Quick answer

Generally, no. A lending app may not contact a borrower’s relatives, employer, former partner, or other phone contacts simply to pressure, embarrass, or shame the borrower into paying. For debt collection, Philippine privacy rules generally allow contact only with the borrower and a person who validly and separately agreed to be a guarantor. A genuine co-borrower or co-maker may also be contacted about that person’s own contractual obligation.

The person’s status—not the relationship—controls:

A parent, sibling, spouse, employer, colleague, friend, or former partner does not become liable merely because the borrower knows them or saved their number.
A character reference may be contacted only for the limited purpose of verifying the borrower’s identity and the truthfulness of information supplied during the loan application. A character reference is not automatically a guarantor and may not be used for debt collection.
A guarantor must have separately and expressly consented to guarantee the loan. Naming someone in an app, without that person’s agreement, is not enough.
A co-borrower or co-maker who actually signed the loan documents may be pursued according to the contract and applicable law.

The National Privacy Commission (NPC), Securities and Exchange Commission (SEC), and Department of Information and Communications Technology reiterated these rules in their 18 March 2026 advisory on online lending platforms.

The rule depends on why the person is being contacted

Person or situation	Is contact generally allowed?	Legal limit
Relative, friend, colleague, employer, or former partner found only in the borrower’s contacts	No, for debt collection	The lender may not harvest or use the contact list to pressure or shame the borrower
Character reference selected by the borrower	Yes, but only for verification	The lender may verify identity or the truthfulness of application information—not collect the debt
Guarantor	Yes	The person must have separately and expressly agreed to guarantee the obligation
Co-borrower or co-maker	Yes, if genuine	The person may be contacted regarding the obligation that they actually signed
Employer or HR contacted to verify employment during an application	Possibly	The verification must be disclosed, lawful, necessary, proportionate, and limited to its stated purpose
Borrower called through a workplace number	Not automatically prohibited	The communication must remain private and reasonable; the lender may not disclose the debt to supervisors or coworkers
Court, regulator, authorized credit system, or lawful service provider	Sometimes	Disclosure must have a lawful basis and remain limited to what is necessary

Character references are not collection targets

Under NPC Circular No. 2022-02, a character reference is someone whose details are provided to verify the borrower’s identity and the truthfulness of information used in evaluating a loan application.

The rules require several safeguards:

The borrower should inform the person that they are being named as a character reference.
The lender must tell the reference that they were selected and explain how their contact details were obtained.
The reference must be given the option to have their personal data removed as a character reference.
The lender may not contact the reference for debt collection, marketing, cross-selling, or unrelated third-party offers.
A character reference cannot be automatically treated as a guarantor.

This means a lending app cannot call a borrower’s mother, former partner, or supervisor about an overdue balance merely because that person was once listed as a reference.

A guarantor must actually agree to the role

A guarantor is someone who expressly binds themselves to answer for the borrower’s obligation if the borrower fails to perform. The lender must obtain the guarantor’s separate consent, consistent with the Civil Code and data-privacy requirements.

A borrower cannot unilaterally make another person a guarantor by:

typing the person’s name or number into an app;
selecting the person from a contact list;
describing the person as an “emergency contact”;
claiming that the person agreed; or
accepting app terms on the other person’s behalf without authority.

Whether someone is genuinely liable depends on the signed or electronically authenticated documents, the wording of the undertaking, and the circumstances in which consent was obtained. Anyone wrongly described as a guarantor should demand a copy of the document allegedly bearing their agreement.

Special points for relatives, employers, and former partners

Relatives

Family relationship alone does not make a person responsible for the borrower’s debt. A collector cannot tell parents, siblings, children, or other relatives to pay unless the person independently assumed a legal obligation.

A spouse’s possible liability can involve the loan documents, the applicable property regime, and the purpose of the debt. Marriage alone should not be treated as automatic proof that the spouse guaranteed the loan. Obtain legal advice before accepting a collector’s claim that a spouse or family member must pay.

Employers and coworkers

A lender may perform a properly disclosed and proportionate employment check during the application process. That does not authorize it to tell HR, a manager, receptionist, or coworkers that the borrower is delinquent.

A collector reaching the borrower through a workplace number is not necessarily the same as contacting the employer. However, revealing the debt, repeatedly disrupting the workplace, asking the employer to force payment, or threatening the borrower’s employment may amount to unfair collection or unlawful processing, depending on the facts.

Former partners or former spouses

A former relationship creates no collection exception. If the person is merely in the borrower’s old contact list, the lender may not use the number for collection.

If the former partner validly signed as a guarantor, co-maker, or co-borrower, ending the relationship does not by itself cancel that written obligation. The documents must be reviewed to determine whether the person was released, the obligation was paid, or the agreement was otherwise extinguished.

