Quick answer

Generally, no. An online lending platform cannot contact a borrower’s relatives, employer, former partner, friends, or other phone contacts merely to pressure the borrower into paying. It also cannot reveal the loan, balance, alleged default, or other personal information to shame or embarrass the borrower.

The main exceptions are narrow:

A person may be contacted for collection if that person is a guarantor who separately and expressly agreed to answer for the debt.
A genuine co-borrower or co-maker may be contacted because that person is a party to the loan—not simply because their number appeared in the borrower’s phone.
A chosen character reference may be contacted only to verify the borrower’s identity or the truth of information supplied during the loan application. A character reference is not automatically a guarantor and should not be pursued for payment.
Limited contact may be lawful for a different, legitimate purpose, such as proportionate employment verification, an authorized payroll arrangement, or compliance with a court or government order. These situations do not permit public shaming or unnecessary disclosure.

This remains true even when the debt is genuine and unpaid. A lender may collect a valid debt through reasonable, lawful means, but delinquency does not cancel the borrower’s privacy and consumer rights.

The rule for online lending platforms

Under NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02, an online lender cannot engage in unconstrained, excessive, or disproportionate processing of a borrower’s contacts.

The amended rules permit only limited contact-list access when necessary to:

Allow the borrower to select a character reference or guarantor;
Identify and contact the specific reference or guarantor selected by the borrower; or
Derive proportionate metadata for a specified, legitimate purpose.

The app should not harvest, copy, or use the borrower’s entire phonebook, email list, or social-media contacts as a collection directory. In its 18 March 2026 joint advisory, the DICT, NPC, and SEC expressly reiterated that contacting people in a borrower’s contact list other than named guarantors is prohibited for debt collection.

The Data Privacy Act of 2012 also requires personal-data processing to be transparent, lawful, tied to a legitimate purpose, and proportionate. Access to a phone’s contacts, photographs, or other data is not automatically lawful simply because an app technically obtained permission.

What this means for each type of person

Person contacted	What may be allowed	What is generally prohibited
Parent, sibling, child, or other relative	Identity verification if personally selected as a character reference; collection if the relative separately became a guarantor or direct obligor	Asking the relative to pay, repeatedly pressuring them, or disclosing the debt merely because they are family
Employer, HR officer, or supervisor	Necessary and proportionate employment verification during an application, with proper notice and a lawful basis; compliance with a valid court or agency order; an authorized payroll arrangement	Calling the workplace to embarrass the borrower, announcing the debt to coworkers, or demanding that the employer collect the loan
Former boyfriend, girlfriend, or partner	Verification if personally selected as a character reference; collection if the person actually signed as guarantor, co-maker, or co-borrower	Contact based only on the past relationship or because the person’s number was found in the borrower’s phone
Former or current spouse	Contact if the spouse signed the loan or guaranty, or where a valid legal proceeding requires communication	Assuming liability solely from marital status or using the spouse to pressure or shame the borrower
Character reference	Verification of the borrower’s identity and the accuracy of application information	Collection calls, payment demands, marketing, cross-selling, or treating the reference as a guarantor
Guarantor	Communication about the guaranteed obligation, within the actual terms of the guaranty	Harassment, threats, false statements, public disclosure, or demands exceeding the guarantor’s legal undertaking
Co-maker or co-borrower	Collection because the person is a party to the obligation, subject to the contract and applicable law	Abusive collection practices or disclosure to additional outsiders

Labels inside an app are not conclusive. Calling someone an “emergency contact,” “reference,” or “co-maker” does not bind that person unless the documents and legally valid consent support that status.

A character reference is not a guarantor

A character reference is someone whose details are provided to verify the borrower’s identity and the truth of application information. Under NPC Circular No. 2022-02:

The borrower should inform the person before naming them as a reference.
The lender must tell the person that they were selected and explain how the contact details were obtained.
The lender must provide the reference with an option to have their information removed.
The lender cannot use the reference’s information for debt collection, marketing, cross-selling, or unrelated third-party offers.
The reference cannot automatically be treated as a guarantor.

