Quick answer

Generally, no. A lending app may not contact a borrower’s relatives, employer, former partner, friends, co-workers, or other phone contacts to disclose the loan, demand payment, shame the borrower, or pressure those people to collect.

Contact may be lawful only for a limited, legitimate reason, such as:

verifying employment or information supplied during the loan application;
verifying the borrower’s identity or information with a voluntarily named character reference;
communicating with a person who separately and expressly agreed to be a guarantor, co-maker, or co-borrower;
communicating with a representative specifically authorized by the borrower; or
complying with a court order, lawful government request, payroll-deduction arrangement, or other legal process.

These exceptions do not authorize harassment, public shaming, mass messaging, or disclosure of more information than necessary. Giving an app access to a phone’s contacts—or accepting a broad privacy policy—does not make everyone in the contact list responsible for the debt.

The borrower still owes a valid loan despite unlawful collection conduct. The proper response is to preserve evidence, restrict unnecessary app permissions, complain in writing to the lender, and report the conduct to the correct regulator.

The controlling rules

Three sets of rules are especially important:

SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair debt collection by lending and financing companies. Among other acts, it prohibits contacting people in the borrower’s contact list other than persons named as guarantors or co-makers, even if the borrower supposedly consented. It also requires borrower information to remain confidential, subject to limited legal exceptions. See the official SEC issuance page.
NPC Circular No. 2020-01, as amended by NPC Circular No. 2022-02, restricts how lending and financing companies process personal data. Unbridled or excessive processing of contact lists is prohibited. For debt collection, persons in the contact list who were not named as guarantors must not be contacted. Character references have a separate, limited role. See NPC Circular No. 2020-01 and the 2022 amendments.
The Financial Products and Services Consumer Protection Act, Republic Act No. 11765, prohibits abusive collection or debt-recovery practices and requires financial service providers to respect client privacy and protect client data. It also requires a free internal consumer-assistance mechanism. See Republic Act No. 11765.

In March 2026, the DICT, NPC, and SEC jointly reiterated that online lending platforms—whether recorded or unrecorded—must not engage in unauthorized or excessive processing of contact lists and may contact only a qualifying guarantor for debt-collection purposes. See the 2026 government advisory on online lending platforms.

Who may be contacted, and for what purpose?

Person contacted	General rule
Borrower	The lender may contact the borrower through reasonable, lawful, and non-abusive means.
Relative	Not merely because of the family relationship. Contact for collection generally requires a separate legal role, such as guarantor or co-maker.
Employer or HR office	Limited verification may be permissible during the application process if necessary and properly disclosed. Revealing delinquency or pressuring the employer to collect is generally not permissible.
Co-worker or supervisor	They should not be contacted to shame, threaten, or pressure the borrower.
Former spouse or former partner	The former relationship creates no automatic liability or right to disclose the debt.
Character reference	May be contacted only to verify the borrower’s identity and the truth of information supplied for the application—not to collect the debt.
Guarantor	May be contacted about the guaranteed obligation if the person separately and expressly consented to become a guarantor.
Genuine co-maker or co-borrower	May be contacted based on the contract because that person may have an independent payment obligation.
Authorized representative	Limited communication may be allowed if the borrower specifically authorized that person to discuss the account.

The lender should be able to identify the exact document or lawful basis that gives a third person a role in the loan. A collector’s statement that someone is a “co-maker” or “guarantor” is not enough by itself.

A character reference is not a guarantor

Under the amended NPC rules, a character reference is someone whose information is provided to verify the borrower’s identity and the truth of information supplied for the loan application.

The lender must:

tell the person that they were selected as a character reference;
explain how the person’s contact details were obtained; and
provide an option to have the person’s data removed as a character reference.

A character reference must not automatically be treated as a guarantor. The lender may not ask the reference to pay, threaten the reference, or repeatedly call the reference to force the borrower to settle.

A guarantor must separately agree

A relative, employer, friend, or former partner does not become liable simply because the borrower entered their name or number in an app.

Article 2055 of the Civil Code states that a guaranty is not presumed; it must be express and cannot extend beyond what was stipulated. The NPC rules also require the lender to obtain the guarantor’s separate consent. See the Civil Code of the Philippines.

Ask for a copy of the alleged guaranty, promissory note, or co-maker agreement. Check:

whose name and signature appear;
whether electronic consent can be authenticated;
whether the person expressly agreed to answer for the debt;
whether the document describes the extent of liability; and
whether the collector is using “character reference,” “contact person,” and “guarantor” as if they meant the same thing.

A dispute over whether a valid guaranty or co-maker agreement exists depends on the actual documents and circumstances.

When an employer may be contacted

A lender may have a legitimate reason to verify employment, salary information, or other application details that the borrower supplied. Any verification must be transparent, necessary, proportionate, and limited to the stated purpose.

