Receiving messages from an online lending app threatening to call your employer, shame you in a family group chat, or tell relatives that they must pay your loan can feel frightening and humiliating. Even when a debt is valid and overdue, a lender does not gain the right to threaten, deceive, publicly shame, or indiscriminately contact people in your phone. Philippine law allows legitimate collection efforts, but it places clear limits on how lenders and collection agents may use personal data and communicate with borrowers, employers, relatives, character references, and guarantors.

Can an online lending app contact your employer or relatives?

As a debt-collection tactic, an online lending platform generally cannot contact people in your phone other than a person who knowingly and expressly agreed to be a guarantor or co-maker.

The March 18, 2026 joint advisory of the Securities and Exchange Commission (SEC), National Privacy Commission (NPC), and Department of Information and Communications Technology (DICT) specifically states that contacting people in a borrower’s contact list—other than a named guarantor—for debt collection is prohibited. It also treats threats against a person, reputation, or property, and threats to take an action that cannot legally be taken, as unlawful collection conduct.

This means a collector should not:

Tell your supervisor, human resources department, co-workers, clients, or business partners that you have an unpaid loan merely to pressure you.
Message your parents, siblings, spouse, children, friends, or acquaintances demanding payment when they are not guarantors or co-makers.
Announce your alleged debt in a group chat, social-media post, workplace page, or community group.
Falsely claim that a character reference is a “co-maker” or “guarantor.”
Threaten to have you arrested merely because you could not pay an ordinary loan.
Threaten to file a criminal case that has no legal basis.
Use insults, obscenities, edited photos, fake wanted posters, or accusations such as “scammer” or “fraudster” to embarrass you.
Send messages before 6:00 a.m. or after 10:00 p.m., subject to limited exceptions under SEC rules.
Pretend to be a police officer, court employee, lawyer, government official, or member of an enforcement agency.

A lender may communicate directly with the borrower using lawful and proportionate methods. It may send payment reminders, provide an account statement, make a lawful demand, negotiate restructuring, assign the account to a legitimate collector, or pursue a proper civil case. What it cannot do is turn collection into intimidation or public humiliation.

Character reference, guarantor, and co-maker: important differences

Collectors often blur these terms to pressure relatives and friends. Legally, they are not interchangeable.

Person	Role	Responsible for paying the loan?	May be contacted for collection?
Borrower	Person who obtained the loan	Yes	Yes, through lawful methods
Character reference	Person named to help verify identity or information	No, merely because they were listed	Generally no
Guarantor	Person who expressly agreed to answer for another person’s debt	Possibly, under the written guaranty	Yes
Co-maker or solidary debtor	Person who signed an agreement accepting direct or solidary liability	Yes, depending on the contract	Yes
Employer or HR officer	Workplace contact	No	Not merely to expose or collect the debt
Relative or friend found in phone contacts	Uninvolved third party	No	No

Under Article 2055 of the Civil Code, a guaranty is not presumed; it must be express. The NPC’s loan-related data rules similarly provide that a character reference may be used only for identity or information verification and cannot automatically be treated as a guarantor. A guarantor must expressly consent to assume that responsibility.

Typing a relative’s number into an application form as a reference does not, by itself, make that relative liable for the loan. Answering a verification call, receiving a one-time password, or being saved in the borrower’s phone also does not create a guaranty.

Philippine laws that protect borrowers and third parties

SEC rules against unfair debt collection

SEC Memorandum Circular No. 18, Series of 2019 prohibits financing and lending companies and their collection agents from using unfair debt-collection practices.

Prohibited conduct includes:

Violence or criminal means intended to harm a borrower’s person, reputation, or property.
Threatening an action that cannot legally be taken.
Using obscenities, insults, or profane language amounting to abuse.
Publishing or disclosing borrowers’ names and personal information, except in limited lawful circumstances.
Communicating false or misleading information about the debt.
Using deceptive methods to collect.
Contacting people in the borrower’s contact list other than named guarantors or co-makers.
Making collection calls at prohibited hours.

The lender remains responsible for the acts of a collection agency working on its behalf. A company cannot avoid liability by saying that the threats came from an “outside collector.” SEC rules also require collectors to disclose their true identity and require regulated companies to maintain a customer-service or complaint-handling mechanism.

You may read the official SEC rules on unfair debt collection practices.

Data Privacy Act and NPC loan-data rules

Republic Act No. 10173, or the Data Privacy Act of 2012, requires personal-data processing to have a lawful purpose and to comply with transparency, necessity, and proportionality.

