Quick answer

Generally, no. A lending app, lending company, financing company, or its collection agent may not contact people in the borrower’s phonebook—including relatives, an employer, co-workers, or a former partner—to collect the debt unless the person is an actual guarantor or is independently liable under the loan documents.

A character reference is not automatically a guarantor. Character references may be contacted only for legitimate identification or verification purposes—not pressured to pay, told to make the borrower pay, or used for public shaming. A guarantor must separately consent to that role. The borrower’s blanket consent to access contacts does not authorize debt-collection calls to non-guarantors.

The debt itself does not disappear because the lender used an unlawful collection method. The borrower should address the account separately while documenting and reporting any harassment, improper disclosure, or misuse of personal data.

The rules that protect borrowers and their contacts

Several overlapping rules apply:

The Financial Products and Services Consumer Protection Act, Republic Act No. 11765, prohibits abusive collection or debt-recovery practices, requires respect for client privacy, and makes financial service providers responsible for their employees and agents—including accredited third-party collectors. It also requires providers to maintain a free consumer-assistance mechanism. See the official Senate copy of RA 11765.
The Data Privacy Act of 2012, Republic Act No. 10173, requires personal-data processing to be transparent, lawful, for a legitimate purpose, and proportionate. Information must not be excessive or used for an incompatible purpose. Data subjects have qualified rights to information, access, correction, blocking or removal, and damages. See the official NPC text of the Data Privacy Act.
NPC Circular No. 2020-01, as amended by NPC Circular No. 2022-02, specifically regulates personal data used in loan applications, servicing, collection, and account closure. The NPC explains that collecting a debt through anyone other than a declared guarantor is prohibited. See the NPC’s explanation of the amended circular.
SEC Memorandum Circular No. 18, series of 2019, prohibits unfair collection practices by lending companies, financing companies, and their third-party service providers. These include threats, abusive language, deceptive collection methods, public disclosure of borrower information, and contacting non-guarantors in the borrower’s contact list. See the official SEC issuance page.

In March 2026, the DICT, NPC, and SEC jointly reiterated that contacting people in a borrower’s contact list other than guarantors is prohibited for debt collection. The advisory applies to online lending platforms operated by lending companies, financing companies, and persons acting as such, whether recorded or unrecorded. See the 2026 joint government advisory.

Who may be contacted—and for what purpose?

Person	What may be permitted	What is generally prohibited
Relative who is not a guarantor	A narrowly limited verification contact if the borrower deliberately named the relative as a character reference	Demanding payment, revealing delinquency, asking the relative to pressure the borrower, or threatening embarrassment
Employer, supervisor, or HR officer	Necessary and proportionate employment or income verification during the application process, with proper notice and a lawful basis	Disclosing the debt or arrears, asking HR to collect, threatening the borrower’s job, or contacting co-workers to shame the borrower
Former spouse or former partner	Contact concerning an obligation that the person actually signed as borrower, co-maker, or guarantor	Contact based only on the past relationship, or falsely calling the person a co-maker or guarantor
Character reference	Identification and verification of the borrower and the truthfulness of application information	Debt collection, repeated collection calls, marketing, or treating the reference as liable
Guarantor	Contact about the guaranteed obligation, after the person separately and validly consented to be a guarantor	Harassment, threats, false statements, excessive disclosure, or demands beyond the undertaking
Co-borrower or co-maker	Contact about an obligation the person actually assumed; the precise liability depends on the signed documents	Inventing liability merely because the person appears in the borrower’s contacts

A relative is not automatically responsible

Being a borrower’s parent, sibling, child, spouse, or other relative does not by itself make someone liable for the loan. A guaranty is not presumed; it must be express and cannot extend beyond what was undertaken. The Supreme Court has applied this rule under Article 2055 of the Civil Code. See Aglibot v. Santia, G.R. No. 185945.

Marriage also does not automatically make a spouse the borrower’s guarantor. Questions about whether community or conjugal property may answer for a particular obligation are separate, fact-dependent issues involving the loan’s purpose, the couple’s property regime, and the documents signed. They do not give a collector permission to harass or publicly expose the spouse.

A character reference is not a guarantor

A lending app must distinguish between:

A character reference, whose information is supplied solely to verify the borrower’s identity or the truthfulness of application information; and
A guarantor, who expressly agrees to answer for the borrower’s obligation in case of default.

The guarantor’s separate consent must be obtained. A lender cannot turn a reference into a guarantor through a statement made only by the borrower, a pre-ticked box, or a collector’s unsupported claim.

The lender must tell a character reference that they were named as such and explain how their contact details were obtained. The reference must also be given the option to request removal of their personal data as a character reference. That request remains subject to lawful retention needs, such as establishing or defending legal claims.

What about contacting the borrower’s employer?

A limited employment or income check during underwriting may be lawful if it is necessary, transparent, proportionate, and consistent with the privacy notice and the information the borrower provided.

