No. An online lending app may collect a legitimate debt, but it cannot shame you, post your photo, threaten you, or message your friends, relatives, co-workers, or employer just to pressure you to pay. In the Philippines, lending and financing companies must follow debt collection rules, data privacy rules, and financial consumer protection standards. This article explains what online lending apps are allowed to do, what crosses the line, what legal rights borrowers and third parties have, and how to file complaints with the proper government agencies.

The short answer: collection is allowed, harassment is not

A lender is allowed to remind you about a due loan, ask for payment, send statements, impose lawful charges under the contract, and pursue legal remedies if you default.

But collection must be done through reasonable, lawful, and fair means. The Securities and Exchange Commission (SEC) issued SEC Memorandum Circular No. 18, Series of 2019 specifically to prohibit unfair debt collection practices by financing companies, lending companies, and their third-party service providers. The circular was issued after complaints about harassment, abusive collection, and unethical means used against borrowers. (SEC Appointment System)

Separately, the National Privacy Commission (NPC) regulates how online lending platforms process borrowers’ personal data under the Data Privacy Act of 2012, or Republic Act No. 10173. NPC rules apply to loan processing, loan evaluation, and debt collection activities of lending and financing companies, including persons or entities acting like lenders even if they claim not to be properly recorded or authorized.

In plain English: you may still owe the debt, but the lender cannot collect it by humiliating you or weaponizing your phone contacts.

What online lending apps cannot legally do

Online lending apps in the Philippines are commonly reported for aggressive tactics such as repeated calls, threats, messages to contacts, and public shaming. Not every annoying reminder is illegal, but several common tactics are clearly prohibited or legally risky.

Collection tactic	Is it allowed?	Why it is a problem
Posting your name, photo, loan amount, or “wanted” image online	No	This may violate SEC debt collection rules, data privacy law, and possibly defamation laws depending on the content.
Sending messages to your friends, family, co-workers, or employer to pressure you to pay	Generally no	NPC rules prohibit contacting persons in the borrower’s contact list for debt collection unless they are named guarantors.
Calling a character reference to demand payment	No	A character reference is for identity or veracity checking, not automatic debt liability.
Threatening violence, arrest, public humiliation, or actions the lender cannot legally take	No	SEC rules prohibit threats and unlawful or unfair collection methods.
Accessing your full contact list without necessity	No	NPC rules prohibit unnecessary app permissions and unbridled contact-list processing.
Using your gallery or camera photos to embarrass you	No	NPC rules allow camera/gallery access only for legitimate purposes such as KYC or payment verification, and photos must not be used to harass or embarrass borrowers.
Calling or texting within reasonable hours about a real debt	Usually allowed	Collection itself is not illegal if done lawfully, fairly, and without harassment.

Can an online lending app contact your friends or phone contacts?

Ordinary phone contacts: generally no

An online lending app should not harvest your contact list and message random people in it to say you owe money. NPC rules expressly treat this as prohibited when the processing is excessive, disproportionate, or used for harassment, unfair collection, or debt collection outside guarantors.

This remains true even if the app previously asked for broad contact permission. Consent under privacy law must be specific, informed, and tied to a legitimate purpose. NPC rules require online lending apps to use just-in-time notices, obtain consent at the point the data becomes necessary, and keep privacy information accessible inside the app.

Character references: limited verification only

Many loan apps ask for “character references.” This often confuses borrowers because apps later treat those people as if they are guarantors.

Under NPC rules, a character reference is someone whose details are used to verify the borrower’s identity or truthfulness for loan evaluation. The lender must inform the character reference that the borrower chose them, explain how their data was obtained, and give them an option to have their data removed.

A character reference is not automatically liable for the loan. The lender cannot turn that person into a collector target just because their name and number appeared in the application. NPC rules specifically prohibit contacting character references for other purposes such as marketing or unrelated processing.

Guarantors and co-makers: different legal situation

A guarantor is different. Under Philippine law and NPC rules, a guarantor is a person who expressly binds himself or herself to fulfill the borrower’s obligation if the borrower fails to pay. The key word is expressly. There must be a clear agreement, not just a phone number typed into an app.