A loan application’s request for phone permissions does not give the lender unlimited authority to extract, retain, message, or shame everyone in the borrower’s contact list.

NPC Circular No. 2022-02 provides, among other things, that:

App permissions must be suitable and necessary for a legitimate purpose.
Access must not be excessive.
Contact-list access cannot be used for unrestrained collection or harassment.
A borrower may be allowed to select a specific reference or guarantor, but the app cannot freely process the borrower’s entire contact list for collection.
A character reference must be told how the lender obtained the person’s details and must be given an opportunity to have unnecessary data removed.
A character reference cannot automatically be treated as a guarantor.
Only a guarantor may be contacted for debt collection under the applicable loan-data rules.

The NPC has previously acted on complaints involving lending apps that accessed contacts, contacted borrowers’ supervisors and relatives, falsely described third parties as co-makers, and used threats and social-media shaming. (National Privacy Commission)

Financial consumer protection law

Republic Act No. 11765, or the Financial Products and Services Consumer Protection Act of 2022, recognizes consumers’ rights to fair treatment, data privacy, transparency, and timely complaint handling.

Financial service providers must maintain a free consumer-assistance mechanism. They may be held responsible for the acts of their employees and accredited third-party collection agents. The law also expressly prohibits abusive debt-collection practices. (Supreme Court E-Library)

Possible criminal offenses

Depending on the exact words, conduct, intent, and evidence, lending-app harassment may also involve offenses under the Revised Penal Code or Republic Act No. 10175, the Cybercrime Prevention Act of 2012.

Possible offenses may include:

Grave threats, when someone threatens a wrong amounting to a crime.
Grave coercion, when threats, violence, or intimidation are used to force a person to do something against their will.
Unjust vexation, for conduct intended to cause substantial annoyance, distress, irritation, or torment when no more specific offense applies.
Libel or cyberlibel, when defamatory statements identifying a person are communicated to third parties, including through online platforms.
Identity-related or computer-related offenses, where a collector uses unauthorized accounts, fabricated profiles, or unlawfully obtained digital information.

Not every rude message automatically satisfies the elements of a criminal offense. Police investigators and prosecutors examine the exact language, context, recipients, identity of the sender, and available electronic evidence.

What to do immediately after receiving threats

1. Preserve evidence before blocking numbers or uninstalling the app

Do not delete the messages immediately. Save:

Full screenshots showing the sender’s number, account name, date, and time.
The complete conversation, not only the most offensive line.
Call logs and voicemail recordings.
Emails, social-media messages, group-chat posts, and public comments.
Screenshots of the app’s name, developer, privacy notice, loan account, and payment history.
Collection notices and account statements.
Names or aliases used by collectors.
Threats sent to relatives, employers, or co-workers.
Proof that the contacted person was never a guarantor or co-maker.
The loan agreement and any disclosure statement available in the app.

Use a screen-recording function to scroll through long conversations. Export chats when the platform permits it. Keep copies in cloud storage or another device.

Electronic evidence becomes more persuasive when it shows context and authenticity. Avoid cropping out the sender, timestamps, web address, or surrounding conversation.

2. Ask employers and relatives to preserve what they received

A complaint is stronger when the actual recipient keeps the original message.

Ask the recipient to prepare:

Screenshots from their own device.
A short written statement explaining when and how they received the message.
The number, account, or profile used by the collector.
A description of any workplace disruption, embarrassment, or repeated calls.
Confirmation that they never agreed to guarantee or co-sign the loan.

An employer’s HR department may retain the message in the employee’s personnel or incident file. Request a copy rather than relying only on a verbal report.

3. Revoke unnecessary app permissions

After preserving evidence, review the app’s access to:

Contacts.
Photos and videos.
Camera and microphone.
SMS messages.
Call logs.
Location.
Files and storage.

Revoke permissions that are no longer needed. Change passwords if the app or collector appears to have accessed an email, social-media account, or device without authority.

Uninstalling the app does not necessarily delete information already copied to the lender’s servers, which is why a written data-privacy request may still be necessary.

4. Send a written complaint to the lender

Before filing a formal NPC complaint, the complainant ordinarily must first inform the company in writing and give it 15 calendar days from receipt to act. The NPC may waive this requirement for serious, patently illegal, or urgently harmful conduct, but the safer approach is to send a written notice whenever circumstances allow.

Send the notice to the lender’s:

Customer-service address.
Data protection officer or privacy email.
Complaints or consumer-assistance channel.
Official in-app support system.

