When an online lending collector starts messaging your relatives, coworkers, employer, or other people in your phone, the pressure can feel humiliating and out of control. Philippine law does not give lenders unlimited authority to use your contact list as a collection tool. As a general rule, an online lender may communicate with the borrower and a person who expressly agreed to be a guarantor—not every friend, family member, character reference, or contact whose number happened to be stored on the borrower’s device. The most effective response is to preserve evidence, secure your phone, demand that the lender stop, and file the appropriate complaints without ignoring any legitimate loan obligation.

Is It Legal for an Online Lending App to Contact Your Friends or Family?

Ordinarily, no. A lender cannot treat your entire contact list as a directory of people it may call, threaten, shame, or inform about your debt.

The 2026 joint advisory of the DICT, National Privacy Commission, and Securities and Exchange Commission states that, for debt collection, lenders may contact only a guarantor. Contacting other persons found in the borrower’s contact list is prohibited. The advisory also requires online lending platforms to distinguish clearly between a character reference and a guarantor.

A character reference is not automatically a guarantor

A character reference is normally identified only to help verify the borrower’s identity or the truthfulness of information in the loan application. That person does not become responsible for the debt merely because:

Their name or number was entered in the application.
They are related to the borrower.
They answered a verification call.
Their number appeared in the borrower’s phone.
They received a collection message.
They were described by the collector as a “reference.”

A guarantor is different. A guarantor must knowingly and expressly agree to assume responsibility under a guaranty arrangement. An app should not hide that agreement inside a character-reference field or treat silence as consent. NPC rules require separate treatment of character references and guarantors.

Allowing contact access does not authorize harassment

Some borrowers tap “Allow” when an app requests access to contacts, text messages, photos, storage, or call logs. That permission does not give the lender a permanent or unrestricted right to copy, use, disclose, or weaponize the information.

Under NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02, loan-related data processing must be necessary, relevant, proportionate, and not excessive. “Unbridled processing” of contact lists—including processing that leads to harassment, collection outside guarantors, or other unfair collection practices—is prohibited.

Your Rights Under Philippine Law

Several laws and regulatory rules may apply to the same conduct. A collection campaign can simultaneously involve unfair debt collection, unlawful personal-data processing, civil liability, and—in serious cases—a criminal offense.

Protection against unfair debt collection

SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair debt collection practices by financing and lending companies. Prohibited conduct includes threats, insults, deceptive representations, public shaming, improper disclosure of borrower information, and improper contact with people other than those legally connected with the loan.

A lending or financing company generally remains responsible for the conduct of its employees, collection agents, outsourced agencies, and other service providers. It normally cannot escape regulatory responsibility by saying that an abusive message came from a “third-party collector.” (SEC Appointment System)

Rights under the Data Privacy Act

The Data Privacy Act of 2012, or Republic Act No. 10173, requires personal information to be processed lawfully, fairly, transparently, and only for a legitimate and proportionate purpose.

Depending on the circumstances, both the borrower and the contacted person may exercise data-subject rights, including the right to:

Be informed about how their information was obtained and used.
Object to certain processing.
Request access to personal information being processed.
Correct inaccurate or misleading information.
Seek erasure or blocking when there is no lawful basis for continued processing, subject to legitimate retention duties.
File a complaint with the National Privacy Commission.
Claim damages when unlawful processing causes injury.

Unauthorized copying, use, access, processing, or disclosure may potentially fall under one or more penal provisions of RA 10173. The particular offense depends on evidence showing what data was processed, who processed it, for what purpose, and whether disclosure was authorized. (Lawphil)

Civil liability for humiliation, anxiety, and invasion of privacy

The Civil Code of the Philippines may provide a basis for damages:

Article 19 requires people to act with justice, give everyone their due, and observe honesty and good faith.
Article 20 makes a person liable for damage caused by an act contrary to law.
Article 21 covers willful acts that cause loss or injury in a manner contrary to morals, good customs, or public policy.
Article 26 protects dignity, personality, privacy, and peace of mind against improper interference.

