Quick answer

An online lending app generally cannot contact people in a borrower’s phonebook to shame, pressure, or threaten the borrower into paying. For debt collection, a lending or financing company may contact only a person who expressly agreed to be a guarantor. A character reference is not automatically a guarantor and may be contacted only for legitimate identity or information-verification purposes—not to collect the debt.

Harassment, public shaming, threats of unlawful action, deceptive messages, and disclosure of loan information to unrelated contacts may violate Philippine privacy and financial-consumer-protection rules. This remains true even if the borrower previously allowed the app to access the phone’s contacts. Consent does not authorize excessive processing or unfair collection practices.

The harassment does not automatically cancel a valid debt. The borrower should address the legitimate balance separately while documenting and reporting abusive conduct.

What online lenders are prohibited from doing

Under SEC Memorandum Circular No. 18, Series of 2019, prohibited unfair collection practices include:

Threatening violence or other criminal means against a person, reputation, or property.
Threatening action that cannot legally be taken.
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense.
Publishing or disclosing a borrower’s name and personal information, subject only to limited lawful exceptions.
Communicating false loan information or failing to disclose that a debt is disputed when disclosure is otherwise legally permitted.
Using false representations or deceptive means to collect a debt or obtain information.
Contacting a borrower before 6:00 a.m. or after 10:00 p.m., unless the account has been past due for more than 15 days or the borrower gave properly recorded express consent that those are the only reasonable times for contact.
Contacting people in the borrower’s contact list who were not named as guarantors or co-makers.

The Financial Products and Services Consumer Protection Act, Republic Act No. 11765, separately prohibits financial service providers from using abusive collection or debt-recovery practices. It also requires fair treatment, data protection, and a free consumer-assistance mechanism. Providers remain responsible for their employees and agents and may be solidarily liable with accredited third-party collection service providers.

Contacts, character references, and guarantors are different

The distinction matters because each category has different rights and obligations.

Ordinary phone contacts

Friends, relatives, co-workers, employers, clients, neighbors, and other people merely stored in the borrower’s phone are not responsible for the loan. They should not be contacted to collect it.

The current joint DICT-NPC-SEC advisory on online lending platforms expressly states that contacting people in a borrower’s contact list, other than guarantors, is prohibited for debt-collection purposes.

Character references

A character reference is identified so the lender can verify the borrower’s identity or the truthfulness of information supplied in the application. Under NPC Circular No. 2022-02:

The lender must inform the person that they were named as a reference and explain how it obtained their contact details.
The person must be given an option to have their data removed as a character reference.
The lender cannot use the reference’s information for unrelated purposes such as marketing, cross-selling, or third-party product offers.
A character reference is not automatically a guarantor.

A lender therefore should not demand payment from a character reference or use repeated calls to that person to pressure the borrower.

Guarantors

A guarantor is someone who expressly binds themselves to answer for the borrower’s obligation if the borrower defaults. Separate consent is required, together with compliance with the Civil Code rules on guaranty and the Data Privacy Act.

Merely appearing in someone’s contacts, receiving a verification call, or being named unilaterally in an application does not by itself establish a valid guaranty. Whether a particular document created an enforceable guaranty depends on its language, execution, authenticity, and surrounding facts.

Even a genuine guarantor must still be treated fairly. Guarantor status does not permit threats, insults, deceptive statements, public shaming, or excessive disclosure.

Why phonebook harvesting may violate data-privacy rules

The Data Privacy Act of 2012, Republic Act No. 10173, requires personal-data processing to have a lawful basis and to comply with transparency, legitimate purpose, and proportionality.

NPC Circular No. 2022-02 permits only limited, necessary, and proportionate processing of app permissions. It specifically prohibits “unbridled” processing of contact lists, including processing that:

Leads to harassment.
Is used to collect a debt from people other than the borrower’s guarantors.
Results in unfair collection practices.

An app may provide a limited interface that lets the borrower select a chosen character reference or guarantor. That is different from copying, retaining, profiling, or messaging the entire address book.

A privacy notice or broad permission prompt does not cure excessive processing. The lender must give meaningful, timely information about why particular data is needed and how it will be used. Once access is no longer necessary and no other lawful basis applies, the app should prompt the user to revoke the permission.

Revoking permission now may stop future access, but it does not necessarily delete information already collected. A separate written request should ask what data was obtained, whom it was disclosed to, the legal basis and retention period, and whether deletion or blocking is available.

