Receiving threats, repeated collection messages, or public-shaming warnings from an online lender when you never borrowed money can feel both frightening and absurd. This usually happens because someone listed you as a character reference, an app copied a borrower’s phone contacts, your number previously belonged to another person, somebody used your identity, or the sender is pretending to represent a lender. Philippine law gives you practical ways to demand that the messages stop, find out where your information came from, correct or delete improperly processed data, and report the lender to the National Privacy Commission and other authorities.

You do not become responsible for another person’s loan simply because your name or mobile number appears in an application. A character reference is not automatically a guarantor, and Article 2055 of the Civil Code provides that a guaranty cannot be presumed—it must be express. The Supreme Court has repeatedly applied this rule. (Lawphil)

Why an Online Lender May Contact You Without a Loan

The most common situations are:

A friend, relative, co-worker, or acquaintance entered your number as a character reference.
A lending app accessed and copied the borrower’s entire contact list.
You received a recycled SIM number previously used by a borrower.
Someone submitted a fraudulent loan application using your name, ID, photograph, or phone number.
The lender’s database contains an incorrect or outdated number.
A fake collection agency or scammer is using the name of a real lending company.
Your number appeared in a contact list purchased or shared by another company.

These situations are legally different. A lender may have a limited reason to contact a genuine character reference once to verify information. That does not give it unlimited authority to demand payment, reveal the borrower’s debt, threaten you, contact your family or employer, or repeatedly use your number after you have explained that you are not the borrower.

The National Privacy Commission’s rules distinguish between a character reference and a guarantor:

A character reference may be contacted only for limited verification purposes.
A guarantor must knowingly and expressly agree to answer for the borrower’s obligation.
A character reference cannot be treated as a guarantor merely because the borrower entered the reference’s name or number.
For debt collection, an online lender may contact only a person who actually consented to act as guarantor—not everyone in the borrower’s phonebook.

These restrictions are stated in NPC Circular No. 2022-02 and were reinforced in the government’s 2026 joint advisory on online lending platforms.

What Counts as a Data Privacy Violation

Republic Act No. 10173, or the Data Privacy Act of 2012, regulates the collection, use, storage, disclosure, and deletion of personal information. A name, mobile number, photograph, home address, employer, contact list, social-media profile, and information connecting a person to an alleged debt can all be personal data.

Under the Data Privacy Act, personal data must generally be:

Collected for a specified and legitimate purpose;
Processed fairly and lawfully;
Relevant and not excessive for that purpose;
Kept accurate and updated;
Retained only as long as necessary; and
Protected against unauthorized access, disclosure, or misuse.

Processing must also have a lawful basis, such as valid consent, necessity for a contract involving the data subject, compliance with a legal obligation, or a legitimate interest that does not override the individual’s fundamental rights. (National Privacy Commission)

Examples of Possible Violations

An online lender may be violating data privacy rules when it:

Copies an entire contact list even though only one or two references are needed;
Sends collection demands to people who did not borrow and did not guarantee the loan;
Reveals the borrower’s debt to relatives, friends, employers, or co-workers;
Uses your photograph in a “wanted,” “scammer,” or “fraudster” post;
Adds you to group chats created to shame the borrower;
Threatens to publish your personal information;
Refuses to correct a mistaken identity after receiving proof;
Continues calling after being told that the number was reassigned;
Uses your information for marketing after obtaining it as a reference;
Keeps your data indefinitely without a legitimate retention purpose; or
Obtains your information from another source but refuses to explain where it came from.

The NPC’s loan-processing rules specifically prohibit excessive or indiscriminate access to contact lists, contacting non-guarantors for collection, and processing that results in harassment, intimidation, threats, or public shaming. The rules apply not only to registered lenders but also to service providers and persons acting as lenders, whether or not they are properly authorized by the Securities and Exchange Commission.

Your Rights Under the Data Privacy Act

When a lender processes information about you, you may exercise the following rights:

Right to Be Informed

You may ask:

What information the lender has about you;
Why it is processing that information;
Where the information came from;
Who received or had access to it;
How long the information will be retained; and
Who the lender’s data protection officer is.

