I. Introduction

In the Philippines, online lending apps have become a common source of quick credit. They offer fast approval, minimal documentary requirements, and convenient loan disbursement through mobile phones. However, many borrowers and even non-borrowers have reported abusive collection practices, including threats, public shaming, harassment, and the contacting of people in the borrower’s phone contacts.

A particularly serious issue arises when an online lending app contacts a person who does not owe any debt. This may happen because the app accessed the borrower’s phone contacts, treated those contacts as references or collection targets, and then sent messages or made calls to pressure the borrower into paying.

This article discusses the legal implications of that practice under Philippine law, including data privacy, harassment, unfair debt collection, cybercrime, consumer protection, and possible remedies.

II. The Basic Legal Problem

When an online lending app contacts a person who is not a borrower, not a guarantor, not a co-maker, and not legally liable for the debt, several legal issues may arise.

The main questions are:

Did the lending app lawfully obtain and use the person’s contact information?
Did the person consent to being contacted?
Was the message merely informational, or was it threatening, defamatory, or harassing?
Did the app disclose the borrower’s debt to third parties?
Did the app pressure a non-debtor to pay or help collect the debt?
Did the app violate data privacy, lending regulations, or criminal laws?

In many situations, contacting phone contacts without a valid legal basis may be unlawful, especially if the contact person has no participation in the loan transaction.

III. Phone Contacts Are Personal Information

Under the Philippine Data Privacy Act of 2012, a person’s name, mobile number, email address, and other contact details may be considered personal information because they can identify an individual.

This means that an online lending app that collects, stores, accesses, uses, or discloses phone contacts is processing personal information.

Processing personal information generally requires a lawful basis, such as consent, contract, legal obligation, legitimate interest, or another ground recognized by law. For lending apps, merely saying in their terms and conditions that they may access all phone contacts does not automatically make the practice lawful. Consent must generally be informed, specific, freely given, and limited to a legitimate purpose.

A borrower may allow an app to access their phone contacts, but that does not necessarily mean every person in the borrower’s contact list has consented to being contacted, profiled, threatened, or used for debt collection.

IV. The Borrower’s Consent Is Not Always Enough

A common defense of online lending apps is that the borrower agreed to the app’s privacy policy and gave permission to access contacts. However, this is legally problematic.

The borrower owns or controls their phone, but the people in the contact list are separate individuals with their own privacy rights. The borrower may have stored names and numbers for personal convenience, but that does not mean the borrower can validly authorize a lending app to use those contacts for collection pressure.

For example, if Juan borrows money from an online lending app and the app accesses Juan’s contact list, the app may find the number of Maria, Juan’s coworker. Maria did not apply for a loan, did not sign a contract, did not agree to be a reference, and did not guarantee Juan’s obligation. If the app then calls Maria and says Juan is a delinquent borrower, that may involve unlawful processing and disclosure of personal information.

The borrower’s consent may permit some limited data processing related to the loan, but it should not be treated as blanket permission to harass or expose third parties.

V. Non-Debtors Have No Obligation to Pay

A person listed in a borrower’s phone contacts does not become liable for the borrower’s loan.

Under basic principles of obligations and contracts, a person is generally bound only by obligations they consented to or obligations imposed by law. A non-borrower is not liable merely because their name or number appears in someone else’s phone.

A person may become liable only if they legally acted as:

a borrower;
a co-borrower;
a surety;
a guarantor;
a co-maker;
or another legally bound party under a valid agreement.

Being a friend, relative, coworker, spouse, neighbor, employer, classmate, or emergency contact does not automatically make a person responsible for another person’s online loan.

Therefore, if an online lending app demands payment from a non-debtor, threatens them, or pressures them to settle another person’s loan, the non-debtor may respond that they have no legal obligation and should demand that the app stop contacting them.

VI. Contacting Third Parties May Violate Data Privacy Rights

The most direct legal issue is often a possible violation of the Data Privacy Act.

