Quick answer

An online lending app generally cannot use a borrower’s phone, email, or social-media contact list to shame the borrower or pressure unrelated people to collect a debt. Under National Privacy Commission rules, contacting people in the borrower’s contact list for debt collection is prohibited unless the person was validly named as a guarantor. A character reference is not automatically a guarantor and may ask to have their personal data removed.

A lender may pursue a legitimate unpaid debt through lawful collection methods. But threats, insults, public shaming, deceptive statements, excessive contact, unauthorized disclosure of personal information, and harassment of relatives, friends, co-workers, or employers may violate privacy and financial-consumer-protection rules. The harassment does not automatically cancel a valid loan, but the borrower or affected contact may seek regulatory and, depending on the conduct, civil or criminal remedies.

What Philippine law says about contacting other people

The most specific rules come from the National Privacy Commission (NPC) and the Securities and Exchange Commission (SEC).

Contact-list harvesting and harassment are prohibited

NPC Circular No. 2020-01, as amended by NPC Circular No. 2022-02, regulates how lending companies, financing companies, their collection providers, and other persons acting as lenders process personal data in loan transactions.

The amended rules provide that:

An app may request access to personal data only when the access is suitable, necessary, and not excessive for a legitimate purpose.
Unconstrained, excessive, or disproportionate processing of a contact list is prohibited.
Processing that leads to harassment, unfair collection practices, or collection from people other than the borrower’s guarantors is prohibited.
An app may obtain only the limited access necessary for the borrower to select a character reference or guarantor.
For debt collection, the lender may contact a guarantor, but not other people found in the borrower’s contact list.
The lender remains responsible for complying with privacy rules when collection work is outsourced.

Contact lists include phone contacts, email lists, and social-media contacts. The NPC has also expressly warned that online lenders may not harvest these lists to harass delinquent borrowers or people connected to them. See the NPC’s official advisory on online lenders and contact lists.

A character reference is not liable for the loan

A character reference is someone identified to help verify a loan applicant’s identity or the truthfulness of information in the application. The lender must explain that the person was selected as a character reference, disclose how the contact details were obtained, and provide an option to have those details removed.

Being listed as a reference does not make someone a guarantor. A guarantor must expressly agree to fulfill the borrower’s obligation if the borrower fails to do so, consistently with the Civil Code rules on guaranty. The lender must separately obtain the guarantor’s consent.

Therefore, a relative, friend, officemate, supervisor, or other contact normally has no duty to pay merely because:

their number appeared in the borrower’s phone;
the borrower listed them as a reference;
the collector called or messaged them;
they know or are related to the borrower; or
the collector claims that they must “help settle” the account.

Whether someone truly became a guarantor depends on the documents and the person’s express agreement—not on the collector’s assertion.

Collection must remain fair and lawful

SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair debt-collection practices by lending and financing companies and their third-party collection providers. Prohibited conduct includes threats of violence or other criminal means, threats to take action that cannot legally be taken, abusive or profane language, deceptive means, and improper disclosure or publication of borrowers’ personal information.

The Financial Products and Services Consumer Protection Act, Republic Act No. 11765, also protects financial consumers’ rights to fair treatment, data privacy, disclosure, and timely handling of complaints. It empowers financial regulators, including the SEC, to investigate and act against providers under their jurisdiction.

The Data Privacy Act of 2012, Republic Act No. 10173, separately requires personal-data processing to have a lawful basis and to observe transparency, legitimate purpose, and proportionality. Depending on the evidence and circumstances, unauthorized collection, use, or disclosure of contact information may result in administrative, civil, or criminal consequences.

Examples of conduct that may be unlawful

Possible violations include:

Messaging everyone in the borrower’s contact list about the debt.
Telling an employer, co-worker, customer, neighbor, or relative that the borrower is delinquent when disclosure is unnecessary for lawful collection.
Posting the borrower’s photograph, identification document, loan details, or accusations on social media.
Editing a borrower’s photo into a “wanted,” “scammer,” or humiliating graphic.
Threatening arrest, imprisonment, violence, or public exposure when the threatened action has no lawful basis.
Using insults, sexual remarks, profanity, or degrading language.
Repeatedly calling unrelated contacts to pressure them to locate or pay for the borrower.
Falsely presenting a collector as a court, police officer, lawyer, or government employee.
Treating a character reference as a guarantor without express agreement.
Refusing a character reference’s request to remove their personal data without identifying another lawful basis for continued processing.
Continuing to use device permissions or personal data beyond what is necessary for the stated purpose.

A single legitimate verification call is not necessarily harassment. The complete context matters: who was contacted, why, what was disclosed, what was said, how often it occurred, and whether the person was actually a guarantor.

