When an online lending app starts messaging your relatives, coworkers, employer, or friends, the pressure can feel more damaging than the unpaid loan itself. Philippine law allows a lender to collect a legitimate debt, but it does not give the lender permission to expose your debt, shame you publicly, threaten people, or use your phone’s contact list as a collection weapon. Your immediate priorities are to preserve evidence, stop further access to your data, notify the lender in writing, and file the appropriate complaints without accidentally weakening your case.

Can an Online Lending App Legally Contact Your Contacts?

The clearest current government rule is found in the March 18, 2026 joint advisory of the DICT, National Privacy Commission, and Securities and Exchange Commission.

The advisory states that an online lending platform may not contact people in a borrower’s contact list for debt collection unless the person is a named guarantor. It also requires separate interfaces for character references and guarantors because the two roles are legally different. A guarantor must expressly consent to the role and assume responsibility for the debt. A person merely listed as a reference does not become liable for repayment.

This means a lending app generally cannot:

Message everyone in your phonebook.
Call your coworkers merely because their numbers appeared in your contacts.
Tell relatives that you are a delinquent borrower.
Pressure a character reference to pay your loan.
Contact people you never identified during the application.
Treat a reference as a guarantor without that person’s informed and express consent.
Continue using copied contact data after you revoke the app’s permission.

A person who actually signed as a co-maker, surety, or guarantor may be contacted because that person may have an independent contractual obligation. But a family member, friend, employer, or reference is not liable simply because the borrower entered the person’s name or number in an app.

The fact that an app displayed a broad “Allow access to contacts” button does not automatically make mass collection lawful. Consent under the Data Privacy Act must be informed, specific, freely given, and tied to a legitimate purpose. Deceptive screens, forced permissions, and bundled consent may be legally defective. The 2026 advisory specifically warns that deceptive design practices can invalidate consent.

What Counts as Online Lending App Harassment?

Not every payment reminder is harassment. A lender may send a truthful, professional demand to the borrower through reasonable channels. The problem begins when collection methods become abusive, deceptive, excessive, threatening, or invasive.

Collection conduct	Why it may be unlawful
Messaging relatives, friends, or coworkers who are not guarantors	Unauthorized disclosure and prohibited contact-list collection
Sending your loan details to a group chat	Disclosure of personal and financial information
Posting your name, photograph, ID, or debt on Facebook	Public shaming, possible privacy violation, libel, or cyberlibel
Threatening physical harm or damage to property	Possible grave threats or another criminal offense
Claiming police are “on the way” when no case or warrant exists	Deceptive collection and possible false representation
Using profanity, sexual insults, or degrading language	Unfair collection; possible oral defamation or unjust vexation
Calling repeatedly before 6:00 a.m. or after 10:00 p.m.	Generally prohibited under SEC collection rules, subject to limited exceptions
Threatening to expose the debt to an employer	Improper pressure and unauthorized disclosure
Editing your photo into a “wanted,” “scammer,” or funeral-style poster	Privacy violation and possible defamation or cybercrime
Telling a reference that the reference must pay	Misrepresentation unless the person validly became a guarantor or co-maker
Demanding payment through an employee’s personal e-wallet	Serious verification and fraud risk
Threatening arrest solely because a loan is unpaid	Misleading; ordinary nonpayment of debt is not by itself grounds for imprisonment

SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair debt collection practices by financing and lending companies. Prohibited conduct includes threats of violence, threats to take an illegal action, insulting or profane language amounting to a criminal offense, public disclosure of borrower information, deceptive representations, and contacting people in the borrower’s contact list other than guarantors or co-makers. Collection calls before 6:00 a.m. or after 10:00 p.m. are also generally prohibited, subject to the circular’s stated exceptions. (SEC Appointment System)

The prohibition applies even when collection is outsourced. A lending company cannot avoid responsibility simply by saying that an independent collection agency or individual collector sent the messages.

Philippine Laws That Protect Borrowers and Their Contacts

Republic Act No. 11765: Financial Products and Services Consumer Protection Act

The Financial Products and Services Consumer Protection Act of 2022 requires financial service providers to use fair debt collection practices. It prohibits abusive collection or debt recovery conduct and gives financial regulators, including the SEC, enforcement authority over regulated providers. (Lawphil)

A lender’s right to collect does not include the right to humiliate, terrorize, or mislead the borrower.

Republic Act No. 10173: Data Privacy Act of 2012

The Data Privacy Act of 2012 regulates the collection, use, storage, disclosure, and disposal of personal data.