For debt collection, NPC rules state that lending or financing companies may contact the guarantor. But they may not contact other persons in the borrower’s contact list who were not named guarantors.

Legal basis: borrower rights under Philippine law

SEC rules on unfair debt collection

The SEC supervises lending companies under the Lending Company Regulation Act of 2007, or Republic Act No. 9474, and financing companies under the Financing Company Act, Republic Act No. 8556. The SEC also handles complaints involving the Truth in Lending Act, Republic Act No. 3765, and unfair debt collection by lending or financing companies. (SEC Appointment System)

SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair debt collection practices. It covers lending companies, financing companies, and third-party service providers that collect on their behalf. The SEC’s rule recognizes that lenders may use reasonable and legal collection methods, but they must act in good faith and with reasonable conduct. Threats, abusive language, violence, reputational harm, and threats of legal action that cannot actually be taken are red flags. (SEC Appointment System)

In practice, this means a collector should not say things like:

“Ipapahiya ka namin sa Facebook.”
“Tatawagan namin lahat ng contacts mo.”
“Pupuntahan ka ng pulis bukas.”
“Makukulong ka agad kapag hindi ka nagbayad today.”
“Ipapa-blotter ka namin sa barangay at ipapahiya ka sa employer mo.”

A lender can demand payment. It cannot use humiliation, intimidation, or false legal threats as collection tools.

Data Privacy Act and NPC rules for online lending apps

The Data Privacy Act of 2012, or RA 10173, protects the fundamental human right to privacy while allowing legitimate personal data processing under lawful conditions. (National Privacy Commission)

For online lending, the NPC has issued detailed rules because loan apps often process sensitive information such as:

Full name, address, birthday, and mobile number
ID cards and selfies for know-your-customer checks
Employment information
Payment information
Contact references
Device permissions such as camera, gallery, and contacts

NPC Circular No. 20-01 covers personal data processing for loan processing activities, including debt collection and remedial measures. It applies not only to traditional lenders, but also to online lending apps, financing companies, third-party service providers, and persons acting like such lenders.

NPC Circular No. 2022-02 further tightened the rules. It prohibits unnecessary app permissions and excessive contact-list processing. It also states that photos obtained through camera or gallery permissions cannot be used to harass or embarrass borrowers in collecting delinquent loans.

In 2026, the DICT, NPC, and SEC jointly reiterated that online lending platforms must not engage in harassment, intimidation, public shaming, or unlawful use of personal data. The advisory again emphasized that contacting persons in a borrower’s contact list other than named guarantors is prohibited for debt collection.

Financial Consumer Protection Act

The Financial Products and Services Consumer Protection Act, or Republic Act No. 11765, strengthens consumer protection in financial transactions. It recognizes rights such as equitable and fair treatment, disclosure and transparency, data privacy and protection, and timely handling of complaints. (Supreme Court E-Library)

For borrowers, this matters because online lending is not only a private contract issue. It is also a financial consumer issue. A lending company cannot hide behind an app interface, outsourced collector, or vague “system-generated” message when its collection methods violate consumer protection standards.

Possible criminal and civil liability

Some extreme collection tactics may go beyond administrative violations.

Depending on the facts, the borrower or affected third party may consider whether the conduct involves:

Cyberlibel or libel, if false or defamatory statements are published online. The Supreme Court in Disini v. Secretary of Justice discussed cyberlibel under RA 10175 in relation to libel under Articles 353 and 355 of the Revised Penal Code. (Supreme Court E-Library)
Threats or coercion, if collectors threaten harm, force, or intimidation.
Unjust vexation, when the acts are meant to annoy, irritate, or distress without lawful justification.
Data Privacy Act violations, especially unauthorized processing, malicious disclosure, or improper processing of personal information.

The NPC has previously recommended prosecution involving online lending operators accused of harassing and publicly shaming borrowers. In one NPC enforcement example, complaints alleged that borrowers’ personal information was discussed with friends, relatives, co-workers, and superiors to force payment. (National Privacy Commission)

What to do if an online lending app is shaming or harassing you

Step 1: Preserve evidence before deleting anything

Do this immediately. Many loan apps, collectors, and pages disappear or change names quickly.

