Quick answer

Usually, no. A lending app may contact the borrower and, within strict limits, a person whom the borrower deliberately named as a character reference, guarantor, or co-maker. It generally may not search the borrower’s phone contacts and call, text, or message relatives, an employer, co-workers, friends, or a former partner to disclose the debt, demand payment, embarrass the borrower, or pressure someone else to make the borrower pay.

The person’s actual legal role matters:

A character reference may be contacted only to verify the borrower’s identity and the truth of information submitted in the loan application. The reference must not automatically be treated as a guarantor or contacted for debt collection.
A guarantor or co-maker may be contacted about an obligation genuinely covered by the signed agreement. Liability depends on the wording and validity of that agreement.
A relative, employer, co-worker, or former partner who is neither a guarantor nor a co-maker does not become liable merely because the lender found the person in the borrower’s contacts, the borrower named the person as a reference, or the parties are related.
Limited employment verification may be permissible when it is transparently disclosed, necessary for a legitimate loan-evaluation purpose, and proportionate. That does not authorize telling supervisors or co-workers about the debt or using the workplace to shame the borrower.

Consent to app permissions or broad loan terms is not a free pass. SEC rules expressly treat contacting people in the borrower’s contact list—other than named guarantors or co-makers—as an unfair collection practice, notwithstanding the borrower’s consent.

What Philippine rules protect borrowers and their contacts?

Two regulatory frameworks usually apply.

Data-privacy rules

Under the Data Privacy Act of 2012, personal information must be processed lawfully, fairly, transparently, for a legitimate declared purpose, and only to the extent necessary. A lender’s legitimate interest in collecting a valid debt does not automatically override the privacy rights of the borrower or third parties.

The more specific rules are in NPC Circular No. 2020-01, as amended by NPC Circular No. 2022-02. They prohibit “unbridled processing” of contact lists, including processing that:

leads to harassment;
is used to collect a debt from people other than guarantors provided by the borrower; or
results in unfair collection practices.

An app may be given only the minimum access necessary for the borrower to choose a character reference or guarantor. It should provide a separate interface for that choice—not silently copy or harvest the borrower’s entire phone, email, or social-media contact list.

SEC debt-collection rules

SEC Memorandum Circular No. 18, Series of 2019 prohibits lending and financing companies, their collectors, agents, and third-party service providers from using unfair collection methods.

Prohibited conduct includes:

violence or threats of violence or other criminal means;
threats to take action that cannot legally be taken;
obscene, insulting, or abusive language amounting to an offense;
false representations or deceptive collection methods;
publishing or disclosing borrowers’ names and personal information outside a lawful exception;
communicating false loan information, including concealing that a debt is disputed;
contacting people in the borrower’s contact list other than named guarantors or co-makers; and
contacting the borrower before 6:00 a.m. or after 10:00 p.m., subject to the circular’s limited exceptions for accounts more than 15 days past due or times expressly identified by the borrower as the only reasonable opportunities for contact.

The exception concerning late-night or early-morning contact does not authorize harassment, public shaming, threats, or disclosure to unrelated third parties.

Rules for specific people

Relatives

Being the borrower’s parent, sibling, child, cousin, or other relative does not make a person responsible for the debt. A lender should not disclose the debt to a relative merely to locate, embarrass, or pressure the borrower.

The position may be different if the relative knowingly signed as a guarantor or co-maker. A spouse’s possible responsibility can also require examination of the loan documents, the property regime, the purpose of the debt, and applicable family and property law. Marriage alone should not be treated as automatic proof that a spouse personally guaranteed the loan.

Employer and co-workers

A lender may have a legitimate reason to verify employment information supplied in an application, but the processing must remain necessary, transparent, and proportionate. Verification does not ordinarily justify announcing the loan, delinquency, balance, or alleged refusal to pay to human resources, a manager, receptionist, or co-workers.

A private collector cannot simply order an employer to deduct money from wages. Any legally enforceable wage deduction or garnishment must rest on proper authority and applicable legal procedure—not merely a collector’s text, call, or demand letter.

Former partner

An ex-spouse, former boyfriend or girlfriend, or former live-in partner generally has no obligation to pay merely because of the past relationship. The lender should not disclose the borrower’s debt to that person or use the person as a collection intermediary unless there is a separate lawful basis.