Right of Access

You may request a copy or understandable description of personal data relating to you, including the source, recipients, processing method, and reason for disclosure.

This does not necessarily entitle you to unrelated confidential information about the actual borrower. Your request should focus on records involving your identity, phone number, photograph, communications, and alleged role in the account.

Right to Correct Inaccurate Information

When the database wrongly identifies you as the borrower, co-maker, reference, or guarantor, you may demand correction.

Right to Object

You may object to processing that is based on consent or legitimate interest, particularly when the lender is using your information for collection or marketing even though you have no contractual relationship with it.

Right to Blocking, Removal, or Destruction

You may request blocking or deletion when the information was unlawfully obtained, is being used for an unauthorized purpose, is inaccurate, is no longer necessary, or prejudices your rights.

Deletion is not always immediate. A company may retain limited records needed to comply with a legal obligation, investigate fraud, or defend a pending case. However, it should not continue using retained data to harass you or pursue a debt that is not yours.

Right to Indemnification

The Data Privacy Act recognizes a right to indemnification for damage caused by inaccurate, incomplete, outdated, unlawfully obtained, or unauthorized use of personal data. Compensation is not automatic; the harm and the connection between the violation and the damage must be proved. (National Privacy Commission)

What to Do Immediately

1. Deal With Any Immediate Safety Risk

If a message contains a specific threat of physical harm, identifies your address or workplace, demands money through intimidation, or suggests that someone is coming to your location, contact the nearest police station or cybercrime unit immediately.

You do not need to wait 15 days for a lender’s response before reporting an urgent threat to law enforcement.

2. Preserve Evidence Before Blocking the Sender

Save evidence in its original form as much as possible:

Full screenshots showing the sender, date, time, and complete conversation;
Call logs showing the number, frequency, and duration of calls;
Voicemails and voice messages;
Text messages, emails, chat messages, and group-chat invitations;
Links and screenshots of social-media posts;
The name and logo of the lending app;
The app-store page and developer details;
The lender’s website, privacy notice, and listed corporate name;
Payment instructions, bank accounts, e-wallet numbers, or QR codes sent by the collector;
Screenshots of app permissions, if the app remains installed;
Messages sent to your family, co-workers, employer, or friends; and
Copies of any response from the lender.

Avoid relying only on a cropped screenshot of one threatening sentence. Investigators need context showing who sent the message, when it was sent, and how it relates to the alleged loan.

Ask other affected people to preserve the messages received on their own devices. Their screenshots and sworn statements may help prove that the lender disclosed information to third parties.

3. Create an Incident Log

A simple chronological record makes the complaint easier to evaluate.

Date and time	Sender or account	What happened	Evidence saved
10 July, 9:15 a.m.	Mobile number ending 1234	Demanded payment for a person I do not know	Screenshots 1–4
10 July, 2:40 p.m.	Same number	Threatened to message my employer	Screenshot 5
11 July, 8:05 a.m.	Facebook account using lender’s logo	Posted my photo and number	URL, screen recording, screenshots

Record facts rather than conclusions. For example, write “The sender said it would post my photograph” instead of merely writing “The lender violated the law.”

4. Do Not Pay or Admit the Debt

Paying a small amount “just to make them stop” can create confusion about whether you recognized the account. Do not promise payment, negotiate a balance, or describe yourself as a borrower or guarantor when that is untrue.

A clear response is enough:

I did not apply for, receive, or guarantee this loan. I dispute any account associated with my name or number. Stop all collection activity against me and provide the source and lawful basis for processing my personal data.

5. Do Not Send an OTP, Selfie, or Full ID to an Unknown Collector

A legitimate investigation may eventually require identity verification, but confirm the company’s official corporate name, website, email domain, and SEC registration before sending identification documents.

When submitting an ID only for verification, consider placing a watermark such as “For identity-dispute verification only—[date]” across the copy, provided it does not cover essential details. Never send an OTP, password, PIN, or account-recovery code.

