When an online lending app starts texting your relatives, coworkers, employer, or other people in your phone because you missed a payment, this is not simply “normal collection.” Philippine regulators expressly prohibit lenders from using a borrower’s contact list as a pressure network. The law distinguishes between someone who is merely saved in your phone, a character reference used for verification, and a guarantor who expressly agreed to answer for the debt. This guide explains what collectors may legally do, how to preserve evidence before deleting the app, where to complain, and what happens to the underlying loan.

In a joint advisory dated 18 March 2026, the Department of Information and Communications Technology, National Privacy Commission, and Securities and Exchange Commission warned online lending platforms against harassment, intimidation, public shaming, unnecessary app permissions, and unauthorized or disproportionate use of borrowers’ contacts. Most importantly, the advisory states that lenders may not contact people in a borrower’s contact list for debt collection unless the person is an actual guarantor.

Can an Online Lending App Legally Access Your Contacts?

Access to your phone contacts is not automatically lawful just because you clicked “Allow” while applying for a loan.

Under NPC Circular No. 2022-02 on loan-related transactions, an online lending app may request only permissions that are suitable, necessary, and not excessive for a clearly stated purpose. Permission should be requested at the point when the information is actually needed, with a clear “just-in-time” explanation of what will be collected and why.

Limited contact access may be allowed, for example, to let you select a specific character reference or guarantor. An app may also process carefully limited and proportionate metadata for a legitimate, disclosed purpose. What it cannot do is copy, retain, analyze, or message your entire address book without a lawful and proportionate reason.

The NPC calls excessive or unrestricted use of contact information unbridled processing. This includes using your contacts to harass you, shame you, pressure third parties to collect from you, or pursue people who never agreed to guarantee your loan. Access should also be withdrawn when the stated purpose has already been completed.

Character Reference vs. Guarantor

These roles are legally different.

Person contacted	What the lender may generally do	What the lender may not do
Someone merely saved in your contacts	Nothing merely because the number appears in your phone	Reveal your debt, demand payment, threaten, shame, or repeatedly contact the person
Character reference	Contact the person for limited identity or credibility verification, provided proper notice and consent requirements are observed	Treat the reference as liable for the loan or use the person for debt collection
Guarantor	Contact the person concerning payment if the guarantor separately and expressly agreed to answer for the debt	Assume guaranty merely because the borrower entered the person’s name or number
Co-borrower or surety	Enforce obligations actually stated in the signed agreement	Impose obligations beyond the contract or use abusive collection methods

A character reference helps verify information about an applicant. A reference is not automatically a co-borrower or guarantor and may request removal of their information where continued processing is no longer justified.

A guarantor, under Article 2047 of the Civil Code, is a person who binds themselves to fulfill the borrower’s obligation if the borrower fails to pay. Article 2055 states that a guaranty is not presumed: it must be express and cannot extend beyond what was agreed. The fact that you typed your mother’s, friend’s, or coworker’s number into an app does not, by itself, make that person legally responsible for your loan.

Your Rights Under Philippine Law

Data Privacy Act of 2012

The Data Privacy Act of 2012, or Republic Act No. 10173, requires personal information to be processed according to three basic principles:

Transparency: You must be told what information is being collected, why it is needed, how it will be used, and to whom it may be disclosed.
Legitimate purpose: The purpose must be lawful and specifically declared.
Proportionality: The lender must not collect or use more information than is reasonably necessary.

Giving an app permission does not authorize every possible use of your contacts. Consent must be informed and connected to a specific purpose. A blanket statement hidden in lengthy terms and conditions does not necessarily justify copying your address book and sending collection messages to dozens of people.

You may also request information about the data collected, its source, the purposes of processing, and the persons or organizations that received it. Depending on the circumstances, you may seek correction, blocking, deletion, or destruction of information that is unlawfully obtained, outdated, false, or no longer necessary.

Possible Data Privacy Act offenses may include unauthorized processing, processing for unauthorized purposes, malicious disclosure, and unauthorized disclosure. Criminal liability is not automatic; it depends on the evidence, the people responsible, the information involved, and the purpose for which it was processed or disclosed. (Lawphil)

SEC Rules Against Unfair Debt Collection

Lending and financing companies, including their employees and third-party collection agencies, are subject to SEC rules against unfair debt collection. SEC Memorandum Circular No. 18, Series of 2019 prohibits abusive practices such as threats of violence or criminal action, attacks on a borrower’s reputation or property, and threats to take actions that cannot legally be taken.