A damages case still requires proof. Useful evidence may include messages sent to coworkers, medical or counseling records, employment consequences, witness affidavits, lost-income records, and proof identifying the lender or collector. (Lawphil)

Possible criminal liability

The collector’s conduct may also be evaluated under the Revised Penal Code:

A threat to kill, injure, or commit another crime against a person, honor, or property may constitute grave threats under Article 282.
Forcing someone through violence, threats, or intimidation to do something not prohibited by law may raise grave coercion under Article 286.
Repeated abusive conduct that causes annoyance or distress may, depending on the facts, be assessed as unjust vexation under Article 287.
False and defamatory accusations communicated to other people may raise libel issues under Articles 353 and 355.

When defamatory material is published through a computer system, the Cybercrime Prevention Act of 2012, or RA 10175, may also become relevant. Not every offensive collection message automatically satisfies the elements of a criminal offense; police investigators and prosecutors assess the exact words, context, recipient, intent, and available evidence. (Lawphil)

What to Do Immediately

1. Treat threats to safety as urgent

If a collector threatens physical harm, sends someone to your home, impersonates law enforcement, or appears to know your real-time location, contact the local police immediately. Do not meet the collector alone.

Tell household members, building security, school personnel, or workplace security not to disclose your location, schedule, identification documents, or other personal information.

2. Preserve evidence before blocking or uninstalling anything

Do not rely only on memory. Save evidence while the messages, profiles, app pages, and call records are still available.

Capture:

Full screenshots showing the sender’s number or account name.
Dates and times.
The complete message thread, not only the most offensive line.
Social-media profile links and usernames.
Call logs and voicemail recordings.
Group-chat names and members.
Posts, comments, captions, or images used for public shaming.
The app’s name, developer, download page, and privacy policy.
Loan agreement, disclosure statement, payment schedule, and statement of account.
Payment receipts and official communications from the lender.
Screenshots of app permissions.
Messages sent to relatives, coworkers, employers, or clients.

Keep original files. Avoid cropping, annotating, or editing your only copy. Store backups in a separate device, cloud account, or external drive.

Ask every affected contact to save their own evidence. A short signed statement can later be useful. It should identify:

The date and time of contact.
The number, account, or email used by the collector.
The exact statement made.
The person’s relationship to the borrower.
Whether the person ever agreed to be a guarantor.
Any harm caused, such as workplace embarrassment or repeated calls.

3. Warn your contacts without oversharing

Send a brief, factual notice to affected contacts:

An online lending collector may contact you about an account associated with me. You are not responsible for the debt unless you knowingly signed as a co-borrower, co-maker, or guarantor. Please do not send money, identification, one-time passwords, or personal information. Save screenshots and block the sender after preserving the evidence.

This reduces the risk of relatives being deceived into paying a collector’s personal e-wallet or disclosing additional information.

4. Revoke unnecessary app permissions

After preserving evidence:

Open the phone’s privacy or app-permission settings.
Remove access to contacts, call logs, SMS, photos, microphone, camera, files, and location when these are not needed.
Change passwords if the app may have accessed email, cloud storage, or social-media accounts.
Enable two-factor authentication.
Review connected devices and active sessions.
Uninstall the app after saving the loan details, receipts, and evidence.

Revoking access does not necessarily erase data already copied by the lender. That is why a written privacy request and regulatory complaint may still be necessary.

5. Send a written demand to the lender and its data protection officer

Send the demand through a traceable channel, such as the lender’s official email, in-app support system, website ticket, or registered office. Do not rely solely on a telephone conversation.

State that you demand the following:

Immediate cessation of contact with anyone other than you and any person who expressly agreed to be a guarantor.
Removal of character references and unrelated contacts from collection lists.
Identification of the legal entity operating the app.
Identification of the collection agency or service provider involved.
The name and contact details of the lender’s data protection officer.
The source, purpose, and legal basis for processing each contacted person’s information.
Preservation of logs, call recordings, access records, and collection instructions.
Correction of false information communicated to third parties.
Erasure or blocking of unlawfully processed contact data, subject to records the lender is legally required to retain.
A written response describing the corrective action taken.