An online lending app may violate privacy rights when it:

accesses the borrower’s full contact list unnecessarily;
stores contacts of persons who are not involved in the loan;
uses those contacts for debt collection;
discloses the borrower’s debt to third parties;
sends defamatory or shaming messages to contacts;
contacts people who never gave consent;
refuses to delete a non-debtor’s information upon valid request;
fails to explain how it obtained the person’s data;
uses threats or intimidation involving personal data.

The National Privacy Commission has repeatedly treated abusive online lending practices as a serious data privacy concern. The privacy issue is not only about the borrower’s information. It also involves the personal information of non-borrowers whose details were harvested from phone contacts.

VII. Debt Disclosure to Contacts Can Be Unlawful

Debt information is sensitive in practical terms even if not always technically classified as sensitive personal information. Disclosing that a person borrowed money, defaulted, or is being collected from can harm reputation, employment, family relations, and mental health.

If an online lending app contacts third parties and says things like:

“Your friend is a scammer.”
“Your relative has unpaid debt.”
“Tell this person to pay or we will file a case.”
“You are listed as a reference, so you must pay.”
“We will report your friend to your office.”
“This person is a fraudster.”

then the app may be engaging in improper disclosure, harassment, or defamation.

Even when a collector contacts a third party only to locate a borrower, the communication should be limited, respectful, and non-harassing. It should not disclose unnecessary details about the debt or pressure the third party to pay.

VIII. SEC Rules on Online Lending and Collection Practices

Online lending companies in the Philippines are regulated by the Securities and Exchange Commission if they operate as lending companies or financing companies.

The SEC has issued rules and advisories addressing abusive debt collection practices by lending and financing companies, including online lending platforms. These rules generally prohibit unfair, abusive, deceptive, or humiliating collection methods.

Problematic practices may include:

using threats;
using obscene or insulting language;
making repeated or excessive calls;
contacting people at unreasonable hours;
misrepresenting legal consequences;
falsely claiming to be connected with courts or law enforcement;
threatening public shaming;
posting borrower information online;
contacting third parties to shame or pressure the borrower;
using information from phone contacts for abusive collection.

A lending company may face regulatory sanctions, including fines, suspension, revocation of authority to operate, or other penalties, depending on the facts.

IX. Harassment and Unjust Vexation

If the calls or messages are persistent, abusive, intimidating, or intended to annoy or distress the recipient, the conduct may also amount to harassment or unjust vexation.

Unjust vexation under Philippine criminal law is generally a broad offense covering conduct that unjustly annoys, irritates, torments, or causes distress to another person without lawful justification.

Examples may include:

repeated calls despite being told to stop;
threatening a non-debtor with legal action;
sending humiliating text messages;
calling a person’s employer;
accusing the non-debtor of hiding the borrower;
making false claims that the non-debtor is legally responsible;
using aggressive language to force the non-debtor to contact the borrower.

The strength of a complaint will depend on the content, frequency, timing, and context of the communications.

X. Grave Threats, Light Threats, Coercion, or Alarm and Scandal

Depending on the wording of the messages, other criminal provisions may become relevant.

If a collector threatens harm, arrest, public exposure, fabricated cases, or other unlawful acts, possible legal issues may include threats or coercion.

Examples of alarming statements include:

“We will have you arrested.”
“We will go to your house and embarrass you.”
“We will tell your employer you are involved.”
“You will be included in the case if you do not pay.”
“We will post your face online.”
“We know where you live.”

Not every unpleasant collection message is automatically a criminal offense. But threats, intimidation, false legal claims, and coercive pressure can create criminal liability depending on the facts.

XI. Cyber Libel and Online Shaming

If an online lending app, its agents, or collectors post false or malicious statements online about a borrower or a non-debtor, cyber libel may become an issue under the Cybercrime Prevention Act in relation to libel under the Revised Penal Code.

