Introduction

One of the most abusive practices associated with online lending applications in the Philippines is the sending of messages to a borrower’s phone contacts. In many cases, the contacts themselves do not owe any money, did not borrow from the lending app, did not consent to be contacted, and may not even know that their names or numbers were accessed by the app.

This situation raises serious legal issues. An online lending app, lending company, financing company, collector, agent, or third-party collection service cannot freely message a person merely because that person appears in a borrower’s contact list. A contact who has no loan obligation is not automatically liable for the borrower’s debt. The contact’s personal information is also protected by law.

In the Philippines, this conduct may involve violations of data privacy law, abusive debt collection rules, cybercrime laws, consumer protection principles, and possibly criminal law, depending on the content and manner of the messages.

This article discusses the rights of a person whose number was messaged by an online lending app despite having no debt, the possible liability of the lender or collector, where to report the abuse, what evidence to preserve, and what legal remedies may be available.

The Common Scenario

A person receives a text message, chat message, call, or social media message from an online lending app or collector saying that a friend, relative, co-worker, neighbor, or acquaintance has an unpaid loan.

The message may say things like:

“Tell this person to pay.”
“You are listed as a reference.”
“You are a guarantor.”
“You will be included in the complaint.”
“You will be visited by collectors.”
“You are responsible because you know the borrower.”
“We will report you if you do not help us collect.”
“Your friend is a scammer.”
“Your relative is hiding from debt.”
“You must tell them to settle today.”
“We will post your name and the borrower’s name online.”
“We will call your office, barangay, or employer.”

The recipient may have no connection to the loan except that their number was saved in the borrower’s phone. In other cases, the recipient may have been falsely labeled as a co-maker, guarantor, reference, or emergency contact without consent.

This is a serious problem because it harms both the borrower and the contacted third person. It exposes personal relationships, spreads debt information, causes embarrassment, creates fear, and misuses personal data.

Key Legal Principle: A Contact Is Not Liable for Another Person’s Debt

A person does not become liable for a loan simply because their name or mobile number appears in someone else’s phone contacts.

Debt liability generally arises from:

A contract signed or accepted by the debtor.
A valid loan agreement.
A lawful guaranty or suretyship agreement.
A co-maker arrangement.
A legal obligation imposed by law.
A court judgment or enforceable obligation.

Mere friendship, family relation, employment connection, or appearance in a contact list does not create liability.

An online lending app cannot lawfully demand payment from a third person who did not borrow, did not guarantee the loan, and did not authorize participation in the transaction.

Contacts Are Not Automatic Guarantors

Some collectors tell contacts that they are “guarantors” or “co-makers” because the borrower listed them or because their number appeared in the borrower’s phone.

This is generally wrong.

A guaranty or suretyship is a legal undertaking to answer for another person’s debt. It cannot be created casually by a lending app harvesting a phone contact list. The alleged guarantor must have knowingly and voluntarily agreed to the obligation.

A person who never signed or accepted a guaranty, never confirmed being a co-maker, and never consented to be responsible for the loan should not be treated as liable.

Contacts Are Not Automatic References

A person may be used as a character reference only if there is a lawful basis to process that person’s personal information. Even if a borrower lists someone as a reference, the lender must still handle the reference’s personal data lawfully, fairly, and proportionately.

A reference is not a debtor. A reference is not a collection agent. A reference is not legally required to pressure the borrower. A reference is not responsible for payment unless the reference separately agreed to be legally bound.

The lender may not use the label “reference” as a license to shame, threaten, or harass.

Why Messaging Contacts Is Legally Problematic

Messaging contacts without debt may be unlawful because it often involves several wrongful acts:

Unauthorized access to contact information

Many lending apps require access to a borrower’s phone contacts. If this access is excessive, forced, unclear, or unrelated to the loan, it may violate privacy principles.
Unauthorized disclosure of debt information

Telling contacts that a borrower has a debt may disclose the borrower’s personal financial information.
Misuse of the contact’s personal data

A third person’s mobile number and name are personal information. Using that data for collection pressure without consent or lawful basis may violate privacy law.
Harassment of third persons

Repeated calls, threats, insults, and pressure may amount to harassment, unjust vexation, or other unlawful conduct.
False representation of liability

Telling a contact that they must pay or will be sued despite no legal obligation may be deceptive or coercive.
Public shaming and reputational harm

Messages accusing the borrower or contact of fraud, theft, or criminal conduct may create liability for defamation or cyber libel if made online.
Abusive debt collection

Debt collection must be lawful. Contacting third persons to shame or pressure the borrower may violate fair collection standards.

Relevant Philippine Laws and Rules

1. Data Privacy Act of 2012

The Data Privacy Act protects personal information and sensitive personal information. A person’s name, mobile number, address, workplace, photo, social media account, and relationship to another person may be personal information.

Online lending apps and collectors that process contact information must comply with data privacy principles, including:

Transparency.
Legitimate purpose.
Proportionality.
Lawful basis.
Data minimization.
Security.
Accountability.