6. Secure Your Phone and Accounts

After preserving evidence:

Revoke unnecessary access to contacts, SMS, files, camera, microphone, and location;
Uninstall suspicious lending apps;
Change passwords for affected email and financial accounts;
Enable multi-factor authentication;
Check whether an unknown SIM or account has been registered in your name;
Inform your bank or e-wallet provider if financial credentials may have been exposed; and
Review recent transactions and login alerts.

Do not reinstall a suspicious app merely to obtain more evidence.

7. Warn Contacts Carefully

You may privately tell family members, co-workers, or an employer that unauthorized collection messages are being sent and that no payment should be made.

Avoid reposting the collector’s allegations together with unredacted phone numbers, IDs, account details, or photographs. Publicly republishing personal information can cause additional harm and complicate the complaint.

Send a Written Data Privacy Demand First

Except in situations where the NPC allows an exception, its complaint rules generally require the complainant to first notify the respondent in writing and give it a reasonable opportunity to act. If the respondent does not provide an appropriate response within 15 calendar days, you may proceed with an NPC complaint. The NPC may waive this requirement in serious cases, including situations involving grave or irreparable harm, patently illegal conduct, or the absence of a speedy and adequate remedy.

Send the notice to as many verified channels as reasonably available:

The lender’s data protection officer;
Its official customer-service or complaints email;
The email address shown in its privacy notice;
Its SEC-registered office; and
The support channel inside the official app.

Keep delivery receipts, email headers, ticket numbers, and screenshots showing that the message was sent.

Suggested Written Notice

Subject: Formal Objection and Request to Stop Processing My Personal Data

I am receiving collection messages and/or threats concerning an alleged loan that I did not apply for, receive, or guarantee.

I formally dispute any account associated with my name, mobile number, photograph, or other personal information. I object to the continued use of my data for collection, disclosure, profiling, or contact with third parties.

Please provide:

The personal data you hold about me;

The source from which you obtained it;

The lawful basis and purpose for processing it;

The identity of persons or entities to whom it was disclosed;

The record allegedly showing that I consented to be a guarantor, if that is your claim; and

The name and contact details of your data protection officer.

Please immediately stop contacting me for collection, correct any record falsely identifying me as a borrower or guarantor, prevent further disclosure, and block or delete data that you have no lawful reason to retain.

Please confirm the action taken within 15 calendar days. I am preserving all messages and related evidence for submission to the appropriate authorities.

Do not send the notice only to the collector’s personal mobile number when an official company channel can be identified. The NPC will want to see that the responsible organization had a genuine opportunity to address the complaint.

How to File a Complaint With the National Privacy Commission

The National Privacy Commission is the principal agency for complaints involving unlawful collection, use, disclosure, retention, or deletion of personal data.

1. Identify the Respondent

Try to determine the legal entity behind the messages. The app’s brand name may be different from the registered company name.

Check:

The app-store developer listing;
The privacy notice and terms of service;
The lender’s website footer;
SEC registration information;
Email domains;
Payment account names;
Text-message sender IDs; and
Names appearing in collection notices.

If the identity remains uncertain, provide every available identifier, including phone numbers, URLs, screenshots, app names, and bank or e-wallet details. Do not guess a corporate name.

2. Complete the Current Complaint-Affidavit

Download the current NPC Complaint-Affidavit form. The form asks for:

Your identity and contact information;
Information about the respondent;
The personal data involved;
A chronological statement of facts;
The steps you took to contact the respondent;
The relief you are requesting;
Related cases or complaints; and
Verification and certification against forum shopping.

The form must be answered accurately and supported by evidence. Because it is an affidavit, false material statements can have legal consequences.

3. Prepare the Attachments

Document	Why it matters
Notarized Complaint-Affidavit	Contains the sworn allegations
Valid government-issued ID	Confirms the complainant’s identity
Written demand or privacy objection	Shows that the respondent was notified
Proof of delivery and any response	Establishes compliance with the 15-day requirement
Screenshots and message exports	Prove the communications and disclosures
Incident chronology	Helps investigators follow the sequence
App, website, and corporate information	Helps identify the responsible entity
Witness affidavits, when available	Support messages or posts received by third parties
Proof of actual loss or harm	Relevant when indemnification is requested
Special power of attorney	Required when filing through a representative

Arrange screenshots by date and label them clearly, such as “Annex A,” “Annex B,” and “Annex C.” Refer to those labels in the factual narration.

