Quick answer

Generally, no. A lending app, lending company, financing company, or its collection agency may contact the borrower through lawful and reasonable means, but it ordinarily may not contact relatives, an employer, co-workers, a former partner, or other people in the borrower’s phone or social-media contacts to collect the debt.

The principal exceptions are people who expressly became guarantors or co-makers. A person listed only as a character reference is not automatically a guarantor and may be contacted only to verify the borrower’s identity and the truth of information supplied during the loan application—not to pressure that person into paying or collecting from the borrower.

The borrower’s consent to access a phone’s contacts does not give the lender unlimited authority to call those contacts. SEC rules specifically treat contacting people in the borrower’s contact list, other than named guarantors or co-makers, as an unfair collection practice even when the borrower supposedly consented.

These restrictions do not erase a valid debt. The lender may still contact the borrower, demand lawful payment, report credit information when legally authorized, engage an authorized collection agency, or file an appropriate civil case.

The rule depends on the person’s actual legal role

The label used by the collector is not conclusive. What matters is whether the person actually agreed to a legally significant role.

Person contacted	What is generally allowed
Relative, friend, neighbor, co-worker, employer, or former partner who has no role in the loan	The lender should not disclose the debt or use that person to pressure, shame, or locate the borrower through harvested contacts.
Character reference	The lender may verify the borrower’s identity and the accuracy of application information. The reference is not automatically liable for the loan and should not be used for debt collection.
Guarantor	The lender may contact the guarantor about collection if that person expressly consented to act as guarantor in accordance with the law.
Co-maker or solidary debtor	The lender may pursue the person according to the signed agreement and the nature of the undertaking. Whether someone is truly a co-maker depends on the documents, not merely on the lender’s records.
Borrower reached through a workplace number	Contact directed to the borrower may be permissible, but disclosure to the employer, receptionist, HR staff, supervisor, or co-workers remains restricted. Repeated or disruptive workplace contact may also become unfair or abusive.

A relative, spouse, employer, or former partner does not become responsible for the debt simply because of the relationship. Liability normally requires a contract, guaranty, co-maker undertaking, or another recognized legal basis.

Relatives and friends

A collector should not call or message a borrower’s parents, siblings, children, cousins, friends, neighbors, or other contacts merely to announce that the borrower owes money, demand that they pay, or ask them to shame the borrower into responding.

This is especially problematic when the lender obtained their details by:

copying the borrower’s entire contact list;
harvesting social-media contacts;
accessing email contacts;
sending mass texts or group messages;
posting the borrower’s photograph or loan details online; or
calling people who were never voluntarily identified as guarantors or co-makers.

Under NPC Circular No. 2022-02, unbridled processing of a borrower’s contact list is prohibited. This includes processing that leads to harassment, collection from people other than the borrower’s guarantors, or unfair collection practices.

A collector cannot avoid the rule by saying it merely asked the relative to “relay a message” if the communication reveals the debt, threatens consequences, repeatedly disturbs the relative, or is really designed to pressure the borrower.

Employers, HR personnel, and co-workers

An employer is not automatically entitled to know about an employee’s personal loan.

A collector generally should not tell HR, a manager, receptionist, payroll officer, or co-worker:

that the employee borrowed from a lending app;
the amount or status of the debt;
that the employee is allegedly delinquent;
that legal action will supposedly be taken;
that the company should discipline or dismiss the employee; or
that wages should be withheld or turned over without lawful authority.

Calling a workplace number and speaking directly to the borrower is different from disclosing the debt to other employees. Even then, the collector must act reasonably and avoid harassment, deception, disruption, or public embarrassment.

A lender cannot garnish wages by simply sending a demand to the employer. Garnishment ordinarily requires judicial process and an enforceable court order. Employers should not deduct a private debt from wages merely because an app or collector requests it, unless a lawful and applicable basis exists.

There may be fact-specific exceptions—for example, if the employer independently became a guarantor, administers a legitimate salary-loan arrangement, or must comply with a valid court order. Those situations should be evaluated from the actual contract and legal documents.

Former spouses and former partners

A former boyfriend, girlfriend, live-in partner, spouse, or other former partner has no special debt-collection role merely because of the past relationship.

The lender may contact that person for collection only if the person actually became a guarantor, co-maker, or debtor under the loan documents. Being an emergency contact or character reference is not enough.

For legally married persons, questions about whether an obligation affects community or conjugal property can depend on when and why the debt was incurred, the applicable property regime, and whether the family benefited. That separate property-law issue does not authorize a lending app to shame or harass the spouse or former spouse.