That does not authorize later disclosure of the borrower’s debt to the employer. A collector generally should not:

Tell HR, a supervisor, or co-workers that the borrower is overdue;
Ask the employer to embarrass, discipline, suspend, or dismiss the borrower;
Send group messages identifying the borrower as a debtor;
Demand that the employer deduct money from salary without a valid legal or contractual basis; or
Pretend that an ordinary collection demand is a court order.

A genuine court order, lawful garnishment process, or separately valid payroll arrangement raises different issues. The employer should verify the document and obtain legal advice rather than acting on a collector’s message alone.

What if the person is a former partner?

A former boyfriend, girlfriend, live-in partner, or spouse has no special collection role merely because of the past relationship. The lender may contact that person about the debt only if the person actually signed or validly consented as a co-borrower, co-maker, guarantor, or other liable party.

If the former partner was only listed as a character reference, any contact must remain within the limited verification purpose. The collector may not demand payment, disclose detailed account information, or use the former relationship to pressure or humiliate the borrower.

Does allowing access to contacts make third-party collection lawful?

No. SEC rules prohibit contacting non-guarantors in the borrower’s contact list for collection even if the borrower supposedly consented.

The 2026 government advisory recognizes that an app may access contacts in a limited manner so the user can select a character reference or guarantor, or to derive proportionate metadata when genuinely necessary for a specified and legitimate purpose. It does not permit unconstrained copying, storing, or using the whole phonebook for collection.

Pre-ticked permissions, misleading buttons, or designs that make consent easy to give but difficult to withdraw may undermine the validity of consent. Once an app permission is no longer necessary, the app should prompt the user to revoke or turn it off.

Examples of likely violations

Possible violations include:

Calling a borrower’s parents, siblings, employer, co-workers, or former partner to demand payment when they are not guarantors;
Claiming falsely that someone is a co-maker or guarantor;
Sending the borrower’s name, photograph, ID, balance, or alleged delinquency to group chats or social-media contacts;
Editing photographs or creating “wanted,” “scammer,” or funeral-style posts to shame the borrower;
Threatening violence, damage to property or reputation, arrest without legal basis, or an action the collector cannot lawfully take;
Using insults, obscenities, or deceptive identities;
Failing to say that an alleged balance is disputed when communicating information that the rules lawfully allow to be communicated;
Harassing character references after they ask not to be contacted; or
Using contacts gathered for verification to market other products.

SEC Memorandum Circular No. 18 generally treats contact before 6:00 a.m. or after 10:00 p.m. as unreasonable, subject to its stated exceptions where the account is more than 15 days past due or the borrower expressly agrees that those are the only convenient times. Those exceptions do not legalize threats, public shaming, false statements, or contact with non-guarantors.

What the lender may still do

Privacy and collection rules do not prevent lawful recovery. Depending on the contract and applicable law, a lender may:

Contact the borrower directly and send a proper demand;
Offer or negotiate a payment arrangement;
Use an authorized collection agency or lawyer, subject to the same collection and privacy rules;
Contact an actual guarantor, co-maker, or co-borrower within the scope of that person’s undertaking;
Submit credit information when required or lawfully authorized; or
File a civil case and use lawful court processes.

Outsourcing collection does not erase the lender’s responsibility. RA 11765 makes the provider responsible for its representatives and solidarily liable with accredited third-party service providers for covered acts or omissions.

What to do if third parties are being contacted

1. Preserve evidence before blocking numbers or deleting the app

Keep:

Full screenshots showing the sender, number or account, date, time, and complete message;
Call logs and any voicemail left by the collector;
Messages received by relatives, co-workers, the employer, or former partner;
Written statements from contacted persons describing what was said;
Social-media posts, URLs, account names, group names, and timestamps;
The loan agreement, disclosure statement, repayment records, and any dispute over the amount;
The app’s privacy notice, consent screens, and permissions;
The app-store listing and the legal name of the company operating the app; and
Previous complaints and the lender’s responses.

Do not rely only on cropped screenshots. Preserve the surrounding conversation and original files where possible. Avoid secretly recording private telephone conversations without specific legal advice; covert recording may create a separate issue under the Anti-Wiretapping Act. Preserve written messages and voicemail instead.

2. Secure the phone and accounts

After preserving evidence:

Revoke unnecessary access to contacts, SMS, photos, storage, microphone, camera, and location;
Change the app password and any reused passwords;
Review email, social-media, cloud-storage, and mobile-wallet sessions for unauthorized access; and
Back up evidence before uninstalling the app.

Revoking permission stops future access from the device but does not necessarily delete data the operator already copied.

3. Send a written complaint to the lender

Write to the lender’s consumer-assistance unit and data protection officer. Identify:

The app and registered company;
The loan or account reference;
The collector’s number or account;
The people contacted and their relationship to the borrower;
What was disclosed, demanded, or threatened;
The dates and times; and
The corrective action requested.

