Quick answer

Generally, no. A lending app may contact the borrower and, for debt collection, a person who actually agreed to be legally responsible for the loan—such as a guarantor, co-borrower, co-maker, or surety. It generally may not contact a borrower’s relatives, employer, co-workers, friends, former partner, or other phone contacts merely to pressure, shame, or embarrass the borrower into paying.

A character reference is not automatically a guarantor. A former partner is not liable simply because of the past relationship. An employer may be contacted for limited, properly disclosed employment verification during a loan application when the processing is lawful and necessary, but not to announce the debt, demand payment, threaten the borrower’s job, or enlist HR and co-workers as collection agents.

These rules apply even when collection is outsourced. The lender cannot avoid responsibility by blaming a call center, collection agency, or individual collector.

Who may be contacted—and for what purpose?

Person	What is generally allowed?
Borrower	Lawful, proportionate collection communications directed to the borrower
Co-borrower, co-maker, or surety	Contact about an obligation that the person actually undertook, subject to fair-collection and privacy rules
Guarantor	Collection contact if the person separately and expressly consented to be a guarantor
Character reference	Limited contact to verify the borrower’s identity or the truthfulness of information supplied during the loan application—not debt collection
Relative or friend	No collection contact merely because the person is related to the borrower or appears in the borrower’s contacts
Employer, HR, supervisor, or co-worker	Possible limited employment verification when lawfully necessary and properly disclosed; no debt disclosure, shaming, or collection pressure
Former spouse or former partner	No collection contact unless the person separately assumed a legal obligation under the loan documents
Emergency contact	Not automatically liable and not automatically a permissible collection target

The person’s legal role, not the relationship label, controls. Calling someone a “guarantor” inside an app does not make it so if that person never separately agreed to assume the obligation.

Under Article 2047 of the Civil Code, a guarantor binds himself or herself to answer to the creditor if the principal debtor fails to perform. NPC Circular No. 2022-02 therefore requires the guarantor’s separate consent. It also expressly states that a character reference must not automatically be treated as a guarantor.

The current rule for online lending platforms

The March 18, 2026 joint advisory of the Department of Information and Communications Technology, National Privacy Commission, and Securities and Exchange Commission states that:

contacting people in the borrower’s contact list other than named guarantors is prohibited;
for debt collection, lending companies, financing companies, and persons acting for them may contact the guarantor;
character references and guarantors must be entered through separate interfaces;
a guarantor must expressly consent to assume responsibility in case of default; and
unauthorized, excessive, or disproportionate access to contact lists—including processing that leads to harassment or collection outside the borrower’s guarantors—is prohibited.

A co-borrower, co-maker, or surety may still be contacted about an obligation that person personally undertook. Such a person is not merely a third-party phone contact.

The controlling privacy rules are found in NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02. The government restated them in its 2026 Public Advisory on Online Lending Platforms.

What a character reference may be asked

A character reference may be contacted to verify:

the borrower’s identity; or
whether information supplied for the loan application is truthful.

The lender must tell the person that they were identified as a character reference and explain how the contact details were obtained. The person must also be given the option to request removal of their data as a reference.

A reference should not be:

ordered to pay the borrower’s debt;
told to force the borrower to pay;
threatened with calls or legal action;
described as a guarantor without separate consent;
contacted for debt collection, marketing, or cross-selling; or
sent the borrower’s loan balance, payment history, ID, photograph, or other unnecessary personal information.

Borrowers also have a responsibility to inform a person before naming them as a character reference. That responsibility does not authorize the lender to use the reference for collection.

When contacting an employer crosses the line

A lender may have a legitimate reason to verify employment before granting credit, provided the process is transparent, necessary, proportionate, and supported by a lawful basis under the Data Privacy Act.

That is different from contacting an employer after default to say:

“Your employee refuses to pay”;
“Deduct this from the employee’s salary”;
“Terminate or discipline this person”;
“Tell everyone in the office that this person is a scammer”; or
“You are responsible for the employee’s loan.”

An employer does not become liable merely because the borrower works there. A private collector also cannot simply impose a salary deduction. Any deduction or garnishment requires an applicable legal basis, valid authorization, or proper court process.

If an employer itself is a genuine guarantor, co-borrower, or party to a lawful payroll-loan arrangement, the documents must be examined before reaching a conclusion. Even then, the lender must limit communications to what is necessary and must not shame or harass the employee.

What about a former spouse or former partner?

A past or present romantic relationship does not create liability for another person’s app loan.

A former partner may be contacted about payment only if that person independently became a co-borrower, co-maker, surety, or properly consenting guarantor. Being listed as an emergency contact or character reference is insufficient.

For former spouses, questions involving obligations signed during marriage or liability of marital property can be fact-specific. Those issues require examination of the loan documents, the applicable property regime, the purpose of the debt, and any separation or annulment documents. They do not give a collector permission to harass or publicly shame the former spouse.

“I clicked Allow Contacts.” Does that make the calls legal?

