Quick answer

Generally, no. A lending app may pursue the borrower and any person who actually signed as a co-borrower, co-maker, surety, or guarantor. It may not use the borrower’s phonebook, social-media contacts, relatives, employer, or former partner to collect the debt, pressure the borrower, or cause embarrassment.

The main exceptions are narrow:

A person expressly named as a character reference may be contacted only to verify the borrower’s identity and the truthfulness of information supplied in the loan application—not to collect the debt.
A person who separately and expressly agreed to be a guarantor, surety, co-maker, or co-borrower may be contacted in that capacity.
An employer or another third party may receive information when disclosure is required by a valid court order, lawful garnishment process, subpoena, or another legal obligation.
Limited employment verification during a loan application may be lawful when it is properly disclosed, necessary, proportionate, and supported by an applicable lawful basis. That does not permit the lender to reveal the debt unnecessarily or shame the applicant at work.

Being a relative, employer, emergency contact, friend, or former romantic partner does not by itself make someone responsible for the loan.

The controlling rules

The Data Privacy Act of 2012 requires personal-data processing to be transparent, lawful, for a legitimate purpose, and proportionate. Information collected for a loan cannot simply be repurposed for public shaming or indiscriminate collection calls.

More specifically, NPC Circular No. 2020-01, as amended by NPC Circular No. 2022-02, provides that:

Unconstrained, excessive, or disproportionate processing of a borrower’s contact list is prohibited.
Prohibited processing includes harassment, unfair collection practices, and debt collection from people other than guarantors provided by the borrower.
Access to a contact list must be limited to what is necessary, such as allowing the borrower to choose a character reference or guarantor through a separate interface.
For debt collection, a lender may contact the guarantor; it may not contact other people found in the borrower’s contact list.
A character reference is not automatically a guarantor.

The rules cover lending and financing companies, persons acting as lenders whether or not properly authorized by the Securities and Exchange Commission, and third-party processors or collection providers handling their data.

The Financial Products and Services Consumer Protection Act also prohibits abusive collection or debt-recovery practices and protects financial consumers’ privacy. A regulated provider remains responsible for the conduct of its employees and agents and may be solidarily liable with an accredited third-party service provider involved in debt collection.

When each type of contact may—or may not—be allowed

Relatives

A lender cannot contact parents, siblings, children, cousins, or other relatives merely because their numbers appear in the borrower’s phone or social-media account.

A relative may properly be contacted if that person:

Signed as a co-borrower, co-maker, surety, or guarantor;
Was voluntarily chosen as a character reference, but only for permitted verification; or
Is involved in a lawful court or estate proceeding affecting the obligation.

Family relationship alone does not transfer the debt. Under the Civil Code, contracts generally bind the contracting parties, while a guaranty is not presumed and must be express.

Employer, supervisor, or coworkers

A lending app should not call an employer, HR department, supervisor, or coworkers to announce that the borrower is delinquent, demand that they make the borrower pay, or threaten the borrower’s employment.

Limited employment verification may be possible during the application stage if it is genuinely necessary to verify information the applicant supplied and complies with the lender’s privacy notice and applicable law. The lender should disclose no more than necessary.

An employer may also receive a lawful court-issued notice, such as a proper garnishment order. A collector’s private demand letter or threat is not equivalent to a court order.

Former partner or former spouse

A former boyfriend, girlfriend, live-in partner, or spouse cannot be contacted for collection merely because of the past relationship or because the number remains in the borrower’s contacts.

Different rules may apply if that person signed the loan, guaranty, or suretyship, or if a court order or property regime is relevant. Those issues depend on the actual documents and circumstances. Even then, the lender may not use threats, public shaming, false statements, or unnecessary disclosure.

Character reference is not the same as guarantor

This distinction is critical.

A character reference supplies information that may help verify the borrower’s identity or the truthfulness of the loan application. Under the amended NPC circular, the lender must tell the reference:

That the borrower identified them as a character reference;
How the lender obtained their contact details; and
That they may request removal of their personal data as a character reference.

The lender cannot use the reference for debt collection, marketing, cross-selling, or unrelated sharing with third parties.

A guarantor expressly agrees to answer for the borrower’s obligation if the borrower fails to perform. The lender must obtain the guarantor’s separate consent. A name or phone number entered into an app does not, by itself, create a guaranty.

A co-borrower, co-maker, or surety may have a direct or solidary contractual obligation, depending on the signed agreement. The document—not the label casually used by a collector—determines the person’s legal position.

Phone permission is not blanket permission to contact everyone

Tapping “Allow contacts” does not give a lender unlimited authority to copy the entire phonebook, retain it indefinitely, message everyone in it, or disclose the loan.

