data removed as a character reference.

A character reference cannot automatically be converted into a guarantor. A guarantor must separately consent and expressly bind themselves to answer for the borrower’s obligation. The Civil Code likewise provides that guaranty is not presumed; it must be express. See Articles 2047 and 2055 of the Civil Code.

Merely entering someone’s name and phone number—or allowing an app to see that person in a contact list—does not establish a guaranty.

Does clicking “Allow contacts” make third-party collection legal?

No. Under SEC Memorandum Circular No. 18, contacting people in the borrower’s contact list other than named guarantors or co-makers is an unfair collection practice notwithstanding the borrower’s consent.

Consent under the Data Privacy Act must also be freely given, specific, informed, and evidenced in writing, electronically, or by recorded means. A broad app permission cannot legitimize unnecessary or disproportionate processing. Deceptive interfaces, pre-ticked boxes, hidden privacy terms, or designs that make refusal or withdrawal difficult may undermine valid consent.

Current NPC rules permit only limited access needed to let the borrower choose a character reference or guarantor, or to derive proportionate metadata for a specified legitimate purpose. Unconstrained copying and use of the contact list is prohibited.

Can the app contact the borrower at work?

The law does not create a blanket ban on every direct communication with a borrower through a work number or address. But the lender must keep the communication confidential and reasonable.

There is an important difference between:

Privately asking to speak with the borrower without revealing the purpose; and
Telling reception, HR, a manager, or coworkers that the borrower owes money.

The second situation may involve an unauthorized disclosure and an unfair collection practice. Repeated workplace calls intended to embarrass the borrower, disrupt employment, or threaten dismissal are especially problematic.

Where the employer is genuinely involved in a lawful salary-deduction arrangement, is a party to the transaction, or must respond to a lawful court or government order, the documents and applicable law must be examined. Those situations should not be assumed from the mere existence of an employment relationship.

Other prohibited collection conduct

SEC Memorandum Circular No. 18, Series of 2019 prohibits lending companies, financing companies, and their collectors from conduct including:

Using or threatening violence or other criminal means against any person, reputation, or property;
Threatening action that cannot legally be taken;
Using obscenities, insults, or abusive language;
Publishing borrowers’ names or personal information;
Communicating loan information known or reasonably expected to be false, including failing to disclose that a debt is disputed;
Using false representations or deceptive collection methods; and
Contacting the borrower before 6:00 a.m. or after 10:00 p.m.

The rule contains limited exceptions to the hours restriction where the account has been past due for more than 15 days or the borrower expressly agreed that those hours are the only reasonable opportunity for contact. Those exceptions do not authorize threats, harassment, public shaming, or contact with unauthorized third parties.

The Financial Products and Services Consumer Protection Act also prohibits financial service providers from employing abusive collection or debt-recovery practices and requires respect for client privacy.

What to do if other people are being contacted

1. Preserve the evidence before changing the app

Save:

Full screenshots and screen recordings showing the sender, number, date, time, and complete message;
Call logs, voicemail, emails with headers, chat histories, and collection letters;
Social-media URLs, account names, posts, comments, and timestamps;
The app’s name, developer, app-store page, privacy notice, requested permissions, and version;
The loan agreement, disclosure statement, payment history, receipts, and any dispute over the balance;
Messages sent to relatives, the employer, or former partner;
The collector’s name, claimed company, phone number, and collection agency;
Proof showing whether the contacted person was—or was not—a character reference or guarantor; and
A dated written statement or affidavit from each contacted person describing what was said.

Keep original files. Avoid cropping or editing the only copy.

2. Secure the phone and accounts

After documenting the evidence:

Revoke unnecessary contacts, storage, camera, location, microphone, and social-media permissions;
Change passwords if the app or collector may have obtained account access;
Enable multi-factor authentication;
Check for unfamiliar device sessions or account recovery changes; and
Remove the app if necessary, but remember that uninstalling it does not automatically delete data already copied by the lender.

3. Send a written demand to the lender and its data protection officer

Identify the loan and disputed conduct, then demand that the lender:

Stop contacting unauthorized third parties;
Communicate directly with the borrower through a specified channel;
Identify the source of the third parties’ contact information;
State the lawful basis, purpose, and recipients of the data processing;
Provide access to relevant personal data and disclosure records;
Correct false information;
Remove character-reference data where applicable; and
Preserve collection logs, recordings, messages, access records, and instructions given to collectors.

A deletion request is not absolute. The lender may retain data genuinely required by law, the loan contract, or the establishment, exercise, or defense of legal claims. It must still stop unauthorized use and dispose of data securely when lawful retention is no longer necessary.

4. Report unfair collection to the SEC

For a lending or financing company, submit the complaint through the SEC’s iMessage ticketing system and select the appropriate Financing and Lending Companies Department or FINLEND category. Attach the loan documents, communications, third-party messages, and proof of your written complaint to the company.

The March 2026 joint advisory also lists the SEC hotline as 1-4732 (1-4SEC).

5. File a privacy complaint with the NPC when appropriate

Ordinarily, the complainant must first notify the lender or concerned entity in writing and allow it to act. If it does not take timely and appropriate action, or gives no response within 15 calendar days after receiving the written notice, a complaint may be filed with the NPC. The NPC may waive this requirement for good cause or serious violations, including risks of grave and irreparable harm.

