Quick answer

Contact shaming by an online lender can violate Philippine privacy and debt-collection rules. A lender or collection agency may pursue a valid debt through lawful means, but it generally may not expose the borrower’s debt to relatives, friends, coworkers, employers, or other people taken from the borrower’s contact list; publish the borrower’s photo or personal information to shame them; or use personal data for threats and harassment.

A borrower’s unpaid balance does not give the lender unlimited authority over the borrower’s phone data. Merely clicking “Allow Contacts” or accepting a broad privacy policy does not automatically make excessive or unlawful processing valid. The controlling rules include the Data Privacy Act of 2012, NPC Circular No. 20-01, and its 2022 amendments.

Report the privacy violation to the National Privacy Commission (NPC). If the lender is a lending or financing company, also report unfair collection practices to the Securities and Exchange Commission (SEC). Threats, extortion, impersonation, account intrusion, or other possible crimes should also be reported promptly to law-enforcement authorities.

What counts as contact shaming?

“Contact shaming” is a descriptive term, not a separate offense named in one statute. It commonly refers to using a borrower’s personal data to pressure or humiliate them before other people. Examples include:

Texting or calling relatives, friends, coworkers, an employer, or unrelated contacts to announce the debt or accuse the borrower of fraud
Creating group chats that identify the borrower and disclose the balance, due date, ID, address, photograph, or other loan information
Posting the borrower’s photograph, identification document, social-media account, or alleged debt publicly
Editing photographs into “wanted,” “scammer,” or similar images and sending them to other people
Accessing, copying, or saving an entire contact list and using it for collection
Threatening to disclose the debt or personal information unless immediate payment is made
Contacting a person listed only as a character reference and demanding that person pay or pressure the borrower
Continuing mass disclosures through a third-party collection agency after the borrower has objected

A message sent only to the borrower may still violate the SEC’s unfair-collection rules if it contains threats, insults, deceptive claims, or other abusive conduct. However, not every unpleasant reminder is automatically a privacy violation. The actual words, recipients, data disclosed, frequency, timing, and surrounding circumstances matter.

What lenders may lawfully do

A creditor may use reasonable and legally permissible measures to collect an amount that is genuinely due. It may ordinarily:

Contact the borrower through the contact details supplied for the loan
Send accurate account statements and payment reminders
Negotiate a payment arrangement
Use an authorized collection service, while remaining accountable for personal data under its control
Pursue lawful contractual or court remedies
Contact a person who actually and expressly bound themselves as a guarantor or co-maker, as the applicable contract and law permit

The NPC’s amended rules allow limited access to contact lists in certain circumstances—for example, processing proportional metadata or allowing a borrower to choose a character reference or guarantor through a separate interface. This is not permission to copy and weaponize the entire contact list. Unconstrained, excessive, or disproportionate processing that leads to harassment, unfair collection, or collection from people other than the borrower’s guarantor is prohibited.

Character references are not automatically guarantors

A character reference is used to verify the borrower’s identity and the truthfulness of information submitted during the loan application. Under NPC Circular No. 2022-02:

The lender must tell the reference that they were named and explain how their contact details were obtained.
The reference must be given the option to have their personal data removed.
The reference may not be contacted for unrelated marketing, cross-selling, or third-party product offers.
A character reference is not automatically a guarantor.
Guarantor status requires the person’s separate, express consent and a legally effective undertaking to answer for the debt.

Saving someone’s number in a phone, naming them as a reference, or receiving a lender’s call does not make that person liable for the loan.

Why consent does not excuse contact shaming

Personal-data processing must have a lawful basis and remain transparent, legitimate, and proportionate. Even where consent is relied upon, it must be specific and properly informed. A broad app permission does not authorize every later use of the information.

In an NPC decision involving the Pesopop online lending application, the Commission found that requiring access to users’ phone contacts and failing to provide a separate interface for selected references violated the loan-related privacy rules and proportionality principle. The decision also treated the use of contact information for collection beyond lawful limits as unauthorized processing. The ruling illustrates how the rules apply, although liability in every new complaint still depends on its evidence and facts. See In re: Populus Lending Corporation (Pesopop).

What to do immediately

1. Preserve evidence before blocking or uninstalling anything

Save evidence in its original form whenever possible:

Full screenshots showing the sender, complete message, date, and time
Screen recordings showing the conversation or post in context
URLs, usernames, account IDs, telephone numbers, and profile pages
Call logs and voicemail files
The app’s name, developer, version, store listing, privacy notice, and requested permissions
The loan agreement, disclosure statement, account statement, payment history, and receipts
Messages sent to relatives, coworkers, employers, or other contacts
Names and contact details of witnesses or recipients
Copies of written complaints sent to the lender and proof of delivery
Any collector’s name, company, employee number, payment instructions, and claimed authority

Ask recipients to keep their own original messages and screenshots. If willing, they may later execute affidavits describing what they received and when.