Under the amended NPC rules:

Permissions may be requested only when suitable, necessary, and not excessive.
Processing should begin only when the information is needed.
Once access is no longer supported by a lawful purpose, the app should turn it off or tell the user that permission may be revoked.
Contact-list access for selecting a reference or guarantor must be limited to the minimum extent necessary.
Contact-list metadata may be processed only proportionately and cannot be used for harassment or unfair collection.

SEC rules are even more direct: under SEC Memorandum Circular No. 18, series of 2019, contacting people in the borrower’s contact list other than named guarantors or co-makers is an unfair collection practice notwithstanding the borrower’s consent.

Other prohibited collection conduct

A collector may make a lawful demand, negotiate payment, and pursue available court remedies. It may not use methods such as:

Threatening violence, property damage, arrest without legal basis, or another action that cannot lawfully be taken;
Using obscenities, insults, or abusive language that may amount to a criminal act or offense;
Publishing the borrower’s name, photograph, loan details, or other personal information to shame the borrower;
Messaging group chats, social-media contacts, neighbors, coworkers, or relatives about the debt;
Making false representations or using deceptive means to collect or obtain information;
Communicating loan information known—or which should be known—to be false, including failing to say that a debt is disputed when applicable;
Using the borrower’s photo to embarrass or harass them; or
Refusing to identify the collector truthfully to the borrower.

SEC Memorandum Circular No. 18 generally treats contact before 6:00 a.m. or after 10:00 p.m. as unreasonable. Its text contains exceptions where the account has been past due for more than 15 days or the borrower gave express consent—documented in writing, electronically, or by recorded means—that those are the only reasonable or convenient times. Those exceptions do not legalize harassment, threats, deception, or unlawful disclosure.

What to do if third parties are being contacted

1. Preserve the evidence

Before uninstalling the app or blocking every number, save:

Screenshots showing the full message, account or profile, number, date, and time;
Call logs and voicemail messages;
Social-media posts, comments, tags, and group-chat messages;
The app’s name, developer, download-page link, and requested permissions;
The loan agreement, disclosure statement, payment history, receipts, and account statements;
The privacy notice and collection policy shown when the loan was obtained;
Emails or messages sent to the lender and its responses; and
Statements or screenshots from relatives, employers, or other people contacted.

Ask affected third parties not to delete the messages. Do not secretly record private calls without first obtaining advice about the Anti-Wiretapping Act and other applicable rules.

2. Identify the actual lender

The app’s brand may differ from the corporation providing the loan. Check the agreement, disclosure statement, payment instructions, privacy notice, and collection message for:

The lender’s complete corporate name;
SEC registration and Certificate of Authority details;
Business address and official contact information;
The collector or collection agency’s identity; and
The company’s consumer-assistance unit and data protection officer.

The SEC’s Check with SEC service can help verify corporate information, but corporate registration alone does not necessarily prove authority to operate as a lending or financing company.

3. Revoke unnecessary app permissions

After preserving evidence, disable access to contacts, photos, storage, location, and other resources that are not needed. Review the phone’s permission history and connected social-media accounts.

Revoking access does not erase information already copied by the app. A written privacy request is still important.

4. Send a written complaint to the lender

Address the complaint to both the consumer-assistance unit and the data protection officer. State:

The loan or account number, without posting it publicly;
The numbers, accounts, or collectors involved;
Who was contacted and what was disclosed;
Whether the person was ever named as a reference, guarantor, or co-maker;
That you object to third-party collection contact and unauthorized disclosure;
That future collection communications should be directed to the borrower or authorized representative;
Any disputed balance or payment that must be investigated; and
The action requested, such as stopping contact, removing third-party data, identifying the source and recipients of the data, correcting records, and preserving collection logs for investigation.

Request written confirmation. Keep proof that the company received the complaint.

5. Escalate to the proper regulator

For a lending or financing company, submit the evidence through the SEC iMessage complaint system. Include the lender’s legal name, app name, collector details, loan documents, messages, call logs, and proof that third parties were contacted.

For a privacy complaint, the borrower and any contacted person whose own data was misused may approach the National Privacy Commission. Under the 2021 NPC Rules of Procedure, as amended in 2024, the complainant ordinarily must first notify the lender, processor, or concerned entity in writing. A formal complaint may proceed if the entity fails to take timely and appropriate action or does not respond within 15 calendar days from receipt. The NPC may waive this requirement for good cause or serious violations, including circumstances involving grave and irreparable harm or patently illegal conduct.

An NPC complaint must generally be written, signed, and verified, and should include the parties’ details, material facts, requested relief, evidence, witness affidavits where available, and correspondence with the respondent. Follow the NPC’s current filing instructions and complaint-assisted form rather than relying on an old online template.