A guarantor, by contrast, expressly undertakes to fulfill the borrower’s obligation if the borrower fails to do so. The lender must obtain the guarantor’s separate consent. A borrower generally cannot turn another person into a guarantor merely by typing that person’s name or phone number into an app.

A co-maker or co-borrower may have direct contractual liability, depending on the signed documents. Anyone incorrectly identified as a co-maker should immediately request a copy of the document supposedly bearing their consent or signature.

Does accepting the app’s terms allow it to contact everyone?

No. Consent under the Data Privacy Act must be freely given, specific, informed, and evidenced by written, electronic, or recorded means. A broad clause, pre-ticked box, forced phonebook permission, or “accept all” screen is not an unlimited authority to use other people’s information.

The borrower also cannot normally consent on behalf of every person stored in their phone. Each contact is a separate data subject with their own rights.

The 2026 joint advisory warns that deceptive interface designs—such as pre-selected permissions, easy consent paired with difficult withdrawal, or an obscured privacy-preserving option—may undermine or invalidate consent. The Financial Products and Services Consumer Protection Act also prevents contractual terms from taking away a client’s legal right to protection of non-public data.

Contacting an employer

Providing an employer’s name during a loan application does not ordinarily authorize the lender to tell the employer that the borrower has defaulted.

A lender may have a legitimate reason to verify employment, salary information, or details supplied in the application. Any verification must still be:

Disclosed to the borrower;
Necessary for the stated purpose;
Limited to relevant information;
Conducted fairly and lawfully; and
Free from unnecessary disclosure of the loan or alleged default.

Collection calls intended to humiliate the borrower at work, threaten their employment, or enlist managers and coworkers as collection agents may amount to unfair collection and unlawful data processing.

Different considerations may apply when the employer is administering a valid, authorized payroll-deduction facility or responding to lawful court process. Whether such an arrangement exists depends on the signed documents and applicable employment rules.

Contacting a former partner or spouse

A former romantic relationship does not create responsibility for another person’s loan.

A former partner may be contacted only if there is an independent legal basis—for example, the person actually signed as a co-borrower, co-maker, or guarantor, or was knowingly selected as a character reference for identity verification.

For spouses and former spouses, liability can depend on who signed, when the debt was incurred, its purpose, the applicable property regime, and any court judgment or settlement. Marital or former marital status alone does not justify harassment or disclosure. Where family property may be affected, the loan documents should be reviewed by a Philippine lawyer.

Other practices that are prohibited

SEC Memorandum Circular No. 18, Series of 2019 and the Financial Products and Services Consumer Protection Act prohibit abusive collection practices. These include:

Threatening violence or other criminal harm;
Threatening an action that cannot legally be taken;
Using obscenities, insults, or abusive language;
Publishing a borrower’s identity or personal information because of alleged nonpayment;
Sending false loan information or concealing that the debt is disputed;
Using deception or false representations to obtain payment or information;
Contacting people in the borrower’s contact list who are not guarantors or co-makers; and
Using a borrower’s photograph or contacts to harass or embarrass anyone.

SEC rules generally treat contact before 6:00 a.m. or after 10:00 p.m. as unreasonable, subject to the stated exceptions for an account more than 15 days past due or the consumer’s express consent regarding convenient contact times. Those exceptions do not legalize threats, insults, false statements, public shaming, or privacy violations.

The lender cannot avoid responsibility simply by outsourcing collection. Under Republic Act No. 11765, a financial service provider may be responsible—and may be solidarily liable with an accredited third-party provider—for acts or omissions involving debt collection.

What a lender may lawfully do

A lender may:

Contact the borrower directly using reasonable and lawful methods;
Send accurate demands and account statements;
Negotiate payment, restructuring, or settlement;
Engage an authorized collection agency or lawyer while remaining accountable for its conduct;
Report credit information where disclosure is authorized by law;
File a collection case or use another lawful remedy; and
Enforce a valid guaranty or co-maker’s undertaking according to its actual terms.