That does not ordinarily permit the lender to tell HR, a supervisor, receptionist, or co-workers that:

the employee is overdue;
the employee “refuses” to pay;
the company should force the employee to settle;
the employee is dishonest or involved in a criminal case; or
workplace disruption will continue until payment is made.

A valid payroll-deduction authority, employer-backed loan, court order, or garnishment process may justify specific communication with an employer. That formal process is different from a collector casually calling the workplace to cause embarrassment.

Calling the borrower directly at a work number is not automatically unlawful. However, the collector must take reasonable steps to avoid disclosing the debt to other employees and must respect a request to use a more private and appropriate channel.

Limited tracing is not permission to reveal the debt

A fact-specific NPC advisory opinion issued before the later online-lending circulars recognized that a collection agency might, in limited circumstances, ask an employer or relative for updated contact information when the borrower could no longer be reached. The third party is not required to provide it, and the collector must have a lawful basis and avoid prejudicial disclosure. See NPC Advisory Opinion No. 2018-059.

That narrow possibility does not authorize the app to harvest a phonebook, send collection messages to multiple contacts, identify the person as a debtor, or ask others to pay. The later NPC circulars and the 2026 joint advisory expressly restrict contact-list processing and third-party collection contacts.

Conduct that is likely prohibited

Red flags include:

copying or uploading the borrower’s entire phone, email, or social-media contact list;
calling relatives, friends, former partners, co-workers, or supervisors to announce the debt;
sending text blasts or group messages naming the borrower;
posting the borrower’s name, photograph, ID, loan details, or edited images online;
falsely telling a contact that they are a guarantor or co-maker;
asking a character reference to pay;
threatening arrest, violence, loss of employment, or an action that cannot legally be taken;
using insults, obscenities, humiliating language, or false statements;
impersonating a lawyer, court, police officer, or government agency;
failing to disclose the collector’s true identity;
continuing to use unnecessary app permissions after their stated purpose has ended; or
contacting the borrower before 6:00 a.m. or after 10:00 p.m., subject to the limited exceptions in the SEC rule.

Under SEC Memorandum Circular No. 18, the time restriction has exceptions where the account is more than 15 days past due or the borrower expressly agreed that those hours are the only reasonable opportunities for contact. That exception affects when the borrower may be contacted. It does not authorize harassment or calls to unrelated third parties.

Does the borrower’s consent make third-party contact lawful?

Not necessarily.

Consent under the Data Privacy Act must be freely given, specific, informed, and evidenced in written, electronic, or recorded form. The lender must also observe transparency, legitimate purpose, and proportionality. See the Data Privacy Act of 2012.

A blanket statement such as “allow access to all contacts for collection” does not override the SEC prohibition on contacting ordinary phone contacts. Nor does the borrower’s consent substitute for the separate consent required from a guarantor.

A borrower may specifically authorize a named representative to discuss the account. That limited authorization should not be treated as permission to publish the debt or contact anyone else.

What to do if third parties are being contacted

1. Address immediate safety risks

If messages contain threats of violence, extortion, impersonation, doxxing, sexualized images, or threats to visit or harm someone, do not negotiate through an unverified personal account. Preserve the messages and promptly report the incident to law enforcement. The government’s 2026 online-lending advisory lists the official DICT, NBI, and PNP reporting channels.

2. Preserve evidence

Keep copies of:

complete text, chat, email, and social-media messages;
screenshots showing the sender, account, number, date, and time;
call logs and voicemails;
messages received by relatives, employers, or former partners;
the app’s name, developer, download page, and website;
the lender’s corporate name, SEC registration number, and Certificate of Authority number;
the loan agreement, disclosure statement, privacy notice, payment history, and account statement;
app-permission screens and any notices asking for access to contacts, photos, location, or storage;
complaints sent to the lender and proof of receipt; and
replies from the lender or collector.

Ask each contacted person to prepare their own dated account of what was said. Do not secretly record a private call without legal advice: the Anti-Wiretapping Act generally requires authorization from all parties to a private communication. See Republic Act No. 4200.

3. Restrict unnecessary permissions

Turn off access to contacts, photos, storage, location, microphone, and other data that are no longer necessary. Preserve screenshots before changing the settings.

Revoking permission may stop future access, but it does not necessarily erase information already copied. Send a separate written request asking the lender to identify what data it holds, where the data came from, who received it, and what information it will delete, block, or retain.

4. Send a written complaint and demand

Send the complaint to the lender’s customer-assistance unit and data protection officer. Identify the app, account, collector, numbers used, dates, people contacted, and information disclosed.

A concise demand may state:

Stop contacting persons who are not parties to or guarantors of the loan. Stop disclosing my account and personal information to third parties. Preserve all collection records, call logs, messages, access logs, and instructions given to collection agents. Identify the legal company operating the app, the collection agency involved, the source and recipients of the personal data used, and the lawful basis for the processing. Please communicate directly with me through the following channel: [preferred channel].