4. Have the Complaint Notarized

Sign the Complaint-Affidavit before a notary public. Bring the original valid ID that will be presented to the notary.

A representative filing for an adult complainant generally needs a special power of attorney. A parent filing for a minor should attach proof of the relationship, such as a birth certificate, while a court-appointed guardian should attach the relevant order.

For a Filipino citizen residing abroad without a Philippine representative, the amended NPC rules allow authentication through a Philippine Embassy or Consulate, or through an apostille from the country of origin where the apostille system is available.

A foreign national whose data was processed in connection with Philippine operations may ask the NPC to assess whether the Data Privacy Act applies. Jurisdiction may depend on where the company is established, where the processing occurred, and whether the processing concerns Philippine residents or has links to the Philippines.

5. Submit the Complaint

The NPC’s official complaint-filing instructions allow filing through authorized electronic submission, personal delivery, registered mail, or courier.

Electronic documents should generally be sent in PDF form when practicable. The complaint may be emailed to complaints@privacy.gov.ph, subject to the NPC’s current filing and payment instructions.

The NPC’s current office address is:

National Privacy Commission 25th–27th Floors, The Upper Class Tower Quezon Avenue corner Scout Reyes Street Quezon City, Philippines

Check the official filing page before sending physical documents because receiving procedures and office arrangements can change. (National Privacy Commission)

6. Pay the Assessed Filing Fee

The NPC’s published schedule sets a ₱500 basic filing fee for a complaint. Additional fees may apply when claiming damages or requesting certain special remedies. Qualified indigent complainants may apply for exemption by submitting the required proof of income or indigency.

The NPC currently uses an assessment-and-payment process involving a Statement of Revenue and Accountable Form and Landbank Link.Biz.Portal. Follow the instructions sent by the NPC rather than paying money to an account supplied by the respondent or collector.

7. Monitor the Case and Answer NPC Communications

The NPC may:

Require clarification or additional evidence;
Direct the respondent to submit a comment;
Conduct preliminary conferences;
Encourage settlement or mediation where appropriate;
Receive affidavits and position papers;
Order compliance with data-subject rights;
Direct correction, blocking, deletion, or other remedial action;
Award appropriate indemnification when legally supported; or
Recommend criminal prosecution when evidence indicates a possible offense.

The NPC’s public process information indicates an initial period of approximately 30 calendar days for determining whether a complaint should be given due course or dismissed without prejudice. It also describes a typical overall process of roughly 10 to 12 months. Actual cases can take longer when the respondent is difficult to identify or serve, evidence is incomplete, multiple parties are involved, or further proceedings are required. (National Privacy Commission)

NPC enforcement is not merely theoretical. The Commission has issued takedown orders against online lending applications and has recommended prosecution in cases involving harassment, public shaming, and unlawful data use. (National Privacy Commission)

Where Else to Report Online Lending Harassment

One incident may involve several separate violations. Reporting to one agency does not necessarily address every issue.

Office	Report when	What the office can address
National Privacy Commission	Your number, photo, contacts, identity, or other data was unlawfully collected, used, disclosed, or retained	Data-subject rights, compliance orders, administrative remedies, indemnification, and possible prosecution recommendations
Securities and Exchange Commission	A lending or financing company uses abusive collection practices, operates an online lending app, or may be unregistered	Regulation, registration, licensing, and compliance of lending and financing companies
NBI Cybercrime Division or PNP cybercrime unit	There are threats, extortion, identity theft, impersonation, account hacking, fraudulent applications, or online publication	Criminal investigation and evidence preservation
Nearest police station	There is an immediate or specific threat to safety	Immediate police assistance, documentation, and referral
App store or platform	The application or account violates platform rules	Account review, suspension, or app takedown; this does not replace a government complaint

Reporting to the SEC

Use the SEC iMessage portal. The portal’s complaint route includes:

