A Philippine legal article

Introduction

A recurring complaint in the Philippines involves online lending apps or their collectors contacting a borrower’s relatives, friends, co-workers, or other “references,” then using pressure, embarrassment, repeated calls, text blasts, or social exposure to force payment. In practice, this usually appears as:

repeated calls or messages to people who are not the borrower,
disclosure that the borrower supposedly has an unpaid debt,
threats to “report,” “post,” or “expose” the borrower,
use of the borrower’s contact list or phone permissions,
pressure on references to pay or to shame the borrower into paying,
abusive language, intimidation, or public humiliation.

This raises two major legal issues in Philippine law: data privacy and harassment/unfair debt collection. It can also trigger issues under civil law, administrative regulation, and sometimes criminal law.

This article explains the Philippine legal framework, the rights of borrowers and references, the possible liabilities of lenders and collectors, how consent works, what lawful collections should look like, and what practical steps victims can take.

I. The basic legal problem

The central legal question is this:

Can a loan app lawfully contact a borrower’s references or people in the borrower’s phonebook, reveal the debt, and pressure them?

In many situations, no. Even where a borrower gave references or clicked “agree” inside an app, that does not automatically legalize every form of contact, disclosure, harassment, or humiliation.

Philippine law does not treat debt collection as a free pass to invade privacy or terrorize third parties. A debt may be real, but collection must still be lawful.

That means a collector must still respect:

Data privacy rules on collection, processing, sharing, and disclosure of personal data;
Fair collection rules and licensing requirements applicable to lending and financing entities;
Civil law protections against abusive conduct and injury to rights;
Criminal law limits against threats, coercion, libel/defamation, unjust vexation, and other punishable acts.

II. Key Philippine laws and legal sources involved

In Philippine context, these disputes usually sit at the intersection of several legal regimes.

1. Data Privacy Act of 2012

The Data Privacy Act of 2012 is the main law on personal data protection. It protects personal information and regulates how organizations collect, use, store, disclose, and share personal data.

A lending app often processes:

the borrower’s name, address, number, email, IDs, device data,
contact list entries,
reference persons’ names and numbers,
repayment history,
geolocation or device metadata,
sometimes sensitive information if poorly designed apps over-collect.

Even when debt collection is a legitimate business activity, the app still has to follow privacy principles such as:

transparency,
legitimate purpose,
proportionality.

These principles matter because many abusive loan apps collect far more than necessary, use it for purposes broader than disclosed, or disclose debt information to people who do not need to know.

2. National Privacy Commission framework

The National Privacy Commission (NPC) is the Philippine privacy regulator. It handles complaints involving improper processing of personal data, unauthorized disclosure, excessive collection, security failures, and similar privacy issues.

In the loan app setting, the NPC becomes relevant where there is:

unauthorized use of a borrower’s contacts,
contacting references beyond the legitimate and disclosed purpose,
disclosure of debt status to third parties,
processing without valid consent or other lawful basis,
invasive use of phone permissions,
refusal to honor rights of access, correction, deletion, or objection where applicable.

3. Lending and financing regulation

Online lenders are not outside regulation simply because they operate through an app.

Depending on their structure, they may be regulated as:

lending companies,
financing companies,
or entities under a different regulated financial framework.

For non-bank lenders and financing companies, the Securities and Exchange Commission (SEC) plays a major role. The SEC has taken a strong interest in abusive and unfair collection practices by online lending platforms and their agents. In Philippine practice, this is one of the most important enforcement routes for borrowers facing collection harassment.

4. Civil Code protections

The Civil Code protects persons against acts that are contrary to law, morals, good customs, public order, or public policy. It also recognizes damages for violations of rights, abuse, humiliation, and wrongful interference.

Even if a collector avoids a specific criminal offense, highly oppressive conduct can still expose the lender or collector to:

actual damages,
moral damages,
exemplary damages,
attorney’s fees,
injunctive relief in proper cases.

5. Revised Penal Code and related criminal statutes

Some collection methods may cross into criminal conduct, especially where there are:

threats,
coercion,
defamation/libel,
unjust vexation,
harassment through electronic means,
disclosure meant to shame rather than lawfully collect.

Not every rude text is a crime. But repeated abusive conduct, public exposure, false accusations, or intimidation can create criminal exposure.

6. Cybercrime-related concerns

Where the acts are done through digital channels such as mass texts, chat apps, social media posts, or online shaming, cyber-related laws may also become relevant, especially when the underlying conduct is defamation, identity misuse, or online harassment.