No. Clicking a phone permission does not:

make every contact a guarantor;
authorize disclosure of the borrower’s debt to everyone;
permit harassment, threats, or public shaming; or
allow unlimited copying and storage of contact information.

NPC rules allow only limited access when it is suitable, necessary, and not excessive for a legitimate purpose. An app may, for example, allow a borrower to select a reference or guarantor, or derive proportionate metadata when genuinely necessary. “Unbridled” processing—processing that is unconstrained, excessive, disproportionate, used for harassment, or used to collect from people other than guarantors—is prohibited.

Consent must also be specific and informed. The 2026 government advisory warns that deceptive designs, such as pre-ticked permissions or interfaces that make consent easy but withdrawal difficult, may undermine or invalidate consent.

Once a permission is no longer needed and no other lawful basis applies, the app should prompt the borrower to revoke or turn it off.

Other collection practices that may be unlawful

The SEC’s Memorandum Circular No. 18, Series of 2019 prohibits unfair collection practices by lending and financing companies and their third-party service providers. Depending on the facts, violations may include:

threats of violence or harm to a person, reputation, or property;
threats to take an action that cannot legally be taken;
obscene, insulting, or profane language;
false or deceptive representations;
public disclosure or debt shaming;
repeated communications intended to annoy, abuse, or humiliate;
use of the borrower’s photograph or ID to embarrass the borrower; and
contacting people in the borrower’s contact list who are not legally involved in the obligation.

Republic Act No. 11765, the Financial Products and Services Consumer Protection Act, separately requires fair and respectful treatment, prohibits abusive debt-recovery practices, and protects client data. A financial service provider is responsible for the acts or omissions of its representatives and may be solidarily liable with an accredited third-party service provider involved in debt collection.

What to do if someone has already been contacted

1. Preserve the evidence before deleting anything

Ask every affected person to save:

the complete message thread, not only selected lines;
the sender’s phone number, username, profile link, and account name;
call logs showing dates, times, frequency, and duration;
voicemails and emails received;
screenshots showing the borrower’s name, alleged balance, threats, or demands;
any social-media post, group-chat message, or employer communication; and
a short written account identifying who received the communication and what happened.

Also preserve:

the loan agreement and disclosure statement;
statement of account and payment history;
the app’s privacy notice and terms in effect when the loan was obtained;
screenshots of app permissions;
the app-store listing and developer details;
the legal company name behind the app;
receipts and payment confirmations; and
previous complaints and the lender’s replies.

Do not uninstall the app until essential records have been saved. Avoid editing, cropping, or reposting evidence in a way that removes timestamps or unnecessarily exposes other people’s data.

2. Revoke unnecessary permissions

After preserving evidence, review the phone’s settings and revoke access to contacts, photos, camera, location, SMS, microphone, and storage where access is no longer necessary. Change relevant account passwords if there are signs of unauthorized access.

Revoking permissions does not erase data already copied by the lender, so a written privacy request may still be necessary.

3. Identify the actual lender

The app’s brand may differ from the corporation that granted the loan. Check the contract, disclosure statement, privacy notice, payment instructions, and app-store developer page for:

the corporate name;
SEC registration details;
Certificate of Authority information;
customer-assistance unit;
data protection officer; and
name of any collection agency.

A lending company must have SEC authority to operate. Lack of registration should be reported, but it does not automatically establish that the borrower owes nothing.

4. Send a written complaint to the lender and its data protection officer

A concise notice can state:

Your collectors contacted [name/relationship or employer] on [date and time]. That person is not my guarantor, co-borrower, co-maker, or surety. The communication disclosed or used information concerning my alleged loan for debt collection.

Stop all collection contact with uninvolved third parties and direct lawful communications to me through [email or number]. Please preserve all call recordings, messages, contact-access logs, collector assignments, and records identifying how the third party’s information was obtained. Please also provide the collector’s authority, a complete statement of account, and your written response to this complaint.

Do not admit an amount that is genuinely disputed. Request a breakdown of the principal, interest, fees, penalties, payments, and current balance.

This written notice is particularly important for an NPC complaint. Under the 2021 NPC Rules of Procedure, the complainant ordinarily must first notify the company in writing. The NPC may give due course when the company fails to take timely and appropriate action or does not respond within 15 calendar days. The NPC may waive this requirement for good cause or a serious violation, including grave and irreparable harm, lack of an adequate remedy, or patently illegal conduct.

5. Report unfair collection to the SEC

For a lending company, financing company, online lending platform, or its collection agency, submit a complaint through the SEC I-Message portal and direct it to the Financing and Lending Companies Department. The 2026 joint advisory also identifies the SEC hotline 1-4732 (1-4SEC).

Include the corporate name if known, app name, account details, chronological facts, identities of third parties contacted, and organized copies of the evidence.

6. File a privacy complaint with the NPC

Unauthorized contact-list processing, disclosure of loan information, debt shaming, or failure to honor data-subject rights may be brought to the National Privacy Commission.