Character references are not collection targets

The current NPC rules define a character reference as someone whose contact information is supplied to verify the borrower’s identity and the truth of information provided for the loan application.

The borrower should inform the person that they are being named as a reference. The lender, in turn, must tell the reference:

that the borrower selected them;
how the lender obtained their contact details; and
that they may request removal of their personal data as a character reference.

The lender may not contact a character reference for unrelated purposes such as marketing, cross-selling, or offering products through third parties. Most importantly, a character reference is not automatically a guarantor.

If a collector tells a reference, “You were listed, so you must pay,” the reference should request the signed document supposedly creating that liability. A lender’s database entry or the borrower’s unilateral selection of a contact does not by itself establish a guaranty.

When a guarantor or co-maker may be contacted

A guarantor expressly undertakes to fulfill the borrower’s obligation if the borrower fails to do so. NPC rules require the guarantor’s separate consent, while the Civil Code governs the nature and extent of guaranty.

A co-maker may have different or more direct liability depending on the promissory note or loan agreement. Some agreements create solidary liability, allowing the creditor to proceed against a co-maker according to the contract and law.

Before paying or negotiating, an alleged guarantor or co-maker should obtain and review:

the signed loan agreement or promissory note;
the guaranty or co-maker clause;
any electronic signature and authentication record;
the disclosure statement and payment history;
the collector’s authority to act; and
a current statement of account.

A person should not assume liability merely because a collector knows their name, possesses a copy of an ID, or claims that the borrower selected them in an app.

Phone-contact access is not blanket permission

The Data Privacy Act of 2012 requires personal-data processing to have a lawful basis and to observe transparency, legitimate purpose, and proportionality.

Under the amended NPC loan-transaction rules:

an app may require access to protected phone resources only when suitable, necessary, and not excessive for a lawful purpose;
data processing should begin only when the information is actually needed;
access should be stopped or made revocable after its purpose has been fulfilled;
unrestricted or excessive contact-list processing is prohibited; and
an app must provide a separate interface through which the borrower chooses any character references or guarantors.

Limited contact-list access may be used to let the borrower select a reference or guarantor, and proportional metadata may be processed in a legally compliant manner. That is not permission to copy everyone’s details and later contact them for collection.

The National Privacy Commission applied these principles in its official Pesopop decision, finding that contact-list access and use for debt collection violated privacy and unfair-collection rules. Each complaint still turns on its own evidence.

Other collection conduct that may be unlawful

Apart from improper third-party contact, SEC rules prohibit collection methods involving conduct such as:

threats of violence or other criminal means;
threats to take action that cannot legally be taken;
insults, obscenities, or profane language;
false representations or deceptive collection methods;
publication or disclosure intended to shame the borrower;
unreasonable or inconvenient communications; and
contacting people in the borrower’s contact list who were not named guarantors or co-makers.

The governing SEC issuance is SEC Memorandum Circular No. 18, Series of 2019. Its restrictions apply to covered lending and financing companies and the third-party service providers they hire. Outsourcing collection does not free the lender from accountability for personal data under its control.

What to do if someone else is being contacted

1. Preserve the evidence before blocking anyone

Save:

screenshots showing the full number, account name, date, and time;
complete message threads rather than selected excerpts;
call logs and recordings lawfully made by a participant;
voicemails, emails, social-media posts, and group-chat messages;
the app name, developer, download page, website, and privacy policy;
collection-agency names and the collectors’ claimed identities;
statements made to relatives, HR personnel, or former partners;
copies of the loan agreement, disclosure statement, receipts, and account history; and
witness statements from everyone contacted.

Ask recipients to preserve their own copies. Do not edit screenshots or delete the app until relevant permissions, notices, and messages have been documented.

2. Secure the phone and accounts

Review and revoke unnecessary permissions for contacts, storage, camera, location, microphone, and social media. Change compromised passwords, enable multi-factor authentication, and check whether the app was installed from an unofficial source.

Revoking permissions may limit future access but may not erase data already copied. Send a separate written request addressing stored data.

3. Send a written notice to the lender and collector

Identify the account without sending unnecessary sensitive documents. State:

which third parties were contacted;
when and how they were contacted;
what information was disclosed;
whether those people were ever named as guarantors or co-makers;
that third-party collection contact and disclosure must stop;
that all relevant records must be preserved;
that the lender should identify its data protection officer and collection agency; and
that the lender should explain the source, lawful basis, purpose, recipients, and retention period for the affected personal data.

A character reference may separately demand removal of their information as a reference under the NPC rules.

Keep proof that the notice was received. This is important because an NPC complaint ordinarily requires proof that the respondent was first informed in writing and failed to take timely and appropriate action, or failed to respond within 15 calendar days.