If the former partner signed the relevant agreement as a co-borrower, co-maker, or guarantor, the documents must be examined. Ending the relationship does not necessarily cancel a contractual obligation already undertaken, but the lender may collect only within the scope of that obligation and through lawful methods.

Character reference

A character reference is not a backup payer. Under the NPC rules, the reference exists to verify the borrower’s identity and the truth of information supplied for the loan application.

The lender must:

tell the person that the borrower selected them as a character reference;
explain how the contact details were obtained;
offer the person the option to have their data removed as a reference; and
avoid using the information for collection, marketing, cross-selling, or unrelated third-party offers.

The borrower is also expected to inform the person that they have been named as a reference.

Guarantor or co-maker

A genuine guarantor or co-maker may be contacted because that person may have an obligation under the contract. But the lender cannot merely label a character reference as a guarantor after default.

Ask for the complete document bearing the person’s signature or valid electronic assent. Whether the person is liable—and whether collection must first be pursued against the principal borrower—depends on the wording and legal nature of the undertaking. Do not pay solely because a collector asserts that a name or number in the app proves guaranty.

App permission is not unlimited consent

Clicking “Allow Contacts” does not necessarily authorize every later use of the contact list. Valid consent under the Data Privacy Act must be freely given, specific, informed, and evidenced by written, electronic, or recorded means.

Even when a borrower accepted a privacy notice:

the lender must still observe transparency, legitimate purpose, and proportionality;
access should be limited to the relevant stage and purpose;
data obtained for identity or application verification cannot automatically be repurposed for public shaming or collection; and
the SEC prohibition on contacting unrelated people in the contact list applies notwithstanding the borrower’s consent.

Revoking phone permission can prevent future device access, but it may not erase information already copied. Send a separate written request to the lender or its data protection officer asking what data was collected, where it came from, to whom it was disclosed, and whether unlawfully processed data has been blocked or deleted.

What to do if a lender contacts other people

1. Preserve the evidence before blocking anyone

Keep the original material where possible:

complete screenshots showing the sender, number, account name, date, and time;
the full message thread, not only the most offensive line;
call logs, voice messages, emails, demand letters, and social-media posts;
the app’s name, developer, download page, privacy notice, permissions, and version;
the loan agreement, disclosure statement, payment history, and receipts;
names and numbers used by collectors;
messages received by relatives, an employer, co-workers, or a former partner;
written statements from recipients describing what was said; and
proof that the person contacted was not a guarantor or co-maker.

Export or back up evidence before uninstalling the app. Avoid editing screenshots in a way that removes identifying details.

2. Secure the phone and accounts

Review the app’s permissions and disable access that is no longer necessary, including contacts, storage, photos, location, camera, microphone, and social-media accounts. Change reused passwords and enable multi-factor authentication where available.

Do not delete the loan records merely to stop notifications. Preserve copies first.

3. Dispute the conduct in writing

Write to the lending company and its data protection officer. Identify the borrower and account without sending unnecessary sensitive information. State:

which people were contacted;
whether they were references, guarantors, or neither;
what loan information was disclosed;
why the processing or disclosure is disputed;
that harassment and third-party contact must stop;
that communications should be directed to a specified borrower-controlled channel;
that inaccurate information must be corrected; and
that you are requesting access to the source, recipients, purpose, and history of the relevant personal-data processing.

If the debt amount is also disputed, request an itemized statement and continue separating that accounting issue from the privacy complaint. A collection violation does not automatically extinguish a valid debt.

4. Complain to the proper regulator

For unfair collection by a lending or financing company, use the SEC’s official lending and financing company complaints page or SEC iMessage. Follow the current form requirements and attach the evidence. The SEC advises filing one complaint form per respondent company and including a valid government-issued ID.

For misuse or unauthorized disclosure of personal data, a complaint may be filed with the NPC. Ordinarily, the complainant must first notify the respondent in writing and allow appropriate action. If the respondent gives no response within 15 calendar days, or fails to act timely and appropriately, attach proof to the NPC complaint. The NPC may waive exhaustion in the circumstances allowed by its rules, but a complainant should not assume an exception applies.