Save:

Screenshots of all threatening messages
Screenshots of posts, comments, group chats, or edited photos
Call logs showing dates, times, and numbers used
Voice recordings, if lawfully obtained and relevant
The loan agreement, disclosure statement, promissory note, and payment schedule
Proof of payments and receipts
App name, app store link, website, Facebook page, and screenshots of the app listing
The company name, SEC registration number, Certificate of Authority number, and collection agency name if available
Names and numbers of friends, relatives, co-workers, or employers contacted
Written statements or affidavits from people who received messages

For screenshots, include the full screen where possible: date, time, sender name or number, and the actual message. If the harassment happened on Facebook, Messenger, Viber, WhatsApp, Telegram, SMS, or email, export or preserve the conversation thread before blocking.

Step 2: Revoke unnecessary app permissions

After saving evidence, review the app permissions on your phone.

For Android or iPhone, check whether the app can access:

Contacts
Camera
Photos or gallery
Microphone
Location
SMS
Call logs

NPC rules prohibit unnecessary processing and unnecessary app permissions by online lending apps. Permissions must be suitable, necessary, and not excessive for the declared purpose.

Revoking permissions may not stop data already copied by the app, but it can reduce further exposure.

Step 3: Identify the real company behind the app

Many borrowers know only the app name. Government agencies usually need the company or operator name.

Look for:

Corporate name in the loan contract
SEC registration number
Certificate of Authority number
App developer name
Privacy policy
Email address of the Data Protection Officer
Payment account name
Collection agency or third-party service provider name

The SEC has online verification links for registered lending companies, financing companies, and recorded online lending platforms, and it accepts complaints involving lending or financing company violations. (www.foi.gov.ph)

If the app uses multiple names, list all of them in your complaint. For example: “ABC Cash App / XYZ Lending Corp. / collector using mobile number 09xx…”

Step 4: Send a written objection or demand to stop unlawful data processing

For NPC privacy complaints, a common bottleneck is the exhaustion requirement. The NPC complaint rules generally require the complainant to first notify the respondent in writing about the privacy violation and give the respondent a chance to act. The complainant must attach proof that the respondent received the written concern, and the NPC looks for proof that the respondent failed to act within 15 calendar days or gave an unsatisfactory response. (National Privacy Commission)

Your written message may say:

Stop contacting persons who are not my guarantors.
Stop using my contact list for debt collection.
Stop posting or sharing my photo, name, loan details, or alleged debt.
Delete or block unlawfully processed personal data.
Provide the name and contact details of your Data Protection Officer.
Provide the legal name and SEC details of the lending company.

Send it through channels you can prove: email, app support ticket, registered mail, or screenshots of in-app support messages.

Step 5: File a complaint with the National Privacy Commission

File with the NPC when the issue involves misuse of personal data, such as:

Accessing your contacts without valid purpose
Messaging friends or relatives about your loan
Posting your identity or loan details
Using your photo for shaming
Refusing to delete character reference data
Processing data beyond what was disclosed in the privacy notice

The NPC allows a data subject or an authorized representative to file a complaint. If filed through a representative, proof of authority such as a Special Power of Attorney may be required. (National Privacy Commission)

NPC filing generally involves:

Requirement	Practical notes
Complaint-assisted form or verified complaint	The NPC provides forms and requires relevant details of the privacy violation. (National Privacy Commission)
Notarization	NPC instructions require the form or complaint to be notarized or verified. (National Privacy Commission)
Evidence	Attach screenshots, call logs, app details, contracts, and witness statements.
Proof of prior written notice	Show that you first notified the lender and waited 15 calendar days, unless an exception applies. (National Privacy Commission)
Submission	Filing may be done personally, by registered mail, courier, or email according to NPC instructions. (National Privacy Commission)

After filing, the NPC evaluates whether the complaint is sufficient. If the complaint is upheld, records may be forwarded for enforcement action, civil damages, fines, administrative sanctions, or possible criminal prosecution through the Department of Justice when warranted. (National Privacy Commission)

Step 6: File a complaint with the SEC

File with the SEC when the issue involves the conduct of a lending or financing company, such as:

Unfair debt collection
Harassment by collectors
Misleading interest, charges, or disclosures
Unregistered or unauthorized lending operations
Violations of the Lending Company Regulation Act, Financing Company Act, Truth in Lending Act, or SEC circulars

The SEC complaint process requires a complaint form, supporting evidence, one complaint form per respondent company, and a government-issued ID. The SEC states that after evaluation, it may send a copy of the complaint to the company and require an answer or comment within 10 days. It may later require a reply, close the complaint, or initiate formal administrative action. (SEC Appointment System)

Important limitation: the SEC complaint process is not the same as a court case to cancel your loan. The SEC can act on regulatory violations, but the debt, interest, penalties, and contract issues may still require separate handling depending on the facts.