Cyber libel may arise when defamatory statements are made online or through computer systems, such as:

Facebook posts;
group chats;
messaging platforms;
public posts tagging friends or coworkers;
comments accusing someone of fraud, theft, or being a scammer;
edited images or “wanted” posters;
public posts revealing debt or personal information.

Calling someone a “scammer,” “estafador,” “criminal,” or “fraudster” in connection with a debt may be defamatory if the statement is false, malicious, or not legally justified.

A non-debtor who is falsely accused or publicly shamed may have separate claims from the borrower.

XII. Illegal Access to Contacts and Excessive App Permissions

Many online lending apps request permissions that are not necessary for the loan transaction, such as access to:

full contact list;
photos;
camera;
microphone;
location;
call logs;
SMS;
storage files;
social media information.

Access to a contact list may be excessive if the app does not need all contacts to evaluate or collect a loan. Data privacy principles require that personal data processing be legitimate, necessary, and proportionate.

A lending app should not collect more information than necessary. It should not use personal data for purposes unrelated to the loan. It should not secretly harvest contact information or use it to shame borrowers.

Even if the app discloses its practices in a privacy policy, the policy may still be challenged if the processing is excessive, unfair, misleading, or coercive.

XIII. References, Emergency Contacts, and Guarantors Are Different

Online lending apps sometimes blur the distinction between a reference, an emergency contact, and a guarantor.

These are legally different.

A reference is usually someone who may verify identity or character. A reference does not automatically owe the debt.

An emergency contact is someone who may be contacted in emergencies or for identity verification. An emergency contact does not automatically owe the debt.

A guarantor or surety is someone who legally agrees to answer for another person’s obligation. This requires a clear agreement. It cannot be presumed merely from a name appearing in a phonebook.

A co-maker or co-borrower signs or agrees to the loan obligation and may be directly liable.

Therefore, a lending app cannot simply claim that a person is liable because they were listed as a reference or found in the borrower’s contacts.

XIV. Employer Contacting and Workplace Harassment

Some lending apps contact employers, supervisors, HR departments, coworkers, or business pages to pressure payment. This can be especially damaging.

Contacting a borrower’s workplace may lead to:

embarrassment;
reputational harm;
disciplinary consequences;
stress;
workplace conflict;
possible job loss.

For non-debtors, workplace contact is even more questionable. A coworker or employer generally has no duty to help collect a private debt unless there is a lawful court process or a valid legal obligation.

Collectors should not use workplace channels to shame, threaten, or pressure third parties. If the messages affect employment or reputation, the victim may consider privacy, civil, criminal, and regulatory remedies.

XV. Common Illegal or Abusive Collection Tactics

The following practices are commonly associated with abusive online lending collection:

Mass texting the borrower’s contacts.
Calling relatives repeatedly.
Threatening to file criminal cases without basis.
Pretending to be police, NBI, barangay, court staff, or lawyers.
Sending fake subpoenas or fake warrants.
Posting the borrower’s photo online.
Creating group chats to shame the borrower.
Telling contacts that they must pay.
Harassing a borrower’s spouse, parents, children, employer, or coworkers.
Using insults, profanity, or degrading language.
Calling at very early or late hours.
Threatening arrest for ordinary nonpayment of debt.
Accusing the borrower of estafa without legal basis.
Accessing private photos or files from the phone.
Refusing to identify the company or collector.

Many of these acts may violate privacy rules, lending regulations, civil law, criminal law, or consumer protection standards.

XVI. Nonpayment of Debt Is Generally Not a Crime by Itself

A common intimidation tactic is to tell borrowers or their contacts that the borrower will be jailed for nonpayment.

In general, failure to pay a debt is a civil matter, not automatically a criminal offense. The Philippine Constitution prohibits imprisonment for debt.

However, criminal liability may arise in separate situations, such as fraud, deceit, bouncing checks, falsification, or other criminal acts. But mere inability or failure to pay a loan is not by itself enough to justify threats of arrest.

