An online loan app may lawfully remind you to pay a valid debt, but it cannot use your phone contacts as a pressure tool. Threatening your family, messaging co-workers, publicly shaming you, using your photograph in insulting posts, or telling unrelated contacts that they must pay can violate Philippine privacy, consumer-protection, civil, and criminal laws. The most effective response is to preserve evidence first, secure your accounts and phone permissions, demand that the harassment stop in writing, and file the right complaint with the Securities and Exchange Commission, National Privacy Commission, or cybercrime authorities.

Can an Online Loan App Contact People in Your Phone?

As a general rule, an online lending platform cannot contact everyone in your address book to collect your loan.

A joint advisory issued by the Department of Information and Communications Technology, National Privacy Commission, and Securities and Exchange Commission on March 18, 2026 states that contacting people in a borrower’s contact list for debt collection is prohibited unless the person is a properly designated guarantor. It also prohibits excessive contact-list processing that results in harassment, public shaming, threats, or collection efforts directed at people who did not guarantee the loan.

This distinction is important:

Person contacted	What the person’s role means	May the lender demand payment?
Character reference	A person identified only to help verify the borrower’s identity or background	No
Guarantor	A person who expressly agreed to answer for the borrower’s obligation if the borrower defaults	Potentially, depending on the written guaranty
Co-maker or co-borrower	A person who signed or accepted the loan as another borrower or solidary debtor	Potentially, depending on the contract
Ordinary phone contact	A relative, friend, co-worker, client, employer, or acquaintance who did not agree to the loan	No

Under Article 2055 of the Civil Code, a guaranty is not presumed. It must be express. Saving someone’s number, naming that person as a reference, or allowing an app to read your contacts does not automatically make that person a guarantor. The government’s 2026 advisory likewise states that a person becomes a guarantor only after giving consent to that role. (Lawphil)

An app should also provide separate processes for character references and guarantors. It should not quietly treat a reference as someone who agreed to pay.

Philippine Laws That Protect Borrowers and Their Contacts

Several laws may apply at the same time. Filing a privacy complaint does not prevent you from also filing an SEC complaint or reporting criminal threats.

Data Privacy Act of 2012

Republic Act No. 10173, or the Data Privacy Act of 2012, regulates how companies collect, use, store, disclose, and delete personal information.

Phone numbers, names, photographs, social-media accounts, messages, and contact lists may constitute personal information. The borrower’s contacts also have privacy rights of their own. They do not lose those rights merely because their numbers were stored on someone else’s phone.

The National Privacy Commission has specifically prohibited online lending apps from requiring unnecessary permissions or engaging in unrestrained access to contact lists, cameras, photographs, and similar information. Access must be suitable, necessary, and proportionate to a legitimate purpose. Once the purpose has been completed, the borrower should be allowed or prompted to revoke the permission.

Clicking “Allow Contacts” is therefore not a blank check. Permission to access information does not authorize the lender to:

Send collection messages to every person in the address book;
Upload or retain the entire contact list indefinitely;
Threaten the borrower’s relatives or employer;
Use the borrower’s photograph for humiliation;
Publish allegations about the borrower online;
Pretend that references are guarantors; or
Use personal information for purposes that were not properly disclosed.

A person whose information has been misused may exercise rights to be informed, object to processing, request access or correction, seek erasure or blocking in proper cases, claim damages, and file a complaint with the National Privacy Commission. (National Privacy Commission)

SEC Rules Against Unfair Debt Collection

The SEC regulates lending and financing companies under Republic Act No. 9474, the Lending Company Regulation Act of 2007, and Republic Act No. 8556, the Financing Company Act of 1998, as amended.

SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair debt-collection practices by lending and financing companies. Harassment, insulting language, deceptive representations, threats, public disclosure of a debt, and abusive contact with unrelated third parties may expose the company and responsible personnel to administrative sanctions. (SEC Appointment System)

Republic Act No. 11765, the Financial Products and Services Consumer Protection Act of 2022, also requires financial service providers to observe fair collection practices and protect consumers’ privacy and data. Abusive debt recovery is prohibited even when the underlying debt is genuine. (Lawphil)

Civil Liability for Humiliation and Invasion of Privacy

Articles 19, 20, and 21 of the Civil Code require every person to act with justice, give everyone their due, and observe honesty and good faith. A person who unlawfully, negligently, or willfully causes damage may be required to pay compensation.

