Quick answer

An online lender may lawfully ask the borrower to pay a valid debt, but it generally may not harass, shame, threaten, or disclose the borrower’s loan to family members. It also may not harvest or use the borrower’s phone or social-media contacts for debt collection.

Under SEC rules, contacting people in the borrower’s contact list—other than persons actually named as guarantors or co-makers—is an unfair debt-collection practice, even if the borrower supposedly consented. A relative who did not borrow, sign as guarantor or co-maker, or otherwise assume the obligation generally does not become liable merely because the lender found that person in the borrower’s phone.

The borrower and affected family members may demand that the conduct stop, preserve evidence, complain to the lender and the proper regulator, and report credible threats or other possible crimes to law enforcement. The debt itself does not disappear merely because collection methods were unlawful.

What online lenders are prohibited from doing

SEC Memorandum Circular No. 18, Series of 2019 applies to financing companies, lending companies, and third-party collectors acting for them. It permits reasonable and legally permissible collection efforts but prohibits practices such as:

Threatening violence or other criminal harm to the borrower, a relative, or anyone’s property or reputation
Threatening arrest, prosecution, public exposure, or another action that cannot legally be taken
Using obscenities, insults, degrading language, or communications amounting to a criminal offense
Publishing or disclosing borrowers’ names or personal information except when a lawful exception applies
Giving anyone false loan information, including concealing the fact that a debt is disputed
Misrepresenting the collector’s identity, authority, legal remedies, or the consequences of nonpayment
Contacting people in the borrower’s contact list unless they were named as guarantors or co-makers
Contacting the borrower before 6:00 a.m. or after 10:00 p.m., subject to the circular’s limited exceptions for an account more than 15 days past due or the borrower’s express agreement that those hours are the only reasonable or convenient time

A collector does not avoid responsibility merely by saying it is an outside collection agency. Republic Act No. 11765, the Financial Products and Services Consumer Protection Act, makes a regulated financial service provider responsible for its representatives and solidarily liable with accredited third-party service providers for relevant acts or omissions, including debt collection.

How the privacy rules protect family members

The Data Privacy Act of 2012 requires personal-data processing to have a lawful basis and to observe transparency, legitimate purpose, and proportionality. Consent, when relied upon, must be freely given, specific, and informed.

A family member is a separate data subject. The borrower ordinarily cannot give blanket consent for a lender to collect, store, or use that relative’s name, mobile number, workplace, social-media account, photograph, or relationship information.

NPC Circular No. 2020-01 specifically governs personal data in loan-related transactions. The National Privacy Commission’s official explanation states that online lending applications must not:

Access or copy phone or email contact lists when unnecessary
Harvest social-media contacts
Save contact information for collection or harassment
Use a borrower’s photograph to embarrass or pressure the borrower
Keep unnecessary device permissions after their legitimate purpose has ended
Use personal data to carry out unfair collection practices

A lender’s legitimate interest in collecting a debt is not unlimited. The disclosure must still be necessary, proportionate, and supported by a lawful basis. Broadcasting the debt to relatives, co-workers, neighbors, or social-media contacts to cause embarrassment will ordinarily be difficult to justify as necessary and proportionate collection activity.

When contact with a family member may be lawful

Not every communication with a relative is automatically unlawful. The result depends on what the relative agreed to, what information was disclosed, why the contact occurred, and how it was conducted.

The relative is a guarantor or co-maker

A lender may contact someone who actually signed or was validly named as a guarantor or co-maker because that person may have contractual obligations. The exact liability depends on the signed loan documents and applicable law.

Even then, the lender may not threaten, insult, deceive, publicly shame, or contact the person in an abusive manner. Guarantor or co-maker status is not permission to harass.

The relative is merely a reference or emergency contact

Being listed as a character reference or emergency contact does not, by itself, make a person liable for the debt. It also does not automatically authorize repeated collection calls or disclosure of detailed loan information.

Ask the collector to identify the document allegedly signed by the family member. Do not accept a verbal claim that the relative is a “co-maker.” Request a copy and check the signature, date, terms, and manner in which consent was supposedly obtained.

The borrower gave the lender the relative’s number

Supplying another person’s number does not necessarily authorize unrestricted collection or disclosure. The lender must still comply with privacy and fair-collection rules, and the family member retains independent rights over their personal data.

A court or government authority lawfully requires disclosure

Information may sometimes be disclosed pursuant to a lawful court process, regulatory requirement, credit-reporting rule, or another specific legal obligation. That is different from mass messaging, public posting, or contacting relatives simply to embarrass the borrower.

Is the family responsible for paying?

Usually, no. A contract generally binds the parties who entered into it. A parent, adult child, sibling, partner, employer, friend, or other relative does not become a debtor merely by being related to the borrower, living at the same address, or appearing in the borrower’s contacts.