Thus, when an online lending app tells a non-debtor that the borrower will be arrested immediately unless payment is made, that may be misleading or abusive, especially if there is no actual criminal case.

XVII. Estafa Threats Should Be Examined Carefully

Collectors often threaten to file estafa. Estafa requires specific elements, such as deceit, abuse of confidence, or fraudulent means. A simple unpaid loan does not automatically become estafa.

For estafa to exist, there must generally be something more than nonpayment, such as fraudulent intent at the time of borrowing or deceit that caused the lender to part with money.

A collection message saying “you will be charged with estafa” may be improper if used merely to scare the borrower or contacts without factual and legal basis.

A non-debtor contacted about another person’s alleged estafa should not assume liability. Unless the non-debtor participated in fraud or signed a legal obligation, they are generally not responsible.

XVIII. Civil Liability for Damages

Victims of abusive collection may also consider civil claims for damages.

Under Philippine civil law, a person who causes damage to another through fault, negligence, bad faith, abuse of rights, or acts contrary to morals, good customs, or public policy may be held liable.

Possible damages may include:

moral damages for anxiety, humiliation, sleepless nights, wounded feelings, or social embarrassment;
actual damages if financial loss can be proven;
exemplary damages in serious cases to deter similar conduct;
attorney’s fees when allowed by law.

A civil case may be considered if the harassment caused reputational, emotional, professional, or financial harm.

XIX. The Right to Demand Cessation and Deletion

A non-debtor whose personal information was obtained from another person’s phone contacts may demand that the online lending app:

identify the source of the personal data;
explain the purpose of processing;
stop contacting them;
delete or block their personal information;
cease using their number for collection;
stop disclosing their information;
provide the identity of the company, collection agency, or data protection officer.

Under data privacy principles, individuals have rights over their personal data, including rights to information, access, correction, objection, blocking, erasure, and damages in proper cases.

A written demand is often useful because it creates a record that the person objected to further processing.

XX. What a Non-Debtor Can Say to the Lending App

A non-debtor may send a firm but calm message such as:

I am not the borrower, co-maker, guarantor, surety, or debtor in this matter. I did not consent to the use of my personal information for debt collection. Please stop contacting me and delete my number from your records. Any further contact, harassment, disclosure of debt information, or threat may be reported to the National Privacy Commission, the Securities and Exchange Commission, and other proper authorities.

The message should avoid insults or threats. The goal is to clearly deny liability, object to data processing, and preserve evidence.

XXI. Evidence to Preserve

Anyone harassed by an online lending app should preserve evidence immediately.

Useful evidence includes:

screenshots of text messages;
screenshots of chat messages;
call logs;
voice recordings, where legally and safely obtained;
names and numbers used by collectors;
app name;
company name;
SEC registration details, if available;
loan account details, if known;
privacy policy screenshots;
app permission screenshots;
URLs or social media posts;
names of people contacted;
dates and times of calls;
proof that the complainant is not a borrower or guarantor;
demand messages asking the app to stop.

The more organized the evidence, the easier it is to file complaints.

XXII. Where to File Complaints

Depending on the facts, a victim may consider filing complaints with different offices.

1. National Privacy Commission

The NPC is the primary agency for data privacy concerns. Complaints may involve unauthorized access, improper processing, disclosure of personal information, harassment through personal data, and refusal to delete or stop processing data.

2. Securities and Exchange Commission

The SEC handles complaints involving lending companies and financing companies, including abusive collection practices, unauthorized lending operations, and violations of lending regulations.

3. Philippine National Police Anti-Cybercrime Group or NBI Cybercrime Division

If there are threats, cyber libel, online shaming, identity misuse, fake documents, hacking, or other cyber-related conduct, law enforcement cybercrime units may be relevant.

4. Barangay or Local Authorities

For local harassment, repeated visits, threats, or community-level disputes, barangay assistance may sometimes be useful, though privacy and cybercrime issues often require national agencies.