Financing and Lending Companies Department → Monitoring and Compliance Division → Complaints on Financing and Lending Companies

Attach the same organized evidence used for the NPC complaint, particularly messages showing threats, public shaming, unauthorized contact-list use, and collection against a non-borrower. (Securities and Exchange Commission)

Republic Act No. 11765, or the Financial Products and Services Consumer Protection Act of 2022, prohibits abusive debt-collection practices by covered financial service providers and requires protection of client data and privacy. (Supreme Court E-Library)

Reporting Criminal Conduct

A privacy complaint is not a substitute for a criminal report. Depending on the exact words and acts involved, authorities may assess possible violations involving:

Grave threats;
Coercion;
Unjust vexation;
Extortion or attempted extortion;
Computer-related identity theft;
Unauthorized access to accounts or devices;
Falsification or use of falsified documents; or
Cyberlibel when defamatory material is published online.

The proper offense depends on the complete facts, not merely the label used by the victim. Bring the original device, screenshots, URLs, account identifiers, and an incident chronology to investigators.

The NBI’s cybercrime assistance procedure states that complainants may be required to complete the division’s complaint form and submit supporting materials. The NBI also maintains an online complaint page and regional offices. (National Bureau of Investigation)

Common Situations and How to Handle Them

You Were Listed as a Character Reference

Tell the lender in writing that:

You did not consent to guarantee the loan;
You do not accept responsibility for payment;
Any contact must be limited to legitimate verification;
Your data must not be used for collection or marketing; and
You are requesting the source, purpose, retention period, and removal of your information.

Being a friend or relative of the borrower does not make you liable. A guaranty must be express and cannot simply be created by the borrower typing your name into an app. (Lawphil)

Your Number Was Recycled

Ask the lender to correct its records and explain that the number has been reassigned. Attach only enough evidence to establish current ownership of the number, such as a recent telco document or account screenshot, after verifying the company’s official channel.

The lender should not continue collection merely because its database has not been updated. The Data Privacy Act requires personal data to be accurate, relevant, and corrected when necessary. (National Privacy Commission)

Someone Used Your Identity for a Loan

Treat the matter as possible identity theft rather than an ordinary wrong-number complaint.

Request:

A copy or description of the application records relating to you;
The date and method of application;
The phone number, email, device, or account used;
The IDs and photographs attributed to you;
The source of your personal information;
Immediate suspension of collection and disbursement activity; and
Preservation of logs for investigation.

Do not pay or sign a restructuring agreement. Report the suspected identity theft to the NBI or PNP cybercrime authorities and include the police or investigation reference number in your NPC and SEC submissions.

The Lender Contacted Your Employer or Co-Workers

Preserve each message separately. Ask the recipient to identify:

When the message was received;
The account or number that sent it;
What personal information was disclosed;
Whether the message was shown to other people; and
Any workplace consequence that followed.

Each person whose own information was processed or who directly received threatening messages may have a separate basis to submit evidence or file a complaint.

The Lender Posted Your Photograph Online

Save:

The exact URL;
Full-page screenshots;
The account name and profile URL;
Date and time of access;
Reactions, comments, and shares;
Any visible group or page name; and
A screen recording showing how the post was located.

After preserving evidence, report the post to the platform. If the post falsely accuses you of fraud, theft, or nonpayment, bring it to cybercrime investigators for assessment. A platform takedown is useful but does not replace an NPC or criminal complaint.

You Are Outside the Philippines

A non-resident Filipino may prepare the complaint abroad and comply with the NPC’s consular-notarization or apostille requirements. A Philippine representative may also act under a properly authenticated special power of attorney.

Keep electronic originals and submit readable PDF copies. Documents in another language should be accompanied by a reliable English translation when needed to make the evidence understandable.

Mistakes That Can Weaken a Complaint

Blocking Every Number Before Saving Evidence

Blocking may be necessary for safety and peace of mind, but first save enough information to identify the sender and show the pattern. When the messages involve an immediate threat, preserve the minimum evidence available and seek police help without delay.

Filing Only Against the App’s Brand Name

An app can use a marketing name unrelated to the corporation operating it. Include both the brand name and every possible corporate identifier, while clearly marking uncertain information as unverified.