III. What is “reference harassment”?

In this setting, reference harassment usually means a collector contacts people listed as references, or pulled from the borrower’s device, in a way that goes beyond legitimate verification or reasonable communication.

Typical patterns include:

calling a reference over and over to demand payment,
telling a co-worker or neighbor that the borrower is a “scammer” or “criminal,”
threatening to contact everyone in the borrower’s phonebook,
sending group messages identifying the borrower as delinquent,
using insulting language,
tagging family and friends on social media,
circulating photos or ID images with accusations,
pressuring third parties to act as collection agents.

The legal problem is not merely the fact of one contact. The problem is often the combination of disclosure, excess, intimidation, and lack of necessity.

A collector may argue: “We are just collecting a lawful debt.” But lawful debt collection is not the same thing as lawful data processing or lawful treatment of third parties.

IV. Are references fair game once the borrower lists them?

No. Listing a person as a reference does not make that person an all-purpose target for collection pressure.

A reference is typically provided for limited reasons, such as:

identity verification,
confirming the borrower is known to the person,
emergency contact in some narrow context,
basic due diligence.

That does not automatically authorize the lender to:

disclose the existence of the debt in full detail,
shame the borrower through the reference,
repeatedly harass the reference,
demand that the reference pay,
threaten the reference,
use the reference as leverage.

A reference is generally not the debtor unless they separately signed as co-maker, guarantor, surety, or otherwise undertook a legal obligation. Many references are simply contact persons, not liable parties.

That distinction is critical.

Reference vs guarantor vs surety vs co-maker

A lot of abuse arises because collectors blur these roles.

A reference is usually just a person named by the borrower.
A guarantor may have a secondary obligation under contract.
A surety may be directly liable depending on the terms.
A co-maker/co-borrower may share primary liability.

If a person is only a reference, the collector ordinarily has no basis to demand payment from that person. Harassing a mere reference is especially vulnerable to legal attack.

V. Data privacy: why reference harassment is often unlawful

1. Personal data is involved at every step

When a collector uses a reference’s phone number, name, or relationship to the borrower, that is already processing personal data.

When the collector tells the reference that the borrower has a loan or is overdue, that is often a disclosure of the borrower’s personal information.

When the collector mined the borrower’s contact list from device permissions, that can involve processing the personal data of many non-borrowers who never directly dealt with the app.

So one abusive collection event can involve the personal data rights of both:

the borrower, and
the reference or third party.

2. The principles of transparency, legitimate purpose, and proportionality

These privacy principles are the strongest conceptual tools in these cases.

Transparency

People must be clearly informed how their data will be used. Vague app permissions or dense terms buried in tiny text are often attacked as inadequate, especially if they do not clearly explain the extent of debt-related third-party contact.

Legitimate purpose

A lender may have a legitimate interest in collections. But “collection” does not justify everything. The purpose must be specific, lawful, and not contrary to morals or public policy.

Proportionality

Even if debt collection is legitimate, the data processing must be adequate, relevant, suitable, necessary, and not excessive. This is where many loan apps fail.

Examples of likely disproportionality include:

scraping an entire contact list,
contacting many unrelated persons,
repeated non-stop communications,
revealing more debt information than necessary,
escalating to public embarrassment,
contacting the workplace when unnecessary,
messaging multiple references after the app already knows the borrower’s identity.

3. Consent is not magic

Many loan apps rely heavily on “consent.” But in law, consent is not an all-purpose shield.

Problems with consent in these cases include:

the borrower may have “consented” only through a one-click interface,
the scope may be vague or overbroad,
the reference may never have consented at all,
the processing may exceed what was disclosed,
the conduct may still be disproportionate or abusive,
consent does not legalize acts that violate other laws or public policy.

A common mistake is to think: “The borrower gave access to contacts, so the lender can message everyone.” That is not a safe legal conclusion.

The borrower’s app consent does not automatically erase the privacy rights of all persons in the contact list. Nor does it justify humiliating disclosures.

4. Disclosure of debt to third parties

A debt status is personal information linked to an identifiable individual. Telling third parties that a named person is in default can create serious privacy issues, especially where:

the third party has no real need to know,
the disclosure is made to pressure payment,
the details are inaccurate or exaggerated,
the message includes insulting labels or accusations,
the disclosure reaches employers, colleagues, neighbors, or social circles.