Include representative screenshots, but retain the originals. Give the lender the opportunity to respond because the NPC normally requires prior written recourse to the personal information controller before accepting a formal complaint.

6. Verify the lender and the debt through official channels

Do not negotiate solely through a collector’s personal number.

Ask the lender for:

Its complete corporate name.
SEC registration details.
Certificate of Authority to operate as a lending or financing company.
Official business address.
Itemized statement of account.
Principal, interest, penalties, and other charges.
Official payment channels.
Written authority of any outsourced collection agency.

Under the Lending Company Regulation Act, or RA 9474, a lending company must satisfy registration and authority requirements. Suspected unlicensed operations may be reported to the SEC. (Lawphil)

Do not send payment to a personal bank account or e-wallet merely because a collector demands it. Confirm the payment channel through the lender’s official website, application, or verified customer-service account.

7. File complaints with the proper agencies

Different agencies handle different aspects of the problem. Filing with one agency does not necessarily prevent filing with another.

Office	Appropriate when	Main result sought
Securities and Exchange Commission	Unfair collection, public shaming, improper contact with third parties, abusive collectors, unlicensed lending	Regulatory investigation and sanctions
National Privacy Commission	Unlawful contact-list access, disclosure, excessive processing, refusal to honor data rights	Privacy investigation, corrective orders, indemnity where warranted, possible prosecution referral
PNP Anti-Cybercrime Group or NBI Cybercrime Division	Threats, cyberharassment, impersonation, scams, account misuse, defamatory online posts	Criminal investigation and evidence gathering
Office of the Prosecutor	Evidence supports a specific criminal offense	Preliminary investigation and possible filing of charges
Barangay or local police station	Immediate local disturbance, home visit, threats, or need for a contemporaneous record	Blotter entry, local intervention, safety documentation

Filing with the SEC

Use the official SEC iMessage portal. Select the service for complaints involving financing and lending companies under the Financing and Lending Companies Department.

Upload:

A chronology of events.
Screenshots and call logs.
Loan documents.
Proof of payment.
Names and numbers of collectors.
Messages sent to third parties.
The demand sent to the lender.
The lender’s response, if any.

The portal generates a ticket that can be monitored online. Save the ticket number and use the same ticket for additional submissions unless the SEC directs otherwise. An SEC complaint is regulatory; it does not automatically extinguish the loan or determine civil damages. (Securities and Exchange Commission)

Filing with the National Privacy Commission

Before filing, normally send a written complaint to the lender or other organization controlling the data. If it fails to respond or take appropriate action within 15 calendar days, a formal NPC complaint may be filed. The NPC may waive this prior-recourse requirement in urgent or exceptional cases, such as serious violations, grave and irreparable injury, lack of an adequate remedy, or patently illegal action.

Use the NPC complaint instructions and the current Complaint-Affidavit form. A formal complaint generally requires:

A verified and notarized complaint-affidavit.
Full names and addresses of the complainant and respondent.
A clear statement of facts.
The relief requested.
Copies of prior correspondence with the lender.
Screenshots, records, and other supporting evidence.
Witness affidavits, when available.
A certification against forum shopping.
A valid government-issued ID.
A special power of attorney if filed through a representative.

A nonresident Filipino who has no Philippine representative may need the complaint notarized through a Philippine embassy or consulate, or apostilled in the country where it is executed, following NPC requirements. Foreign complainants and those appointing Philippine representatives should confirm the appropriate authentication requirements with the NPC before filing.

The published NPC fee schedule lists a basic complaint filing fee of ₱500, plus a legal research fee and possible additional charges when damages or urgent orders are requested. Qualified indigent litigants may apply for exemption subject to documentary requirements. (National Privacy Commission)

Reporting threats, fraud, or cyberharassment

The 2026 joint advisory identifies these reporting channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph
PNP Anti-Cybercrime Group: acg@pnp.gov.ph

The NBI’s investigative-assistance service for victims of computer crimes explains the agency’s cybercrime intake process. Bring identification, printed copies of key evidence, electronic copies on a secure device, and a written chronology.