Dispute any inaccurate balance or false claim separately. Request an itemized statement, but do not include passwords, PINs, one-time passwords, or unnecessary identification documents.

5. Tell the contacted person how to respond

A relative, employer, or former partner may say:

they do not consent to further calls or messages;
they are not a guarantor or co-maker;
the collector must communicate directly with the borrower;
their contact information must be removed if they were merely listed as a character reference; and
all further communications will be preserved for a regulatory complaint.

Employers should avoid confirming addresses, schedules, salary data, or other employee information without an appropriate lawful basis.

6. File with the correct regulator

For a lending or financing company or its online lending platform, file an unfair-collection complaint through the SEC iMessage portal. Include evidence identifying both the app and the corporation behind it. A collection agency’s involvement does not necessarily excuse the lender; regulated providers remain responsible for agents used in collection.

For unlawful processing or disclosure of personal data, a borrower—or a relative, co-worker, former partner, or other person whose own data was misused—may complain to the NPC.

Under the 2021 NPC Rules of Procedure, as amended, the complainant should ordinarily:

inform the lender or other responsible entity of the privacy violation in writing;
allow it an opportunity to act; and
if it takes no timely or appropriate action, or gives no response within 15 calendar days after receiving the written notice, file a verified complaint with the NPC.

The NPC may waive that prerequisite for good cause or a serious violation, including circumstances involving grave and irreparable harm, lack of an adequate remedy, or patently illegal conduct. The complaint must follow the current form and evidentiary requirements. Use the NPC’s official complaint-filing page.

If the lender is a bank, digital bank, or another BSP-supervised institution, first use the institution’s own consumer-assistance mechanism. If unresolved, escalate through the BSP Consumer Assistance Mechanism. The BSP’s rules also prohibit abusive collection and require good faith, reasonable conduct, and protection of client information.

Common mistakes to avoid

Do not assume that deleting the app deletes data already collected.
Do not treat every threatening message as a real court document.
Do not ignore an authentic summons, subpoena, or court order.
Do not pay through a collector’s personal account without confirming the lender’s official payment channel.
Do not post unredacted IDs, loan documents, phone numbers, or third-party messages publicly.
Do not secretly record private calls without checking the Anti-Wiretapping Act.
Do not assume that abusive collection cancels the debt. Challenge the collection conduct and the account balance as separate issues.
Do not sign a restructuring, waiver, acknowledgment, or settlement without reading how it affects the debt and any existing complaint.

When legal help is urgent

Consult a Philippine lawyer promptly if:

the lender claims a relative or former partner signed as guarantor or co-maker;
signatures, electronic consents, or loan documents appear forged;
the collector has published personal data or intimate, altered, or defamatory material;
threats involve violence, arrest, job loss, or physical visits;
money is being deducted from salary without a clear authority;
a court complaint, summons, garnishment order, or other formal process has been received;
the borrower faces multiple coordinated contacts or continuing workplace harassment; or
the lender refuses to identify the corporation, collection agency, or legal basis for processing personal data.

Frequently asked questions

Can a lending app call everyone in the borrower’s phonebook?

No. Unbridled contact-list processing and debt-collection contact with ordinary phone contacts are prohibited. App permission does not make every contact a guarantor.

Can a character reference be asked to pay?

No, not merely because they are a character reference. They may be contacted for limited identity or information verification. Payment liability requires a separate, express contractual undertaking.

Can the app tell an employer that an employee has an overdue loan?

Generally, it should not disclose the delinquency merely to pressure the employee. Limited employment verification during the application stage, a valid payroll arrangement, or formal legal process must be distinguished from debt shaming.

Can a former partner be contacted?

Not simply because of the former relationship. Contact may be justified only if the person has an independent documented role, such as guarantor, co-maker, authorized representative, or character reference contacted solely for permitted verification.

What if the borrower is already overdue?

Default allows the lender to pursue lawful collection against the borrower and any genuinely liable parties. It does not authorize public shaming, contact-list blasting, false threats, or disclosure to unrelated people.

Can a contacted relative or co-worker file their own privacy complaint?

Yes, if their own personal data was collected, used, or disclosed unlawfully. They should preserve the messages and first send the responsible entity a written privacy complaint unless an NPC waiver may apply.

Does filing a complaint erase the loan?

No. Regulatory complaints address unlawful conduct and data processing. A valid unpaid balance may still be collected through lawful channels, negotiated, restructured, or pursued in court.

Can someone be jailed simply for failing to pay a loan?

The Constitution provides that no person shall be imprisoned for debt. This does not protect separate criminal conduct, such as proven fraud or other offenses. A collector should not present ordinary nonpayment as an automatic arrest case. See the 1987 Constitution, Article III, Section 20.

Disclaimer

This article provides general Philippine legal information, not legal advice for a particular loan, contract, complaint, or court case. Liability and available remedies depend on the documents, the lender’s regulatory status, the information disclosed, and the manner and purpose of contact. Official sources and procedures were checked as of 31 July 2026.