A phone number, photograph, government ID, contact-list entry, employment detail, and loan information can constitute personal information. Processing must have a lawful basis and comply with the principles of:

Transparency: The person should understand what data will be collected and why.
Legitimate purpose: The purpose must be lawful and clearly stated.
Proportionality: The lender should not collect more information than reasonably necessary.

NPC Circular No. 2020-01, as amended, specifically addresses the processing of personal data for loans and financing. Online lenders are prohibited from harvesting phone or social-media contacts for debt collection and harassment. Access to a camera or photo gallery should be limited to a legitimate function such as identity verification, and a borrower’s photograph cannot later be repurposed for public shaming. (National Privacy Commission)

The National Privacy Commission has issued decisions against lenders that required access to an applicant’s entire phonebook or used contact information for collection. In one case involving Pesopop, the NPC found that requiring access to the entire contact list without a proper separate interface resulted in unauthorized processing. (National Privacy Commission)

Importantly, the borrower is not the only possible complainant. A friend, relative, coworker, or employer representative whose number or personal information was improperly collected or used may also be a data subject with an independent privacy complaint.

Civil Code Articles 19, 20, 21, and 26

The Civil Code provides broader protection against abusive conduct.

Article 19 requires every person to act with justice, give everyone their due, and observe honesty and good faith.
Article 20 requires a person who causes damage contrary to law, through a willful or negligent act, to compensate the injured party.
Article 21 allows compensation when a person willfully causes loss or injury in a manner contrary to morals, good customs, or public policy.
Article 26 protects personal dignity, privacy, family relations, and peace of mind.

These provisions may support a civil claim for damages when collection methods involve public shaming, disclosure of private matters, humiliation, or other abuse of rights. (Lawphil)

Revised Penal Code and Cybercrime Prevention Act

Depending on the exact words and conduct involved, a collector’s actions may potentially fall under offenses such as:

Grave threats under Article 282 of the Revised Penal Code.
Libel under Articles 353 and 355.
Oral defamation or slander under Article 358.
Unjust vexation under Article 287.
Cyberlibel under Section 4(c)(4) of Republic Act No. 10175 when defamatory material is published through a computer system.

Criminal liability is not automatic. The precise message, context, audience, identity of the sender, and available evidence matter. A threatening text should therefore be preserved in its original form rather than copied only as plain text. (Lawphil)

No Imprisonment for Ordinary Debt

Article III, Section 20 of the 1987 Constitution states that no person may be imprisoned for debt. A borrower cannot be arrested merely because a legitimate loan remains unpaid. (Lawphil)

This does not mean every loan-related situation is immune from criminal proceedings. A separate offense, such as fraud or the issuance of a bouncing check, may have criminal consequences if all legal elements are present. But a collection agent cannot truthfully claim that ordinary inability or failure to pay automatically produces an arrest warrant.

What to Do Immediately If the App Is Harassing Your Contacts

1. Preserve the Evidence Before Blocking or Uninstalling the App

Do not immediately delete the app, clear the chat, or reset your phone. First, collect evidence showing the full pattern of conduct.

Save:

Screenshots showing the sender’s number, profile name, date, and time.
Screen recordings that show the conversation from beginning to end.
Call logs showing frequency and time of calls.
Voice messages and recordings lawfully available to you.
Facebook posts, comments, group chats, and URLs.
Copies of edited photographs or “shame posts.”
Messages received by relatives, coworkers, and references.
The app’s name, developer name, download page, and privacy notice.
Permission screens showing access to contacts, camera, files, SMS, or location.
Loan agreement, disclosure statement, payment schedule, receipts, and account history.
Names used by the collector and any company, agency, phone number, email address, or payment account mentioned.

Ask each affected contact to preserve the original message on the device. A screenshot forwarded back to you is useful, but the original recipient may later need to execute an affidavit explaining when and how the message was received.

For social-media posts, capture the account name, complete URL, date, time, reactions, comments, and number of shares. A close-up screenshot of the defamatory words alone may not establish where the post appeared or who published it.

2. Revoke Unnecessary App Permissions

After preserving the relevant screens, open your phone’s privacy or app settings and revoke permissions for:

Contacts.
Call logs.
SMS.
Camera.
Microphone.
Photos and files.
Location.

Also change passwords for your email, e-wallet, cloud storage, and social-media accounts if the app or its agents may have obtained access. Enable two-factor authentication.