The March 2026 joint advisory specifically identifies harassment, intimidation, public shaming, and unauthorized contact-list use as prohibited conduct. A lender remains responsible for collection activities carried out through its employees, agents, or outsourced collection service providers. (SEC Appointment System)

Financial Consumer Protection Act

The Financial Products and Services Consumer Protection Act, or Republic Act No. 11765 of 2022, recognizes financial consumers’ rights to:

Equitable and fair treatment
Disclosure and transparency
Protection against fraud and misuse
Data privacy and protection
Timely handling and redress of complaints

The law gives financial regulators, including the SEC, authority to investigate market conduct, impose penalties, issue cease-and-desist orders, restrict operations, and provide complaint-handling or adjudication mechanisms within their jurisdiction.

You Cannot Be Imprisoned Merely for Unpaid Debt

Article III, Section 20 of the 1987 Constitution provides that no person shall be imprisoned for debt or nonpayment of a poll tax. A collector cannot obtain an arrest warrant simply because you missed an online loan payment.

A legitimate creditor may file a civil collection case, including a small claims case when the claim falls within the applicable jurisdictional limit. Fraud, estafa, or a violation involving a dishonored check is different: those require separate facts and legal elements. Mere financial difficulty or inability to pay does not automatically become a criminal offense. (Lawphil)

Threats and Public Shaming May Create Separate Liability

Depending on the exact language and conduct, collectors may potentially expose themselves to complaints involving:

Grave threats or other threats under Articles 282 to 285 of the Revised Penal Code
Grave coercion under Article 286
Oral defamation under Article 358
Libel under Articles 353 and 355
Cyberlibel under Republic Act No. 10175 when defamatory material is communicated through a computer system
Civil damages under Articles 19, 20, and 21 of the Civil Code for abuse of rights or conduct contrary to law, morals, good customs, or public policy

Not every rude message satisfies the elements of a crime. Preserve the exact words, images, recipients, dates, and circumstances so investigators can properly classify the conduct. (Lawphil)

What to Do When a Lending App Accesses or Messages Your Contacts

1. Preserve Evidence Before Uninstalling the App

Do not immediately delete everything in panic. First, capture evidence that identifies the app, lender, collector, and conduct.

Save the following:

Screenshots of the app’s name, developer, app-store page, version, and privacy notice
The operator’s corporate name, office address, email address, and SEC details shown in the app
Screenshots of every permission requested or granted
Loan agreement, disclosure statement, promissory note, repayment schedule, and statement of account
Proof of amounts received and payments already made
Collection texts, chat messages, emails, social-media messages, and call logs
The collector’s phone numbers, usernames, profile links, and claimed company
Screenshots sent by relatives, coworkers, employers, or friends
Dates and times when each person was contacted
Any message falsely claiming that a warrant, criminal case, court order, or public posting already exists

Keep the original files. Avoid cropping away phone numbers, timestamps, usernames, or message headers. Make a separate backup in cloud storage, email, or another device.

Ask each contacted person to preserve the original message on their own phone. A short written statement describing when and how they were contacted may later support an SEC, NPC, police, or prosecutor’s complaint.

2. Revoke Unnecessary Permissions

After preserving the permission screens and other evidence, open your phone settings and remove the app’s access to information it no longer needs, including:

Contacts
SMS
Call logs or phone functions
Photos and files
Location
Camera
Microphone

Revoking permission may stop future access, but it cannot retrieve information already copied to the lender’s servers. That is why a written deletion, blocking, and disclosure request is also important.

Secure the email account, mobile number, e-wallet, or bank account connected to the loan. Change reused passwords and PINs, enable two-factor authentication, and check for unfamiliar transactions or account-recovery requests.

3. Send a Written Stop-Contact and Data-Privacy Notice

Use an official customer-service, compliance, or data-protection email shown in the loan agreement, privacy notice, or company website. Keep proof that the message was sent.

A practical notice may state:

I dispute and object to the collection and use of my phone contacts for debt collection. Stop contacting any person other than me and any individual who separately and expressly agreed to be a guarantor.