Messaging a contact who has no debt may violate these principles if the app had no proper basis to collect, store, use, or disclose that person’s information.

The Data Privacy Act is especially relevant where the app accessed a borrower’s phone contacts and used those contacts for collection or harassment.

2. SEC Regulation of Lending and Financing Companies

Lending companies and financing companies in the Philippines are generally subject to regulation by the Securities and Exchange Commission. Online lending platforms may also be subject to SEC rules and circulars on registration, disclosure, and unfair or abusive collection practices.

The SEC has acted against online lending apps for abusive collection methods, including shaming borrowers, contacting people in the borrower’s contact list, threatening borrowers, and using unfair collection tactics.

A lending or financing company cannot use debt collection as an excuse to violate privacy, harass third persons, or pressure unrelated contacts.

3. Cybercrime Prevention Act of 2012

If the messages are sent through text, social media, messaging apps, email, websites, or online platforms, cybercrime laws may become relevant depending on the content.

Possible cyber-related issues include:

Online threats.
Identity theft.
Cyber libel.
Computer-related fraud.
Extortion.
Unauthorized access or misuse of information.
Harassment through information and communications technology.

If collectors use fake accounts, automated messages, defamatory posts, phishing links, or threats of online exposure, the matter may be reported to cybercrime authorities.

4. Revised Penal Code

Depending on the facts, the conduct may also implicate criminal law provisions, such as:

Grave threats.
Light threats.
Coercion.
Unjust vexation.
Libel or slander.
Estafa, if deception is involved.
Alarms and scandals, depending on the circumstances.
Usurpation of authority, if the collector falsely pretends to be police, court personnel, or government agent.

For example, a collector who threatens to have a non-debtor arrested unless the borrower pays may be committing unlawful intimidation.

5. Civil Code

The Civil Code may provide remedies for damages where a person’s rights are violated.

Possible civil claims may arise from:

Abuse of rights.
Acts contrary to morals, good customs, or public policy.
Violation of privacy.
Defamation.
Emotional distress.
Damage to reputation.
Interference with employment or business.
Unjustified harassment.

A person harmed by abusive collection messages may potentially claim damages, depending on proof.

Is It Legal for a Lending App to Access Phone Contacts?

Not automatically.

Accessing phone contacts may be lawful only if there is a valid legal basis and the processing is necessary, transparent, and proportionate. However, many lending apps request broad access to a borrower’s entire contact list, which may be excessive.

A borrower’s consent to app permissions does not automatically authorize the lender to harass everyone in the contact list. Consent must be specific, informed, and freely given. Also, the contacts themselves did not necessarily consent to having their personal data collected and used.

Even if the borrower agreed to provide references, the lender must still process the reference’s data lawfully.

Borrower Consent Does Not Automatically Equal Contact Consent

A borrower cannot freely give away the privacy rights of all people saved in the borrower’s phone.

A phone contact list contains personal data of many people who may have no relationship to the loan. The borrower may have saved the numbers of relatives, doctors, lawyers, teachers, employers, clients, co-workers, government offices, children’s schools, or unrelated acquaintances.

If an app uses the borrower’s contact list to send debt messages, it may be processing the personal information of third persons who never dealt with the lender.

This is one of the strongest reasons why messaging contacts without debt may be unlawful.

What If the Contact Was Listed as an Emergency Contact?

Being listed as an emergency contact does not make a person liable for the loan.

An emergency contact is usually someone who may be reached in genuine emergencies or for identity verification. It does not authorize collectors to demand payment, shame the borrower, threaten the contact, or disclose excessive debt details.

If the contact did not consent to being listed, even the use of that person’s information may be questioned.

What If the Contact Was Listed as a Reference?

A reference may be contacted for limited, legitimate purposes if the processing of personal information is lawful. But the lender should not:

Demand payment from the reference.
Threaten the reference.
Repeatedly harass the reference.
Disclose unnecessary debt details.
Ask the reference to shame or pressure the borrower.
Claim the reference is liable without legal basis.
Send defamatory messages.

A reference is not a collection substitute.

What If the Contact Was Listed as a Co-Maker or Guarantor Without Consent?

If a person was falsely listed as a co-maker or guarantor, that person should immediately dispute the obligation in writing.

A co-maker or guarantor relationship generally requires consent. If the person never signed, electronically accepted, verified, or authorized the obligation, the lender should not treat that person as liable.

The person may demand copies of the alleged loan documents, consent records, identity verification records, or electronic confirmation supposedly showing that they agreed. If the lender cannot produce proof, the person may report the matter.

What If the Contact Is a Spouse or Family Member?

Family relationship alone does not automatically make a person liable for another family member’s online loan.

A spouse, parent, sibling, child, cousin, in-law, or relative is not automatically responsible for a borrower’s personal debt unless they signed or legally agreed to be bound, or unless specific property or family law rules apply in a particular situation.

Collectors often exploit family pressure. They may message relatives to embarrass the borrower or force relatives to pay. This conduct may violate privacy and collection rules if abusive.