What to do immediately

1. Preserve evidence before blocking or uninstalling the app

Save complete, unedited copies where possible:

Screenshots and screen recordings showing the sender, number, account name, date, time, and full message.
Call logs, voicemails, emails, chat threads, social-media posts, and collection notices.
Messages received by family members, co-workers, or other contacts.
Written statements from affected contacts describing what was said and when.
The app’s name, developer, download-page URL, privacy notice, permission screens, and version.
The loan agreement, disclosure statement, repayment schedule, receipts, account ledger, and payment history.
Names used by collectors and the company they claim to represent.
Any threats to publish photographs, contact an employer, fabricate a criminal case, or cause physical harm.
Copies of earlier complaints and proof that the lender received them.

Ask affected contacts not to delete messages. They should preserve the original communications and avoid editing screenshots in a way that removes identifying details.

2. Secure the phone and accounts

After preserving evidence:

Revoke the app’s access to contacts, phone logs, SMS, photos, camera, microphone, location, and social-media accounts unless genuinely required.
Change passwords for email, financial, and social-media accounts if the app or its representatives may have obtained access.
Enable multifactor authentication.
Check for unfamiliar apps, device-administrator privileges, accessibility permissions, and linked devices.
Report impersonating or abusive accounts through the relevant platform.
Avoid sending identification documents, one-time passwords, PINs, or additional contact lists to an unverified collector.

Do not rely on uninstalling alone. Review permissions and account access first.

3. Send a written notice to the lender

Send the notice to the company’s consumer-assistance unit and data-protection officer, if identified. Keep proof of delivery.

State that:

You dispute and object to harassment, third-party collection, and excessive disclosure.
Collection communications should be directed only to you through specified reasonable channels.
The company must stop contacting non-guarantor contacts.
You want the identity and authority of the company and collection agency confirmed.
You request a complete statement of account and the contractual basis of all charges.
You request information about the personal data collected, its sources, recipients, purpose, lawful basis, and retention period.
You request correction, blocking, erasure, or secure disposal where legally applicable.
Relevant records, call recordings, access logs, disclosure logs, and collector instructions must be preserved.

If you are only a contacted friend, relative, or co-worker, say that you are neither the borrower nor a guarantor, demand that collection calls stop, and request removal of your information.

For an ordinary NPC privacy complaint, the complainant generally must first notify the company in writing. If it does not take timely or appropriate action—or gives no response within 15 calendar days after receipt—the exhaustion requirement is ordinarily satisfied under the NPC’s 2021 Rules of Procedure.

4. Deal with the legitimate account separately

Ask for a written account statement identifying:

The lender’s complete corporate name.
The principal amount released.
Interest, fees, penalties, and prior payments.
The current balance and computation.
The proposed payment or restructuring terms.
The official payment channel.

Pay only through a verified channel belonging to the authorized lender or collection representative. Obtain a receipt and written confirmation of how the payment was applied. Do not pay a stranger’s personal account merely because the sender is threatening immediate exposure or arrest.

If the amount, interest, fees, identity of the lender, or validity of the loan is disputed, say so clearly in writing. Do not admit an amount you have not verified.

Where to complain

More than one agency may have jurisdiction. Complaints can address different conduct and do not necessarily provide the same remedy.

Securities and Exchange Commission

For unfair collection by a lending company, financing company, or online lending platform, file through the SEC iMessage portal. The current government advisory also identifies the SEC hotline as 1-4732 (1-4SEC).

Include the company and app names, the loan details, a clear timeline, screenshots, phone numbers used, affected contacts, proof of the written demand, and the specific relief requested.

National Privacy Commission

A borrower or any contact whose own personal data was misused may file a privacy complaint. This means a friend, relative, employer, or co-worker directly targeted through improper use of their information may have an independent basis to complain.

The NPC requires a completed and notarized Complaints-Assisted Form or a verified complaint, together with evidence and any witness affidavits. Its current instructions allow filing personally, by registered mail, by courier, or by authorized electronic means. Review the latest form and requirements on the NPC complaint page before submission.

For privacy complaints, preserve proof that the company received your prior written notice and that 15 calendar days passed without an appropriate response, unless a recognized exception under the NPC rules applies.

Bangko Sentral ng Pilipinas

If the provider is a bank or another BSP-supervised institution, first use the institution’s own consumer-assistance mechanism. If the issue remains unresolved or the institution does not act, escalate it to the BSP Consumer Protection and Market Conduct Office. The BSP’s Circular No. 1169 FAQ explains the consumer-assistance, mediation, and adjudication routes.

Do not assume every lending app is BSP-supervised. Ordinary lending and financing companies are generally under SEC regulation, while banks and specified financial institutions fall under the BSP.

