If persistent calls and messages from a loan app are reaching not only you but also your family members, friends, colleagues, and other contacts in your phonebook—often at odd hours, with shaming language, threats, or demands to pressure you into paying—you are facing a form of harassment that Philippine law specifically prohibits. This invasive tactic, common with some online lending apps (OLAs), goes beyond normal debt collection and violates your privacy and dignity. This article explains exactly what the law says, why these practices are illegal, and the concrete steps you can take to stop them, hold the responsible parties accountable, and protect yourself and your loved ones.

Many borrowers discover the problem only after their contacts start asking awkward questions or complaining about repeated calls. The apps often gain access to contact lists during the loan application process, then use that data to broadcast your debt situation. Even if you provided some access for “verification,” the law draws a clear line: that data cannot be weaponized to harass third parties or you.

Common Tactics That Cross Into Harassment

Loan app harassment through contact calls typically involves several patterns that regulators and courts have flagged as problematic:

Repeated calls or texts to your contacts announcing that you owe money, labeling you a “scammer,” or urging them to pressure you.
Calls or messages at unreasonable hours (often before 6:00 a.m. or after 10:00 p.m.).
Use of vulgar, threatening, or emotionally manipulative language directed at you or your contacts.
Threats of legal action, public exposure, or harm that go beyond legitimate collection.
Continued contact even after you or your contacts have asked them to stop or provided settlement proposals.

These actions are not standard business practice. They are deliberate strategies to create social pressure and embarrassment, and Philippine law treats them as violations of privacy, consumer protection, and criminal statutes.

Key Legal Protections Available to You

Data Privacy Act of 2012 (Republic Act No. 10173)

The Data Privacy Act (DPA) is one of the strongest tools against this type of harassment. It governs how personal information—including names, phone numbers, and relationships in your contact list—may be collected, used, and shared.

Under NPC Circular No. 20-01 (Series of 2020), which specifically addresses lending and financing companies and online lending platforms, entities processing personal data for loans must follow strict rules:

They are prohibited from accessing, harvesting, copying, or saving phone contact lists, email lists, or social media contacts for debt collection or to harass you or your contacts.
Online lending apps must provide a separate interface where you voluntarily provide character references or co-makers of your own choosing. They cannot simply scrape your entire phonebook.
Any use of personal data for unfair collection practices is also a violation of the DPA.
The borrower (you) is responsible for informing any references you voluntarily provide, but the app still must handle that data lawfully and respectfully.

The National Privacy Commission (NPC) enforces these rules. In the landmark case Grace M. Trimillos v. FCash Global Lending, Inc. (G.R. No. 271360, August 13, 2025), the Supreme Court upheld an NPC decision against a lending app that accessed a borrower’s contact list and sent messages about her loan to those contacts. The Court affirmed the award of damages and the recommendation for criminal prosecution under the DPA. This ruling shows that courts take these violations seriously.

Violations can lead to administrative orders to stop the processing, payment of damages to affected individuals (including contacts), and referral for criminal prosecution with penalties that include fines and imprisonment.

Criminal Law Under the Revised Penal Code

Harassing calls and messages can also constitute criminal offenses:

Article 287 (Unjust Vexation): This covers any act that unjustly annoys, irritates, torments, or disturbs another person’s peace of mind without legal justification. The Supreme Court has described it as a broad “catch-all” offense for conduct that causes mental distress even without physical injury or financial loss (Melchor G. Maderazo v. People, G.R. No. 165065, September 26, 2006). Persistent unwanted calls, shaming through contacts, and similar tactics frequently fall here. It is punishable by arresto menor (1 to 30 days imprisonment) or a fine.
Articles 282 and 283 (Grave or Light Threats): If the communications include credible threats to commit a crime (such as harm to person or property), this may apply.
Article 286 (Grave Coercion): Compelling you or others to act against your will through intimidation.
If the harassment involves posting or threatening to post information on social media or public groups, cyber libel under Republic Act No. 10175 (Cybercrime Prevention Act) or traditional libel under Article 353 of the Revised Penal Code may also be relevant.

Note on timing: Unjust vexation is classified as a light offense and generally prescribes (expires) two months from discovery by the offended party. Act promptly and document ongoing incidents, as each new harassing call or message can support a fresh or continuing claim.

Lending Company Regulations and Consumer Protection

Under Republic Act No. 9474 (Lending Company Regulation Act of 2007), legitimate lending companies must register with and obtain authority from the Securities and Exchange Commission (SEC). Unregistered operations are illegal.

SEC Memorandum Circular No. 18, Series of 2019, explicitly prohibits unfair debt collection practices by lending and financing companies, including:

Contacting persons other than the borrower, named guarantors, co-makers, or properly authorized references.
Making contact at unreasonable or inconvenient times (generally before 6:00 a.m. or after 10:00 p.m., with limited exceptions).
Using threats, obscene language, or public shaming.
Communicating false information about the debt.