What If the Contact Is the Borrower’s Employer or Co-Worker?

Messaging an employer or co-worker about a borrower’s debt is especially serious. It may cause humiliation, disciplinary issues, loss of reputation, or even job consequences.

A lending app should not disclose a borrower’s debt to an employer or co-worker merely to pressure payment. The borrower’s employment information and debt status are personal information.

If the collector threatens to report the borrower to HR, spread messages at work, or interfere with employment, the borrower and affected contacts may report the conduct.

What If the Contact Is a Lawyer, Doctor, Teacher, or Client?

If the contact is a professional, client, patient, or person in a confidential relationship with the borrower, messaging them may cause additional harm. It may expose private relationships, confidential associations, or sensitive circumstances.

The lender’s mass messaging of contacts may be grossly disproportionate and may support a privacy complaint.

What If the Contact Is a Minor?

Messaging minors about another person’s debt is highly improper and potentially more serious. Children should not be used as debt collection targets.

If a lending app messages a child, minor student, or young family member, the recipient’s guardian should preserve the evidence and report the matter to the appropriate authorities.

Types of Messages That May Be Illegal or Abusive

The following messages are especially problematic:

Demanding payment from a non-debtor

“You must pay because you are in the borrower’s contacts.”
Claiming legal liability without basis

“You are a guarantor and we will sue you.”
Threatening arrest

“Police will arrest you if the borrower does not pay.”
Threatening public exposure

“We will post your name and photo online.”
Shaming the borrower

“Your friend is a scammer and thief.”
Threatening the workplace

“We will report this to your HR and boss.”
Using insults or profanity

“You and your friend are criminals.”
Sending repeated messages

Constant calls or texts to force action may be harassment.
Impersonating authorities

Pretending to be from a court, police station, NBI, barangay, or law office may be unlawful.
Sending fake legal documents

Fake subpoenas, warrants, complaints, or demand letters may constitute fraud or coercion.

Can an Online Lending App Tell Contacts About the Borrower’s Debt?

Generally, a lender should not disclose a borrower’s debt to unrelated third persons without a lawful basis.

Debt information is personal information. Disclosure must be necessary, proportionate, and lawful. Public shaming or third-party pressure is not a legitimate collection method.

Even if a lender may contact a reference for verification, it should not disclose unnecessary details such as:

Amount borrowed.
Amount overdue.
Penalties.
Allegations of fraud.
Borrower’s financial hardship.
Threats of legal action.
Borrower’s ID, address, or photo.
Screenshots of loan records.

Can the Contact Demand That the Lender Stop Messaging?

Yes. A non-debtor contact may demand that the lender or collector stop contacting them, delete their personal information, and explain the basis for processing their data.

The demand may state:

The recipient did not borrow money.
The recipient did not guarantee the loan.
The recipient did not consent to being contacted.
The messages are unwanted and harassing.
The recipient demands deletion or restriction of their personal data.
Continued messaging may be reported to the NPC, SEC, PNP-ACG, or NBI.

The demand should be polite, direct, and documented.

Sample Message to the Collector

A non-debtor contact may send:

I am not the borrower, co-maker, guarantor, or debtor. I did not consent to be contacted regarding this loan. Please stop messaging or calling me, delete my personal information from your records, and provide the legal basis for processing my name and mobile number. Any further harassment, threats, or disclosure of personal information may be reported to the proper government agencies.

This message should be sent only after screenshots are preserved.

Should the Contact Pay the Loan to Stop Harassment?

A non-debtor should be careful about paying someone else’s debt just to stop harassment. Paying may encourage further demands or be misinterpreted as acknowledgment of responsibility.

If the contact wants to help the borrower voluntarily, that is a personal decision. But legally, a person who has no debt, guaranty, or co-maker obligation should not be forced to pay.

If harassment continues, reporting is usually better than paying under pressure.

What Evidence Should Be Preserved?

Evidence is critical. The recipient should preserve:

Screenshots of all messages.
Sender’s phone number, username, email address, or account name.
Date and time of each message.
Call logs.
Voice recordings, if lawfully obtained and admissible.
Screenshots of threats.
Screenshots of social media posts or comments.
Links to posts, profiles, or pages.
Name of the online lending app.
App store link, if known.
Website URL, if known.
Collector’s claimed company name.
Demand letters or fake legal notices.
Proof that the recipient has no loan.
Proof that the recipient did not consent to be guarantor or co-maker.
Messages sent to other contacts.
Messages sent to employer or workplace.
Any payment demand from the collector.
Bank or e-wallet account details where payment is demanded.
Borrower’s explanation, if available.

The recipient should avoid deleting messages, blocking immediately before capturing evidence, or relying only on memory.

Where to Report

1. National Privacy Commission

The National Privacy Commission is the primary agency for complaints involving misuse of personal information.

Report to the NPC if:

Your number was obtained from someone’s contact list.
You did not consent to be contacted.
Your personal data was used for collection.
The lender disclosed the borrower’s debt to you.
The lender repeatedly messaged or called you.
Your name, number, photo, or social media account was used.
You were included in group chats or public posts.
The app harvested contacts.
The lender refused to stop processing your data.

