Quick answer

Usually, no. A lending app may contact the borrower and, within strict limits, a person whom the borrower deliberately identified as a character reference, guarantor, or co-maker. It generally may not search the borrower’s phonebook and contact relatives, an employer, co-workers, friends, or a former partner to collect the debt, pressure the borrower, disclose the loan, or cause embarrassment.

The important distinctions are:

A character reference may be contacted to verify the borrower’s identity and the truthfulness of information supplied in the loan application. A reference does not become liable for the debt merely because their name or number was provided.
A guarantor or co-maker may be contacted about collection if that person actually agreed to undertake that legal obligation. A lender cannot simply label someone a guarantor after taking the person’s number from a contact list.
A relative, employer, co-worker, friend, or former partner who is neither the borrower nor a genuine guarantor or co-maker generally should not be contacted for debt collection.
Even when contact is otherwise permitted, threats, insults, deception, public shaming, false statements, excessive disclosure, and other abusive collection practices remain prohibited.

Whether a particular contact was lawful can depend on what the person signed, what the borrower disclosed, the purpose of the communication, and exactly what the collector said.

The rules that protect borrowers and their contacts

Two regulatory frameworks are especially important.

Data-privacy rules

The Data Privacy Act of 2012 requires personal-data processing to have a lawful basis and to comply with transparency, legitimate-purpose, and proportionality requirements. Consent obtained through an app does not give a lender unlimited authority to collect, copy, use, or disclose every contact stored on a phone.

NPC Circular No. 2020-01, as amended by NPC Circular No. 2022-02, specifically regulates personal data used in loan-related transactions. It prohibits unbridled—that is, unconstrained, excessive, or disproportionate—processing of contact lists. Prohibited processing includes:

processing that leads to harassment;
using contact-list data to collect a debt from persons other than guarantors provided by the borrower; and
processing that results in unfair collection practices.

An online lending app may have limited access that lets the borrower select a character reference or guarantor of the borrower’s own choosing. That is different from copying or harvesting the entire phonebook.

SEC rules on unfair debt collection

SEC Memorandum Circular No. 18, Series of 2019 applies to lending and financing companies, including their collection agents and third-party service providers. Among other things, it treats the following as unfair collection practices:

using or threatening violence or other criminal means against a person, reputation, or property;
threatening action that cannot legally be taken;
using obscenities, insults, or profane language that amounts to abuse or a criminal offense;
improperly disclosing or publishing a borrower’s name or personal information;
communicating false loan information or concealing that a debt is disputed;
using false representations or deceptive means;
making contact before 6:00 a.m. or after 10:00 p.m., subject to the circular’s limited exceptions; and
despite purported borrower consent, contacting people in the borrower’s contact list who were not named as guarantors or co-makers.

The lender remains responsible for collection work performed through an outsourced agency or individual collector.

When may a relative be contacted?

Being related to the borrower does not make someone responsible for the loan.

A relative may generally be contacted only when there is an independent, legitimate reason—for example, the relative was deliberately named as a character reference or validly agreed to become a guarantor or co-maker. The permitted purpose and content of the call still depend on that role.

A collector should not call parents, siblings, children, cousins, or other relatives merely because their numbers appeared in the borrower’s phonebook. It is particularly problematic to tell them that the borrower is delinquent, demand that they pay, ask them to shame the borrower, or threaten to expose the debt to the family.

A spouse is not automatically liable simply because of the marriage. Liability may depend on who signed the loan, the terms of the obligation, and applicable Civil Code or Family Code rules concerning marital property. A spouse who did not sign should not be casually treated as a co-maker or guarantor.

When may an employer or co-worker be contacted?

A lender may process employment information when genuinely necessary for a lawful loan-related purpose, such as verifying information provided in an application. That does not create a general right to reveal the debt to a supervisor, human-resources department, receptionist, or co-workers.

Using the workplace to pressure or embarrass the borrower—for example, announcing the unpaid loan, asking HR to force payment, sending a workplace group message, or repeatedly calling colleagues—is likely to raise both unfair-collection and data-privacy concerns.

A collector’s attempt to reach the borrower through a known workplace number must still be proportionate and confidential. It does not authorize disclosure of the loan to whoever answers. The rules may differ if the employer is itself a lawful party to the transaction, such as under a valid salary-deduction arrangement, but the lender must stay within the authority actually granted.

What about a former boyfriend, girlfriend, or spouse?

A former partner has no special collection responsibility merely because of the past relationship.

The person may be contacted within the applicable limits only if they were deliberately designated as a character reference or validly became a guarantor, co-maker, or other party to the loan. A collector may not treat a former partner as liable merely because the person appears in old messages, social-media connections, emergency-contact records, or the borrower’s phonebook.

If the former partner was only a character reference, the lender may use the contact for identity or information verification—not debt collection. The reference must be told that they were selected, how their contact details were obtained, and that they may ask to have their data removed as a character reference.