The NPC’s official complaint page requires a filled-out and notarized complaint-assisted form or a verified complaint, together with evidence and any witness affidavits. Filing may be personal, by registered mail, by courier, or by electronic mail when authorized by the Commission. Follow the current page instructions for signatures, copies, fees, and electronic-document requirements.

The investigating officer has 30 calendar days from receipt to give the complaint due course or dismiss it without prejudice. This is an initial evaluation period, not a deadline for final resolution.

A borrower and a contacted relative, former partner, or employee may have separate privacy interests. The person whose own data was misused should consider filing or joining through a properly authorized representative.

7. Use the correct regulator if the lender is not SEC-regulated

If the app or credit service is operated by a bank or another BSP-supervised institution, complain first through that institution’s consumer-assistance mechanism. If unresolved, escalate through the BSP Consumer Assistance Mechanism.

The NPC may still have jurisdiction over unlawful personal-data processing regardless of which financial regulator supervises the lender.

When help is urgent

Contact law enforcement promptly if the messages involve credible violence, stalking, extortion, account takeover, identity theft, fake warrants, or threats to publish intimate or highly sensitive information.

The 2026 government advisory identifies these channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph
PNP Anti-Cybercrime Group: acg@pnp.gov.ph

Seek immediate advice from a Philippine lawyer or legal-aid office if:

a court summons, subpoena, or formal pleading has been received;
the collector is threatening physical harm;
personal data or photographs are being published;
the contact has caused dismissal, suspension, or another serious workplace consequence;
money is being demanded through threats or impersonation; or
the alleged borrower never applied for the loan.

Do not ignore genuine court papers. A threatening text designed to look official is not necessarily a court document, but an actual summons has procedural deadlines stated in the papers.

Does abusive collection cancel the loan?

Not automatically. Unlawful collection and the validity or amount of the debt are separate questions.

A borrower may report the lender, demand correction of records, dispute unauthorized charges, and pursue appropriate privacy, regulatory, civil, or criminal remedies. But a valid lender may still send proper demands, report accurate credit information through lawful channels, negotiate payment, or file a civil collection case.

For ordinary nonpayment of a civil debt, Article III, Section 20 of the 1987 Constitution prohibits imprisonment for debt. Separate fraudulent acts, falsified documents, or other independently punishable conduct are different and depend on evidence—not merely on inability to pay.

Common mistakes to avoid

Deleting the app, messages, or account before saving the evidence.
Assuming a reference or emergency contact is automatically a guarantor.
Paying an unknown collector without verifying authority and an official payment channel.
Responding with threats, insults, or public accusations that create a separate dispute.
Posting unredacted IDs, contracts, phone numbers, or account details on social media.
Ignoring the underlying balance because the collection method was abusive.
Filing a privacy complaint without first sending the required written notice, unless facts support an NPC waiver.
Naming only the app brand when the legal corporate operator can be identified.
Secretly recording private calls without first obtaining advice on the Anti-Wiretapping Act; written communications and received voicemails are safer evidence.

Frequently asked questions

Can a lending app call my parents or siblings?

Not for debt collection merely because they are relatives or appear in your contacts. Contact may be proper only if the person actually assumed a legally recognized role, such as guarantor, co-borrower, co-maker, or surety.

Can the app demand payment from a character reference?

No. A character reference is for identity and information verification, not automatic liability or debt collection.

Can the lender tell HR how much I owe?

Generally no. Disclosing the debt or balance to HR to shame or pressure the borrower is materially different from limited, lawful employment verification during the application process.

Can my former partner ask the lender to stop contacting them?

Yes. The former partner should state in writing that they are not a guarantor or co-obligor, request the source and purpose of the data processing, demand that improper contact stop, and preserve the request and response.

What if the app says my relative consented?

Ask for the document, electronic record, or recording showing separate and informed consent to become a guarantor. Merely appearing in a contact list or answering a verification call is not the same as assuming the debt.

Is the lender responsible for its collection agency?

Yes. Outsourcing does not remove the lender’s accountability. The provider may be responsible for its representatives and, under Republic Act No. 11765, may be solidarily liable with an accredited third-party service provider involved in collection.

Can the lender post my name or photo online?

Using a borrower’s name, photo, ID, loan details, or altered “wanted” image for public shaming may violate SEC collection rules, the Data Privacy Act, and—depending on the precise words, audience, and circumstances—other civil or criminal laws. Preserve the original post, URL, account name, audience, date, and time.

Should I stop paying because the collector contacted my family?

Do not assume the debt disappeared. Continue to dispute incorrect amounts in writing, request a proper statement of account, and use only verified payment channels. Report the collection conduct separately.

Official references

This article provides general legal information, not advice for a particular case. Liability may depend on the signed loan documents, the person’s actual role, the lender’s regulator, and the content and purpose of each communication. Sources and official procedures were checked as of August 18, 2026.