Do not ignore genuine court papers merely because the lender previously used an improper collection method. An unlawful collection practice does not automatically erase a valid principal obligation, and a valid debt does not excuse an unlawful collection practice.

What to do if a lender contacts someone else

If you are the borrower

Preserve the evidence before blocking numbers or uninstalling the app.
Ask the contacted person for screenshots and a written account of what was said.
Send a written complaint to the lender’s consumer-assistance unit and data protection officer.
Identify the numbers, accounts, agents, and collection agency involved.
State that the recipient is not a guarantor or co-maker, if accurate, and demand that third-party collection contact stop.
Ask how the lender obtained the person’s details, what lawful basis it relies on, who received your information, and what data remains stored.
Revoke unnecessary app permissions after preserving evidence.
Continue addressing any legitimate balance through the lender’s official channel. Do not send payment to an unverified personal account.

If you are the relative, employer, reference, or former partner

Do not promise payment or admit being a guarantor unless you knowingly signed a valid undertaking.
Ask for the caller’s full name, company, lender, official contact details, and the specific basis for contacting you.
State in writing that you are not the borrower or guarantor, if true.
If you were only a character reference, request removal of your personal data.
Tell the caller not to disclose further loan information or contact you for collection.
Preserve the message and notify the borrower if doing so is safe.
File your own privacy complaint if your contact information was accessed or used unlawfully.

A request for erasure is not absolute. A lender may retain limited information where necessary to comply with law or establish, exercise, or defend legal claims. It should not retain or use the information indefinitely for an unrelated future purpose.

Evidence to preserve

Keep original, unedited copies where possible:

Screenshots showing the full message, sender, date, and time;
SMS, chat threads, emails, social-media posts, and group messages;
Call logs, voicemail, and the numbers used;
The app’s name, download page, developer, version, and displayed company name;
The lender’s privacy notice, permissions screen, terms, disclosure statement, and loan agreement;
Receipts, payment records, account statements, and dispute correspondence;
Names or aliases used by collection agents;
Proof of written complaints and delivery or read receipts;
Statements from relatives, coworkers, HR personnel, or other recipients describing the communication; and
Evidence showing that the contacted person never agreed to be a guarantor or co-maker.

Write down the caller’s exact statements immediately after each call. Secret call recording can raise separate legal issues, so obtain legal advice before recording a private conversation without the participants’ consent.

Where to complain

1. Complain to the lender first

Use the lender’s official consumer-assistance channel and data protection officer. Request:

Immediate cessation of third-party collection contact;
Removal of a character reference’s information where applicable;
Identification of the source, purpose, recipients, and retention period of the data;
Correction of any false co-maker or guarantor designation;
Preservation of relevant call logs and agent records; and
A written response.

For a formal NPC complaint, the general rule is that the complainant must first notify the lender or other responsible entity in writing. If it provides no response within 15 calendar days, or its action is not timely or appropriate, the complaint may be brought to the NPC. The NPC may waive this requirement for good cause or serious cases involving risks such as grave and irreparable harm, lack of an adequate remedy, or patently illegal conduct. See the NPC Rules of Procedure, as amended.

2. Report unfair collection to the SEC

For lending and financing companies and their online platforms, submit a complaint through SEC iMessage and select the appropriate Financing and Lending Companies concern. The March 2026 government advisory also lists the SEC hotline 1-4732 (1-4SEC).

Include the company’s legal name if known, the app name, dates, agent numbers, loan or account reference, written complaint to the lender, and supporting screenshots.

3. File a privacy complaint with the NPC

Use the current NPC complaint instructions and form. A formal complaint generally must be verified or made through the prescribed complaint-affidavit, notarized, and supported by evidence. It may be filed personally, by registered mail, by courier, or through an authorized electronic filing channel. The NPC website currently directs complaint submissions to complaints@privacy.gov.ph.

Both the borrower whose loan information was disclosed and a contacted individual whose own data was improperly accessed or used may have grounds to complain, depending on the facts.