Revoking permission may prevent future access, but it will not necessarily delete data already copied to the lender’s systems. A written deletion or restriction request is still important.

3. Tell Your Contacts What Happened

Send a brief factual notice to the people being contacted:

Do not argue with the collector.
Do not click unfamiliar links.
Do not send money.
Do not disclose your address, workplace, schedule, or other personal information.
Preserve all messages and call logs.
Block the sender only after saving evidence.
Report any threat of violence immediately.

A contact should avoid replying with insults or threats. An angry response can complicate the evidence and create an unnecessary counter-allegation.

4. Send a Written Notice to the Lender and Its Data Protection Officer

The National Privacy Commission generally requires a complainant to notify the respondent in writing and give it an opportunity to act before a formal NPC complaint is filed. The usual waiting period is 15 calendar days from receipt of the written notice, unless the NPC accepts a request to waive this requirement because of serious or urgent harm. Filing too early without a valid basis can lead to dismissal. (National Privacy Commission)

Send the notice through every verifiable channel available:

The lender’s official support email.
Its data protection officer’s email.
The address stated in the loan agreement or privacy notice.
The app’s official support ticket.
Registered mail or reputable courier, when feasible.

Keep the sent email, delivery receipt, ticket number, and any automated acknowledgment.

A practical notice may read:

I am formally objecting to the collection, use, and disclosure of my personal data and the personal data of persons in my contact list for debt collection.

Your agents have contacted persons who are not guarantors or co-makers and have disclosed or implied information about my alleged loan. I demand that you:

Immediately stop contacting all non-guarantor third parties;

Stop all threats, insults, public disclosures, and deceptive representations;

Identify the lending company, collection agency, and agents handling the account;

State your SEC registration details and Certificate of Authority information;

Provide an itemized statement of account, including principal, interest, penalties, fees, payments, and balance;

Restrict or delete contact-list data that was unlawfully or unnecessarily collected;

Preserve all access logs, call records, messages, instructions to collectors, and data-processing records relating to my account; and

Communicate with me only through [email address or other chosen channel].

Please provide a written response within 15 calendar days. This notice does not admit the accuracy of any disputed amount.

Do not include unnecessary personal documents in the notice. A collector who already has questionable data practices should not receive additional IDs, selfies, or contact details unless legitimately required and transmitted through a verified channel.

5. Identify the Legal Company Behind the App

The app name may not be the lender’s registered corporate name. Check the loan agreement, disclosure statement, privacy policy, receipts, app-store developer information, and payment instructions.

Record:

Registered corporate name.
SEC registration number.
Certificate of Authority number.
Business and email addresses.
App or platform name.
Collection agency name.
Phone numbers and social-media accounts used.
Names or aliases of collectors.
Bank or e-wallet account receiving payment.

A lending or financing company generally needs SEC registration and the appropriate Certificate of Authority to operate. An app should also be connected to the legal entity responsible for it. If the company refuses to identify itself, include that fact in the complaint.

6. File a Complaint With the SEC

Complaints involving unfair collection, abusive lending conduct, unregistered lending activity, or violations by a lending or financing company may be submitted through the SEC iMessage portal.

The portal generates an electronic ticket that can be used to track the submission. The March 2026 joint advisory identifies SEC FINLEND and iMessage as the channel for reporting unfair collection practices. (Securities and Exchange Commission)

Attach an organized set of documents rather than dozens of unexplained screenshots. A useful complaint package contains:

A one- or two-page chronology.
The loan agreement or account information.
Screenshots arranged by date.
Messages sent to third parties.
Proof that the recipients were not guarantors.
Your written cease-and-desist or privacy notice.
The lender’s response, if any.
The app’s identifying details.
Proof of payment already made.
A list of the specific practices being complained of.

The SEC may impose administrative sanctions, including fines and possible suspension or revocation of authority, depending on the violation.

7. File a Data Privacy Complaint With the NPC

Use the National Privacy Commission’s complaint filing page and current NPC forms.

A formal NPC complaint generally requires:

A notarized Complaint-Assisted Form or verified complaint-affidavit.
A clear narration of the facts.
Copies of the written notice sent to the respondent.
Proof that the respondent received it.
The respondent’s reply, if any.
Screenshots, messages, affidavits, or other supporting evidence.
Identification and authorization documents when another person files for the complainant.
The applicable filing fee.