A lending app cannot freely harvest the borrower’s contacts

NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02, prohibits unnecessary, excessive, or disproportionate processing of personal data.

Limited contact-list access may be used to let the borrower select a character reference or guarantor, or to derive proportionate metadata where necessary for a specified legitimate purpose. The app must not indiscriminately copy, save, or process the entire list. Phone contacts, email lists, and social-media contacts are covered.

Once an app permission is no longer necessary, the app should turn it off or tell the borrower that it may be revoked. Camera or photo-gallery access may be justified for identity, fraud, or payment verification, but a borrower’s photograph may never be used to humiliate or threaten them.

Clicking “Allow Contacts” is not blanket permission to call everyone

Consent under the Data Privacy Act of 2012 must be freely given, specific, informed, and evidenced by written, electronic, or recorded means. A vague privacy notice, pre-ticked box, hidden term, or interface designed to make refusal difficult may not amount to valid consent.

More importantly, SEC Memorandum Circular No. 18 treats contacting people in the borrower’s contact list—other than recognized guarantors or co-makers—as an unfair collection practice notwithstanding the borrower’s consent. The official SEC issuance is available through the SEC page for Memorandum Circular No. 18, Series of 2019.

The Financial Products and Services Consumer Protection Act also prohibits abusive collection or debt-recovery practices and protects client data. A contract cannot validly waive a financial consumer’s right to have non-public client data protected.

Conduct that can amount to unfair collection

Apart from unauthorized third-party contact, SEC rules prohibit practices such as:

violence or threats of violence or other criminal means;
threats to take action that cannot legally be taken;
obscenities, insults, or profane language amounting to abuse;
disclosure or publication of borrowers’ names or personal information to shame them;
false statements about a loan, including failure to disclose that a debt is disputed where required;
false representations or deceptive methods used to collect or obtain information; and
contacting the borrower at unreasonable hours.

Under SEC Memorandum Circular No. 18, contact before 6:00 a.m. or after 10:00 p.m. is generally considered unreasonable. Its stated exceptions concern an account more than 15 days past due or the borrower’s express, properly recorded consent that those are the only convenient contact times. Those time exceptions do not authorize harassment, threats, public shaming, or contact with otherwise prohibited third parties.

An improper call does not automatically establish every possible civil, administrative, or criminal violation. Liability depends on what information was processed or disclosed, the collector’s purpose and conduct, the available evidence, and the elements of the applicable law.

What to do if the app contacts other people

1. Preserve the evidence first

Save:

screenshots of texts, chats, social-media posts, and app notifications;
call logs showing numbers, dates, times, and frequency;
voicemails and emails;
the exact words used by the collector, written down promptly;
the app’s name, developer, download page, privacy notice, and requested permissions;
the lender’s registered corporate name, SEC number, and Certificate of Authority number;
loan documents, disclosure statements, account history, and payment receipts;
the name or alias used by the collector and the collection agency, if any; and
statements or affidavits from relatives, coworkers, or other recipients describing what was disclosed.

Preserve original electronic files when possible. Be cautious about secretly recording private calls: the Anti-Wiretapping Act may apply, so obtain legal advice before making a recording without the participants’ authorization. Existing voicemails and lawfully created recordings should be kept.

2. Restrict unnecessary app access

After preserving the evidence:

revoke access to contacts, storage, location, camera, microphone, and social-media accounts when no longer needed;
change passwords if the app obtained access to an account;
review permissions in the phone’s settings; and
remove the app only after saving the contract, payment information, privacy notice, and complaint evidence.

Revoking access does not cancel a valid debt. Continue dealing with the legitimate lender through a verified channel.

3. Send a written complaint to the lender

Address the complaint to the lender’s consumer assistance unit and data protection officer. Keep proof of delivery.

A practical notice may say:

Stop contacting my relatives, employer, former partner, coworkers, and any other person who has not separately and validly agreed to be a guarantor or co-maker. Please identify the source and lawful basis for processing each person’s data, the identity of the collector and collection agency, and the privacy notice or consent record relied upon. Restrict further processing and securely delete contact-list data that has no continuing lawful purpose. Communicate directly with me through the contact details below and provide an updated statement of account. This request is not a waiver of any dispute, defense, privacy right, or remedy.

A contacted third party may write separately:

I am not a borrower, guarantor, co-maker, or co-borrower. Do not contact me for collection. Explain how you obtained my data and remove it from your character-reference and collection records, subject only to any retention specifically required by law.

Do not send identification documents to an unverified collector. Confirm the company and its authority through the SEC’s Check with SEC service.