Character reference is not the same as guarantor

This distinction is crucial.

A character reference is a person whose information is supplied to help verify the applicant’s identity and the truthfulness of application information. Under the amended NPC circular:

the borrower is responsible for informing the chosen reference;
the lender must tell the reference that they were selected and explain how it obtained their details;
the lender must offer the reference the option to have their personal data removed as a reference; and
the lender may not contact the reference for unrelated marketing, cross-selling, or third-party offers.

A character reference must not automatically be treated as a guarantor.

A guarantor, by contrast, expressly binds themselves to fulfill the borrower’s obligation if the borrower fails to do so. The lender must obtain the guarantor’s separate consent in accordance with data-privacy requirements and the Civil Code rules on guaranty. A claim that someone is a guarantor should therefore be checked against the signed or otherwise validly executed documents—not merely the lender’s database label.

Does clicking “Allow contacts” make all calls legal?

No. Permission given through a phone’s operating system is not unlimited legal consent.

The app must still explain what data will be processed, for what purpose, and under what lawful basis. Collection must be necessary and proportionate. The NPC requires appropriate, accessible, and timely privacy notices rather than vague permission requests that conceal the real use of the data.

Unbridled access to phone, email, or social-media contact lists is prohibited. An app should not copy an entire contact list for debt collection or harassment. When access is no longer necessary, the app should prompt the user to revoke the permission or turn it off by default where appropriate.

Revoking the phone permission can prevent future app access, but it may not erase data already copied. A written request to the lender or its data protection officer may therefore also be necessary.

What lawful collection can still look like

The restrictions do not erase a valid debt or stop a creditor from using lawful collection remedies. Depending on the facts and contract, a lender may:

send accurate and appropriately worded demands directly to the borrower;
communicate with a properly authorized representative;
contact a genuine guarantor or co-maker within the scope of that person’s obligation;
report information through lawful credit-information channels;
engage a collection agency while remaining accountable for its conduct; or
file an appropriate civil action and serve court documents through lawful procedure.

A legitimate demand may be firm. It should not contain violence, fabricated criminal charges, fake court documents, public humiliation, or threats to take action the collector has no legal right to take.

Nonpayment of an ordinary loan does not, by itself, automatically prove a crime. Fraud or another criminal offense requires facts establishing the elements of that offense; a collector cannot truthfully present every unpaid debt as an automatic criminal case.

What borrowers should do immediately

1. Preserve the evidence

Keep original, unedited copies where possible:

screenshots showing the full messages, sender, date, and time;
call logs and the numbers used;
voicemails and recordings lawfully obtained;
emails, demand letters, envelopes, and delivery records;
social-media posts, comments, account names, and working links;
statements from relatives, employers, co-workers, or former partners who were contacted;
the app’s name, developer, download page, privacy notice, and requested permissions;
the loan agreement, disclosure statement, receipts, and payment history; and
the collector’s name, agency, claimed authority, and exact statements.

Ask contacted third parties to preserve their own screenshots and call logs. Do not rely solely on disappearing messages or cropped screenshots that omit identifying details.

2. Secure the phone and accounts

Review the app’s permissions and disable access that is no longer necessary, especially contacts, call logs, files, camera, microphone, and location. Preserve evidence before uninstalling the app. Change compromised passwords, enable multi-factor authentication, and warn contacts not to send money or personal information to unknown collectors.

3. Put the objection in writing

Write to the lender and, if identified in its privacy notice, its data protection officer. State:

which people were contacted;
when and how contact occurred;
what loan information was disclosed;
whether those people were references, guarantors, or neither;
which statements were false, threatening, or abusive;
that the debt is disputed, if applicable; and
the specific action requested.

Possible requests include stopping third-party collection contact, identifying the source and recipients of the data, correcting inaccurate information, removing a person as a character reference, and explaining the lawful basis and purpose of the processing.

Keep proof that the complaint was delivered. Rights such as erasure are not absolute: a lender may retain information that remains necessary for a lawful obligation, legal claim, regulatory requirement, or other lawful purpose. That does not permit continued harassment or unnecessary disclosure.

4. Separate the collection complaint from the debt issue

If the amount is disputed, request a written account statement and itemization of principal, interest, fees, penalties, payments, and balance. If the debt is valid, propose payment only through a verified company channel and obtain an official receipt.

Do not send payment to a collector’s personal wallet merely because of a threat. Confirm the lender’s identity and authority first. An unlawful collection method does not automatically cancel the underlying debt, while payment does not necessarily waive a complaint about prior misconduct.

Where to complain

Securities and Exchange Commission

For conduct by a lending or financing company, a complaint may be submitted through the SEC’s current iMessage ticketing portal. Include the company’s legal name if known, the lending app’s name, relevant dates, loan documents, messages, call records, and evidence of third-party contact.