The less necessary the third-party disclosure is, the harder it is to defend.

5. Access to phone contacts and permissions

Many complaints involve apps requesting access to:

contacts,
storage,
camera,
SMS,
location,
microphone,
call logs.

In a legal challenge, the question is not only whether the app technically requested permission, but whether the collection and later use of that data were necessary and proportionate to the loan transaction.

Mass harvesting of contacts for future collection pressure is especially vulnerable from a privacy perspective.

VI. Unfair debt collection in the Philippines

Even when a debt is real and due, collection methods can still be unlawful.

Examples of likely unfair or abusive collection conduct

using obscene, insulting, or threatening language,
calling or texting at unreasonable frequency,
contacting unrelated third parties to shame the borrower,
pretending to be from a government agency, court, or police unit,
falsely stating that non-payment is automatically a criminal offense,
threatening arrest without legal basis,
posting the borrower publicly,
using doctored graphics or “wanted” posters,
contacting the borrower’s employer to humiliate rather than verify,
forcing references to act as debt collectors,
implying that a mere reference is legally liable when they are not.

A legitimate collector should aim to communicate with the borrower directly and professionally. Once the collector turns to humiliation, intimidation, or social pressure campaigns, the legal risk increases sharply.

VII. Can a lender contact a workplace, family, or friends?

Sometimes a lender may argue that it can make a limited contact for location confirmation or to relay a message. But the legality of this depends on scope, frequency, content, and necessity.

A single neutral contact is different from a harassment campaign

There is a big legal difference between:

one restrained call asking for updated contact information, and
repeated messages saying the borrower is a delinquent scammer who should be shamed.

The first may be arguable in some circumstances. The second is much harder to justify.

Employer contact is especially risky

Contacting an employer, co-worker, HR office, or supervisor can be highly problematic because it can:

damage reputation,
interfere with employment,
disclose private financial matters,
create humiliation disproportionate to collection needs.

The more the communication appears aimed at pressure through embarrassment rather than legitimate verification, the weaker the lender’s legal position.

VIII. When harassment becomes a criminal issue

Not every collection abuse will ripen into a criminal case, but some do.

1. Threats

If the collector threatens harm, exposure, false charges, or baseless arrest, criminal implications may arise depending on the wording and surrounding facts.

Examples:

“Pay now or we will have you arrested tomorrow,” when there is no such immediate legal process;
“We will ruin your name and post your photo everywhere”;
“Your family will suffer if you don’t pay.”

2. Unjust vexation and similar offenses

Persistent annoying, tormenting, or harassing conduct without lawful justification may be framed under offenses such as unjust vexation, depending on the facts.

3. Libel or defamation

If the collector publicly calls the borrower a thief, scammer, criminal, or fraudster, especially in messages to third parties or online posts, defamation issues may arise.

Truth is not automatically simple in debt cases. A person can owe money without being a criminal. Labeling someone a “scammer” in a defamatory way may create legal risk if not supported and if published to others.

4. Coercion

If the collector uses intimidation to compel an act not legally required, coercion-type issues may arise.

5. Identity misuse and fake authority

Collectors sometimes falsely claim to be:

lawyers when they are not,
court personnel,
government enforcement agents,
police officers.

That can create additional legal exposure.

IX. Civil liability: damages and abuse of rights

Even where criminal prosecution is uncertain or slow, civil liability can be powerful.

A borrower or even a reference may potentially pursue civil remedies where there is:

unlawful invasion of privacy,
public humiliation,
emotional distress,
reputational injury,
interference with family or employment,
abusive exercise of rights,
acts contrary to morals, good customs, or public policy.

Types of damages that may be claimed

Depending on proof and cause of action, the claimant may seek:

actual damages for proven financial loss,
moral damages for anxiety, humiliation, sleepless nights, embarrassment, emotional suffering,
exemplary damages where conduct was wanton or oppressive,
attorney’s fees and costs in proper cases.

Borrower and reference may both have claims

This is often overlooked. A mere reference who never borrowed money may still have an independent complaint if the lender:

used the reference’s data without lawful basis,
repeatedly harassed the reference,
falsely implied the reference was liable,
exposed the reference to nuisance, anxiety, or reputational harm.

X. The borrower’s own wrongdoing does not excuse abusive collections

A practical but important point: even if the borrower truly owes money, even if the borrower defaulted, and even if the borrower ignored demand letters, the lender still cannot use unlawful means.