Republic Act No. 11765 (Financial Products and Services Consumer Protection Act) reinforces the right to fair treatment and prohibits abusive conduct during collection. Violations can result in SEC sanctions such as fines, suspension, or revocation of authority to operate.

These frameworks work together. Even if a company claims you “consented” to contact access when you installed the app, that consent does not override the DPA’s requirements or the SEC’s prohibitions on unfair practices. The contacts themselves never consented to being used as collection tools.

Step-by-Step: What You Can Do Right Now

Document everything thoroughly
Take clear screenshots of all messages and call logs showing dates, times, phone numbers, and full content (including messages sent to your contacts). Ask affected contacts for their own screenshots or sworn statements. Note patterns such as frequency, language used, and any impact on your or their daily life. Back up evidence securely (cloud storage with timestamps helps). Preserve the original app data and any privacy policy or loan agreement.
Send a formal demand to stop
Email or write to the app’s official support or registered address demanding that they immediately cease all contact with you and your contacts, stop any further processing or disclosure of personal data, and confirm compliance in writing within a short deadline (e.g., 5–7 days). Keep records of this communication. This step creates a paper trail and can strengthen later complaints.
File a complaint with the National Privacy Commission (NPC)
This is often the most direct and effective first step for contact-harassment cases because it directly addresses the unauthorized processing of personal data.
- Visit the NPC website (privacy.gov.ph) for the online complaint form or submission guidelines.
- Submit your narrative, evidence, and details of the app/company.
- The NPC can investigate, order the company to stop the practices, award damages (as seen in the Trimillos case), and refer the matter for criminal prosecution.
  There is no strict barangay requirement for NPC complaints.
Report to the Securities and Exchange Commission (SEC)
Check whether the lending company or platform is registered on the SEC website (sec.gov.ph). File a complaint detailing the unfair collection practices prohibited under MC 18-2019. The SEC can impose administrative penalties, including fines and revocation of authority. Unregistered operators can also be reported here.
Consider a criminal complaint for unjust vexation or related offenses
- For light offenses like unjust vexation, Philippine law generally requires prior conciliation at the barangay level (Katarungang Pambarangay under the Local Government Code) if the parties are in the same city or municipality. File a complaint with your local Lupong Tagapamayapa. If no settlement is reached, obtain a Certificate to File Action and proceed to the Office of the City or Provincial Prosecutor.
- For more serious threats or cyber elements, go directly to the nearest Philippine National Police (PNP) station for a blotter report or to the PNP Anti-Cybercrime Group.
- You can file a sworn complaint-affidavit with supporting evidence at the prosecutor’s office. The prosecutor conducts a preliminary investigation to determine probable cause.
Explore civil remedies for damages
You may file a civil case for moral damages (for mental anguish and humiliation), exemplary damages (to deter similar conduct), and actual damages if any out-of-pocket losses occurred. This can be based on abuse of rights under Articles 19–21 of the Civil Code, quasi-delict (Article 2176), or violations of the DPA. Civil cases can proceed independently or alongside criminal or administrative actions.

You can pursue several of these remedies at the same time or in sequence. Many people start with NPC and SEC complaints while gathering evidence for a possible criminal or civil case.

Practical Considerations, Challenges, and Realities

Evidence is everything. Vague descriptions are rarely enough; dated screenshots, call detail records, and witness affidavits from contacts carry significant weight with the NPC, SEC, and prosecutors.

Ongoing or repeated acts strengthen your case. Even if some incidents are older, recent ones keep the matter alive.

For contacts who are also harassed: They have their own independent rights under the DPA and can file separate or joint complaints. Encourage them to document and report as well.

Foreigners or overseas Filipinos: The same laws apply if the harassment affects individuals in the Philippines or involves Philippine-based processing of data. You can file complaints online or through a representative in the Philippines. Enforcement against purely foreign entities without local presence can be more difficult, but NPC and SEC actions remain possible where local operations or effects exist. Foreign documents submitted in Philippine proceedings may require apostille authentication.

Prescription risks: Because unjust vexation prescribes in two months from discovery, do not delay filing criminal complaints for this specific offense. DPA violations and SEC matters generally allow more time, but prompt action is still best.

The debt itself: Illegal collection methods do not automatically cancel a legitimate debt. You should still address any valid obligation through proper channels (negotiation, restructuring, or legal defenses if the loan terms were usurious or the lender unlicensed). Harassment can, however, support counterclaims or defenses in any collection suit they file against you.