Do not crop, annotate, or alter the only copy. Keep a backup outside the affected phone. Be cautious about secretly recording calls: the legality and admissibility of a recording can depend on the circumstances and the Anti-Wiretapping Act. Obtain legal advice before making undisclosed recordings.

2. Secure the phone and accounts

After documenting the permissions:

Revoke unnecessary access to contacts, photographs, files, location, camera, microphone, and SMS.
Change passwords for email, social media, banking, and e-wallet accounts if compromise is possible.
Enable multi-factor authentication and review active sessions.
Report impersonating accounts and preserve their URLs before requesting removal.
Verify payment instructions through the lender’s official channel. Do not send money to an unfamiliar personal account merely because a collector threatens you.

Revoking permission prevents some future access but does not erase data already uploaded. A written privacy request is still important.

3. Send a written privacy complaint to the lender

Before the NPC ordinarily gives a complaint due course, the complainant must show that they informed the personal information controller, processor, or concerned entity in writing and allowed it to act. If the entity takes no timely appropriate action or does not respond within 15 calendar days after receiving the written notice, the complainant may proceed. The NPC may waive this requirement for good cause or a serious violation, including grave and irreparable harm, lack of an adequate remedy, or patently illegal conduct. These requirements appear in the NPC Rules of Procedure, as amended.

Send the notice to the lender’s official customer-service channel and data protection officer, if identified in its privacy notice. State:

Your name and account or loan reference
The dates and description of the contact shaming
The numbers, accounts, employees, or collection agencies involved
What personal data was used and who received it
That you object to further disclosure and harassment
The action you want the lender to take
A request for a written response within 15 calendar days

You may request that the lender:

Stop disclosure to people who are not lawful guarantors or co-makers
Identify the personal data it holds, its sources, the recipients, and the reason for disclosure
Correct false information
Block, remove, or destroy unlawfully obtained or unauthorized data, subject to legitimate retention duties
Instruct its employees and collectors to stop the conduct
Preserve relevant collection logs and records
Confirm the authorized channel for legitimate account communications

A privacy complaint does not by itself cancel the debt or suspend valid interest, charges, or court proceedings. If you dispute the balance, charges, or identity of the creditor, state that separately and request a complete statement of account.

How to file a privacy complaint with the NPC

A person whose own personal information was misused may file. This includes the borrower and, where their information was improperly accessed or used, affected contacts. A representative generally needs a special power of attorney.

Required complaint documents

Use the NPC’s current Complaints-Assisted Form and filing instructions, or prepare a verified complaint that contains:

The complainant’s identity and contact details
The respondent’s legal name and contact details, if known
Facts identifying an unknown respondent as far as reasonably possible
A chronological narration of the violation
The personal data involved and how it was processed or disclosed
The relief requested
Copies of correspondence with the respondent and its response, if any
Documentary evidence and witness affidavits, if available
A certification against forum shopping
The complainant’s signature and proper verification or notarization

If the app name differs from the lender’s corporate name, identify both. The legal entity may appear in the loan agreement, privacy notice, disclosure statement, payment receipt, app-store developer information, or SEC records.

Where and how to submit

The amended rules allow filing at any NPC office personally, by registered mail, by courier, or by electronic mail when authorized by the Commission. The NPC’s current filing page authorizes scanned complaints by email at complaints@privacy.gov.ph. Confirm the current address and contact details on the NPC contact page before sending physical documents.

For personal filing, the rules call for two original copies plus copies for the receiving parties. Keep proof of submission and the complete filed set.

Filing fees

Under NPC Circular No. 2023-01, the basic complaint filing fee is ₱500, plus a legal research fee of 1% of the filing fee but not less than ₱10. Additional fees apply to claims for damages, motions for reconsideration, and applications for a cease-and-desist order. Qualified indigent litigants may be exempt upon submitting the required proof. Check the NPC’s current instructions before paying.

If unlawful disclosures are continuing and causing grave harm, explain the urgency and ask the NPC whether an application for a temporary ban or other immediate protective measure is appropriate. Such an application has separate requirements and may require a bond.

Report unfair collection practices to the SEC

The SEC regulates ordinary lending and financing companies and their online lending platforms. Its Memorandum Circular No. 18, Series of 2019 prohibits unfair debt-collection practices by these companies and their third-party collectors. Prohibited conduct includes threats, abusive language, deceptive collection methods, improper disclosure of borrower information, and contacting people in a borrower’s contact list who are not lawful guarantors or co-makers.