Philippine law does not generally allow private humiliation as a collection method.

A valid debt does not authorize:

public shaming,
excessive third-party disclosure,
threats without basis,
abusive or obscene messages,
harvesting and weaponizing contact lists,
making uninvolved people suffer to force payment.

The lender’s remedy is to pursue lawful collection, not extrajudicial punishment through social pressure.

XI. What about the argument: “But the terms and conditions allowed it”?

This is one of the most common lender defenses. It is not conclusive.

A clause in an app’s terms may still be attacked if it is:

vague,
overbroad,
not clearly explained,
disproportionate,
contrary to privacy principles,
unconscionable,
contrary to law, morals, or public policy.

Contract terms do matter, but they do not automatically validate everything. Courts and regulators can look past labels and ask what was actually done.

A clause that supposedly allows the lender to contact “all persons in your contact list” and reveal debt details is vulnerable to challenge, especially if used oppressively.

XII. What rights do borrowers and references have?

A. Rights of the borrower

A borrower facing loan app harassment may invoke rights relating to:

fair and lawful processing of personal data,
transparency about what data was collected and how it was used,
objection to unlawful or excessive processing where applicable,
correction of inaccurate information,
complaint to regulators,
relief from unfair or abusive collection conduct,
damages under civil law,
criminal complaint where the facts justify it.

B. Rights of the reference or contact person

A reference who never borrowed money may also have rights, including:

to question why their data was collected and used,
to object to being contacted beyond a legitimate purpose,
to demand that harassment stop,
to complain over unauthorized or excessive processing,
to sue or complain over threats, humiliation, or reputational harm,
to deny liability if they did not sign as co-borrower/guarantor/surety.

A reference is not powerless merely because the borrower listed their name.

XIII. Regulatory and complaint avenues in the Philippines

1. National Privacy Commission

This is the most obvious forum when the core issue is:

misuse of contacts,
unauthorized disclosure,
excessive collection of phone data,
lack of valid privacy notice,
abusive third-party messaging using personal data.

A privacy complaint often becomes stronger when supported by screenshots, call logs, app permissions, recordings where lawful, and proof of who received the messages.

2. Securities and Exchange Commission

For non-bank lending or financing entities, the SEC is often central where the issue concerns:

licensing,
unlawful online lending operations,
unfair collection practices,
abusive conduct by lenders or their agents.

If the entity is unregistered, operating illegally, or violating rules governing lending/financing companies, the regulatory risk can be severe.

3. Police, NBI, or cybercrime units

Where there are threats, online shaming, fake legal notices, impersonation, or possible criminal acts, a complaint may be brought to law enforcement channels.

4. Civil action in court

Where the harm is serious, documented, and continuing, a civil action for damages or injunctive relief may be considered.

5. Barangay process where applicable

Some disputes may pass through barangay conciliation first, depending on the parties, location, and nature of the case. But privacy/regulatory complaints and some criminal matters follow different routes.

XIV. Evidence: what should be preserved

In these cases, evidence is everything. Victims often know the conduct is abusive but fail to document it well.

Important evidence includes:

screenshots of texts, chats, emails, app notifications,
call logs showing repeated contact,
recordings of calls where legally and factually appropriate,
names and numbers of callers,
screenshots of contact permissions requested by the app,
the app’s privacy policy and terms and conditions,
proof that third parties received messages,
sworn statements from references, relatives, co-workers, or employers,
screenshots of social media posts or group messages,
proof of emotional or employment impact,
proof the reference never signed any guarantee/surety agreement.

Also save:

the app name,
company name,
website,
registration details if visible,
payment history,
loan agreement,
demand letters,
receipts,
IDs of collection agents if any.

A case becomes much stronger when you can show not just one offensive message, but a pattern.

XV. Common legal defenses of loan apps and how they are usually challenged

Defense 1: “The borrower consented.”

Challenge: Consent may be invalid, vague, overbroad, or exceeded. It also does not automatically waive the rights of all third-party contacts.

Defense 2: “We only contacted references.”

Challenge: Contacting is one thing; harassment, repeated pressure, and debt disclosure are another. The question is whether the conduct was necessary, proportionate, and lawful.

Defense 3: “We were only reminding them.”

Challenge: Screenshots often show insults, threats, shaming, and pressure on non-borrowers. A “reminder” defense collapses when the content is abusive.

Defense 4: “The borrower really owes the money.”