5. Courts

For civil damages, injunctions, criminal complaints, or other judicial remedies, court action may be considered with the help of counsel.

XXIII. Liability of Collection Agencies

Some online lending companies outsource collection to third-party collection agencies. This does not automatically excuse the lending company.

A lender may still be responsible if its agents or service providers misuse personal data or engage in abusive collection practices. Under data privacy principles, companies that control personal information must ensure that processors and contractors follow the law.

The collection agency itself may also be liable if it commits harassment, threats, privacy violations, or defamatory acts.

XXIV. The Role of App Stores and Platforms

Some abusive online lending apps operate through app stores, websites, APK downloads, or social media ads. Victims may also report abusive apps to the platform hosting or distributing them.

While app store reporting is not a substitute for legal remedies, it may help reduce further harm, especially when apps misuse permissions or engage in predatory lending.

Users should be cautious about installing lending apps that demand excessive permissions or lack transparent company information.

XXV. Red Flags Before Using an Online Lending App

Borrowers should be careful before installing or using any online lending app. Warning signs include:

requiring access to all contacts;
requiring access to photos or files;
very short repayment periods;
unclear interest rates and fees;
no visible company name;
no SEC registration details;
no clear privacy policy;
aggressive permission requests;
threats in reviews from other users;
hidden charges;
automatic deductions;
no official customer support;
use of personal numbers for collection;
promises of “instant approval” with no proper assessment.

A legitimate lender should be transparent about rates, fees, terms, privacy practices, and collection policies.

XXVI. Borrowers Also Have Rights

Even if a borrower truly owes money, they still have rights. A borrower may be asked to pay, but they should not be threatened, humiliated, or exposed to third parties.

Debt collection must be lawful, fair, and proportionate. The existence of a debt does not give a lender unlimited power to invade privacy or harass people.

Borrowers may dispute charges, ask for a statement of account, negotiate payment terms, and demand that collection be conducted lawfully.

XXVII. Contacts of Borrowers Also Have Rights

Non-debtors have independent rights. They are not merely tools for collection.

A person contacted by an online lending app may assert:

the right not to be harassed;
the right not to be falsely accused;
the right not to have personal data processed without lawful basis;
the right not to be pressured to pay another person’s debt;
the right to demand deletion of personal information;
the right to file complaints;
the right to claim damages in proper cases.

The fact that their number was saved in someone else’s phone does not remove these rights.

XXVIII. Sample Demand Letter for a Non-Debtor

Subject: Demand to Stop Contacting Me and Delete My Personal Information

To whom it may concern:

I am not the borrower, co-borrower, guarantor, surety, co-maker, or debtor in relation to the loan account you are collecting. I did not consent to the use of my personal information for debt collection, and I do not authorize your company, agents, representatives, or collection partners to contact me regarding another person’s alleged debt.

Your continued calls, messages, or disclosures involving this matter may constitute harassment, improper debt collection, and unauthorized processing of personal information.

I demand that you immediately:

stop contacting me regarding this debt;
delete or block my personal information from your records;
stop disclosing any debt-related information to me or about me;
identify the source from which you obtained my personal information;
provide the name of your company, office address, and data protection officer or authorized representative.

Please treat this as a formal objection to the processing of my personal information for debt collection purposes.

Further contact may be reported to the National Privacy Commission, the Securities and Exchange Commission, and other proper authorities.

Sincerely, [Name]

XXIX. Sample Complaint Outline

A complaint may be organized as follows:

1. Parties Name of complainant, contact details, and the lending app/company involved.

2. Statement that complainant is not liable Explain that the complainant is not the borrower, guarantor, co-maker, or surety.

3. How the complainant was contacted State dates, times, numbers used, and platforms used.

4. Content of messages or calls Describe threats, demands, insults, disclosure of debt, or false claims.

5. Privacy issue Explain that the complainant did not consent to the use of their personal information.

6. Harm caused Mention anxiety, embarrassment, workplace disruption, reputational damage, or other effects.

7. Evidence Attach screenshots, call logs, recordings, and other proof.

8. Relief requested Ask the agency to investigate, order deletion or cessation, impose penalties where proper, and provide other appropriate relief.

