Quick answer

An online lender or collection agency generally may contact you to collect a valid debt, but it may not use your phone contacts to pressure, shame, threaten, or embarrass you. For debt-collection purposes, current National Privacy Commission rules prohibit lending and financing companies from contacting people in your contact list other than persons properly named as guarantors. A character reference is not automatically a guarantor.

Contacting family members, coworkers, an employer, friends, or other contacts to reveal your debt or force payment may violate the Data Privacy Act, NPC loan-processing rules, SEC rules against unfair debt collection, and the Financial Products and Services Consumer Protection Act. Giving an app permission to access your contacts does not authorize unlimited or abusive use of that information.

Preserve the evidence, revoke unnecessary app permissions, send the lender a written demand to stop third-party contact, complain first through the lender’s consumer-assistance channel, and escalate to the SEC and/or NPC. Report credible threats, impersonation of authorities, extortion, stalking, or immediate danger to law enforcement without waiting for the lender’s response.

Harassment does not erase a legitimate loan. Deal separately with the correct balance, disputed charges, and an affordable payment arrangement.

What collectors are allowed—and not allowed—to do

A lender may use reasonable and legally permissible methods to collect an amount that is actually due. It may ordinarily contact the borrower, explain the account, send lawful demand letters, negotiate payment, and pursue a proper civil remedy.

That right does not permit abusive collection. Under SEC Memorandum Circular No. 18, Series of 2019, prohibited conduct includes:

Using or threatening violence or other criminal means against a person, reputation, or property;
Threatening action that cannot legally be taken;
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense;
Disclosing or publishing borrowers’ names or personal information because they allegedly refuse to pay, except where disclosure is legally permitted;
Communicating loan information known, or that should be known, to be false;
Using false representations or deceptive means to collect a debt or obtain information;
Contacting the borrower before 6:00 a.m. or after 10:00 p.m., subject to the circular’s stated exceptions—such as an account more than 15 days past due or the borrower’s recorded express consent that those hours are the only reasonable or convenient time; and
Contacting people in the borrower’s contact list other than named guarantors or co-makers, even when the borrower allowed contact-list access.

A lending or financing company cannot avoid responsibility simply by outsourcing collection. SEC MC No. 18 requires covered companies to ensure that their collection agencies, lawyers, agents, and other third-party service providers follow the same rules.

More broadly, the Financial Products and Services Consumer Protection Act, Republic Act No. 11765, prohibits financial service providers from employing abusive collection or debt-recovery practices and requires them to respect client privacy and provide a free consumer-assistance mechanism.

Family members and coworkers usually are not responsible for the loan

A person does not become liable merely because:

Their number appeared in the borrower’s phone;
The lender called or texted them;
The borrower identified them as a character reference;
They are the borrower’s spouse, parent, child, sibling, friend, coworker, supervisor, or employer; or
They helped the borrower communicate with the lender.

Under NPC Circular No. 2022-02, a character reference is used to verify the applicant’s identity and the truthfulness of information supplied during the loan application. The lender must tell the person that they were selected as a reference, explain how the contact details were obtained, and give the reference an option to have their personal data removed as a character reference.

A character reference is not automatically a guarantor. A guarantor is someone who expressly agreed to answer for the borrower’s obligation if the borrower fails to perform. The lender must obtain that person’s separate consent, subject to the Civil Code and data-privacy requirements.

Liability can be different if the relative or coworker actually signed—or validly accepted—an agreement as a co-borrower, co-maker, surety, or guarantor. The document and circumstances must be examined. A collector’s assertion alone does not establish liability.

Why accessing the borrower’s contacts does not justify mass messaging

The Data Privacy Act of 2012, Republic Act No. 10173, requires personal-data processing to have a lawful basis and to comply with transparency, legitimate purpose, and proportionality.

NPC rules specifically prohibit unnecessary or excessive app permissions. Access to contact lists must be suitable, necessary, and proportionate to a legitimate purpose. “Unbridled processing”—including processing that leads to harassment, unfair collection, or collection from people other than the borrower’s guarantors—is prohibited.