The NPC complaint should include screenshots, explanation of lack of consent, and identification of the lending app or collector.

2. Securities and Exchange Commission

Report to the SEC if the sender is an online lending app, lending company, financing company, or collector acting for one.

The SEC is relevant if:

The app is unregistered.
The lender uses abusive collection practices.
The lender contacts third persons to shame the borrower.
The lender threatens non-debtors.
The lender misrepresents legal liability.
The lender discloses debt to contacts.
The company operates as a lending or financing business.

The SEC may investigate regulatory violations and impose sanctions on lending or financing companies.

3. PNP Anti-Cybercrime Group

Report to the PNP Anti-Cybercrime Group if the conduct involves cyber threats, online harassment, fake accounts, identity theft, extortion, phishing, cyber libel, or fraudulent representations.

This is especially appropriate if the messages include:

Threats of harm.
Threats of arrest.
Threats to post personal data.
Defamatory statements online.
Fake legal documents.
Attempts to collect money from a non-debtor.
Impersonation of government authorities.

4. NBI Cybercrime Division

The NBI Cybercrime Division may also investigate serious or organized online harassment, identity theft, online fraud, and cyber libel.

A complaint to the NBI may be appropriate if:

Multiple victims are involved.
The app uses fake accounts.
The collector sends coordinated threats.
There is extortion.
The messages involve false criminal accusations.
The sender is difficult to identify.
There is a pattern of online abuse.

5. Barangay or Local Police

If there are immediate threats, harassment, or safety concerns, the recipient may make a barangay or police blotter.

A blotter may help document:

Threats.
Repeated harassment.
Attempts to visit the home or workplace.
Intimidation.
Public shaming.
Disturbance caused by calls or messages.

However, online and privacy-related aspects should still be reported to the proper national agencies.

Who May File the Complaint?

The complaint may be filed by:

The borrower whose contacts were messaged.
The non-debtor contact who received messages.
A group of affected contacts.
A parent or guardian, if the contacted person is a minor.
An authorized representative.
The employer, if workplace harassment occurred.
A person falsely named as guarantor or co-maker.

Both the borrower and the contacted third person may have separate rights because both may have suffered privacy violations.

Rights of the Non-Debtor Contact

A non-debtor contact has the right to:

Refuse to pay a debt they did not incur.
Ask the sender to identify itself.
Demand the legal basis for contacting them.
Demand deletion or restriction of personal data.
Demand that calls and messages stop.
Preserve and submit evidence.
Report to the NPC, SEC, PNP-ACG, or NBI.
Seek damages in proper cases.
Correct false claims that they are a guarantor or co-maker.
Protect their workplace, reputation, and family from harassment.

Rights of the Borrower

The borrower also has rights, even if the borrower has an unpaid loan.

The borrower has the right to:

Lawful and fair collection practices.
Privacy of personal and financial information.
Protection from public shaming.
Protection from threats and harassment.
Proper disclosure of loan terms.
Accurate accounting of loan balance.
Notice of legitimate collection action.
Complaint before government agencies.
Challenge excessive fees, penalties, or unlawful practices.
Demand that contacts not be harassed.

Debt does not erase dignity, privacy, or legal protection.

What If the Borrower Gave the App Permission to Access Contacts?

Even if the borrower tapped “allow contacts” on the app, the lender’s use of the contacts must still be lawful and proportionate.

App permissions are often broad and technical. A borrower may not fully understand that the app will harvest, store, and message contacts. Consent obtained through coercive design, unclear wording, or take-it-or-leave-it access may be questioned.

Also, the contacts themselves generally did not consent.

Therefore, the lender cannot rely on phone permission alone to justify harassment.

What If the Loan Is Real and Unpaid?

Even if the borrower really owes money, abusive contact messaging may still be unlawful.

A legitimate debt does not authorize:

Harassing non-debtors.
Messaging the borrower’s entire contact list.
Disclosing debt to third persons.
Threatening relatives or co-workers.
Posting personal information.
Using insults.
Pretending that non-debtors are liable.
Threatening arrest without basis.

The lender may pursue lawful collection against the debtor, but not unlawful pressure against unrelated persons.

What If There Is No Debt at All?

If the contacted person and the alleged borrower deny any loan, the matter may involve fraud, identity theft, or mistaken identity.

Possible scenarios include:

A scammer is pretending to be a lending app.
Someone used another person’s identity to borrow.
The app has wrong contact data.
The borrower’s phone contacts were harvested from another app.
The recipient’s number was recycled or misidentified.
The collector is mass-messaging random numbers.
The app is fake or unregistered.

In this situation, the recipient should demand proof of the alleged obligation and report suspicious conduct.

What If the Message Says a Case Has Been Filed?

Collectors often threaten legal action. A real case is usually supported by formal notices from proper authorities or courts, not random text threats.