A practical written notice may state:

I demand the immediate cessation of calls, messages, disclosures, and threats directed to my employer, relatives, co-workers, and other persons who are not guarantors or co-makers. I also request preservation of all collection logs, identification of the collectors involved, removal of unlawfully obtained third-party contact data, and a written response within 15 calendar days. I dispute any representation that my character references or phone contacts are guarantors or co-makers unless you can produce their express written agreement.

Attach selected screenshots, but keep the originals. Save the sent email, delivery confirmation, ticket number, or in-app acknowledgment.

5. Do not pay an unknown personal account merely because of a threat

Verify the lender and the payment channel before sending money.

Red flags include instructions to pay:

A collector’s personal e-wallet.
An unrelated bank account.
A different company not identified in the loan documents.
A cryptocurrency wallet.
A payment link sent from an unverified social-media profile.

Ask for an updated statement showing principal, interest, penalties, payments already credited, and the authorized payment method. A complaint about harassment does not erase a legitimate debt, but it also does not require you to pay through a suspicious channel.

Where to file a complaint

The correct office depends on what happened. You may file with more than one agency when the conduct involves separate violations.

Problem	Main office	Appropriate complaint
Threats, shaming, prohibited calls, or contact with employer and relatives	SEC	Unfair debt-collection complaint
Contact harvesting, unauthorized disclosure, misuse of photos or personal data	NPC	Data-privacy complaint
Threats of violence, impersonation, cyberlibel, fraud, or account hacking	PNP, NBI, or DICT	Cybercrime or criminal report
Immediate physical danger	Nearest police station	Urgent police assistance
False or unauthorized loan transaction	SEC plus PNP/NBI	Regulatory and possible criminal complaint

How to file an SEC complaint against an online lending app

The SEC regulates lending and financing companies and receives complaints through its SEC iMessage portal.

Step-by-step SEC filing process

Identify the lender. Look for the company’s complete corporate name in the loan agreement, disclosure statement, privacy notice, app-store page, payment instructions, or messages. The app’s brand name may differ from the registered company name.
Check whether the company is registered and authorized. Include any SEC registration, certificate-of-authority, office address, or app-developer information you can find. If you cannot identify the company, provide the app name, download link, phone numbers, payment accounts, and screenshots.
Create or use an eSECURE account. The iMessage system requires users to sign in through the SEC’s eSECURE system.
Open a new ticket. Select the Financing and Lending Companies Department and the service for complaints involving financing and lending companies.
Write a chronological narrative. State:
- When you borrowed.
- The amount borrowed and amount allegedly due.
- When collection began.
- Who was contacted.
- What the collector said.
- Whether the third parties were guarantors or merely contacts or references.
- Whether you complained directly to the company.
- What relief you are requesting.
Upload supporting evidence. Attach screenshots, call logs, loan documents, payment records, third-party statements, and your written complaint to the lender.
Save the ticket number. The portal allows users to track the ticket, receive responses, upload additional files, and post follow-up replies.

The 2026 joint advisory also identifies the SEC FINLEND complaint channel through iMessage and the SEC hotline 1-4732 (1-4SEC).

What to request from the SEC

You may ask the SEC to:

Investigate the lender and collection agency.
Order the company to stop unfair collection.
Determine whether the app is operating without proper authority.
Require an explanation and preservation of collection records.
Impose appropriate administrative sanctions.
Direct the company to correct false representations about alleged guarantors or co-makers.

SEC administrative action does not automatically cancel a valid loan. Questions about the correct balance, excessive charges, unauthorized transactions, or damages should be clearly separated from the harassment allegations.

How to file a complaint with the National Privacy Commission

File with the NPC when the lender accessed, used, disclosed, or retained personal data unlawfully. The borrower and each employer, relative, friend, or co-worker whose data was misused may have separate rights as affected data subjects.

Step-by-step NPC complaint process

Send written notice to the lender or data controller. Describe the privacy violation and request corrective action.
Allow 15 calendar days for a response. Preserve proof that the company received the notice. Explain any urgent reason for asking the NPC to waive this waiting period.
Download and complete the NPC complaint form. Use the NPC complaint form and filing instructions.
Prepare a verified complaint. “Verified” means you swear that the material allegations are true based on personal knowledge or authentic records. The complaint normally must be notarized.
Identify the respondent. Provide the lender’s corporate name if known. If the true operator is unknown, explain the facts that may help identify it, such as app-store information, telephone numbers, email addresses, payment accounts, and website details.
Attach supporting documents. Include:
- Screenshots and recordings.
- Proof of the lender’s access to or use of contact information.
- Correspondence with the lender.
- Proof of receipt of your written notice.
- Witness affidavits, when available.
- Loan documents and privacy notices.
- A certification against forum shopping in the required form.
Pay the applicable filing fee or establish an exemption. NPC rules require the appropriate fee unless the complainant qualifies for an exemption or the NPC grants a waiver for good cause. Confirm the current amount through the NPC’s official filing page before submission.
File through an accepted mode. The NPC’s current filing page allows submission personally, by courier or registered mail, or by scanning and emailing the notarized complaint to complaints@privacy.gov.ph. Illegible or incomplete electronic submissions may not be accepted.