Ask the company to stop contacting non-guarantors, identify the collector and the authority under which the collector acts, preserve collection logs, explain the source and recipients of the personal data, and block or delete unlawfully obtained or unnecessary contact information. If the balance is disputed, state that clearly and request an account breakdown.

Keep proof that the company received the complaint.

4. Report unfair collection to the proper financial regulator

For an SEC-regulated lending or financing company, file through the SEC iMessage system and select the service for the Financing and Lending Companies Department when available. Attach the evidence and identify both the app’s brand name and its legal corporate operator.

If the lender is a bank, digital bank, or other BSP-supervised institution, first use the institution’s consumer-assistance mechanism. An unresolved complaint may then be escalated through the BSP Consumer Assistance Mechanism.

A cooperative lender may fall under the Cooperative Development Authority. Check the contract, privacy notice, and advertisements for the regulator the provider is required to identify.

5. File a privacy complaint with the NPC

The borrower and any relative, employee, employer representative, or former partner whose own personal data was misused may have separate grounds to complain.

Under the current NPC rules, the ordinary procedure requires the complainant to notify the company in writing and give it an opportunity to act. If it does not take timely and appropriate action, or does not respond within 15 calendar days after receiving the written notice, the complaint may be filed with proof of that step.

Use the NPC’s current complaint-affidavit or complaint-assisted form, have it properly notarized or verified as required, and attach the correspondence, evidence, and any witness affidavits. The NPC introduced a new complaint-affidavit template effective July 1, 2025, so an old downloaded form should not be reused. Consult the NPC complaint mechanics and current requirements before filing.

The NPC may waive the prior-notice requirement for good cause or a serious violation involving a significant risk of harm, including grave and irreparable damage or a situation where the company cannot provide a plain, speedy, and adequate remedy.

When help is urgent

Seek immediate assistance when there are:

Threats of death, violence, abduction, or property damage;
Extortion, impersonation, hacking, or unauthorized account access;
Publication of IDs, addresses, intimate images, children’s information, or other highly sensitive material;
Collectors appearing at a home or workplace and acting violently or coercively;
A serious risk of job loss, stalking, self-harm, or physical danger; or
Genuine court papers, a summons, garnishment documents, or a deadline requiring a legal response.

For harassment, threats, fraud, or scams, the March 2026 joint advisory identifies the DICT Cyber Hotline, NBI Cybercrime Division, and PNP Anti-Cybercrime Group as reporting channels. Their current contact details appear in the official joint advisory. In an immediate physical emergency, contact the police or local emergency services first.

Common mistakes to avoid

Assuming that everyone listed as a reference is legally liable;
Paying a person who cannot prove that they are an authorized collector;
Deleting messages, uninstalling the app, or resetting the phone before preserving evidence;
Sending IDs or account credentials to an unknown collector;
Secretly recording private calls without considering the Anti-Wiretapping Act;
Retaliating by publishing the collector’s unredacted personal data;
Ignoring a genuine summons or court order; and
Assuming that abusive collection cancels a valid debt.

Frequently asked questions

Can a lender tell my family that I have an unpaid loan?

Generally, not for collection if the family members are not guarantors or otherwise liable. Calling them to demand payment, pressure you, or disclose delinquency may violate SEC collection rules and data-privacy requirements.

Can a lending app call my office?

It may contact you through a number you validly supplied, but it should not disclose the debt to HR, your supervisor, receptionist, or co-workers. A limited employment-verification inquiry during the application process is different from a collection disclosure.

Am I liable because the borrower named me as a reference?

No. A character reference is not automatically a guarantor. A guaranty must be express, and the guarantor’s separate consent is required.

What if I clicked “Allow Contacts” when installing the app?

That does not authorize the lender to contact non-guarantors for debt collection. Access and processing must remain necessary, proportionate, and tied to a legitimate, disclosed purpose.

Can a collection agency do what the lender cannot?

No. Third-party collectors remain subject to applicable collection and privacy rules. The financial service provider may also be liable for its authorized representative’s conduct.

Does harassment mean the borrower no longer has to pay?

No. The enforceability and correct amount of the debt are separate from the legality of the collection method. The borrower may dispute charges, request a breakdown, negotiate payment, and report unlawful conduct at the same time.

Can the contacted relative, employer, or former partner complain?

Yes, if that person’s own contact information or other personal data was unlawfully obtained, used, or disclosed. The borrower may also complain about the disclosure and misuse of the borrower’s loan information.

Official sources

This article provides general Philippine legal information, not legal advice for a particular loan, document, or dispute. Liability and available remedies depend on the signed agreements, the lender’s regulatory status, the data actually processed, and the communications made. Sources and procedures were checked as of July 30, 2026.