A collector may lawfully say that legal remedies are available if true and stated properly. But it is abusive to send fake case numbers, fake warrants, fake subpoenas, fake police messages, or false claims that a non-debtor will be arrested.

A non-debtor should not panic. They should ask for official documents and verify through proper channels.

Can a Non-Debtor Be Arrested?

A person who did not borrow, did not guarantee the loan, and did not commit fraud cannot be arrested merely because someone else has an unpaid online loan.

Nonpayment of a debt is generally a civil matter. Criminal liability may arise only if there is a separate criminal act such as fraud, falsification, identity theft, or other offense.

Threats of arrest against non-debtors are commonly used to intimidate people. Such threats should be documented and reported.

Can the Lender Go to the Barangay?

A lender or collector may attempt to involve the barangay, but a barangay process does not automatically make a non-debtor liable.

If a non-debtor is summoned or contacted, they may explain that they are not a party to the loan. They should bring evidence showing that they did not borrow or guarantee the loan.

Collectors should not misuse barangay processes to intimidate unrelated contacts.

Can the Lender Contact the Employer?

Contacting an employer to disclose an employee’s debt or pressure payment may be abusive and privacy-invasive.

If the employer receives messages, the employee may:

Ask HR to preserve the messages.
Explain that the matter is personal and that the disclosure was unauthorized.
Request that HR not act on unverified collector messages.
Report the collector to the NPC and SEC.
Include workplace harassment as part of the complaint.

An employer should also be careful not to discipline an employee solely based on collector messages without due process and verification.

Can the Contact Block the Number?

Yes, but evidence should be preserved first.

Before blocking, take screenshots showing:

The sender.
Date and time.
Message content.
Phone number or account.
Any threats or false claims.

After preserving evidence, blocking may help stop harassment. However, if reporting is planned, the recipient should keep all records.

Can the Contact Reply?

A contact may reply once to deny liability and demand that messages stop. The reply should be calm and short. Avoid insults, threats, or admissions.

Do not provide:

OTPs.
IDs.
Address.
Employer details.
Bank information.
Borrower’s new number or location.
Payment.
Personal documents.

Collectors may use any information provided to continue harassment.

Can the Contact Sue for Damages?

A civil claim for damages may be possible if the contact suffered harm due to unlawful messaging, harassment, defamation, privacy violation, or bad faith.

Potential damages may include:

Moral damages for anxiety, humiliation, or distress.
Actual damages if financial loss is proven.
Exemplary damages in serious cases.
Attorney’s fees where justified.

The success of a damages claim depends on evidence, identity of the wrongdoer, proof of harm, and applicable law.

Can the Borrower Sue for Messaging Contacts?

Yes, the borrower may have claims because the lender disclosed the borrower’s debt and personal information to third persons.

The borrower may complain about:

Unauthorized contact harvesting.
Disclosure of debt.
Public shaming.
Harassment of relatives and co-workers.
Defamatory accusations.
Threats.
Abusive collection.
Violation of privacy rights.

The borrower’s unpaid debt, if any, does not excuse unlawful collection methods.

What If the App Is Not Registered?

If the online lending app is not registered or authorized, report it to the SEC. Include:

App name.
Developer name.
Website.
Screenshots.
Messages.
Payment accounts.
Contact numbers.
App store link.
Loan offer screenshots.
Collector messages.

If the app is fake or fraudulent, also report to cybercrime authorities.

What If the App Is Registered?

A registered lending company can still violate the law. Registration is not permission to harass, shame, or misuse personal data.

A complaint may still be filed with:

NPC for privacy violations.
SEC for abusive collection practices.
PNP-ACG or NBI for cyber threats, fraud, extortion, or cyber libel.
Courts or prosecutors where appropriate.

What If the Collector Is a Third-Party Collection Agency?

A lending company may hire a third-party collector, but outsourcing collection does not erase responsibility. The lender may still be accountable for the acts of its agents or service providers, especially if the collector uses data supplied by the lender.

The third-party collector may also be directly liable for harassment, threats, privacy violations, or unlawful collection practices.

Complaints should identify both:

The lending app or company.
The collection agency, if known.

What If the Sender Uses Different Numbers?

Many abusive collectors use multiple numbers to avoid blocking. Preserve each number and message. A pattern of repeated messages from different numbers may show harassment.

The complaint should state that the sender or related collectors used multiple numbers and accounts. Screenshots should be arranged chronologically.

What If the Sender Uses Fake Names or Fake Law Office Accounts?

Collectors sometimes pretend to be lawyers, courts, police, barangay officials, or government personnel. This may be unlawful if false.

The recipient should preserve:

Name used.
Claimed office.
Message content.
Phone number.
Profile photo.
Documents sent.
Threats made.

If the sender claims to be a lawyer or law office, the recipient may ask for complete office details and verify independently. Fake legal threats should be reported.

What If the Collector Creates a Group Chat?

Creating a group chat with borrower contacts to shame the borrower or demand payment may be a serious privacy and harassment issue.