NPC rules state that a complaint is assigned for evaluation within five calendar days after receipt, although this is not a guarantee that the entire case will be resolved within that period. The investigating officer may dismiss a complaint that is incomplete, unsupported, outside NPC jurisdiction, or filed without first giving the respondent an opportunity to address the issue, unless the omission is justified.

The NPC’s published contact details include:

Email: complaints@privacy.gov.ph
Office: 25th–27th Floors, The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Quezon City
Telephone: (+63 2) 5322-1322, local 114 or 115 (National Privacy Commission)

When to report the collector to the PNP, NBI, or DICT

Do not rely only on an SEC or NPC complaint when the messages contain threats of violence, impersonation, fraud, hacking, extortion, or serious defamatory publication.

The 2026 joint advisory lists the following reporting channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (+632) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com; (+632) 8723-0401 local 7491

For a police or NBI report, bring:

A government-issued ID.
Your phone containing the original messages.
Printed screenshots.
A USB drive or other copy of digital evidence.
The loan agreement and payment records.
A list of phone numbers, accounts, URLs, and payment channels involved.
Statements or affidavits from employers and relatives who received messages.
A concise timeline of events.

A police blotter records the incident but is not, by itself, a complete criminal complaint or proof that an offense occurred. Investigators may require a sworn complaint-affidavit and additional evidence before referring the matter to the city or provincial prosecutor.

Evidence checklist for a strong complaint

Evidence	Why it matters
Full screenshots with dates and sender details	Shows the exact threat, disclosure, or insult
Screen recording of the conversation	Preserves context and reduces claims of selective editing
Call logs and recordings	Establishes frequency, timing, and identity
Messages received by employer or relatives	Proves third-party contact and disclosure
Witness affidavit or signed statement	Confirms who received the communication
Loan agreement and disclosure statement	Identifies the lender and actual obligations
App privacy notice and permissions	Shows what data the app claimed it would process
App-store listing and developer details	Helps trace an unidentified operator
Payment receipts and account statements	Prevents confusion about the actual loan balance
Written complaint to the lender	Proves prior notice for NPC purposes
Delivery receipt or support ticket	Proves when the 15-day response period began
Corporate and collection-agency names	Helps determine responsibility

Arrange files by date and use clear filenames, such as 2026-07-05_Message-to-HR.png. Prepare a one- or two-page chronology so the reviewing officer can understand the case without reconstructing it from dozens of unordered screenshots.

Common situations and practical answers

The borrower still owes money

You may complain about threats or unlawful data use even when the debt is genuine.

The complaint concerns the method of collection, not necessarily whether the loan exists. Continue requesting accurate account statements and use only verified payment channels. Do not falsely deny a valid loan merely because the collector behaved unlawfully.

The collector says nonpayment will result in immediate arrest

Ordinary nonpayment of a loan is generally a civil matter. Article III, Section 20 of the Constitution states that no person shall be imprisoned for debt.

However, separate criminal allegations may arise from genuinely fraudulent conduct, falsified documents, identity theft, or checks covered by special laws. A collector cannot truthfully claim that every overdue app loan automatically results in arrest or imprisonment.

A relative was listed as an “emergency contact”

An emergency contact or character reference is not automatically a guarantor. Ask the lender to produce the document containing the relative’s express agreement to guarantee or co-sign the loan.

The employer received only one verification call

A limited and lawful employment-verification inquiry is different from disclosing the debt or demanding payment. Record what was asked and what information was revealed. Even a single communication may be improper if it exposed the debt, contained threats, or pressured the employer to discipline the borrower.

The app has disappeared from the app store

You may still complain. Preserve the old installation file if safely available, app screenshots, developer details, website, email addresses, phone numbers, payment accounts, and messages. Report an unknown or unregistered operator to the SEC and possible criminal conduct to the PNP or NBI.

The relative or employer wants to file independently

A third party whose personal information was obtained or used without authority may file a separate NPC complaint. A person who personally received threats or defamatory statements may also make a police, NBI, or prosecutor’s complaint based on the conduct directed at that person.