XXX. Defenses Lending Apps May Raise

Online lending apps may argue that:

the borrower consented to contact access;
the contact was listed as a reference;
the call was only for verification;
the communication did not disclose debt details;
the collector acted independently;
the company has a privacy policy;
the contact information was publicly available;
the messages were sent by a third-party collection agency.

These defenses are not automatically valid. The legality will depend on evidence, the scope of consent, the purpose of processing, the actual messages sent, and whether the conduct was necessary, proportionate, and lawful.

A privacy policy does not legalize harassment. A reference field does not create debt liability. A collection agency relationship does not erase the lender’s responsibility.

XXXI. Practical Steps for Victims

A person contacted by an online lending app despite having no debt may take the following steps:

Do not pay unless there is a valid legal obligation.
Do not admit liability.
Ask for the company name and authority to collect.
Tell them in writing to stop contacting you.
Demand deletion of your personal information.
Save all evidence.
Block numbers only after preserving proof.
Warn family or coworkers not to engage with collectors.
Report abusive conduct to proper agencies.
Consult a lawyer if threats, public shaming, or serious harm occurred.

XXXII. Remedies Available

Depending on the facts, remedies may include:

order to stop processing personal data;
deletion or blocking of personal information;
administrative penalties;
suspension or revocation of lending authority;
criminal complaint for threats, unjust vexation, cyber libel, or related offenses;
civil action for damages;
takedown or reporting of defamatory online posts;
complaint against collection agency;
regulatory action against the lending company.

The best remedy depends on the seriousness of the conduct, available evidence, and the identity of the lender or collector.

XXXIII. Ethical and Policy Considerations

The abuse of phone contacts by lending apps is not just a private dispute. It affects public trust, digital finance, privacy, consumer protection, and mental health.

Online lending should not operate through fear. Digital credit can be useful, but it must respect dignity, privacy, and due process.

The use of social pressure as a collection weapon is especially harmful in the Philippines, where family, workplace, and community reputation are highly valued. A borrower may suffer severe shame, and innocent contacts may be dragged into disputes they never joined.

Regulation must therefore balance financial inclusion with strong protection against predatory and abusive practices.

XXXIV. Key Legal Principles

The topic may be summarized through these principles:

A person does not owe a debt merely because their number is in someone’s phone contacts.
A borrower’s consent does not automatically authorize harassment of third parties.
Phone contacts are personal information protected by data privacy law.
Debt collection must be lawful, fair, and non-abusive.
Public shaming, threats, and false accusations may create civil, criminal, and regulatory liability.
Non-debtors may demand that lending apps stop contacting them and delete their data.
Lending companies may be liable for the acts of their collectors and agents.
Nonpayment of debt is generally not a crime by itself.
Victims should preserve evidence before blocking or deleting messages.
Complaints may be filed with privacy, securities, cybercrime, or judicial authorities depending on the facts.

XXXV. Conclusion

In the Philippines, an online lending app that contacts phone contacts who have no debt may be violating multiple legal protections, especially when the communication involves harassment, threats, public shaming, debt disclosure, or unauthorized use of personal information.

A non-debtor has no obligation to pay another person’s loan unless they validly agreed to be legally liable. Being saved in a borrower’s phone does not make someone a guarantor, co-maker, or debtor.

The most important legal issues are data privacy, abusive collection, harassment, defamation, and consumer protection. Victims should document the conduct, clearly deny liability, demand cessation and deletion of their data, and consider complaints before the National Privacy Commission, the Securities and Exchange Commission, law enforcement, or the courts.

Online lending can be legitimate, but collection practices must remain within the law. Debt does not erase dignity, and convenience in digital lending does not justify the misuse of private contact lists.