Please identify the lender’s full corporate name, SEC registration and Certificate of Authority details, the collection agency involved, the personal information obtained from my device, the source and purpose of processing, and every person or organization to whom the information was disclosed.

Block or delete contact-list information that is unnecessary or unlawfully processed, preserve all relevant access and disclosure logs, and confirm in writing what action has been taken. Please send a complete statement of account and communicate with me only through this written channel.

Giving a specific response period, such as three to five business days, creates a clear record. It is not necessary to wait for that period when there is a credible threat of violence, extortion, hacking, or immediate harm.

The NPC’s complaint form generally asks whether you first contacted the respondent in writing or, if not, why doing so was impractical. Your email and the lender’s response—or failure to respond—can therefore become important evidence.

4. Tell Your Contacts Not to Pay or Negotiate for You

Send a calm, factual message to people who were contacted:

I did not authorize this lender to collect from you. You are not responsible unless you separately signed as a co-borrower or guarantor. Please save the original message and screenshots, do not send money or personal information, and block or report the account after preserving the evidence.

Avoid posting unverified accusations publicly. Keep the evidence for regulators and investigators. Public posts naming individuals or companies can create unnecessary defamation disputes, particularly when the identity of the collector has not been confirmed.

5. Keep One Controlled Channel for Legitimate Loan Communications

You may block abusive numbers after saving the evidence. However, it can be useful to retain one written channel—such as email—through which the lender may provide:

A verified statement of account
A breakdown of principal, interest, penalties, and fees
A settlement or restructuring proposal
Confirmation that third-party contact has stopped
The identity and authority of the collection agency

Do not pay a collector through a personal e-wallet or bank account merely because the person is threatening you. Confirm the official payment channel through the lender’s contract, verified website, or customer-service office.

6. Verify Whether the Lender Is Authorized

A company’s appearance in an app store does not prove that it is legally authorized to lend.

Under the Lending Company Regulation Act of 2007, or Republic Act No. 9474, a lending company must obtain authority from the SEC. Corporate registration alone is not necessarily the same as a Certificate of Authority to operate as a lending company.

Check the operator through the SEC Check with SEC portal and compare the corporate name with the name appearing in the agreement, payment instructions, privacy notice, and collection messages. If the names do not match or the lender’s authority is unclear, include that issue in your SEC complaint. The 2026 joint advisory advises borrowers to use verified sources operated by duly registered and licensed entities. (Lawphil)

7. Continue Separating the Debt Issue from the Harassment Issue

Harassment does not automatically cancel a valid loan. At the same time, owing money does not waive your privacy or permit collectors to threaten or shame you.

Request a complete written computation before agreeing to payment. Check:

The amount actually released to you
Principal balance
Contractual interest
Service, processing, or platform fees
Late-payment charges
Previous payments and credits
The basis for any collection fee

Pay only amounts supported by the agreement and applicable law. If you dispute the computation, state which charges you dispute without falsely denying a loan you actually obtained.

Where to Report Online Lending App Harassment

Different agencies handle different parts of the problem. You may file with more than one agency when the conduct overlaps.

Problem	Where to report	Practical filing route
Unfair collection, public shaming, abusive third-party contact, or questions about the lender’s authority	Securities and Exchange Commission	File through the SEC iMessage portal. Select the Financing and Lending Companies Department, Legal and Enforcement Division, and the complaint category for financing or lending companies
Unauthorized contact access, debt disclosure, excessive data collection, or refusal to honor privacy rights	National Privacy Commission	Use the NPC complaint procedure and the current Complaint-Affidavit form
Threats, extortion, impersonation, scams, account compromise, or cyber harassment	PNP Anti-Cybercrime Group or NBI Cybercrime Division	Preserve electronic evidence and prepare to execute a sworn statement; urgent physical threats should also be reported to the nearest police station or through emergency services
Cybersecurity incident or suspicious app activity	DICT Cyber Hotline	The 2026 advisory lists 1326@dict.gov.ph as a reporting channel
Civil damages or criminal prosecution	Prosecutor’s office or appropriate court	A sworn complaint, witness statements, device evidence, and authenticated records may be required

The March 2026 advisory lists the SEC hotline as 1-4732, the NBI Cybercrime Division at ccd@nbi.gov.ph, and the PNP Anti-Cybercrime Group at acg@pnp.gov.ph. Contact details can change, so confirm them through the agencies’ official websites before filing.