Evidence should include:

Group chat name.
Participants.
Admins.
Messages.
Screenshots of borrower information posted.
Date and time.
Profile links or numbers.
Any threats or insults.

This may support complaints before the NPC, SEC, and cybercrime authorities.

What If the Collector Posts on Facebook or Social Media?

Posting debt-related accusations online may expose the poster to privacy and defamation liability.

Preserve:

URL of the post.
Screenshots showing date, account name, and content.
Comments and shares.
Photos or personal information posted.
Audience visibility.
Profile link of poster.
Any demand for payment.

Do not immediately report the post for takedown before preserving evidence. After evidence is saved, report the content to the platform and to government agencies.

What If the Message Contains the Borrower’s Photo or ID?

Sending a borrower’s photo, ID, address, or personal documents to contacts is highly problematic. It may involve unauthorized disclosure of personal or sensitive information.

The borrower and recipient may both report this to the NPC and other relevant agencies.

What If the Contact’s Own Name Is Posted?

If the non-debtor contact’s name, number, photo, or workplace is posted or shared, the contact may file their own privacy and cybercrime complaint.

The fact that the contact did not borrow money makes the misuse even more unjustifiable.

Can a Lending App Use Shame as Collection Strategy?

No. Debt collection must not rely on humiliation, threats, public exposure, or harassment.

A lender may send lawful demand notices to the borrower, offer restructuring, file a civil action, or use lawful collection channels. But shaming borrowers or contacts is abusive and may violate Philippine law.

Proper Collection Practices

A proper collection process should generally involve:

Communicating directly with the borrower.
Identifying the lender and collector.
Stating the correct loan details.
Providing a clear computation.
Avoiding threats and insults.
Respecting privacy.
Using reasonable contact times.
Not disclosing debt to unrelated third persons.
Not misrepresenting legal consequences.
Using lawful remedies if payment is not made.

Messaging contacts without debt is usually inconsistent with fair collection.

Demand Letter Versus Harassment

A lawful demand letter is different from harassment.

A lawful demand letter:

Identifies the creditor.
Identifies the debtor.
States the amount due.
Provides basis for the debt.
Demands payment within a reasonable period.
States lawful consequences.
Is addressed to the proper debtor or legal representative.
Avoids threats, insults, and false statements.

Harassment includes:

Sending messages to unrelated contacts.
Repeated abusive calls.
Threats of arrest.
Public shaming.
False accusations.
Disclosing debt to employers.
Insults and profanity.
Fake legal documents.
Threatening family members.

Data Privacy Rights Involved

A person whose information is processed by a lender may have rights under data privacy principles, including the right to:

Be informed how personal data was obtained.
Know the purpose of processing.
Object to unlawful processing.
Request deletion or blocking of data where appropriate.
Correct inaccurate data.
File a complaint.
Seek damages in proper cases.

A non-debtor contact may ask the lender: “How did you get my number, and what is your legal basis for processing it?”

The Right to Object

A non-debtor contact may object to processing of their personal data for debt collection, especially where they have no relationship to the loan.

The objection should be documented. If the lender continues messaging after objection, that strengthens the complaint.

The Right to Erasure or Blocking

A non-debtor may request deletion or blocking of their personal data from the lender’s collection database, subject to applicable rules.

The lender should not keep using the contact’s number for collection if there is no lawful basis.

The Right to Damages Under Privacy Law

A person who suffers damage due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal data may seek remedies under privacy law, depending on proof and procedure.

Damage may include emotional distress, reputational harm, financial loss, or other injury.

Special Concern: Contact Harvesting

Contact harvesting occurs when an app collects large numbers of contacts from a user’s phone and stores or uses them for business purposes.

This is especially concerning because:

Contacts did not deal with the lender.
Contacts did not consent.
The app may collect unnecessary data.
The data may include minors, professionals, clients, or strangers.
The data may be used for harassment.
The borrower may not understand the extent of collection.
The app may transfer data to third-party collectors.

Contact harvesting by online lending apps is a major privacy concern in the Philippines.

Is “Legitimate Interest” a Defense?

A lender may claim legitimate interest in collecting debts. However, legitimate interest is not unlimited.

Even if a lender has a legitimate interest in collecting from the borrower, that does not automatically justify messaging unrelated contacts, disclosing debt, threatening third persons, or using harvested contact lists.

Any processing must still be necessary and proportionate. Harassing non-debtors is difficult to justify as proportionate.

Is “Consent” a Defense?

The lender may claim that the borrower consented by accepting app terms. But this defense may fail or be weakened if:

Consent was bundled with app use.
The borrower had no meaningful choice.
The terms were vague.
Contacts did not consent.
The app collected excessive data.
The use was for harassment.
The lender disclosed debt unnecessarily.
The processing exceeded what was explained.
The contact objected and the lender continued.

Consent cannot legitimize abusive, unlawful, or disproportionate processing.

Is “Debt Collection” a Defense?

Debt collection may be a legitimate activity, but it must be done lawfully. The existence of a debt does not permit privacy violations, defamation, threats, or harassment.