4. If the provider is supervised by the BSP

For a bank, digital bank, non-bank electronic-money issuer, or another BSP-supervised institution, complain first through the institution’s consumer-assistance mechanism. If unresolved, escalate through the BSP Consumer Assistance Mechanism, including the BSP Online Buddy or consumeraffairs@bsp.gov.ph.

5. Report threats, fraud, or cyber harassment

Do not wait for an administrative complaint if there is a credible threat of violence, extortion, impersonation, account compromise, or an immediate safety risk. Contact law enforcement promptly. The 2026 joint advisory lists:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph; (02) 8723-0401 local 7491

Preserve the evidence and avoid meeting a threatening collector alone.

Common mistakes to avoid

Assuming a genuine unpaid loan gives the lender permission to shame the borrower;
Treating a character reference or emergency contact as a guarantor;
Assuming that phonebook permission authorizes every later use of every contact;
Deleting messages or uninstalling the app before saving evidence;
Complaining only by phone, leaving no proof that the lender received notice;
Paying an unverified collector or transferring money to a personal account;
Ignoring a real demand, summons, or court deadline because the collection conduct was improper;
Publicly posting unredacted loan documents that expose additional personal data; and
Filing only against the collection agent while omitting the lender or platform that engaged the agent.

When legal help is urgent

Consult a Philippine lawyer promptly when:

A court summons, subpoena, garnishment order, or other official document has been received;
Someone is falsely listed as a guarantor, co-maker, or co-borrower;
A signature appears forged or identity documents were used without authority;
A lender threatens arrest, violence, job loss, or publication of intimate or sensitive information;
Workplace discipline or dismissal may result from the disclosure;
A spouse or former spouse’s property may be affected;
The lender has published accusations to a large audience;
Significant financial loss, identity theft, or account takeover has occurred; or
A filing deadline may expire.

Claims under Republic Act No. 11765 generally prescribe five years after the financial transaction was consummated, or five years from discovery of deceit or material nondisclosure, subject to an outside limit of ten years from the violation. Other privacy, civil, criminal, or procedural deadlines may differ, so do not rely on that period for every possible claim.

Frequently asked questions

Can a lending app call my parents or siblings?

Not for debt collection merely because they are relatives or appear in your contacts. A relative may be contacted for limited verification if knowingly selected as a character reference, or about payment if they separately became a guarantor or direct party to the loan.

Can the lender tell my employer that I have an unpaid loan?

Generally, no. Necessary employment verification is different from revealing a default to embarrass or pressure you. Court orders, authorized payroll arrangements, or other specific legal processes require separate analysis.

Can my ex-partner be required to pay?

Not because of the former relationship. Payment responsibility requires an independent legal basis, such as a loan, co-maker, co-borrower, or guaranty agreement that the person validly entered into.

Is an emergency contact the same as a guarantor?

No. An emergency-contact label does not establish a guaranty. A guarantor must separately consent to be bound in accordance with applicable law.

I allowed the app to access my contacts. Can it message all of them?

No. Technical access or broad app consent is not an unlimited collection license. Access must be necessary and proportionate, and unbridled use of a contact list is prohibited.

Can a character reference ask to be removed?

Yes. The lender must provide a character reference with an option to have their personal data removed. Legal retention obligations may affect whether every record can be erased immediately, but the information cannot be repurposed for collection or unrelated marketing.

Does improper collection cancel the debt?

Not automatically. The borrower may still owe a valid balance, while the lender or collector may separately be accountable for abusive collection or unlawful data processing.

Can the lender post my name or photo online?

Publishing or circulating a borrower’s name, photograph, loan details, or alleged default to shame the borrower is generally prohibited and may create liability under several laws, depending on the exact facts.

Must I wait 15 days before complaining to the NPC?

The usual rule is to notify the responsible entity in writing and allow it to act. A lack of response within 15 calendar days, or an inadequate response, supports filing with the NPC. The NPC may waive prior notice in serious or urgent cases under its rules.

This article provides general Philippine legal information, not individualized legal advice or a prediction of any case’s outcome. Liability depends on the loan documents, the person’s actual role, the information disclosed, and how it was obtained and used. Sources and procedures were checked as of 6 August 2026.