8. Address the legitimate account separately

Harassment does not erase a valid debt. Keep the collection-abuse issue separate from questions about the correct amount owed.

Communicate through one official written channel and request:

An updated statement of account.
An explanation of disputed charges.
Confirmation of payments already made.
A lawful restructuring or payment arrangement, when needed.
An official receipt for every payment.

Paying through a verified channel can prevent additional legitimate penalties while complaints against abusive collection practices are pending. Conversely, filing an SEC or NPC complaint should not be interpreted as admitting that every amount claimed by the collector is correct.

Documents and Evidence to Prepare

Document or evidence	Why it matters
Government-issued ID	Confirms the complainant’s identity
Loan agreement and disclosure statement	Identifies the lender, terms, charges, and parties
Statement of account	Shows the amount being claimed
Payment receipts	Proves payments and may expose inaccurate collection claims
Full message screenshots	Shows the sender, words used, recipient, date, and time
Call logs and recordings	Establishes frequency and content of calls
Social-media URLs and screen recordings	Preserves posts that may later be deleted
App-permission screenshots	Shows what device access was requested or granted
Privacy policy and consent screens	Helps evaluate the lender’s claimed authority to process data
Written demand to the lender	Satisfies or supports the NPC prior-recourse requirement
Lender’s reply	Shows whether corrective action was taken
Contact or witness affidavits	Confirms third-party harassment and lack of guarantor consent
Medical, employment, or financial records	Supports proof of actual harm or damages
Chronology of events	Helps agencies understand the case quickly

Name electronic files clearly, such as 2026-07-12_Message-to-Employer.png. Prepare an index listing each file and what it proves. Organized evidence is easier for regulators and investigators to evaluate than hundreds of unsorted screenshots.

Expected Timelines and Practical Bottlenecks

Stage	Typical procedural point
Evidence preservation and security changes	Same day
Written demand to the lender	Immediately after evidence is secured
Waiting period before ordinary NPC filing	Up to 15 calendar days for the lender to respond or act
SEC iMessage filing	Ticket is created upon successful submission
NPC case assignment	Rules provide for assignment within five calendar days from receipt
Respondent’s NPC comment	Generally 15 calendar days after an order to comment
Preliminary conference	Generally scheduled within 30 days after the comment period
Mediation	May suspend proceedings for up to 90 days
Full regulatory or criminal resolution	Often several months or longer, depending on service, evidence, responses, mediation, hearings, and agency workload

The short deadlines in the NPC rules apply to particular procedural steps, not necessarily to final resolution. In practice, cases slow down when the app uses a trade name different from its corporate name, collectors use disposable SIM cards, the lender denies responsibility for an outsourced agency, or the complainant submits incomplete or heavily edited evidence.

Common Situations and Mistakes

“The app says I consented to contact-list access”

Consent is not a blanket defense. The lender must still show that the processing was lawful, transparent, necessary, and proportionate. Permission to verify identity does not automatically authorize mass messaging, public shaming, or collection from unrelated contacts.

“The collector called my employer”

A lender may use contact information necessary to reach the borrower, but disclosing the debt to supervisors, human-resources staff, clients, or coworkers can become an improper disclosure and unfair collection practice. Save evidence of exactly what was said and whether the collector repeatedly interfered with work.

“They are demanding payment from my character reference”

A character reference is not liable merely because their details appeared in the application. Ask the lender to produce the written or electronic agreement showing that the person knowingly consented to act as guarantor. Without such consent, the lender should stop treating that person as responsible for collection.

“They threatened to have me arrested”

Section 20, Article III of the 1987 Constitution provides that no person shall be imprisoned for debt or nonpayment of a poll tax. Ordinary nonpayment of a loan does not, by itself, authorize a collector to issue an arrest warrant or order police to arrest the borrower.