Step 7: Consider police, NBI, or prosecutor action for serious threats

If collectors threaten physical harm, post defamatory content, impersonate police or court officers, extort money, or use hacked accounts, the issue may no longer be just an SEC or NPC complaint.

For serious cases, preserve evidence and consider reporting to:

PNP Anti-Cybercrime Group
NBI Cybercrime Division
City or provincial prosecutor’s office
Local police station for immediate threats

If the harassment involves a known person in the same city or municipality, barangay conciliation may become relevant for some disputes. But many online lending cases involve corporations, unknown collectors, cybercrime elements, or parties in different cities, so the correct route often depends on the exact facts.

Practical timelines and common bottlenecks

Stage	Typical timing or issue	Common bottleneck
Evidence gathering	Same day if possible	Messages disappear, accounts get deleted, numbers change
Written demand to lender or DPO	Send immediately after preserving evidence	App has no clear company name or valid email
NPC exhaustion period	Usually 15 calendar days from notice before complaint proceeds	No proof that the lender received the written complaint
NPC evaluation	Varies depending on completeness and case load	Missing notarization, unclear respondent, weak screenshots
SEC complaint evaluation	SEC may require company answer/comment within 10 days after the complaint is acted upon	Wrong company name, multiple app brands, incomplete evidence
Criminal complaint	Depends on police, NBI, or prosecutor handling	Need to identify responsible persons and preserve digital evidence

Do not wait too long to save proof. In online lending harassment cases, the most useful evidence is often digital and easy to delete.

Common real-life scenarios

“The app messaged my Facebook friends and said I am a scammer.”

This may involve both data privacy and defamation issues. Save screenshots from your friends, including the sender’s profile, date, time, and message. Ask your friends to provide written statements if possible. If the post or message contains false accusations, threats, or humiliating claims, consider SEC, NPC, and cybercrime remedies.

“I gave the app permission to access contacts. Does that mean they can message everyone?”

No. Contact permission does not give a lender unlimited authority to use your contacts for shaming or debt collection. NPC rules prohibit unbridled contact-list processing and specifically treat debt collection outside guarantors as improper.

“My character reference is being asked to pay.”

A character reference is not automatically a guarantor. Unless that person expressly agreed to be liable for the loan, the lender should not demand payment from them. NPC rules treat character references as part of identity or veracity checking for loan evaluation, not as automatic debt substitutes.

“They threatened to file estafa if I do not pay today.”

Nonpayment of a loan can lead to civil collection, but criminal liability requires separate facts. A collector should not use false or exaggerated criminal threats to force payment. If the message claims immediate arrest, police pickup, or automatic imprisonment without a proper legal basis, save it as evidence of possible unfair collection.

“They contacted my employer.”

Contacting an employer to shame you or pressure payment is highly problematic, especially if the employer is not a guarantor or authorized contact for that purpose. It can affect employment, reputation, and privacy. Save the message, ask HR or your supervisor for a copy, and include it in your SEC or NPC complaint.

“I am an OFW or foreign borrower. Can I still complain?”

Yes. If the lending activity, app, borrower data, or affected persons are connected to the Philippines, Philippine regulators may still be relevant. If someone files on your behalf, agencies may require written authority such as a Special Power of Attorney. Documents signed abroad may need notarization, consular acknowledgment, or apostille treatment depending on the receiving office and the document’s intended use.