A lender should pursue the debtor through lawful channels, not by coercing unrelated people.

Effect on the Borrower’s Reputation

Messaging contacts can damage the borrower’s reputation by making friends, family, co-workers, clients, or employers believe the borrower is dishonest or criminal.

If the message contains false statements, insults, accusations of crime, or public posts, the borrower may consider defamation-related remedies.

Effect on the Contact’s Peace and Privacy

A non-debtor contact may suffer fear, anxiety, embarrassment, workplace disturbance, or family conflict. These harms are legally relevant, especially when messages are repeated, threatening, or public.

The contact should document not only the messages but also their effects, such as workplace reports, HR inquiries, family distress, or missed work.

What Employers Should Do If Collectors Message the Workplace

If a company receives messages from a lending app about an employee’s debt, the employer should:

Preserve the message.
Avoid disclosing additional employee information.
Avoid disciplining the employee based only on collector allegations.
Inform the employee privately.
Block or report abusive numbers if needed.
Remind staff not to engage with collectors.
Protect employee privacy.
Cooperate only with lawful processes.

Employers should not become collection agents for online lending apps.

What Borrowers Should Do If Contacts Are Messaged

The borrower should:

Ask contacts to send screenshots.
Preserve all messages from the app.
Identify the app and collector.
Check whether the app accessed contacts.
Revoke app permissions if possible.
File complaints with NPC and SEC.
Report threats to PNP-ACG or NBI.
Avoid responding with insults or threats.
Demand that the lender stop contacting third persons.
Seek legal advice if messages are defamatory or severe.

What Non-Debtor Contacts Should Do

A contacted person should:

Preserve evidence first.
Do not pay unless there is a real legal obligation.
Do not give personal information.
Do not provide the borrower’s location or employer.
Send one written denial and stop-contact demand if appropriate.
Block after saving evidence.
Report to NPC if personal data was misused.
Report to SEC if a lending app or collector is involved.
Report to cybercrime authorities if threats or fraud are present.
Tell family or workplace not to engage if harassment continues.

Sample Complaint Narrative

A complaint may state:

I received messages from an online lending app or collector regarding an alleged debt of another person. I am not the borrower, guarantor, co-maker, or debtor. I did not consent to be contacted for this loan. The sender disclosed debt information, demanded that I contact or pressure the alleged borrower, and threatened further action. I believe my mobile number was obtained from the borrower’s contact list or other unauthorized source. I request investigation for unlawful processing of personal information, abusive debt collection, harassment, and other violations.

Attach screenshots and supporting evidence.

Sample Demand to the Lending App

Subject: Demand to Stop Unlawful Contact and Delete Personal Data

To the Lending App / Collection Agency:

I received messages from your company regarding an alleged loan of another person. I am not the borrower, co-maker, guarantor, or debtor. I did not consent to be contacted regarding this loan, and I do not consent to the continued processing of my personal information for debt collection.

Please immediately stop calling or messaging me, delete or block my personal information from your collection database, and provide the legal basis for obtaining and using my name and mobile number.

Any further harassment, threats, disclosure of personal information, or false claim of liability may be reported to the National Privacy Commission, Securities and Exchange Commission, PNP Anti-Cybercrime Group, National Bureau of Investigation, and other proper authorities.

This is without prejudice to my rights and remedies under Philippine law.

Sample Demand by Borrower

Subject: Demand to Stop Messaging My Contacts

To the Lending App / Collection Agency:

I demand that you immediately stop contacting, messaging, calling, or harassing persons in my phone contacts, family, workplace, or social network regarding my alleged loan.

Your disclosure of my alleged debt to third persons and your use of my contacts for collection are unauthorized, excessive, and abusive. Any legitimate collection should be directed to me through lawful means.

Please confirm in writing that you have stopped contacting third persons and have deleted or restricted any unlawfully collected contact information.

This is without prejudice to my right to file complaints with the proper authorities.

Possible Remedies

Depending on the facts, remedies may include:

Complaint before the National Privacy Commission.
Complaint before the Securities and Exchange Commission.
Cybercrime complaint before PNP-ACG.
Cybercrime complaint before NBI.
Barangay or police blotter for threats.
Civil action for damages.
Criminal complaint for threats, coercion, unjust vexation, libel, or related offenses.
Takedown request to social media platforms.
Demand for deletion of personal data.
Demand for correction of false information.
Complaint against a collection agency.
Complaint against an unregistered lending app.

Possible Penalties or Consequences for the Lender

Depending on the agency and violation, a lender or collector may face:

Administrative fines.
Suspension or revocation of authority.
SEC sanctions.
NPC orders and penalties.
Takedown or blocking of app operations.
Criminal investigation.
Civil damages.
Public advisories.
Liability of officers, agents, or processors.
Reputational consequences.
Orders to stop unlawful processing.

The exact consequence depends on the evidence and legal findings.