An online lending app may provide a limited interface allowing the borrower to select a character reference or guarantor. That does not authorize the lender to copy the entire address book and contact everyone in it.

For debt collection, NPC Circular No. 2022-02 says the lender may contact only the guarantor. Contacting other people in the borrower’s contact list for collection is prohibited. A character reference may be contacted for the limited purpose of verifying identity and application information, but not treated as a collection target or automatic guarantor.

What to do immediately

1. Preserve evidence before blocking numbers or removing the app

Save material in its original form where possible:

Screenshots showing the full message, sender, date, and time;
Screen recordings showing message threads or repeated calls;
Call logs, voice messages, and lawful recordings in your possession;
Emails, social-media messages, group-chat posts, and public posts;
Messages received by relatives, coworkers, supervisors, or customers;
The app’s name, developer, store listing, website, and privacy notice;
The lender’s corporate name, SEC registration number, Certificate of Authority number, address, and collection-agency details;
The loan agreement, disclosure statement, repayment schedule, receipts, and account ledger;
Screenshots of the app permissions it requested;
Copies of every complaint and the lender’s acknowledgment or reference number; and
Short written statements from contacted third parties describing what was disclosed or demanded.

Ask recipients not to delete the messages. They should preserve the original message thread and identify the number, account, or profile that contacted them.

Do not publicly repost unredacted evidence containing another person’s phone number, government ID, account number, or private information. Submit complete copies securely to the proper authority.

2. Secure the phone and accounts

After documenting the relevant permissions:

Turn off the app’s access to contacts, call logs, files, photos, location, microphone, and camera unless access is still genuinely necessary;
Review permissions through the phone’s system settings, not only inside the lending app;
Change reused passwords and enable multi-factor authentication;
Check messaging and social-media privacy settings;
Inform family and coworkers not to give the collector personal details, passwords, one-time PINs, addresses, schedules, or money; and
Report abusive numbers or accounts to the relevant phone, messaging, social-media, or app-store platform.

Revoking access may prevent new collection from the device, but it cannot guarantee deletion of information already copied. Make a written data-privacy request to the lender or its data protection officer.

3. Send a written demand to the lender

Use the lender’s official consumer-assistance and data-protection contact details. Copy the collection agency if its identity is known. Keep proof of delivery.

A concise notice may say:

I demand that you and all persons acting for you stop contacting, disclosing my loan information to, or seeking payment from my family members, coworkers, employer, friends, and other third parties who are not valid guarantors or co-makers.

Please communicate directly with me through [email/address]. I also request the identity of the creditor and collection agency, an itemized statement of the claimed balance, and the lawful basis and source for processing each third party’s personal data. Preserve all relevant records and confirm in writing that prohibited third-party contact has stopped. This notice does not admit the amount claimed and does not waive any right or remedy.

If you acknowledge the loan but need time, add a realistic payment proposal. If you dispute the amount, identify the specific charges or payments in dispute and attach supporting records. Do not promise an amount or date you cannot meet.

A written demand is useful evidence, but it does not by itself cancel the debt or guarantee that every lawful communication must stop.

4. Have contacted relatives or coworkers assert their own rights

The affected third party may send a separate notice:

I did not agree to be a guarantor or co-maker. Stop contacting me for collection and stop disclosing the borrower’s loan information to me. Please identify how you obtained my information, the purpose and lawful basis for processing it, and the recipients to whom it was disclosed. If I was listed as a character reference, I request removal of my personal data in that capacity, subject to any retention strictly required by law.

Rights to object, correct, block, or erase data are not absolute. A lender may retain information when a law, legal claim, regulatory duty, or other valid basis requires retention. That does not permit continued harassment or unnecessary disclosure.

Where to complain

Securities and Exchange Commission

The SEC regulates ordinary lending and financing companies and their online lending platforms. A complaint should identify both the app’s brand name and the legal company operating it, if known.