A barangay blotter can help document incidents involving local threats or visits, but barangay proceedings are not a substitute for an SEC, NPC, police, or cybercrime complaint. You do not need barangay conciliation before submitting an administrative complaint to the SEC or NPC.

How to File a Formal NPC Complaint

A formal privacy complaint generally requires more than sending screenshots to an information email.

Download and complete the current NPC Complaint-Affidavit.
Identify the borrower or other affected person as complainant.
Identify the app operator, lending company, collection agency, and known individuals as respondents where the evidence supports doing so.
Describe the personal information processed, such as names, phone numbers, relationships, workplace information, photographs, or loan details.
Provide a chronological account of permission access, messages, disclosures, and written objections.
Attach your evidence and a valid government-issued ID.
Explain whether you contacted the respondent in writing and attach the correspondence.
Sign the complaint under oath and have it notarized.
Submit it personally, by courier, or by email to complaints@privacy.gov.ph following the instructions on the NPC website.
Retain complete copies and proof of submission.

Failure to attach evidence supporting the allegations may result in outright dismissal. The complaint also includes a certification against forum shopping, which requires disclosure of other cases involving the same issues. (National Privacy Commission)

NPC Filing Fees

The NPC’s published fee schedule provides for a basic complaint filing fee of ₱500. Additional fees may apply when monetary damages are claimed, based on the amount demanded. Qualified indigent complainants may seek exemption by submitting the required proof, such as a barangay indigency certificate and supporting affidavits or property information. Confirm the assessment with the NPC because payment instructions and fee schedules may be updated.

Filing From Abroad

An OFW or non-resident Filipino may submit a complaint without immediately traveling to the Philippines. Under NPC procedural rules, a non-resident citizen without a Philippine representative may have the complaint notarized at a Philippine Embassy or Consulate, or use an apostille from the country of origin where applicable.

Foreign nationals whose data was processed in connection with a Philippine lending operation may also invoke Philippine privacy and consumer-protection processes when the transaction and respondent fall within Philippine jurisdiction. Documents in another language should be accompanied by a reliable English or Filipino translation when requested. (National Privacy Commission)

Evidence Checklist

Evidence	Why it matters
Loan agreement and disclosure statement	Establishes the lender, loan terms, borrower, and payment obligations
App-store listing and privacy notice	Identifies the developer, representations, and declared data-processing purposes
Permission screenshots	Shows whether the app requested contacts, SMS, call logs, files, location, or other information
Messages sent to the borrower	Proves threats, insults, false legal claims, or repetitive harassment
Messages sent to contacts	Proves third-party disclosure and use of the contact list
Full screenshots with timestamps and numbers	Helps authenticate who sent what and when
Statements from contacted persons	Confirms receipt, effect, and surrounding circumstances
Payment records and statement of account	Separates a legitimate balance from disputed or unexplained charges
Written objection sent to the lender	Shows that the lender was notified and given an opportunity to correct the violation
SEC verification results	Helps determine whether the operator is registered and authorized
Police or barangay report	Creates a contemporaneous record of threats or in-person incidents

Do not secretly record private telephone conversations without careful legal consideration. Republic Act No. 4200, the Anti-Wiretapping Act, generally prohibits secretly recording a private communication without authorization from all parties. Preserve voicemail, written messages, call logs, and recordings that were lawfully made instead. (Lawphil)

Common Online Lending Harassment Scenarios

The Collector Texted My Employer

An employer is not responsible for an employee’s personal loan unless the employer separately entered into a lawful agreement. Sending debt details to supervisors or coworkers to embarrass the borrower may constitute prohibited third-party disclosure, unfair collection, and a privacy violation.

Ask the employer or HR officer to preserve the original communication. A brief certification identifying the number, date, recipients, and content may later help prove the disclosure.

My Relative Was Listed Only as a Reference

A reference may be contacted for limited verification, but cannot be treated as a guarantor or collection target. The relative may send their own written objection and request removal of their information. Because the relative’s personal data was also processed, they may independently file a privacy complaint.