The app’s brand name may differ from the corporation operating it. Check the app page, loan agreement, disclosure statement, receipts, and privacy notice for the corporate name, SEC registration number, and Certificate of Authority number.

National Privacy Commission

If personal data was improperly collected, accessed, used, or disclosed, first send a written complaint to the lender or other responsible entity and preserve proof of receipt. Under the NPC’s procedural rules, a formal complaint ordinarily requires showing that the entity failed to take timely or appropriate action, or did not respond within 15 calendar days after receiving the written notice, subject to recognized exceptions.

The NPC provides its current complaint instructions and forms. A formal complaint must follow the prescribed requirements, which may include verification, notarization, supporting evidence, and a certification against forum shopping. Check the current form and filing instructions immediately before submission.

A borrower and an independently affected relative, employer, co-worker, or former partner may each have data-privacy interests. The person whose own information was misused or who personally received the disclosure should document that harm.

Police or cybercrime authorities

Seek immediate police or cybercrime assistance if the conduct involves a credible threat of violence, stalking, extortion, identity theft, account takeover, fabricated sexual material, doxxing that creates a safety risk, or another apparent crime. Preserve the messages and do not meet a threatening collector alone.

For online incidents, complaints may also be brought to the Philippine National Police Anti-Cybercrime Group or the National Bureau of Investigation Cybercrime Division. Regulatory complaints to the SEC or NPC do not replace emergency protection or a criminal report when someone is in danger.

Common mistakes to avoid

Assuming that every third-party call is lawful because the borrower accepted the app’s terms.
Assuming that a character reference must pay the debt.
Deleting the app, messages, and call history before preserving evidence.
Posting unredacted IDs, loan documents, or other people’s phone numbers publicly.
Ignoring a real court summons because earlier collection messages were abusive.
Paying an unverified personal account under pressure.
Treating harassment as proof that the debt itself is invalid.
Filing a vague complaint without dates, screenshots, the company identity, or proof of prior written notice.
Threatening collectors in return, which may create a separate problem.
Relying on a verbal promise that third-party contact will stop.

When legal help is urgent

Consult a Philippine lawyer or the Public Attorney’s Office promptly when:

a summons, subpoena, complaint, or other official document has been received;
wages, bank funds, or property are allegedly about to be seized;
the person contacted actually signed as a guarantor or co-maker;
the loan documents contain disputed signatures or identity information;
the lender has published personal data or defamatory accusations to a broad audience;
threats create an immediate risk to physical safety, employment, or housing;
large amounts or several lenders are involved; or
a regulatory complaint may overlap with a civil or criminal case.

Court documents have response periods that depend on the proceeding and manner of service. Do not calculate a deadline from a collector’s message; have the actual document checked immediately.

Frequently asked questions

Can a lending app call my mother or father because I am late in paying?

Not merely because they are your parents. A lender needs an independent lawful basis and must respect the limits applicable to a reference, guarantor, or co-maker. Taking their numbers from your phonebook and calling them to demand payment or shame you is generally prohibited.

Can the collector tell my employer how much I owe?

Generally, the lender should not disclose the loan or balance to an employer who is not a party to the transaction. Limited employment verification is different from using HR, a supervisor, or co-workers as collection pressure.

I listed someone as an emergency contact. Does that make them liable?

No. Providing contact information does not by itself create a guaranty or co-maker obligation. Liability depends on a valid agreement and the person’s actual consent, not the label chosen by the app.

May a character reference be asked to pay?

A character reference is for identity and information verification. The person cannot automatically be treated as a guarantor and should not be pursued for payment unless they separately and validly assumed that obligation.

What if my former partner signed the loan?

Then the signed documents and the capacity in which the person signed must be examined. A genuine co-borrower, co-maker, or guarantor may have obligations. A former relationship alone creates none.

Can a lender contact everyone if its terms say I consented?

No. SEC rules expressly treat contact with phonebook entries other than named guarantors or co-makers as an unfair collection practice notwithstanding borrower consent. Data processing must also remain lawful, transparent, necessary, and proportionate.

Can I demand deletion of all my information?

You may exercise applicable data-subject rights and object to improper processing, but deletion is not automatic in every case. Information may lawfully be retained where necessary for the loan, regulatory compliance, fraud prevention, accounting, or legal claims. The lender should still stop unnecessary or unlawful contact-list processing and disclosure.

Does harassment cancel the loan?

Not automatically. The borrower may challenge abusive collection and data misuse while the underlying contractual obligation is assessed separately.

Where can I verify the governing rules?

Useful official materials include the Data Privacy Act, NPC Circular No. 2022-02, the NPC’s official explanation of the amended loan-data rules, and SEC Memorandum Circular No. 18, Series of 2019.

General-information disclaimer

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Liability and available remedies depend on the actual communications, loan documents, parties’ roles, consent records, and other evidence. Official sources and filing procedures were checked as of 29 August 2026.