Liability may require closer legal review when the family member:

Signed as a borrower, co-borrower, co-maker, surety, or guarantor
Gave property as security
Expressly assumed the obligation in an enforceable agreement
Is a spouse and the lender claims that the debt binds community or conjugal property
Is an heir facing a claim against the deceased borrower’s estate

Spouses and heirs should not assume personal liability based only on a collector’s message. Liability can depend on the marriage property regime, the purpose and benefit of the debt, the wording of signed documents, succession rules, and whether the claim is properly directed against an estate.

Can the borrower be arrested for failing to pay?

Ordinary inability or failure to pay a civil debt does not, by itself, permit imprisonment. Article III, Section 20 of the 1987 Constitution states that no person shall be imprisoned for debt.

This does not create immunity for a separate offense, such as fraud established through legally sufficient evidence or an offense involving a check under applicable law. A collector, however, cannot truthfully claim that an arrest warrant already exists unless one was actually issued by a court. A demand letter, text message, or collection notice is not an arrest warrant.

A subpoena, summons, complaint, or court order should never be ignored. Verify it directly with the named court, prosecutor’s office, or government agency rather than through a phone number supplied only by the collector.

What affected families should do now

1. Preserve the evidence before blocking anyone

Save the original material whenever possible:

Full screenshots showing the sender, account or number, date, and time
Complete message threads, not only selected lines
Call logs and voicemail files
Social-media posts, comments, profile URLs, and group names
Names and numbers of every relative, co-worker, or friend contacted
The app’s name, developer, store page, privacy notice, and requested permissions
Loan agreement, disclosure statement, payment history, receipts, and account statements
Emails or messages disputing the debt or asking the lender to stop
Any claimed demand letter, complaint, summons, warrant, or collector identification
Statements from recipients describing what was disclosed to them

Keep an untouched copy. Record the sequence of events in a dated incident log. Avoid editing screenshots in a way that removes context or metadata.

2. Secure the borrower’s accounts and device

Review and revoke unnecessary permissions to contacts, call logs, files, camera, location, and social media. Change compromised passwords, enable multi-factor authentication, and check whether the app remains linked to external accounts.

Preserve evidence before uninstalling the app. Revoking access or deleting the app does not erase a valid debt, and it may not delete data already copied by the lender. Send a written request concerning continued processing, correction, blocking, or deletion where legally appropriate. A lender may retain records that it is legally required or legitimately entitled to keep.

3. Send a clear written notice

Write to the lender’s official customer-assistance unit and data protection officer. Identify the account without oversharing sensitive credentials and state:

Which family members were contacted
The dates, numbers, accounts, and messages involved
What loan or personal information was disclosed
Why the recipients were not borrowers, guarantors, or co-makers
Which statements were threatening, false, abusive, or humiliating
That the debt is disputed, if applicable
The action requested: stop third-party contact, preserve records, correct inaccurate data, investigate the collector, and provide a written response

Ask for the lender’s full corporate name, SEC registration details, certificate of authority, collection agency, privacy notice, and basis for processing the family member’s data. Keep proof of delivery.

Do not include PINs, passwords, one-time passwords, or full card or bank-account credentials.

4. Complain to the correct financial regulator

For a lending or financing company regulated by the SEC, use the SEC’s official iMessage ticketing system. Attach the loan details, communications, names or numbers used by collectors, prior complaint to the company, its response, and proof of disclosure to family members.

If the provider is a bank, electronic-money issuer, pawnshop, operator of a payment system, or another BSP-supervised institution, complain first through that institution’s Financial Consumer Protection Assistance Mechanism. If unresolved, elevate the matter through the BSP Consumer Assistance Mechanism, ordinarily using the BSP Online Buddy or the BSP complaint form and consumeraffairs@bsp.gov.ph.

Cooperatives and insurance-related providers fall under different regulators. Republic Act No. 11765 identifies the BSP, SEC, Insurance Commission, and Cooperative Development Authority as financial regulators for providers within their respective jurisdictions.

5. File a privacy complaint when personal data was misused

Before filing a formal NPC complaint, the general rule is to notify the lender or other respondent in writing and allow it to act. If it takes no timely or appropriate action, or gives no response within 15 calendar days after receiving the notice, the complainant may proceed. The NPC may waive this requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm, lack of an adequate remedy, or patently illegal conduct.

Use the current complaint-affidavit form and instructions on the NPC’s formal-complaint page and complaint mechanics page. The complaint must follow the required form, be notarized, and include supporting evidence. It may be filed in person, by courier, or as a scanned submission to complaints@privacy.gov.ph, subject to the NPC’s current filing requirements and fees.

A family member whose own number, identity, relationship, workplace, photograph, or account was unlawfully processed may potentially complain as an affected data subject. The borrower may separately complain about disclosure of the borrower’s loan and personal information.

6. Report threats or possible crimes promptly

Go to the nearest police station or contact emergency services immediately if there is a credible threat of violence, stalking, extortion, doxxing that creates immediate danger, or an attempt to enter a home or workplace.