Submit the complaint through the SEC’s current iMessage ticketing system. Include:

The lender’s corporate and app names
The collector’s identity and numbers used
The loan and account details necessary to identify the transaction
Screenshots and messages sent to third parties
Proof that the recipients were not guarantors or co-makers
Copies of your complaint to the company
Any false, abusive, or threatening statements
The relief you requested

SEC registration as a corporation does not necessarily mean the company holds authority to operate as a lending or financing company or that a particular app is authorized. Report suspected unauthorized lending operations to the SEC as well.

What if the lender is supervised by the BSP?

Banks, digital banks, credit-card issuers, and other institutions supervised by the Bangko Sentral ng Pilipinas follow a different financial-consumer complaint route. The consumer generally must first use the institution’s own Financial Consumer Protection Assistance Mechanism. If the complaint is unresolved, it may be escalated through the BSP Consumer Assistance Mechanism.

Check the loan contract—not merely the app or e-wallet brand—to identify the actual lender. An e-wallet may display a loan issued by a separate SEC-regulated lending company.

The NPC may still receive a privacy complaint even when the financial institution is regulated by the BSP.

When police or NBI assistance is urgent

Seek immediate law-enforcement and legal assistance when the conduct includes:

A credible threat of physical harm or death
Extortion or a demand backed by threats of unlawful disclosure
Stalking or disclosure of a home address and real-time location
Account takeover, hacking, identity theft, or unauthorized transactions
Impersonation using the borrower’s name or photograph
Distribution or threatened distribution of intimate images
Harassment involving children or vulnerable family members
Ongoing mass publication creating an immediate safety risk

Bring the original device, backups, identification, loan documents, and a written timeline. The NBI provides investigative assistance for victims of computer-related crimes through its Cybercrime Division and regional centers. A report to the NPC or SEC does not replace a criminal complaint when threats or other crimes may have occurred.

Common mistakes to avoid

Deleting or uninstalling the app before preserving evidence
Filing only against the app’s brand name without identifying the corporate lender
Sending an emotional complaint without dates, recipients, screenshots, or requested relief
Failing to notify the lender in writing or keep proof of receipt
Assuming that a character reference is automatically liable for the debt
Treating a report to an app store or social-media platform as a substitute for an NPC or SEC complaint
Publicly reposting unredacted IDs, loan records, or other people’s telephone numbers while asking for help
Secretly recording calls without first considering the Anti-Wiretapping Act
Paying an unknown collector through an unverified personal account
Ignoring legitimate court papers because the collection conduct was abusive

Frequently asked questions

Does harassment erase the loan?

No. Unlawful collection conduct and the validity of the debt are separate issues. A borrower may challenge the harassment while still addressing any legitimate obligation through verified channels.

May a lender contact everyone in my phone if I allowed access?

No. The rules do not permit unbridled processing of a contact list. Limited processing may be allowed for lawful and proportionate purposes, but using unrelated contacts for collection or harassment is prohibited.

May the lender call my character reference about payment?

A character reference may be contacted for identity and information verification during the application process. The reference is not automatically a guarantor and should not be used as a collection target merely because their number was supplied.

Can a relative or coworker who received the messages complain?

Yes, if that person’s own personal data was improperly collected or used, they may be a personally affected data subject and may file their own NPC complaint. They can also provide evidence or an affidavit supporting the borrower’s complaint.

Must I always wait 15 calendar days before going to the NPC?

That is the general exhaustion rule after written notice to the entity. The NPC may waive it for properly alleged and proven good cause or serious, urgent harm. Explain the urgency and attach supporting evidence rather than simply omitting the prior notice.

What if the lender or app appears unregistered?

The Data Privacy Act can still apply, and NPC Circular No. 20-01 expressly covers persons acting as lenders whether or not they have the required SEC authority. Report the privacy conduct to the NPC and the suspected unauthorized lending operation to the SEC.

Can I demand deletion of all my loan records?

You may seek blocking, removal, or destruction of unlawfully obtained, unauthorized, excessive, or no-longer-necessary data. The lender may retain records that it must lawfully keep for regulatory, accounting, fraud-prevention, or legal-claim purposes. Any refusal should identify the lawful basis and appropriate retention period.

Do I need a lawyer?

A lawyer is not always required to file an administrative complaint. Legal help is advisable where there are threats, large claimed damages, disputed identity or loan documents, multiple proceedings, a request for urgent injunctive relief, or possible criminal charges.

Official references

This article provides general legal information, not advice for a particular case. Outcomes depend on the messages, loan documents, app permissions, identities of the parties, and other evidence. Official sources and procedures were checked as of 22 July 2026.