What to do immediately

1. Preserve the evidence before deleting or blocking anything

Save original copies of:

text messages, chat threads, emails, and social-media messages;
screenshots showing the sender’s account, phone number, date, and time;
call logs and voicemail recordings;
social-media posts, comments, URLs, usernames, and timestamps;
notifications showing which app sent the message;
the app’s name, developer, download-page URL, privacy notice, and permission screen;
the loan agreement, disclosure statement, repayment schedule, receipts, and account ledger;
messages sent to relatives, friends, co-workers, or employers;
the names of collectors and the company they claim to represent; and
any written complaint and the lender’s response.

Ask affected contacts to preserve what they personally received. Do not rely only on forwarded or cropped screenshots if the original is still available.

Keep an incident log stating what happened, when it happened, who received the communication, and the effect it had. Back up the files somewhere the lending app cannot access.

2. Secure the phone and accounts

After preserving evidence:

Revoke the app’s access to contacts, call logs, SMS, photos, camera, microphone, location, and storage unless a permission remains genuinely necessary.
Uninstall the app if it is no longer needed, but first save contracts, receipts, balances, and evidence stored inside it.
Change passwords for email, social media, and financial accounts if compromise is suspected.
Enable multi-factor authentication.
Review active sessions and remove unfamiliar devices.
Warn contacts not to send money, disclose verification codes, or open suspicious links.

Revoking permissions stops future device access but may not erase data the company already copied. Send a separate written privacy request concerning stored information.

3. Send a written demand to stop the harassment

Write to the lender and its data protection officer or privacy contact. Identify the account only as much as necessary and state:

the conduct being challenged;
the phone numbers or accounts used by the collectors;
the dates and recipients of the communications;
that contact-list processing and third-party disclosure must stop;
that non-guarantor contacts must not be approached for collection;
that inaccurate or unlawfully processed data should be corrected, blocked, erased, or removed as applicable;
that evidence and processing records must be preserved; and
that all future communication should use a specified channel.

Request the lender’s full corporate name, SEC registration details, Certificate of Authority, collection-provider identity, privacy notice, source of the contact data, legal basis and purpose for processing it, recipients of any disclosure, and action taken on the complaint.

Keep proof that the company received the notice.

4. Separate the privacy dispute from the debt

If the debt is yours, request a written statement showing:

principal;
interest;
fees and penalties;
payments credited;
outstanding balance;
due dates; and
the lender’s authorized payment channel.

Do not pay a personal account or unfamiliar wallet merely because a caller demands immediate payment. Verify the company and payment instructions independently.

If the balance is disputed, identify the disputed entries in writing. If the loan is valid but unaffordable, propose a realistic restructuring or payment arrangement. Do not admit a debt that is not yours, and do not sign a settlement or guaranty you do not understand.

A privacy or harassment complaint usually does not suspend an otherwise valid payment obligation. Conversely, late payment does not authorize abuse or public shaming.

Where to complain

More than one complaint may be appropriate because the agencies address different issues.

National Privacy Commission

Complain to the NPC when the issue involves unauthorized access to contacts, excessive permissions, disclosure of loan information, misuse of photographs, refusal to remove a character reference, or another privacy-rights violation.

Under the NPC’s rules, a complainant ordinarily must first notify the company or other responsible entity in writing and allow it an opportunity to act. The applicable exhaustion requirements should be checked carefully; the NPC may waive them in circumstances allowed by its rules.

The NPC currently requires its prescribed complaint-affidavit, supporting evidence, notarization, and the required certification. It accepts formal complaints in person, by courier, or as a scanned submission by email. Use the NPC’s current form and instructions because older forms may no longer be accepted. See:

A borrower may complain about misuse of their own data. A contacted relative, friend, officemate, or other person may also complain about the processing of their personal information.

Securities and Exchange Commission

For harassment or unfair collection by an SEC-regulated lending or financing company, use the SEC complaint process. The SEC instructs complainants to:

complete the prescribed complaint form;
submit one complaint form for each respondent company;
include a valid government-issued ID; and
attach all supporting evidence.

Current SEC information is available through its lending and financing company complaint page and iMessage ticketing system.

The SEC may investigate and impose regulatory measures, but its complaint page cautions that it does not, through that process, rewrite the loan’s terms, cancel the obligation, or simply declare the contract void. Those issues may require a different proceeding and case-specific legal advice.

The lender’s proper regulator

Not every digital credit product is regulated in the same way:

Lending and financing companies are generally under the SEC.
Banks and other BSP-supervised financial institutions are under the Bangko Sentral ng Pilipinas.
Credit cooperatives may fall under the Cooperative Development Authority, subject to statutory exceptions.
Privacy violations may still be brought to the NPC.

Identify the company behind the app rather than relying only on the app’s brand name. The contract, privacy notice, disclosure statement, payment recipient, and app-store developer information may help.