The NPC’s current fee schedule lists a basic complaint filing fee of ₱500, with additional fees potentially applicable when damages are claimed or when other applications are filed. (National Privacy Commission)

The complaint may be submitted using the methods allowed by the NPC, including email to complaints@privacy.gov.ph, personal filing, or an accepted courier or mailing method. The NPC’s current Citizen’s Charter identifies its office at the 25th Floor, Upper Class Tower, Quezon Avenue corner Scout Reyes, Quezon City, subject to any later official update.

NPC proceedings are formal administrative cases and should not be expected to produce an immediate result. Urgent threats, stalking, or risks to physical safety should be separately reported to law enforcement rather than left to the administrative process alone.

8. Report Threats, Fraud, or Cyber Harassment

For threats, impersonation, account compromise, fake legal documents, extortion, or coordinated cyber harassment, the March 2026 advisory lists the following channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph
PNP Anti-Cybercrime Group: acg@pnp.gov.ph

A person facing immediate physical danger should contact local police or emergency services at once.

Bring or submit:

The original device when requested.
Printed and digital screenshots.
URLs and account identifiers.
Phone numbers and email addresses used.
A written timeline.
Copies of threats.
Identification.
Affidavits from recipients or witnesses, when available.

A barangay blotter can help document a local incident or threat, but it does not replace an SEC, NPC, police, prosecutor, or court complaint. Barangay officials also do not have authority to determine that a borrower is criminally liable merely because a debt is unpaid.

9. Deal With the Debt Separately

Harassment does not automatically cancel a valid loan. Article 1159 of the Civil Code provides that contractual obligations have the force of law between the parties and must be performed in good faith. (Lawphil)

At the same time, the lender must prove the correct balance and comply with disclosure, interest, and collection rules.

Request an itemized statement showing:

Original principal.
Interest rate and computation.
Service or processing fees.
Penalties.
Due dates.
Payments and credits.
Current balance.
Name of the legal creditor.
Authority of any collection agency.

Negotiate only through verifiable written channels. Do not pay a collector’s personal bank or e-wallet account without confirming that the lender authorized it. Obtain an official receipt or written confirmation stating how the payment was applied.

If you dispute the amount, identify the specific entries in dispute. A blanket statement that you “do not owe anything” may be less effective than showing, for example, that a payment was omitted, an undisclosed fee was added, or the claimed balance does not match the agreement.

Evidence Checklist

Evidence	Practical purpose
Loan agreement and disclosure statement	Identifies the lender and contractual terms
Payment receipts and transaction histories	Establishes the amount already paid
Full screenshots with dates and sender details	Shows the content and timing of harassment
Original messages on contacts’ devices	Helps authenticate third-party communications
Contact’s affidavit	Explains how the message was received and its effect
Call logs and voice messages	Shows frequency, timing, and threats
URLs and social-media account details	Helps identify online publication
App permission screenshots	Shows the data access requested or granted
Privacy policy and consent screens	Shows what the lender represented about data use
Written notice to lender	Satisfies or supports the NPC exhaustion requirement
Proof of delivery and lender’s response	Establishes the 15-day period and the lender’s action
SEC ticket and NPC docket details	Helps track separate administrative complaints
Medical, counseling, or employment records	May support proof of actual harm where relevant

Keep at least two backups. Store one copy in cloud storage and another on a separate device or drive. Do not alter file names or edit the original image files if they may later be used as evidence.

Common Mistakes That Can Weaken a Complaint

Deleting the App Too Soon

Uninstalling may remove permission screens, in-app messages, account records, and identifying details. Preserve evidence first.

Filing Only Against the App’s Brand Name

A regulator needs the legal entity, collection agency, or identifiable respondent whenever possible. Include every known company name and explain the connection between them.

Filing an NPC Complaint Before Sending Written Notice

Unless there is a valid ground for waiver, the NPC generally expects written notice and a 15-calendar-day opportunity for the respondent to act. Premature filing may be dismissed.

Assuming the Loan Disappears Because Collection Was Illegal

The collection violation and the debt are separate issues. Challenge the harassment while requesting a correct statement and addressing any valid balance.

Paying a Random Account to “Stop the Posting”

Pressure to transfer immediately to a personal account is a warning sign. Verify payment instructions and demand a receipt.

Editing Screenshots

Cropping may be useful for presentation, but preserve untouched originals. Regulators or investigators may need the full context, metadata, account name, and date.

Letting Contacts Delete the Messages

Each contacted person may have direct evidence and may also be an independent privacy complainant.

Threatening the Collector Back

Replying with violence, insults, or defamatory accusations can create a separate issue. Keep responses factual and written.