If the provider is a bank or another BSP-supervised institution, complain first through its financial consumer protection assistance mechanism. An unresolved complaint may then be escalated through the BSP Consumer Assistance Mechanism.

6. Seek immediate help for threats or public attacks

Contact the police, NBI, prosecutor, or a lawyer promptly if the collector:

Threatens physical harm, kidnapping, property damage, or sexual violence;
Publishes private information, altered photos, or accusations online;
Impersonates a police officer, court, lawyer, or government agency;
Threatens immediate arrest without lawful process;
Repeatedly contacts a workplace in a way that endangers employment or safety; or
Targets children, elderly relatives, or another vulnerable person.

Regulatory complaints do not replace urgent police assistance or the filing of an appropriate criminal complaint when immediate safety is at risk.

The debt does not disappear because collection was abusive

Unlawful collection conduct and the validity of the loan are separate questions. A borrower may still owe a valid principal balance even if the lender or collector violated privacy or collection rules.

Do not send additional money to an unverified personal account merely because of threats. Ask for an updated statement, verify the creditor and payment channel, document any dispute, and obtain a receipt for every payment. If the amount includes unexplained interest, fees, penalties, or payments that were not credited, challenge it in writing.

Common mistakes to avoid

Assuming that every call to a reference is illegal. Limited identity or application verification may be allowed.
Assuming that a relative or former partner must pay because a collector says so. Ask for the signed document creating that person’s obligation.
Deleting the app, messages, and call logs before preserving evidence.
Posting complete IDs, loan contracts, account numbers, or phone numbers publicly while seeking help.
Secretly recording private calls without considering applicable recording laws.
Negotiating only by telephone, leaving no written record.
Paying a collector without verifying the lender, account, balance, and official payment channel.
Ignoring an actual summons or court document. Verify it directly with the named court and obtain legal advice promptly.
Believing that an app’s terms can waive statutory privacy and consumer-protection rights. The Financial Products and Services Consumer Protection Act prohibits contractual waivers of specified consumer rights.

Possible consequences for the lender

Under SEC Memorandum Circular No. 18, violations by lending companies may carry fines of ₱25,000 for a first offense and ₱50,000 for a second offense; for financing companies, ₱50,000 and ₱100,000, respectively. For a third offense, the SEC may, depending on the facts and gravity, impose a higher fine of up to ₱1 million, suspend lending or financing activities for 60 days, or revoke the company’s authority.

Separate administrative, civil, or criminal consequences may arise under the Data Privacy Act and the Financial Products and Services Consumer Protection Act. Liability is not automatic merely because a complaint was filed; the specific disclosure, lawful basis, intent, evidence, responsible persons, and resulting harm must be established.

Frequently asked questions

Can the lender call my parents because I have not answered?

Not merely because they are your parents or appear in your contacts. They may be contacted only if they have a legally relevant role, such as an expressly chosen character reference for limited verification or an actual guarantor, co-maker, or co-borrower.

Can a character reference be asked to pay?

No. A character reference is not automatically a guarantor. The lender may use the reference for permitted identity or application verification, not debt collection.

Can HR deduct the debt from my salary after a collector calls?

A collector’s call alone does not authorize salary deductions or garnishment. A lawful deduction or garnishment requires an applicable legal basis and proper procedure, which may include a court order.

Can the app contact my former spouse?

Past marriage alone is not enough. Contact may be justified if the former spouse signed the relevant obligation or is involved in a lawful court process. Property-regime and marital-debt questions require review of the loan documents, dates, and applicable family-law rules.

What if I allowed access to all my contacts?

That is not unlimited permission to collect from or shame everyone in the phonebook. Contact-list processing must remain necessary and proportionate, and SEC rules prohibit collection contact with listed persons other than properly named guarantors or co-makers notwithstanding the borrower’s consent.

Can the person who received the collection message complain?

Yes. That person is a data subject with rights over their own name, number, messages, and other personal data. They should preserve the message and may complain directly to the lender and, when appropriate, the NPC.

Does the rule apply to an unlicensed or foreign-operated app?

The NPC loan-processing circular expressly covers persons acting as lenders whether or not they have the required SEC authority, as well as relevant processors and service providers. Enforcement may be more difficult when the responsible entity is unidentified or outside the Philippines, making preservation of app, payment, developer, domain, and account information especially important.

Should I block the collector?

Preserve evidence first. You may then block abusive numbers and require communication through a documented channel. Blocking a collector does not resolve the underlying account or excuse ignoring genuine court papers.

Official legal sources

This article provides general Philippine legal information, not advice for a particular loan, complaint, or court case. Contractual liability, marital-property issues, privacy violations, and available remedies depend on the documents and facts. Sources and procedures were checked as of 31 July 2026.