Under the 2021 NPC Rules of Procedure, as amended, the complaint should generally include:

A notarized complaint-assisted form or verified complaint;
A clear factual narrative and the relief requested;
Supporting documents and witness affidavits;
All correspondence with the lender and proof of receipt;
A certification against forum shopping; and
The applicable filing fee, unless an exemption or waiver applies.

Filing may be personal, by registered mail, by authorized courier, or by email when authorized by the NPC. Check the NPC’s current complaint mechanics before filing.

A borrower and the contacted third party may have different privacy injuries. Each should describe the personal data concerning them that was collected, used, or disclosed.

When help is urgent

Seek immediate assistance if the messages involve:

Threats of physical harm, kidnapping, sexual violence, property damage, or suicide inducement;
Stalking or disclosure of a home address or real-time location;
Impersonation of police officers, lawyers, courts, or government agencies;
Threats to fabricate a criminal case or arrest;
Publication of identification documents, intimate images, or altered photographs;
Unauthorized access to email, social media, banking, or mobile accounts; or
Demands to send money to an unfamiliar personal account.

For immediate danger, call the Philippines’ Unified 911 emergency hotline. For cyber-related threats, scams, or fraud, the 2026 joint advisory provides reporting details for the DICT Cyber Hotline, NBI Cybercrime Division, and PNP Anti-Cybercrime Group.

Possible consequences for the lender

Under SEC Memorandum Circular No. 18, the administrative penalties are:

Lending company: ₱25,000 for a first offense and ₱50,000 for a second offense;
Financing company: ₱50,000 for a first offense and ₱100,000 for a second offense; and
Third offense: depending on the circumstances and gravity, a fine of at least twice the second-offense fine but not more than ₱1 million, suspension of lending or financing activities for 60 days, or revocation of authority to operate.

Other sanctions may be imposed under separate laws. The NPC may issue compliance or enforcement orders, impose administrative fines, restrict processing, or recommend prosecution.

Depending on the proven facts, unauthorized processing or disclosure may also fall under the criminal provisions of the Data Privacy Act. For example, unauthorized processing of ordinary personal information carries a statutory penalty of one to three years’ imprisonment and a fine of ₱500,000 to ₱2 million; unauthorized disclosure of ordinary personal information carries one to three years and a fine of ₱500,000 to ₱1 million. Sensitive personal information and combinations of offenses carry different, often higher, penalties.

These penalties are not automatic whenever a relative receives a call. The specific offense, evidence, responsible persons, lawful basis, intent, and applicable procedure must be established.

Common mistakes to avoid

Assuming harassment cancels the loan. Unlawful collection does not automatically erase a valid debt. Dispute the collection conduct and the balance separately.
Paying the relative or collector without verification. Confirm the creditor, account, authority to collect, and official payment channel.
Deleting messages immediately. Preserve originals before blocking numbers or uninstalling the app.
Relying only on verbal complaints. Written notice and proof of receipt are important, particularly for an NPC complaint.
Assuming a relative is liable. Kinship, marriage, employment, or a past romantic relationship does not by itself create guarantor status.
Assuming “reference” means “co-maker.” Ask for the signed document showing the person’s alleged obligation.
Hiding another pending complaint. An NPC filing requires a certification against forum shopping and disclosure of relevant proceedings.
Posting unredacted evidence publicly. Complaining online may expose identification numbers, addresses, account details, or other people’s data.

Frequently asked questions

Can a collector ask my relative to tell me to call?

For debt collection arising from an online lending app’s use of a contact list, current NPC guidance prohibits contacting people other than named, consenting guarantors. A purportedly neutral message may still be unlawful if the contact information was improperly obtained or the real purpose is pressure or harassment.

Can the lender tell my family how much I owe?

Generally, no. That is loan information and personal data. Disclosure requires a valid legal basis and must fall within a lawful, necessary purpose. Being related to the borrower is not enough.

Can my employer deduct the loan from my salary?

Not merely because the lender demanded it. Any deduction must have a valid legal and documentary basis. The employer should examine the alleged authorization, applicable labor rules, and any lawful court process before acting.

Am I liable because the borrower listed me as a reference?

No. A reference is not automatically a guarantor. Ask the lender for the document it claims created your obligation. Do not acknowledge liability or pay solely because your number appeared in the app.

What if I signed as a guarantor without understanding the document?

Liability depends on the actual document, how consent was obtained, and applicable contract and consumer-protection law. Obtain a complete copy and seek legal advice promptly, especially if a demand letter or court paper has been received.

Can the lender call after 10:00 p.m.?

SEC rules ordinarily prohibit contact before 6:00 a.m. or after 10:00 p.m., subject to narrow exceptions for accounts past due by more than 15 days or express consent showing those are the only reasonable contact times. Harassment and unauthorized third-party contact remain prohibited.

Can both the SEC and NPC receive complaints?

Potentially, yes. The SEC addresses unfair collection by lending and financing companies, while the NPC addresses unlawful personal-data processing and disclosure. A complainant must accurately disclose related proceedings and comply with each agency’s requirements.

Should I ignore a summons because the lender harassed me?

No. A court summons, subpoena, or other official document has separate legal consequences. Verify it directly with the issuing court or agency and obtain legal assistance immediately.

Official sources

This article provides general Philippine legal information, not legal advice. The proper result depends on the loan documents, the person’s actual role, how the data was obtained and used, and the evidence available. Official sources and procedures were checked as of 23 July 2026.