Cybercrime and law-enforcement channels

For threats, impersonation, account compromise, fraudulent demands, doxxing, or other possible crimes, the current joint government advisory lists:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph; (02) 8723-0401 local 7491

The precise criminal offense, if any, depends on the words used, the medium, intent, publication, authenticity of the account, and supporting evidence. An administrative complaint to the SEC or NPC does not automatically replace a police report or criminal complaint.

When help is urgent

Contact the police or emergency services immediately if there is a credible threat of physical harm, stalking, an attempt to enter a home or workplace, extortion, or disclosure that creates an immediate safety risk.

Prompt legal assistance is also advisable when:

Intimate images, altered photographs, identity documents, or home addresses are being threatened with publication.
The collector is impersonating a court, prosecutor, police officer, or government agency.
An actual summons, subpoena, court order, or verified pleading has been received.
Money was taken from an account without authorization.
The app may have compromised email, banking, e-wallet, or social-media credentials.
The lender continues contacting numerous people after receiving a written demand.
A child’s data or other highly sensitive information is involved.
The company cannot be identified or appears to lack authority to operate.
Employment, safety, or reputation is suffering serious and continuing harm.

Do not ignore genuine court papers. Verify them directly with the court or agency named, using independently obtained contact details.

Common mistakes to avoid

Deleting or blocking messages before preserving evidence.
Arguing only by telephone, leaving no written record.
Assuming permission to access contacts means permission to shame or pressure them.
Treating a character reference as automatically liable for the loan.
Believing that abusive collection automatically erases a valid debt.
Paying an unverified personal bank or e-wallet account.
Sending more IDs, selfies, OTPs, or account credentials to a threatening collector.
Posting unredacted screenshots that expose other people’s numbers, IDs, or loan information.
Naming the wrong respondent because the app brand, lender, and collection agency are different entities.
Filing an NPC complaint without first documenting the required written notice and 15-day opportunity to respond, when no exception applies.
Ignoring a real summons because earlier collection messages were deceptive.

Frequently asked questions

Can an online lender call my family or employer?

Not merely because their numbers appear in your contacts. For debt collection, the lender may contact a person who validly and expressly agreed to be a guarantor. An employer, family member, or co-worker does not become liable simply by knowing the borrower or appearing in the borrower’s phonebook.

Can the lender contact my character reference?

Only for legitimate verification connected with the loan application. A character reference is not automatically a guarantor and should not be contacted to demand payment or pressure the borrower.

What if I clicked “Allow contacts” when installing the app?

That does not authorize unlimited copying, retention, disclosure, or harassment. Data processing must remain necessary, lawful, transparent, and proportionate. The lender also cannot rely on supposed borrower consent to justify contacting non-guarantor phonebook entries for collection.

Can a contacted friend or relative complain even if they are not the borrower?

Yes, if their own personal information was improperly obtained, used, or disclosed. They should preserve the messages, tell the company in writing that they are not a borrower or guarantor, request removal of their data, and consider an NPC complaint if the violation is not appropriately addressed.

Does harassment make the loan unenforceable?

Not automatically. The legality of collection conduct and the enforceability or amount of the debt are separate questions. Challenge abusive conduct while obtaining a verified statement of account and addressing any legitimate obligation.

Can I be imprisoned merely because I did not pay an ordinary debt?

The Constitution prohibits imprisonment for nonpayment of debt. That does not prevent lawful civil collection, and separate conduct involving a genuinely supported criminal offense must be assessed on its own facts. Threatening automatic arrest merely to force payment may be deceptive or abusive, especially when no legitimate criminal proceeding exists.

May the lender post my name or photograph online?

Public shaming and disclosure of borrower information are generally prohibited collection practices unless a specific lawful basis or recognized exception applies. Using a borrower’s photograph to harass or embarrass them in collecting a delinquent loan is expressly prohibited by the NPC loan-processing rules.

Should I negotiate with the collector?

You may discuss a verified debt through a documented and reasonable channel. First confirm the collector’s authority, request the account computation, and insist on written terms and official payment instructions. Negotiation does not require tolerating harassment or third-party disclosure.

How quickly must the lender answer before I approach the NPC?

For the NPC’s ordinary exhaustion requirement, the company must be informed in writing and given an opportunity to act. A complaint may ordinarily proceed if the company takes no timely or appropriate action or gives no response within 15 calendar days from receipt. Check the current NPC rules and complaint form because procedural exceptions or additional requirements may apply.

Official references

This article provides general legal information, not individualized legal advice. The proper remedy and possible liability depend on the actual messages, loan documents, parties, regulator, and evidence. Official sources and procedures were checked as of 7 September 2026.