Separate criminal allegations—such as fraud supported by independent evidence—must satisfy their own legal elements and follow lawful investigation and court procedures. A private collector cannot create an arrest warrant through a text message.

“They posted my photo and called me a scammer”

Preserve the post, URL, profile, audience, comments, and date. Using a borrower’s photograph to shame or embarrass them is specifically inconsistent with NPC loan-processing rules. False public accusations may also raise civil and criminal issues depending on their wording and publication.

“I already paid, but the messages continue”

Send proof of payment to the lender’s official account and request a zero-balance certificate or corrected statement. Do not send sensitive documents repeatedly to unknown collectors. Continuing to contact third parties after payment strengthens the need for an SEC and privacy complaint.

“The app disappeared or appears unlicensed”

Preserve the download page, developer name, package name, website, payment accounts, receipts, and all messages. Report the operation to the SEC even when the company’s legal identity is uncertain. Report suspected fraud, identity theft, or account takeover to the PNP Anti-Cybercrime Group or NBI Cybercrime Division.

Frequently Asked Questions

Can an online lending app legally message everyone in my contacts?

No. Current SEC and NPC guidance prohibits using the borrower’s contact list for debt collection outside persons who expressly agreed to act as guarantors.

Can I complain even if I really owe the money?

Yes. A lender may pursue a legitimate debt only through lawful and fair methods. A valid debt does not authorize threats, insults, public shaming, or unlawful disclosure of personal information.

Are my relatives responsible for my online loan?

Not merely because they are relatives or appear in your phone. Liability generally requires a valid legal undertaking, such as signing or expressly consenting as a co-borrower, co-maker, or guarantor.

Can the person being harassed file a separate complaint?

Yes. A relative, coworker, or other contact whose personal information was unlawfully processed or who directly received abusive messages may have their own privacy, civil, or criminal complaint. Their evidence should be preserved separately.

Should I block the collector?

Preserve the evidence first. You may then block abusive numbers while keeping one official written channel open with the lender. This allows you to address the account without accepting harassment.

Can collectors contact me late at night?

SEC rules prohibit contacting borrowers at unreasonable or inconvenient times, subject to limited circumstances. Repeated late-night or early-morning calls should be documented as part of the unfair-collection complaint.

Can a lender tell my employer that I have an unpaid loan?

Disclosing the debt to an employer or coworkers may be unlawful when it is unnecessary for collection, intended to shame the borrower, or unsupported by a lawful basis. A simple effort to locate a borrower is not permission to reveal loan details.

Does uninstalling the app delete my contacts from the lender’s system?

Not necessarily. Uninstalling removes the app from the device but does not automatically erase information already transmitted. Send a written data request asking what information is retained, why it is retained, and whether unlawfully processed data has been erased or blocked.

How much does it cost to complain to the NPC?

The published basic filing fee is ₱500, with possible legal research and additional fees for damages claims or urgent orders. Indigent complainants may seek exemption by submitting the required proof.

Can I file a complaint while outside the Philippines?

Yes, subject to NPC filing and authentication requirements. A nonresident Filipino without a Philippine representative may need consular notarization or an apostille. A representative in the Philippines generally needs a properly executed special power of attorney.

Key Takeaways

Online lenders generally may collect from the borrower and an expressly consenting guarantor—not everyone in the borrower’s phone.
A character reference is not automatically responsible for the loan.
Contact permission does not authorize mass messaging, humiliation, threats, or unnecessary disclosure.
Preserve complete, original evidence before blocking numbers or uninstalling the app.
Revoke unnecessary permissions and secure email, social-media, and financial accounts.
Send a written demand to the lender and its data protection officer.
Report unfair collection to the SEC through iMessage and unlawful data processing to the National Privacy Commission.
Report threats, impersonation, scams, and cyberharassment to the police, PNP Anti-Cybercrime Group, or NBI Cybercrime Division.
Harassment does not cancel a valid debt, but the debt must be handled separately through verified, lawful payment and dispute channels.