Challenge: A valid debt does not justify unlawful collection methods.

Defense 5: “The reference is responsible.”

Challenge: Ask for the signed document. If the person never signed as guarantor, surety, or co-borrower, the collector may have no basis to demand payment from that person.

Defense 6: “Our agent did it, not the company.”

Challenge: Principals can still face liability for acts of their agents or outsourced collectors, especially where the collection system itself enabled or tolerated the abuse.

XVI. Special issue: contact list scraping

One of the most controversial features of some online lending apps is access to the borrower’s entire contact list. This creates several legal issues.

1. Are all contacts relevant to the loan?

Usually no. That is the proportionality problem.

2. Did the contacts themselves deal with the lender?

Usually no. Yet their data may be stored and used.

3. Was the use clearly disclosed?

Often inadequately.

4. Was the later disclosure to contacts necessary?

Often no.

5. Was the purpose transformed from verification to coercion?

That is the heart of many complaints.

If an app uses contact list access primarily as a future pressure weapon, that is highly vulnerable legally.

XVII. Public shaming is especially dangerous legally

Some collectors do more than call. They create:

“wanted” style images,
social media blasts,
group messages,
accusations that the borrower is a thief, scammer, or fraudster,
posts naming the borrower and asking others to pressure payment.

This is among the legally riskiest conduct because it may combine:

privacy violation,
reputational injury,
defamation,
harassment,
emotional distress,
unfair collection.

The fact that the borrower owes money does not entitle the lender to run a public disgrace campaign.

XVIII. What references should know

A person named as a reference should understand these points:

You are not automatically liable just because your name or number was listed.
Ask whether you signed anything as guarantor or co-maker. If not, you may simply be a reference.
You can tell the collector clearly that:
- you are not the borrower,
- you did not undertake to pay,
- you do not consent to repeated harassment,
- future abusive contact will be documented for complaint.
Preserve all evidence.
Do not be tricked into admitting liability out of fear or pity.
If the collector reveals debt details about another person, that itself may be problematic.

XIX. What borrowers should know

Borrowers often feel they have no ground to complain because they still owe money. That is incorrect.

A borrower may both:

owe a valid debt, and
be a victim of unlawful processing or harassment.

Practical points for borrowers:

Review exactly what permissions the app had.
Save the privacy policy and terms before they disappear.
Identify whether the lender is properly registered.
Demand communication through lawful channels only.
Do not ignore the debt itself if it is legitimate; the goal is not to erase debt but to stop abuse.
Separate the underlying loan obligation from the illegal collection methods.

In many cases, the strongest position is: “I am willing to address lawful collection, but I object to privacy violations and harassment.”

XX. Can the borrower sue even if they borrowed illegally high-interest money?

Yes, potentially. Even a questionable loan structure does not normally authorize illegal harassment.

The case may involve multiple layers:

enforceability of the loan terms,
usurious or unconscionable practices,
licensing issues,
privacy violations,
collection abuse.

The lender’s own regulatory or legal weaknesses may become relevant, but those do not automatically erase the debt. Each issue must be analyzed separately.

XXI. The role of contract language and proof of liability

When references are pressured to pay, the first legal question is documentary:

What exactly did this person sign, if anything?

Ask for the written basis of liability.

If the person signed nothing

The collector’s claim against the reference is weak.

If the person only provided contact details

That usually does not create debt liability.

If the person signed a guarantee or suretyship

Liability may exist, but even then collection must still be lawful and privacy-compliant.

No contract term authorizes harassment by default.

XXII. Possible causes of action or legal theories

A Philippine lawyer evaluating a case may look at several overlapping theories, such as:

violation of data privacy rights,
unauthorized processing or disclosure of personal data,
unfair debt collection practices,
abuse of rights,
damages under the Civil Code,
acts contrary to morals, good customs, or public policy,
defamation/libel,
threats or coercion,
unjust vexation,
regulatory violations by lending/financing entities,
employer interference or reputational injury.

A strong case often uses multiple theories, not just one.

XXIII. Practical legal analysis by scenario

Scenario 1: One neutral call to verify the borrower’s location

This is the least aggressive case. It may be arguable if limited, professional, and non-disclosing. Legality depends on wording, notice, necessity, and frequency.

Scenario 2: Repeated calls to a sibling saying the borrower is overdue

This is much riskier because it discloses debt status and pressures a third party.