The Collector Says Police Are Coming to Arrest Me

A private collector cannot issue a warrant, order the police to arrest you, or declare you criminally liable. Warrants are issued by courts under legally prescribed conditions. Save the exact statement and verify any claimed case directly with the named court or government office rather than through a telephone number supplied by the collector.

The App Already Copied My Contacts Before I Revoked Permission

Revoking access prevents or limits new access but does not necessarily delete information already uploaded. Demand written disclosure of the information obtained, its recipients, retention period, and deletion or blocking of unnecessary data.

The lender may lawfully retain information needed to administer the loan, establish legal claims, comply with recordkeeping obligations, or defend a case. It does not follow that the lender may indefinitely retain an entire contact list or continue using it for harassment. The 2026 advisory requires retention only for as long as necessary for the declared lawful purpose, followed by secure disposal.

The Collection Agency Says It Is Not Responsible for the App’s Conduct

Include both the lending company and collection agency in your complaint when the evidence connects them. Request the collector’s authority, agency agreement details, corporate identity, and the name of the lender that supplied the account and personal information.

A lender generally cannot avoid regulatory responsibility simply by outsourcing collection to another company.

Frequently Asked Questions

Can a lending app legally require access to all my contacts?

Not as a blanket condition without necessity and proportionality. Access must be connected to a specific, lawful, and disclosed purpose. Unrestricted copying or use of the entire contact list is prohibited.

Can collectors text my family and friends about my debt?

Generally, no. They may not contact people in your contact list for collection merely because those people know you. For debt collection, the NPC rules allow contact with an actual guarantor who expressly agreed to that role.

Is a character reference responsible for my loan?

No. A reference does not become liable simply because you entered their name and number. A guaranty must be express and cannot be presumed.

Can collectors post my photo and debt on Facebook?

Publicly posting your identity, photograph, debt, or accusations to shame you may violate privacy, unfair collection, and defamation laws. Preserve the post, its URL, account details, date, comments, and audience before reporting it.

Should I uninstall the lending app immediately?

First preserve evidence, including the app identity, permissions, agreement, and messages. Then revoke unnecessary permissions, secure connected accounts, and uninstall the app when you no longer need it for evidence or legitimate account access.

Does harassment mean I no longer have to repay the loan?

No. A valid debt may remain payable even when the collection method is unlawful. Challenge unexplained charges, demand a proper statement, and address the debt separately from the harassment complaint.

Can I block the collector?

Yes, after saving the evidence. Retaining one official written channel can be useful for statements of account, settlements, and proof that you requested an end to third-party contact.

Can the people in my contacts file their own complaints?

Yes. A person whose number, identity, workplace, relationship, or other personal information was collected or disclosed may have an independent privacy complaint, even though they were not the borrower.

What if the app is operated from outside the Philippines?

Report the app to the SEC, NPC, app store, and cybercrime authorities. Include evidence connecting it to Philippine borrowers, payment channels, representatives, phone numbers, or business operations. Cross-border enforcement may take longer, but a foreign address does not automatically remove Philippine jurisdiction where the transaction or data processing has a substantial Philippine connection.

How quickly will the SEC or NPC resolve my case?

There is no single guaranteed period for final resolution. Complete complaints with clearly identified respondents, organized evidence, proof of prior written objection, and accurate contact details are less likely to be delayed by requests for clarification. Immediate threats should be reported to police or cybercrime authorities without waiting for an administrative investigation.

Key Takeaways

A lending app cannot lawfully use your entire contact list to pressure or shame you.
Collectors may contact an actual guarantor, but not ordinary contacts or character references for debt collection.
A guaranty must be separately and expressly agreed; it cannot be created merely by entering someone’s phone number.
Preserve screenshots, permission records, contracts, call logs, and messages before revoking access or uninstalling the app.
Send a written demand to stop third-party contact and request disclosure, blocking, or deletion of unlawfully processed information.
Report unfair collection to the SEC and privacy violations to the NPC; report threats, extortion, scams, or account compromise to cybercrime authorities.
You cannot be imprisoned merely for unpaid debt, although a creditor may pursue lawful civil collection.
Harassment does not automatically erase a valid loan, but owing money never gives a collector the right to threaten, shame, or unlawfully expose your personal information.