Special Situations

You Are a Contact, Not the Borrower

You can state clearly:

I am not a guarantor, co-maker, or borrower. I do not consent to the use of my personal data for collection. Stop contacting me, disclose how you obtained my information, and delete or restrict it where legally required.

Preserve the message and send your own complaint or written privacy request. The borrower does not have to be the only complainant.

You Were Listed as a Character Reference

A character reference does not become responsible for the loan merely by answering a verification call or appearing in an application. The lender should not misrepresent your role or pressure you to pay.

The Lender Contacted Your Employer

Ask the recipient in human resources or management to preserve the message and limit internal circulation. Wider workplace distribution can amplify the privacy harm. The employer should not assume that a collection message proves misconduct or criminal liability.

You Are an OFW or Live Abroad

A Filipino abroad may still file complaints concerning personal data processed in the Philippines. Foreign nationals may also use NPC procedures when their personal data are processed in the Philippines.

For documents signed abroad, confirm the NPC’s current authentication requirements. Depending on the complainant’s status and place of execution, notarization before a Philippine embassy or consulate or an apostille from the country of origin may be required. (National Privacy Commission)

The App Appears Unregistered or Has Disappeared

Preserve its app-store page, package name, developer identity, privacy policy, bank or e-wallet accounts, text messages, and advertisements. Report the suspected unregistered activity to the SEC and any apparent fraud, identity theft, or cybercrime to the NBI or PNP Anti-Cybercrime Group.

Frequently Asked Questions

Can an online lending app call everyone in my contacts?

No. Current government guidance prohibits contacting people in a borrower’s contact list for collection unless they are named guarantors. Access to an entire contact list cannot be used as a license for mass collection or harassment.

Can a lending app contact my character reference?

A lender may conduct a legitimate, proportionate reference verification, but a character reference is not automatically a guarantor. The reference should not be pressured to pay or repeatedly contacted for collection.

Can the lender post my picture and debt on Facebook?

Publicly posting your photograph, debt, ID, or insulting labels may violate privacy and unfair-collection rules. Depending on the content and circumstances, it may also support a complaint involving libel, cyberlibel, or civil damages.

Can I be arrested for not paying an online loan?

Not merely for the debt. The Constitution prohibits imprisonment for debt. A separate criminal case would require facts establishing an actual offense, not just nonpayment. (Lawphil)

Does deleting the lending app stop it from contacting my contacts?

Not necessarily. The lender may already have copied data. Revoke permissions, preserve evidence, send a written restriction or deletion request, and file complaints when appropriate.

Can my friend or coworker file a privacy complaint?

Yes. A person whose number, name, employment information, or messages were improperly processed may have an independent complaint as a data subject.

Where should I complain first: SEC or NPC?

File with the SEC for unfair collection and lending-company violations. File with the NPC for unauthorized collection, use, disclosure, or retention of personal data. The same conduct may justify complaints with both agencies.

Do I need a lawyer to file an SEC or NPC complaint?

A complainant may generally prepare and submit an administrative complaint without a lawyer, but the required form, notarization, evidence, and procedural rules must still be followed. Complex claims for damages or related criminal and civil actions may require more formal legal preparation.

How long does a complaint take?

A ticket or acknowledgment may be issued relatively early, but investigation and adjudication can take months, particularly when the respondent disputes the facts, cannot be located, or submits repeated procedural filings. Do not rely on the administrative case as the only response to an urgent threat.

Does harassment erase the loan?

No. Harassment may create regulatory, civil, privacy, or criminal liability, but a valid contractual debt generally remains enforceable. The borrower should address the correct balance separately and insist on lawful collection.

Key Takeaways

A legitimate debt does not give an online lender the right to shame, threaten, deceive, or expose a borrower.
People in a borrower’s phonebook generally may not be contacted for collection unless they are validly named guarantors or otherwise independently liable.
A character reference is not automatically a guarantor or co-maker.
Preserve original evidence before blocking numbers, deleting messages, or uninstalling the app.
Revoke unnecessary permissions and send the lender a written demand to stop third-party contact and unlawful data use.
For an NPC complaint, written notice to the lender and a 15-calendar-day opportunity to respond are generally required unless a waiver is justified.
Report unfair collection to the SEC, privacy violations to the NPC, and threats or cybercrime to the PNP, NBI, or DICT.
Ordinary nonpayment of debt does not result in imprisonment.
Harassment and the validity of the loan are separate issues; request an itemized statement and handle any legitimate balance through documented, verified channels.