4. File with the proper regulator

For an SEC-regulated lending or financing company: File an unfair-collection complaint through the SEC’s official iMessage ticketing system and select the service for the Financing and Lending Companies Department. The 2026 joint advisory also lists the SEC hotline 1-4732 (1-4SEC).

For a privacy violation: The NPC’s amended rules generally require the complainant first to notify the lender or other responsible entity in writing. A formal NPC complaint may proceed if the entity takes no timely and appropriate action or gives no response within 15 calendar days of receiving the notice. The NPC may waive this requirement for good cause or a serious violation involving significant risk of harm. Review the 2021 NPC Rules of Procedure, as amended and use the current NPC complaint page and forms. A formal complaint generally must be verified or notarized, include supporting evidence and relevant correspondence, and comply with applicable filing-fee rules.

For a bank or other BSP-supervised institution: First complain through the institution’s own financial consumer protection assistance mechanism. If unresolved, escalate through the BSP Consumer Assistance Mechanism, including the BSP Online Buddy or the official complaint form and email channel.

A collection agency’s involvement does not necessarily remove the lender’s responsibility. Financial service providers can remain responsible for their representatives and, under the Financial Products and Services Consumer Protection Act, may be solidarily liable with accredited third-party providers for covered acts or omissions.

5. Get urgent help when there are threats or immediate danger

Do not wait 15 days if the situation involves threats of physical harm, stalking, extortion, account takeover, impersonation, or another urgent safety risk. Contact local police or the appropriate cybercrime authority immediately.

The 2026 government advisory lists:

DICT Cyber Hotline: 1326 or 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph
PNP Anti-Cybercrime Group: acg@pnp.gov.ph

Seek a lawyer promptly if private information has been posted publicly, employment is being threatened, a summons or court document has arrived, money was taken without authorization, or someone is being falsely accused of fraud or a crime.

Common mistakes to avoid

Assuming every third-party call is lawful because the borrower accepted the app’s terms. Broad consent does not override the specific limits on collection contacts.
Treating a reference as a guarantor. These are legally different roles.
Deleting the app before saving evidence and account records.
Blocking every channel without giving the legitimate lender a safe way to communicate. Provide one verified email address or number.
Paying a collector’s personal account. Verify the lender, collection agency, balance, and official payment channel.
Ignoring a real court summons. Abusive collection and the validity of the underlying debt are separate issues.
Assuming a regulatory complaint automatically cancels the loan. It does not. A valid principal obligation may remain enforceable even when the collection method was unlawful.
Posting unredacted evidence online. Public posts can expose account numbers, IDs, phone numbers, and other people’s data.

Frequently asked questions

Can a lending app call my parents because I listed them as emergency contacts?

Not for debt collection merely because they were called emergency contacts. Contact may be proper only within a valid, limited role—for example, application verification as a character reference or collection from a person who separately agreed to be a guarantor.

Can the app call my employer to confirm that I work there?

A disclosed, necessary, and proportionate employment-verification step may be lawful during application processing. It does not permit the lender to reveal an overdue loan, demand that the employer collect it, or shame the borrower at work.

Can a character reference ask to be removed?

Yes. NPC Circular No. 2022-02 requires lenders to provide character references with the option to have their personal data removed as a reference.

Can a relative be forced to pay?

Not solely because of the family relationship. Liability generally requires a contractual or other legal basis, such as genuinely signing as guarantor, co-maker, or co-borrower. Spousal and property-regime questions may require review of the documents and the purpose of the debt.

Can the lender post my name or photograph on Facebook or message a group chat?

Using personal information or photographs to shame or embarrass a borrower is prohibited and may constitute unfair collection and unlawful personal-data processing.

What if I allowed the app to access all my contacts?

That permission does not give the lender an unrestricted right to copy or call everyone. Contact-list processing must remain necessary, proportionate, and tied to a lawful purpose. Debt collection outside valid guarantors—and genuine co-obligors where applicable—is prohibited.

Is one polite call to a third party automatically unlawful?

A call to a properly designated character reference for application verification or to a valid guarantor may be allowed. An accidental wrong-number call may also present different facts. But deliberately contacting an unrelated person to discuss or collect the borrower’s debt can violate the rules even without profanity or threats.

Does reporting the lender erase the debt?

No. The debt and the collection conduct are separate. Continue requesting an accurate statement and use verified payment channels while preserving any dispute, defense, or complaint.

Official legal sources

This article provides general Philippine legal information, not legal advice for a particular loan, person, or dispute. Contractual liability, privacy violations, and available remedies depend on the documents and evidence. Official sources and procedures were checked as of 4 August 2026.