Depending on the actual words, acts, intent, audience, and evidence, conduct may potentially implicate grave threats, coercion, defamation, unjust vexation, or another offense under the Revised Penal Code. Online defamation may raise issues under the Cybercrime Prevention Act. These offenses have distinct elements; rude or persistent conduct does not automatically prove every crime.

For computer-related conduct, assistance may also be sought from the NBI Cybercrime Division or through the NBI’s online complaint facility. Bring the original device and preserved electronic evidence when requested.

What not to do

Do not pay a stranger solely to stop threats without first verifying the creditor, account, and official payment channel.
Do not send money to a collector’s personal wallet unless the lender has reliably confirmed that channel.
Do not provide passwords, PINs, one-time passwords, contact lists, or additional IDs in response to intimidation.
Do not retaliate by publishing collectors’ unredacted personal information.
Do not fabricate screenshots, edit message content, or impersonate another person to obtain evidence.
Do not assume blocking the number resolves the privacy breach; preserve and report the evidence first.
Do not ignore authentic court papers or regulatory notices.
Do not treat a complaint against harassment as a substitute for addressing a valid balance.

If the debt or amount is disputed

Ask for a written accounting showing the principal, interest, fees, penalties, payments, and current balance. Compare it with the loan agreement and disclosure statement. State precisely which entries are disputed and why.

Republic Act No. 11765 requires regulated providers to maintain a free consumer-assistance mechanism and prohibits abusive debt-recovery practices. It also gives financial consumers rights to fair treatment, data protection, disclosure, and timely complaint handling.

Actions under that law generally prescribe five years after the financial transaction was consummated, or five years from discovery of deceit or nondisclosure of material facts, but in any event no later than ten years after the violation. Other civil, criminal, privacy, or regulatory claims can have different periods. Obtain legal advice promptly rather than waiting for a deadline to approach.

When legal help is urgent

Consult a Philippine lawyer or the Public Attorney’s Office promptly when:

A family member is alleged to have signed as guarantor, surety, or co-maker
A signature appears forged or was obtained through deception
The collector threatens physical harm, sexual violence, arrest, deportation, job loss, or publication of intimate material
Personal information has been posted publicly or sent to an employer, school, clients, or large group
Money is being demanded through threats or impersonation of police, courts, lawyers, or government agencies
A summons, subpoena, prosecutor’s notice, or court order has been received
The lender seeks property belonging to a spouse, relative, or deceased borrower’s estate
Harassment involves a child, older person, person with disability, or someone at risk of self-harm
The applicable filing deadline is uncertain

Immediate danger should be reported to emergency services or the nearest police station; an administrative complaint should not delay urgent safety measures.

Frequently asked questions

May a lender call the borrower’s parents or siblings?

Not merely because their numbers appear in the borrower’s contacts. Under SEC rules, contacting people in the contact list other than named guarantors or co-makers is an unfair collection practice. The legality of an isolated communication can still depend on its purpose, content, source of the number, and whether any valid contractual role exists.

Can a relative demand that the calls stop?

Yes. The relative can state in writing that they are not the borrower, guarantor, or co-maker; demand that collection communications stop; object to the use of their personal data; and ask where the lender obtained it. Keep proof that the notice was received.

Does being an emergency contact make someone a co-maker?

No. A co-maker or guarantor obligation ordinarily requires a valid legal undertaking. Demand the document on which the lender relies and obtain legal review if the signature or terms are disputed.

Is telling a relative that the borrower has an unpaid loan a privacy violation?

It may be. A loan linked to an identifiable person is personal information, and disclosure must have a lawful, necessary, and proportionate basis. Public shaming, mass messaging, or disclosure designed to pressure the borrower may also violate SEC collection rules. The final determination depends on the evidence and circumstances.

What if the borrower allowed the app to access contacts?

Device permission is not unlimited permission to harvest contacts or harass them. NPC rules specifically restrict unnecessary access and use. A borrower’s consent also does not automatically replace the separate consent or rights of each contact.

May the lender contact a genuine guarantor repeatedly?

It may pursue a genuine guarantor through lawful means, but it still cannot use violence, threats, deception, insults, unlawful disclosure, or other abusive practices.

Does harassment cancel the loan?

No. Unlawful collection conduct and the validity or amount of the debt are separate issues. The borrower can challenge harassment while arranging payment, negotiating, or disputing incorrect charges.

Should every harsh message be reported as a crime?

Not necessarily. Criminal liability depends on statutory elements and proof. Preserve the evidence and seek law-enforcement or legal assessment, especially when messages contain credible threats, extortion, impersonation, or damaging public accusations.

Official references

This article provides general legal information, not legal advice or a prediction of any case’s outcome. Rights, liability, remedies, and deadlines may depend on the loan documents, parties, regulator, communications, and other facts. Official sources and procedures were checked as of September 7, 2026.