Consult the NPC’s current complaint mechanics, forms, and filing page. A formal complaint generally requires a notarized complaint-assisted form or verified complaint, supporting documents, and any witness affidavits. The NPC currently lists personal, registered-mail, courier, and authorized email filing methods; verify the current requirements before submission.

A borrower and a contacted relative, employer, or former partner may have different privacy claims because each is a data subject whose information may have been processed.

5. Address threats or immediate danger separately

Contact the Philippine National Police, the National Bureau of Investigation, or emergency services promptly if messages contain credible threats of violence, extortion, stalking, doxxing, impersonation, or other conduct creating immediate danger. Preserve the original device and messages if law enforcement may need to examine them.

Common mistakes to avoid

Assuming every collection call is illegal. A lender may lawfully contact the borrower and may pursue a valid debt through proper channels.
Treating a reference as a guarantor. A reference does not become liable without a valid contractual undertaking.
Relying only on verbal complaints. Written notice and proof of receipt are important, particularly for an NPC complaint.
Paying a collector without verification. Confirm the company, account, amount, and authorized payment channel. Keep official receipts.
Posting unredacted evidence publicly. This may expose IDs, account numbers, phone numbers, and third-party data. Send complete evidence privately to the proper authority.
Deleting the app immediately. Preserve the agreement, privacy notice, permission screens, messages, and transaction history first.
Believing harassment cancels the loan. Regulatory violations may create separate administrative, civil, or criminal consequences, but they do not by themselves erase a valid principal obligation.
Ignoring court papers. A collection message is not a court order, but an actual summons, subpoena, or other official process requires prompt attention.

When legal help is urgent

Consult a Philippine lawyer promptly if:

a court summons or formal pleading has been served;
wages, bank accounts, or property are being threatened with seizure without clear legal process;
a signature or electronic guaranty is disputed;
intimate images, altered photos, IDs, or contact lists have been posted or threatened with publication;
the collector is impersonating a court, police officer, lawyer, or government agency;
threats create a genuine risk to personal safety;
the debt involves a deceased borrower, marital or community property, multiple co-borrowers, or substantial security; or
the lender’s identity, SEC registration, or authority to operate cannot be verified.

Frequently asked questions

Can a lender ask my relative to tell me to call?

A narrowly limited message that does not disclose the loan may present a different factual issue from telling the relative about the debt. However, using relatives repeatedly as collection intermediaries, revealing the debt, or creating pressure and embarrassment may violate privacy and unfair-collection rules. The exact words, source of the contact details, frequency, and purpose matter.

Can the lender contact the number I gave as a reference?

It may contact a genuine character reference for identity and application-information verification. It must explain that the person was selected as a reference, disclose how the number was obtained, and provide an option for removal. It may not turn the reference into a debt collector or guarantor.

Can an employer fire an employee because a lending app called?

A collection call does not itself determine whether an employment action is lawful. Employment consequences depend on the facts, workplace rules, and labor law. Preserve what the lender disclosed and obtain employment advice promptly if disciplinary action is threatened or taken.

Can a lender post my name or photo online?

Publishing a borrower’s name, photograph, loan details, or accusations to shame the borrower may violate SEC collection rules and data-privacy law. A photograph collected for identification or verification must not be repurposed to harass or embarrass the borrower.

What if the relative agreed to be a reference?

That allows only the properly disclosed and lawful processing connected with being a reference. It does not make the relative liable for the loan or permit collection calls, marketing, or unrelated disclosure.

What if I really owe the money?

The lender may demand payment from the proper debtor, negotiate, send lawful notices, or use available legal remedies. It must still comply with privacy and fair-collection rules. Ask for an itemized balance, propose a realistic payment arrangement if appropriate, and pay only through a verified channel.

Does blocking the collector stop legal collection?

No. Blocking abusive messages may protect your immediate peace, but it does not prevent lawful notices or a court action. Give the lender one reliable written channel for legitimate account communications and monitor it.

Where can I verify the governing rules?

Primary official references include:

This article provides general Philippine legal information, not legal advice for a particular loan, message, or contract. Liability and available remedies depend on the documents and complete facts. Official sources and procedures were checked as of August 27, 2026.