Sending Only a General Complaint

Statements such as “They harassed me many times” are less useful than a dated chronology with attached screenshots and exact quotations.

Failing to Notify the Respondent

Unless a recognized exception applies, the NPC may dismiss a complaint without prejudice when the complainant did not first notify the respondent and allow it to act. Send a written privacy demand and retain proof of delivery.

Paying to Make the Harassment Stop

Payment may not stop a fraudulent collector and can expose additional financial information. Dispute the account in writing instead.

Sending More Personal Data Than Necessary

Do not send birth certificates, IDs, selfies, signatures, bank statements, or contact lists unless genuinely necessary and transmitted through a verified channel.

Publicly Shaming the Collector in Return

Posting unverified names, phone numbers, employee photographs, or accusations can create a separate dispute. Preserve evidence and use formal complaint channels.

Concealing Related Complaints or Cases

The NPC Complaint-Affidavit contains a certification against forum shopping and asks about related proceedings. Disclose SEC, police, NBI, court, and other NPC filings accurately, even when they seek different remedies.

Frequently Asked Questions

Can an online lender legally contact me if I never borrowed?

A limited, respectful contact for genuine reference verification may be permissible. Repeated collection demands, threats, disclosure of the borrower’s debt, public shaming, or continued contact after correction can violate NPC rules and the Data Privacy Act.

Am I liable because somebody listed me as a reference?

No. A character reference is not automatically a guarantor. Under Article 2055 of the Civil Code, a guaranty cannot be presumed and must be express.

Can a borrower make me a guarantor without my consent?

No. The borrower cannot unilaterally bind you to pay. The lender should be able to produce evidence that you expressly agreed to guarantee the obligation.

Should I pay a small amount to stop the messages?

No, when the debt is not yours. State clearly that you dispute the account and do not acknowledge liability. Preserve the demand and report continuing harassment.

Can the lender contact my family, friends, or employer?

It cannot indiscriminately use a borrower’s contact list for debt collection. Under the NPC’s loan-processing rules, collection contact should be directed only to a person who expressly consented to act as guarantor.

Can I complain even if I do not know the company’s legal name?

Yes, but identification problems can delay the case. Submit every available phone number, app name, URL, sender ID, email address, payment account, privacy notice, and screenshot.

Do I need a lawyer to file an NPC complaint?

The NPC complaint process allows individuals to file on their own using the prescribed Complaint-Affidavit. Legal assistance may be useful when several companies are involved, substantial damages are claimed, identity theft occurred, or parallel civil and criminal proceedings are being considered.

How long does an NPC complaint take?

The NPC’s published process indicates an initial evaluation period of approximately 30 calendar days and a typical overall duration of roughly 10 to 12 months. Difficult service, incomplete documents, hearings, and complex evidence can extend the case.

Can I ask for damages?

You may request indemnification under the Data Privacy Act and may also evaluate a separate civil action under Articles 19, 20, 21, and 26 of the Civil Code. You must prove the violation, actual harm, and the connection between them. Emotional distress, lost income, reputational damage, medical expenses, and other losses should be documented rather than merely asserted. (Lawphil)

Is deleting or blocking my number enough?

Blocking may stop calls on one device, but it does not correct the lender’s database, prevent messages to other people, or address prior disclosure. Send a written objection and request correction, blocking, or deletion through the company’s official channel.

Key Takeaways

You are not liable for a loan merely because someone entered your name or number as a reference.
A character reference is not a guarantor; a guaranty must be express.
Online lenders may not indiscriminately use contact lists, shame non-borrowers, or contact non-guarantors for collection.
Preserve complete evidence before blocking numbers, deleting messages, or uninstalling an app.
Send a written privacy objection and generally allow 15 calendar days for an appropriate response.
File data-processing complaints with the National Privacy Commission and lending-company complaints through SEC iMessage.
Report specific threats, identity theft, extortion, impersonation, or harmful online publication to cybercrime authorities without waiting for the NPC process.
Do not pay, provide an OTP, or send sensitive identification documents to an unverified collector.