4. Verify the company and the collector

Ask for the lending or financing company’s full corporate name, SEC registration details, Certificate of Authority, business address, and the collector’s written authority.

Do not send payment to a personal wallet or unfamiliar account solely because a caller threatens immediate arrest, public exposure, or workplace action. Verify payment instructions through the lender’s official channel.

5. File with the proper regulator

For an SEC-regulated lending or financing company, submit an inquiry or complaint through the SEC’s official iMessage ticketing system. Attach organized evidence and identify the lending company, app, collection agency, dates, numbers used, and people contacted.

For misuse or unauthorized disclosure of personal data, follow the NPC’s formal complaint procedure. The NPC currently requires a notarized Complaint-Assisted Form or a verified complaint, supporting documents, and compliance with its procedural requirements. Its complaint guidance explains the prior written-notice requirement and the 15-calendar-day response period.

If the lender is a bank, digital bank, credit-card issuer, e-money issuer, pawnshop, or another BSP-supervised institution, first use the institution’s own consumer-assistance channel. An unresolved complaint may then be escalated through the BSP Consumer Assistance Mechanism.

The correct regulator depends on the actual entity behind the app, not merely the app’s brand name.

Common mistakes to avoid

Deleting evidence too early. Document the messages, permissions, and public posts first.
Assuming every reference is a guarantor. Ask for the signed undertaking.
Arguing only by phone. Send a written notice and retain proof of receipt.
Posting IDs, contracts, or account numbers publicly. Redact sensitive information when seeking help.
Ignoring the underlying debt. Challenge abusive collection separately while requesting a verified statement of account and addressing any valid obligation.
Paying an unverified collector. Confirm both the collector’s authority and the destination account.
Filing with only one regulator when several issues are involved. SEC, NPC, and BSP jurisdiction address different entities and violations.
Assuming app consent defeats privacy rights. Consent must be specific and informed, and it cannot legitimize conduct prohibited by law or regulation.

When help is urgent

Seek immediate assistance if communications include credible threats of violence, stalking, extortion, impersonation of police or courts, publication of intimate material, account takeover, or disclosure of sensitive data that creates a serious safety risk.

Preserve the evidence and contact the appropriate law-enforcement agency. If a summons, subpoena, court order, or formal pleading has actually been served, consult a Philippine lawyer promptly; do not rely on the collector’s description of the document. Court deadlines depend on the document and manner of service.

Legal advice is also important when:

a relative or former partner allegedly signed as guarantor or co-maker;
the authenticity of an electronic signature is disputed;
wages or property are being garnished;
the loan may affect community or conjugal property;
multiple lenders or collectors are involved; or
the borrower needs help negotiating a sustainable payment arrangement.

Frequently asked questions

Can a lending app call my parents because I missed a payment?

Not merely because they are your parents. They may be contacted for collection if they expressly became guarantors or co-makers. If they were only character references, contact should be limited to application verification, not debt collection or pressure.

Can the app call my employer to find me?

A lender may use lawful means to contact you, but disclosing your debt to HR, a supervisor, receptionist, or co-workers is generally not justified. Using harvested workplace contacts to shame or pressure you may violate privacy and unfair-collection rules.

What if I allowed the app to access my contacts?

That does not authorize unrestricted collection calls. SEC rules prohibit contacting people in the contact list other than named guarantors or co-makers notwithstanding the borrower’s consent, while NPC rules prohibit unbridled and excessive contact-list processing.

Is an emergency contact responsible for the loan?

No, not solely because that person was entered as an emergency contact. The lender must establish a valid guaranty, co-maker agreement, or other legal undertaking.

Can a character reference ask to be removed?

Yes. The lender must inform the reference how the details were obtained and provide an option to have the personal data removed as a character reference.

Can a former spouse be made to pay?

Not simply because of the former marriage. Liability may depend on a signed loan undertaking and, in some cases, the applicable marital-property rules and purpose of the debt. The documents should be reviewed by counsel.

Does illegal harassment cancel the loan?

Not automatically. The collection conduct and the enforceability or amount of the debt are separate issues. A borrower may complain about unlawful collection while still addressing any valid balance.

Can a borrower be jailed simply for not paying a loan?

The Constitution prohibits imprisonment for debt alone. Fraud or another independently established offense is different, but a collector cannot truthfully threaten automatic arrest merely because an ordinary loan remains unpaid.

Official legal sources

This article provides general Philippine legal information, not legal advice for a particular loan, communication, or court case. Contract terms and supporting documents can change the result. Sources and official procedures were checked as of July 27, 2026.