Common bottlenecks: Investigations by NPC or SEC can take several months. Criminal preliminary investigation also takes time. Persistence and complete documentation help move cases forward. Some companies simply change numbers or use third-party collectors; reporting the pattern helps authorities track them.

Unregistered or fly-by-night apps: These are harder to trace for civil damages but remain fully subject to DPA and criminal liability. Reporting them helps authorities shut down operations.

Documents You Will Typically Need

Valid government-issued ID (passport, driver’s license, UMID, etc.).
Screenshots and logs of all harassing communications (to you and to contacts), with dates and times visible.
Affidavits or statements from affected contacts.
Copies of any loan agreement, app terms, privacy policy, or KYC documents.
Proof of formal demand sent to the app (email printouts or registered mail receipt).
For NPC/SEC: Completed complaint form and narrative summary.
For criminal complaints: Sworn complaint-affidavit (often notarized).
For barangay proceedings: Simple complaint form provided by the barangay.

Notarization is commonly required for affidavits (typical fees are modest). No large filing fees apply for NPC, SEC, or barangay complaints. Prosecutor and court fees are also minimal for these types of cases.

Frequently Asked Questions

Is it legal for loan apps to call my family and friends about my debt?
No. Under NPC Circular No. 20-01 and SEC Memorandum Circular No. 18, s. 2019, lending companies and apps are generally prohibited from contacting or using the personal data of people in your contact list (except properly authorized references, guarantors, or co-makers) to pressure you or shame you. Doing so violates data privacy and unfair collection rules.

Can I file a case even if I still owe money?
Yes. The legality of the debt and the legality of the collection methods are separate issues. You can challenge the harassment regardless of whether you have an outstanding balance. Many people negotiate or settle the debt while simultaneously pursuing remedies for abusive collection.

Which agency should I complain to first?
The National Privacy Commission is often the strongest starting point for contact-harassment cases because it directly addresses the misuse of personal data. You can also file with the SEC if the company is a registered lender. Criminal complaints go through barangay (when required) then the prosecutor’s office or PNP.

How long do I have to file a complaint?
For unjust vexation under the Revised Penal Code, the prescriptive period is generally two months from discovery. Act quickly on criminal aspects. NPC and SEC complaints have more flexible timelines, but early reporting preserves evidence and momentum.

What if the calls come from different numbers or the company seems to have disappeared?
Document the pattern anyway. Authorities can still investigate based on app name, previous numbers, payment channels, or other identifiers. Multiple complaints help build a case against serial violators.

Do my contacts have rights too?
Yes. The people whose numbers were used without their consent are also data subjects under the DPA. They can file their own complaints with the NPC or join yours. They may also have claims for unjust vexation if the calls directly disturbed them.

Can foreigners or OFWs file complaints?
Yes. The protections apply to anyone affected by processing of personal data in the Philippine context or harassment occurring here. You can file online or authorize a representative in the Philippines. Enforcement may be more challenging against purely offshore operators, but regulatory complaints remain viable.

Will reporting the harassment affect my credit standing?
Reporting illegal collection practices should not negatively affect legitimate credit reporting. Credit data is governed by separate rules (including the Credit Information System Act). Focus on documenting that your complaints concern abusive methods, not the existence of the debt itself.

Are there Supreme Court decisions on this issue?
Yes. In Grace M. Trimillos v. FCash Global Lending, Inc. (G.R. No. 271360, August 13, 2025), the Supreme Court upheld NPC findings against a lending app for accessing and using a borrower’s contact list to send messages about the loan, awarding damages and supporting criminal referral under the Data Privacy Act. This reinforces the protections available to borrowers and their contacts.

Key Takeaways

Contacting your family, friends, and other contacts to shame or pressure you is generally prohibited under the Data Privacy Act (RA 10173), NPC Circular No. 20-01, SEC MC No. 18 s. 2019, and related consumer protection laws.
You have multiple remedies: NPC complaints for privacy violations (often the most effective first step), SEC reports for unfair collection practices, criminal complaints (possibly starting at the barangay for light offenses like unjust vexation), and civil actions for damages.
Strong documentation—screenshots, logs, witness statements, and a formal demand letter—is essential for success in any forum.
Act promptly, especially for criminal aspects that prescribe in two months, while recognizing that ongoing harassment supports continuing claims.
The Supreme Court has affirmed these protections in cases like Trimillos v. FCash, showing that regulators and courts will hold violators accountable.
You can pursue remedies while separately addressing any legitimate debt through proper channels. Harassment does not erase obligations, but it gives you powerful legal tools to push back.

The Philippine legal system provides real avenues for ordinary people facing this situation. By understanding your rights and following the proper processes, you can stop the unwanted calls, protect your privacy and relationships, and hold the responsible parties accountable.