Submit a clear timeline and attach the loan documents, screenshots, call logs, third-party messages, written demand, and the lender’s response. The SEC provides its iMessage complaint and inquiry portal for online submissions.

Possible issues to identify include:

Contacting people who were not guarantors or co-makers;
Public shaming or disclosure of loan information;
Threats, insults, deception, or false claims of legal authority;
Unreasonable contact hours under SEC MC No. 18;
Failure to identify the legal lender or collection agency; and
Operation without the required SEC registration or authority.

National Privacy Commission

Complain to the NPC when the conduct involves excessive contact-list access, unauthorized disclosure, failure to explain how data was obtained, refusal to address a data-subject request, or other unlawful personal-data processing.

The NPC’s official complaint page states that a complainant may file a notarized Complaint-Assisted Form or a verified complaint, with evidence and witness affidavits, personally, by registered mail, by courier, or by electronic mail when authorized by the Commission. Consult the current page and form before filing because procedural requirements and authorized channels may change.

It is generally prudent to first notify the lender or its data protection officer in writing and preserve the response or proof that it failed to act. If the borrower and contacted third parties suffered separate privacy violations, each affected person should explain their own involvement and harm.

Bangko Sentral ng Pilipinas

If the creditor is a bank, digital bank, non-bank electronic-money issuer, pawnshop, or another BSP-supervised financial institution, complain first through that institution’s consumer-assistance mechanism. If unresolved, escalate through the BSP Consumer Assistance Mechanism, including the BSP Online Buddy or the current Complaints, Inquiries and Requests form.

The SEC and BSP have different jurisdictions. Check the legal name on the contract, disclosure statement, payment instructions, and app listing—not merely the app’s marketing name.

Police or other law-enforcement authorities

Seek immediate police assistance when messages contain a credible threat of violence, stalking, extortion, doxxing, sexualized threats, or an imminent visit that places someone in danger. Preserve the original communications and do not meet a threatening collector alone.

False claims that a collector is a police officer, court employee, prosecutor, sheriff, or government agent should also be documented and reported. Depending on the facts, threats, defamatory online publications, unauthorized account access, or other conduct may raise criminal or cybercrime issues. Criminal liability depends on the precise words, medium, intent, surrounding circumstances, and proof; it should not be assumed from an unpleasant demand alone.

Does nonpayment mean arrest or imprisonment?

Ordinary failure to pay a civil debt does not by itself authorize arrest or imprisonment. Article III, Section 20 of the 1987 Philippine Constitution provides that no person shall be imprisoned for debt or nonpayment of a poll tax.

This does not create immunity for a separate crime supported by evidence, such as fraud committed through acts independently punishable by law. A genuine criminal complaint also follows legal procedure; a collector cannot issue an arrest warrant, convict someone, or guarantee imprisonment.

Treat claims such as “you will be arrested today,” “a warrant is already out,” or “we will have the police pick you up” as matters to verify independently. Ask for the court, case number, and document, but do not click unknown links or send identification to an unverified collector. Court papers should never be ignored; verify them directly with the named court or through counsel.

Handling the debt while stopping the harassment

Keep the collection-abuse issue separate from the account itself.

Identify the legal creditor and verify that it is authorized to operate.
Request an itemized statement showing principal, interest, fees, penalties, payments, and the amount currently due.
Compare it with the signed contract and disclosure statement.
Dispute specific errors in writing.
If the amount is correct but unaffordable, propose a payment schedule you can realistically sustain.
Require written confirmation of any restructuring, waiver, settlement, or “full payment” arrangement before sending money.
Pay only through a verified channel belonging to the lender or an expressly authorized collection agent.
Keep receipts and request a certificate or written confirmation when the account is fully settled.

Never send an OTP, banking password, remote-access code, or payment to a collector’s personal account merely because they threaten immediate consequences.