Scenario 3: Messages to co-workers that the borrower is a scammer

This may trigger privacy, defamation, and unfair collection concerns.

Scenario 4: Collector sends group texts to many contacts

This is a strong fact pattern for privacy and harassment complaints.

Scenario 5: Collector demands that a mere reference pay

This is highly problematic unless the reference signed a separate binding obligation.

Scenario 6: App accessed the borrower’s entire contact list and used it after default

This raises serious privacy and proportionality issues.

XXIV. A note on banks versus non-bank online lenders

The exact regulatory route can differ depending on whether the creditor is:

a bank,
a financing company,
a lending company,
a digital platform acting with another regulated entity,
an unregistered or illegal operator.

The privacy principles remain broadly relevant in all cases. But the main financial regulator or complaint avenue may differ.

For many notorious “loan app harassment” complaints in the Philippines, the target is a non-bank online lending operator, making SEC and NPC channels especially important.

XXV. How courts and regulators are likely to view these cases

As a practical matter, authorities are usually more sympathetic when the facts show:

mass third-party contact,
humiliation as a deliberate strategy,
non-borrowers being dragged in,
contact list scraping,
false claims of criminality,
repeated pressure after clear objection,
vulnerable victims,
workplace interference,
clear documentary proof.

The lender’s position is stronger only where contact was:

minimal,
professional,
non-abusive,
non-public,
necessary,
and clearly disclosed.

The farther a collector moves from direct, private, professional communication with the borrower, the weaker the defense becomes.

XXVI. Draft legal position in plain English

A concise Philippine legal position on this topic would be:

A loan app may pursue lawful collection of a valid debt, but it may not use debt collection as a justification for excessive data harvesting, unauthorized third-party disclosure, harassment of references, or public humiliation of the borrower. Listing a person as a reference does not make that person automatically liable, nor does it authorize unlimited contact or pressure. The use of a borrower’s contacts or reference data must still satisfy the requirements of lawful processing under Philippine data privacy law and must remain proportionate to a legitimate purpose. Once the app or its collectors reveal the debt to unnecessary third parties, harass non-borrowers, threaten exposure, or use shaming as leverage, the conduct may create administrative, civil, and even criminal liability.

XXVII. What a strong complaint usually alleges

A strong Philippine complaint on this topic often alleges that the lender or its agents:

collected excessive personal data through the app;
obtained access to contacts beyond what was necessary;
processed third-party personal data without adequate lawful basis;
disclosed the borrower’s debt to persons with no legitimate need to know;
harassed references who were not debtors;
used intimidation, humiliation, or reputational pressure as a collection method;
caused emotional distress, reputational damage, and interference with work or family relations;
violated privacy principles and fair collection standards;
should be held administratively, civilly, and where proper criminally liable.

XXVIII. What not to confuse

Several things should not be confused in legal analysis:

Debt is not the same as criminal guilt.
Reference status is not the same as guarantor liability.
App permission is not the same as unlimited lawful authority.
Collection is not the same as harassment.
Notice to borrower is not the same as license to shame the borrower to others.
Business interest is not the same as proportionate data processing.

These distinctions usually decide the case.

XXIX. Limits of this topic

Not every unpleasant call is automatically illegal. Some debt collection contact can be lawful. The real legal analysis depends on:

who was contacted,
how often,
what was said,
whether the debt was disclosed,
whether the person contacted was liable,
what consent or notice actually existed,
what data was accessed,
whether the communication was necessary and proportionate,
whether threats, insults, or public exposure were used.

Still, the Philippine pattern of loan app reference harassment often involves enough excess that legal remedies become realistic.

XXX. Final takeaway

In the Philippines, loan app reference harassment is not just a collections issue; it is often a data privacy issue, a consumer protection issue, a civil wrong, and sometimes a criminal matter.

The most important legal truths are these:

A lender may collect a valid debt, but only by lawful means.
A borrower’s default does not legalize humiliation, intimidation, or mass third-party disclosure.
A mere reference is usually not automatically liable for the loan.
Access to contacts does not justify using those contacts as leverage.
Consent inside an app does not excuse disproportionate, abusive, or unlawful data processing.
Public shaming and repeated pressure on relatives, friends, co-workers, and references are among the weakest practices to defend under Philippine law.
Victims can pursue remedies through privacy, regulatory, civil, and in proper cases criminal channels.

The legal center of gravity in these cases is simple: debt collection must stay within the bounds of privacy, necessity, fairness, and human dignity.