Documents to prepare before filing a complaint

Document or evidence	Why it matters
Government-issued ID	Required for identity verification in agency complaints. (SEC Appointment System)
Loan agreement or disclosure statement	Shows the lender, amount, due date, interest, charges, and borrower obligations.
Screenshots of harassment	Shows the exact words, sender, time, and platform used.
Screenshots from contacted friends or relatives	Proves third-party contact and possible contact-list misuse.
Call logs	Supports repeated calls, unusual hours, or harassment patterns.
App details	Helps identify the app, developer, privacy policy, and company behind it.
Proof of payment	Prevents confusion about the outstanding balance.
Written demand or privacy objection	Needed especially for NPC exhaustion requirements. (National Privacy Commission)
Affidavits or written statements	Useful when friends, relatives, co-workers, or employers were contacted.
Special Power of Attorney	Needed when someone files for you as an authorized representative. (National Privacy Commission)

Frequently Asked Questions

Can an online lending app post my picture or name online because I did not pay?

No. Public shaming is not a lawful collection method. Posting your photo, name, loan details, or accusations online may violate SEC debt collection rules, data privacy rules, and possibly defamation laws depending on what was posted.

Can a loan app contact everyone in my phone contacts?

No. NPC rules prohibit unbridled or excessive processing of contact lists, especially when used for harassment, debt collection outside guarantors, or unfair collection practices. For debt collection, the lender may contact a guarantor, but not random contacts from your phone.

What if I clicked “allow contacts” when installing the app?

That does not automatically make every contact fair game. Consent must be specific, informed, necessary, and proportional. An app permission cannot lawfully authorize harassment or public shaming.

Can they call my character reference?

They may contact a character reference only for legitimate verification related to loan evaluation. A character reference is not automatically a guarantor, and the lender should not demand payment from that person unless there is a separate express agreement creating liability.

Can they contact my employer?

Generally, they should not contact your employer to shame you, pressure you, or disclose your loan. If your employer was not a guarantor or a properly authorized contact for a lawful and limited purpose, employer contact can become evidence of privacy violation or unfair collection.

Can I refuse to pay because the online lending app harassed me?

Harassment does not automatically erase a valid debt. Treat the issues separately: preserve evidence and file complaints for unlawful collection, while also checking the loan contract, payments, interest, penalties, and whether the lender is properly registered or authorized.

Should I file with the SEC or the NPC?

File with the SEC for unfair debt collection, unauthorized lending activity, misleading loan terms, or violations by lending and financing companies. File with the NPC for misuse of personal data, contact-list abuse, public shaming using personal information, or improper processing of your photos and contacts. In many online lending harassment cases, both agencies may be relevant. (SEC Appointment System)

Can my friends or relatives file their own complaint?

Yes, if their own personal data was misused or they were harassed. They are data subjects too. They can save screenshots, write statements, ask for deletion of their data, and complain if their privacy rights were violated.

How long does an SEC or NPC complaint take?

Timelines vary. For SEC complaints, the SEC may require the company to submit an answer or comment within 10 days after the complaint is evaluated and sent to the company. For NPC complaints, the complainant usually needs to show prior written notice to the respondent and lack of sufficient action within 15 calendar days. Agency workload, completeness of evidence, and identification of the correct company can affect the timeline. (SEC Appointment System)

Can the collector say I will be arrested tomorrow?

A collector should not threaten arrest or criminal action without legal basis. Loan nonpayment is usually a civil matter unless separate facts support a criminal complaint, such as fraud from the beginning. Save threats of arrest, police action, or public humiliation because they may support an unfair collection complaint.

Key Takeaways

Online lending apps in the Philippines may collect legitimate debts, but they cannot collect through harassment, threats, public shaming, or unlawful use of personal data.
Lenders generally cannot message your friends, relatives, co-workers, or employer just because their numbers are in your phone contacts.
A character reference is not automatically a guarantor and should not be treated as someone liable for your loan.
A guarantor may be contacted for debt collection only if that person expressly agreed to be liable.
Broad app permissions do not legalize contact-list abuse, photo shaming, or excessive data processing.
File with the NPC for privacy and personal data misuse issues.
File with the SEC for unfair debt collection, lending company violations, and financing company complaints.
Preserve screenshots, call logs, app details, contracts, payment records, and third-party statements before blocking or deleting anything.
Harassment does not automatically cancel a valid loan, but it can create separate liability for the lender, app operator, or collector.