Common mistakes to avoid

Deleting messages or uninstalling the app before preserving evidence;
Assuming that blocking one number prevents the lender from using other numbers;
Paying an unverified individual or personal e-wallet;
Admitting an uncertain balance simply to end a threatening call;
Believing that every relative or reference is automatically responsible;
Ignoring authentic court documents because earlier threats were false;
Posting the dispute publicly with unredacted personal information;
Threatening the collector in return;
Filing a vague complaint without dates, screenshots, company identity, or supporting documents;
Complaining only against the app name and omitting the legal lender or collection agency; and
Assuming that abusive collection automatically cancels a valid debt.

When legal help is urgent

Consult a Philippine lawyer or the Public Attorney’s Office, if eligible, promptly when:

A verified summons, subpoena, complaint, or court order arrives;
A relative or coworker is alleged to have signed as guarantor, surety, co-maker, or co-borrower;
The collector publishes personal information, altered photos, accusations, or sexual content;
There are credible threats of physical harm or repeated visits to a home or workplace;
Money was taken through unauthorized access or account compromise;
The claimed balance is large or includes charges you cannot reconcile;
The lender refuses to identify the creditor or provide basic account records;
You are being pressured to sign a settlement, acknowledgment, promissory note, or waiver; or
The SEC, NPC, BSP, police, or prosecutor requires a verified pleading or affidavit you do not understand.

Frequently asked questions

Can a lending app call my parents, spouse, or officemates?

Generally, not for the purpose of collecting your debt unless the particular person validly agreed to be a guarantor or co-maker. Merely appearing in your contacts, being related to you, or serving as a character reference does not create liability.

Can the collector call my employer?

A collector does not have a general right to reveal your debt to your employer or coworkers. A narrowly necessary communication in a legally recognized process may present different facts, but workplace shaming, pressure, or disclosure to unrelated employees may violate collection and privacy rules.

What if I allowed the app to access my contacts?

Technical permission does not authorize indiscriminate collection use. Personal-data processing must remain lawful, transparent, necessary, and proportionate. SEC rules also prohibit contacting people in the contact list other than named guarantors or co-makers, notwithstanding the borrower’s consent.

May a collector contact my character reference after the loan is approved?

A character reference may be contacted for the limited verification purpose defined by NPC rules. The person may not automatically be treated as a guarantor or pursued for payment. The lender must offer the reference an option to have their personal data removed as a character reference.

Can collectors post my name or photo online?

Public disclosure or publication of a borrower’s name or personal information to shame or pressure payment is generally prohibited, subject only to disclosures specifically allowed by law. Using a borrower’s photo to harass or embarrass them is expressly barred by NPC loan-processing rules.

Are late-night calls always prohibited?

SEC MC No. 18 generally defines unreasonable hours as before 6:00 a.m. or after 10:00 p.m. It states exceptions, including an account more than 15 days past due or recorded express consent that those hours are the borrower’s only reasonable or convenient opportunity for contact. Even when an exception applies, threats, insults, deception, prohibited third-party contact, and other abusive conduct remain unlawful.

Does filing a complaint stop interest or cancel the loan?

Not automatically. Regulatory complaints address misconduct and privacy violations; the contractual debt and disputed charges must be handled separately. Obtain written confirmation of any payment pause, waiver, restructuring, or settlement.

Can I ignore the lender after blocking the collectors?

It is safer to keep one controlled written channel open, unless personal safety requires otherwise. This allows you to receive account information, propose payment, dispute charges, and distinguish real legal documents from threats.

What should a contacted coworker say?

They may state that they are not the borrower, did not consent to be a guarantor, do not authorize further collection contact, and request the source, purpose, and removal of their personal data where applicable. They should save the message and avoid discussing the borrower’s location, salary, schedule, or personal circumstances.

Official sources

This article provides general Philippine legal information, not advice for a particular case. Rights, liability, jurisdiction, and the proper remedy depend on the contract, parties, evidence, lender’s regulatory status, and exact communications. Official sources and procedures were checked as of September 5, 2026.