The borrower is an OFW or lives abroad

SEC iMessage can be accessed online. For an NPC complaint filed by a non-resident Filipino without a Philippine representative, the amended NPC rules allow the complaint to be notarized through a Philippine Embassy or Consulate or authenticated with an apostille certificate from the country of origin.

Keep electronic copies of all evidence. Where messages or foreign documents are not in English or Filipino, attach a clear English translation and be prepared to provide a certified translation if required.

How long does the complaint process take?

There is no single guaranteed completion period.

Process	Initial step	Practical expectation
Lender’s internal complaint	Company receives written notice	Allow 15 calendar days for NPC exhaustion purposes
SEC iMessage complaint	Ticket is generated and assigned	Follow-ups may take weeks or longer depending on evidence and caseload
NPC complaint	Case is assigned for evaluation within five calendar days of receipt	Investigation, mediation, submissions, and resolution may take several months or longer
Police or NBI report	Incident may be recorded on the day of reporting	Investigation depends on identifying the sender and preserving digital records
Prosecutor proceedings	Complaint-affidavit is evaluated and respondent may answer	Timing varies by office, complexity, and service of notices

Respond promptly to requests for clarification or additional evidence. A common source of delay is an incomplete complaint that does not identify the lender, lacks full screenshots, omits proof of prior written notice, or fails to distinguish the borrower from the affected third parties.

Frequently Asked Questions

Can an online lending app call my employer?

It should not call your employer to expose your debt, demand payment, shame you, or pressure the company to discipline you. A narrowly limited employment-verification inquiry is different, but it must not become debt disclosure or harassment.

Can a lending app contact all my relatives?

No. Access to a borrower’s contacts does not authorize indiscriminate collection messages. For debt collection, current NPC and joint-agency guidance limits third-party contact to a person who expressly agreed to be a guarantor.

Is my character reference responsible for my loan?

No. A character reference is not automatically a guarantor or co-maker. A guaranty must be express, and the lender should be able to produce the agreement showing that the person knowingly accepted liability.

Can I file a complaint even if I have not fully paid the loan?

Yes. A valid debt does not excuse threats, humiliation, deceptive representations, or unlawful processing of personal data. The debt and the collection misconduct are separate issues.

Should I complain to the SEC or NPC?

File with the SEC for unfair collection by a lending or financing company. File with the NPC for unauthorized access, disclosure, retention, or use of personal data. File with both when the same conduct involves both abusive collection and privacy violations.

Can my employer or relative file a complaint?

Yes, particularly when that person received threats, defamatory messages, or unauthorized disclosure of personal information. Each affected person should preserve the original communication from their own device.

What if I do not know the lender’s real company name?

Provide every identifying detail available: app name, icon, app-store link, developer, website, telephone numbers, email addresses, collector aliases, bank or e-wallet accounts, loan reference numbers, and screenshots. The SEC, NPC, police, or NBI may use these details to trace the operator.

Is threatening to post my photo on Facebook illegal?

It may violate SEC debt-collection rules and the Data Privacy Act. If the post contains defamatory accusations or fabricated information, cyberlibel or another offense may also be considered depending on the exact content and circumstances.

Should I delete the lending app immediately?

Preserve evidence first. Screenshot the loan details, privacy notice, permissions, messages, and company information. After backing up evidence, revoke unnecessary permissions and uninstall the app if continued access presents a security or privacy risk.

Can the collector have me arrested for an unpaid app loan?

Nonpayment of an ordinary debt does not, by itself, result in imprisonment. A collector cannot lawfully use a baseless threat of arrest as a collection tactic. Separate criminal conduct, such as identity theft or document falsification, is a different matter and must be supported by actual facts.

Key Takeaways

A valid loan does not authorize threats, public shaming, impersonation, or indiscriminate contact with employers and relatives.
A character reference, emergency contact, or person found in a phone is not automatically a guarantor or co-maker.
Preserve complete digital evidence before blocking numbers, revoking permissions, or uninstalling the app.
Send the lender a written demand to stop the conduct and retain proof of receipt; this is normally required before a formal NPC complaint.
File unfair debt-collection complaints through the SEC iMessage portal.
File unauthorized data-use and disclosure complaints with the National Privacy Commission.
Report violence-related threats, impersonation, fraud, hacking, or serious online defamation to the PNP, NBI, or DICT.
Complaining about harassment does not automatically erase a legitimate debt, but the lender remains legally accountable for unlawful collection methods.