How to Strengthen a Complaint

A complaint is stronger when it includes:

Clear screenshots.
Multiple examples of messages.
Proof that the recipient is not a debtor.
Proof of lack of consent.
Sender number or account.
App name and company name.
App store link or website.
Payment account details, if any.
Chronological timeline.
Names of other affected contacts.
Proof of workplace or family impact.
Proof of public posts.
Prior stop-contact demand.
Continued messages after objection.

A single vague allegation is weaker than a documented pattern.

What Not to Do

A recipient should avoid:

Paying without verifying legal obligation.
Sending IDs to the collector.
Giving OTPs or passwords.
Giving the borrower’s new number or address.
Threatening the collector.
Posting private information of the collector online.
Deleting evidence.
Ignoring serious threats.
Signing any acknowledgment of debt.
Admitting liability.
Clicking suspicious links.
Installing apps sent by the collector.
Sending money to personal accounts without verification.

Frequently Asked Questions

Am I liable because my number was in the borrower’s contacts?

No. Being in someone’s contact list does not make you liable for their loan.

Can the lending app force me to pay?

No, unless you are actually a borrower, co-maker, guarantor, or otherwise legally bound. The lender must prove your obligation.

Can they message me to tell the borrower to pay?

They should not use you as a collection tool, especially if you did not consent and have no legal obligation.

Can they disclose the borrower’s debt to me?

Unnecessary disclosure of debt information to third persons may violate privacy and collection rules.

What if I was listed as a reference without consent?

You may deny consent, demand that they stop contacting you, and report misuse of your personal data.

What if I was falsely listed as a guarantor?

Demand proof of your alleged guaranty. If you never agreed, dispute liability and report the false claim.

Can I block the number?

Yes, but preserve screenshots and call logs first.

Where should I report?

For privacy misuse, report to the NPC. For abusive lending practices, report to the SEC. For threats, fake accounts, extortion, or cyber harassment, report to PNP-ACG or NBI.

Can the borrower report even if they owe money?

Yes. A borrower may report abusive collection and privacy violations even if the debt exists.

Can a lender contact my employer?

A lender should not disclose debt to an employer merely to pressure payment. This may be abusive and privacy-invasive.

Can they post my name online?

Posting names, photos, debt details, or accusations online may create privacy, cybercrime, or defamation liability.

Is nonpayment of an online loan a criminal case?

Nonpayment alone is generally civil. Fraud or falsification may be different. Threats of arrest are often abusive if baseless.

What if the app is unregistered?

Report it to the SEC and, if fraud or threats are involved, to cybercrime authorities.

Practical Checklist for Non-Debtor Contacts

A non-debtor contact should prepare:

Screenshot of the message.
Sender’s number or account.
Date and time received.
Name of the app or company.
Content of threats or demands.
Proof of no loan or no consent.
Any claim that you are a guarantor or co-maker.
Stop-contact demand, if sent.
Proof of continued harassment.
Other affected contacts, if known.
Workplace impact, if any.

Practical Checklist for Borrowers

A borrower whose contacts were messaged should prepare:

Loan app name.
Loan documents or app screenshots.
App permissions screenshot.
Privacy policy or terms, if available.
Messages received by borrower.
Messages received by contacts.
List of contacts affected.
Proof of disclosure of debt.
Threats or defamatory statements.
Payment records.
Loan computation.
Stop-contact demand.
Complaints filed.

Key Principles

The key principles are:

A contact is not liable for another person’s debt.
Being in a phone contact list does not create a loan obligation.
A guaranty or co-maker obligation requires consent.
Debt collection must be lawful and respectful.
Debt information should not be disclosed unnecessarily to third persons.
Personal data of contacts is protected by privacy law.
Borrower consent does not automatically waive contact privacy rights.
Harassment, threats, and public shaming may be actionable.
Registered lenders can still violate the law.
Unregistered lending apps should be reported.
The NPC, SEC, PNP-ACG, and NBI may all be relevant depending on the facts.
Evidence preservation is essential.

Conclusion

In the Philippines, an online lending app or collector should not message, threaten, shame, or pressure a person who has no debt merely because that person appears in a borrower’s phone contacts. A non-debtor contact is not automatically a guarantor, co-maker, reference, or collection agent. Liability for a loan must arise from a valid legal obligation, not from a harvested contact list.

The practice of messaging contacts without debt raises serious issues under data privacy law, lending regulation, cybercrime law, and general civil and criminal principles. It may involve unauthorized processing of personal information, disclosure of debt to third persons, abusive collection, harassment, coercion, or defamation.

Both the borrower and the contacted third person may report the conduct. The National Privacy Commission is the main agency for personal data misuse. The Securities and Exchange Commission is relevant for abusive lending and collection practices. The PNP Anti-Cybercrime Group and NBI Cybercrime Division are appropriate where threats, online harassment, fake accounts, extortion, identity theft, or cyber libel are involved.

The best immediate response is to preserve evidence, avoid paying or admitting liability, send a clear stop-contact demand if appropriate, and file complaints with the proper agencies. Debt collection must remain lawful. No lender has the right to turn a borrower’s private contact list into a weapon for harassment.