Police or the National Bureau of Investigation

Seek immediate law-enforcement assistance if messages contain credible threats of physical harm, extortion, stalking, impersonation, account takeover, or other potentially criminal conduct. Preserve the original messages and devices.

For immediate danger, contact emergency services or the nearest police station. Online conduct may also be reported to the appropriate PNP or NBI cybercrime unit. Whether a particular message constitutes grave threats, libel, unjust vexation, identity theft, or another offense depends on its precise words, publication, intent, and surrounding facts.

What contacts who are being harassed can say

A non-borrower may send a short written notice such as:

I am not the borrower and have not agreed to act as guarantor. Do not contact me for debt collection. Please identify your company, explain how you obtained my personal data, remove me as a character reference if I was listed as one, and stop processing or disclosing my information except where retention is legally required. Preserve all records concerning the acquisition, use, and disclosure of my data and confirm your action in writing.

Do not disclose the borrower’s location, workplace, account information, verification codes, or other personal details merely because the caller demands them.

Common mistakes to avoid

Deleting messages or uninstalling the app before saving evidence.
Posting unredacted IDs, loan documents, phone numbers, or contacts publicly while asking for help.
Paying an unknown collector through an unverified account.
Assuming that filing a complaint automatically erases the debt.
Assuming that a missed payment allows the lender to shame the borrower.
Treating every collection message as illegal without considering its content and recipient.
Filing against the app’s brand name without identifying the legal company and collection provider.
Sending only a narrative without dates, screenshots, documents, and proof of prior written notice.
Using an obsolete NPC complaint form.
Ignoring a real court summons. A social-media threat is not a summons, but an authentic court document requires prompt attention.
Blocking all channels before giving the company one controlled written channel for account statements and lawful notices.

When legal help is urgent

Consult a Philippine lawyer promptly if:

the lender published intimate, medical, government-ID, or other highly sensitive information;
threats involve violence, arrest, workplace disruption, or harm to family members;
the harassment caused job loss, serious reputational damage, or significant financial loss;
money was taken without authorization;
someone used your identity to obtain the loan;
the lender claims you signed as guarantor but you deny doing so;
you received an authentic subpoena, summons, complaint, or demand from a court or government agency;
several complaints or proceedings involving the same facts may create forum-shopping issues; or
you want damages, an injunction, or another court remedy.

The Public Attorney’s Office may be an option for people who meet its eligibility and merit requirements. A private lawyer can also review whether coordinated NPC, SEC, civil, or criminal action is appropriate.

Frequently asked questions

Can a lending app call everyone in my contacts?

No. The NPC prohibits unbridled contact-list processing and prohibits contacting people in the borrower’s contact list for debt collection unless they were named as guarantors. Limited processing for selecting a borrower-chosen reference or guarantor does not authorize mass collection messages.

Can the lender contact my employer?

An employer is not automatically entitled to receive information about an employee’s debt. Contact intended to shame the borrower or pressure an unrelated employer may constitute improper disclosure or unfair collection. A communication required by a lawful court process is different.

Am I liable because I was named as a reference?

No—not for that reason alone. A reference is not automatically a guarantor. Guaranty requires the person’s express agreement under the applicable Civil Code rules.

Can a collector threaten to have a borrower arrested?

Ordinary nonpayment of a contractual debt does not by itself justify a threat of arrest. Fraud or another alleged offense is a separate matter requiring facts and proper legal process. A collector must not falsely claim that arrest is automatic or pretend that a criminal case, warrant, or government order exists.

Does granting app permission mean the lender may shame me?

No. Permission does not authorize unlimited processing. Access and use must still be lawful, transparent, necessary, proportionate, and confined to a legitimate purpose.

Will revoking contact permission remove data already collected?

Not necessarily. Revocation can prevent further device access, but copied data may remain in the company’s systems. Send a written data-subject request and ask what information is held, why it is processed, to whom it was disclosed, and whether it can be blocked, erased, or removed.

Can both the borrower and a contacted friend file complaints?

Yes, if each person’s rights were affected. The borrower may complain about disclosure and harassment involving their loan information. The contacted person may complain about the collection and use of their own contact details. Each should describe their own experience and attach their own evidence.

Does harassment make the loan disappear?

No. Misconduct by a collector and the enforceability or amount of the loan are separate questions. Challenge the harassment while requesting an accurate account statement and addressing any valid obligation through lawful channels.

Is there one universal deadline for these complaints?

No single deadline applies to every possible SEC, NPC, civil, or criminal remedy. Some claims have different prescriptive or procedural periods, and delay can make evidence harder to obtain. Preserve evidence and seek advice promptly, especially when threats, publication, identity theft, or significant loss are involved.

Official sources

This article provides general legal information, not advice for a particular case. Loan documents, consent records, the lender’s regulatory status, the content of each communication, and the identity of each recipient can change the legal analysis. Official sources and filing information were checked on September 7, 2026.