Article 26 separately protects a person’s dignity, privacy, peace of mind, and family relations. Intrusive or humiliating collection tactics may support a civil claim, particularly when they cause reputational harm, emotional distress, loss of employment, or damage to business relationships. (Lawphil)

Damages are not automatic. The borrower or affected contact must prove the wrongful conduct, the resulting harm, and the connection between them. This is why complete screenshots, recordings, witness statements, and employment or medical records can become important.

Threats, Coercion, and Online Defamation

Depending on the exact words and conduct, collection tactics may also fall under provisions of the Revised Penal Code, including:

Grave threats under Article 282;
Grave coercion under Article 286;
Unjust vexation under Article 287; or
Libel under Articles 353 and 355.

Defamatory statements posted or transmitted through a computer system may raise issues under Section 4(c)(4) of Republic Act No. 10175, the Cybercrime Prevention Act of 2012.

Not every rude message automatically becomes a criminal offense. Investigators and prosecutors will consider the wording, context, intended harm, method of communication, identities of the sender and recipient, and available evidence. A specific threat such as “We know where your child goes to school” is far more serious than an ordinary payment reminder.

What to Do Immediately If the Loan App Is Harassing Your Contacts

1. Treat credible threats as a safety issue

Call 911 or go to the nearest police station if the collector makes a specific and credible threat of physical harm, claims to be outside your home, threatens a child, publishes your location, or attempts to enter your property.

Do not arrange an in-person meeting with an unknown collector. Do not disclose your current location or send additional identification documents merely because the sender threatens arrest.

2. Preserve evidence before blocking or uninstalling the app

Do not immediately delete the app, reset your phone, close the account, or erase the conversation. Secure the evidence first.

Save the following:

Screenshots showing the complete message, sender, date, and time;
Screen recordings that show the conversation from beginning to end;
Call logs and recordings of voice messages;
The app’s name, developer, download page, package name, and privacy policy;
Screenshots of the permissions granted to the app;
Copies of messages sent to relatives, friends, co-workers, or employers;
Social-media posts, comments, group chats, and edited photographs;
The loan agreement, disclosure statement, repayment schedule, and receipts;
Proof of payments and the account or digital wallet that received them;
Emails sent to the company and its replies;
The collector’s phone numbers, usernames, account names, and payment instructions; and
Any message falsely claiming that a court case or arrest warrant already exists.

Keep original files. Avoid heavily cropping screenshots or adding markings over the relevant text. Store a backup in cloud storage, email, or another device.

3. Ask each contacted person to preserve their own evidence

Evidence directly received by a contact is usually more useful than a forwarded screenshot.

Ask the contact to save:

The original message or call log;
The sender’s number or account;
The date and time received;
Any threats, photographs, or allegations;
A short written account of what happened; and
Proof of consequences, such as an employer’s warning or a lost client.

The contacted person may have an independent privacy or criminal complaint. The borrower does not need to be the only complainant.

4. Revoke unnecessary permissions and secure your accounts

After preserving the evidence:

Open the phone’s settings.
Find the lending app under Apps or Application Management.
Revoke access to contacts, camera, photographs, storage, microphone, location, and call logs unless currently necessary.
Check whether the app is linked to Google, Facebook, Apple, or another account.
Change passwords for linked email and social-media accounts.
Turn on two-factor authentication.
Review active login sessions and sign out unknown devices.
Remove any device-administrator or accessibility permission that the app does not legitimately need.

Revoking permission may limit future access, but it cannot retrieve information that the app has already uploaded. That is why a written privacy demand and an NPC complaint may still be necessary.

5. Send a written demand to stop the harassment

Send the demand through the lender’s official email, in-app support channel, privacy contact, or registered business address. Keep proof of delivery.

A useful written notice should:

Identify your name, account, and loan reference number;
State that unrelated contacts are being approached;
Identify the numbers or accounts used by the collectors;
Demand that threats, public shaming, and third-party communications stop;
State that character references did not consent to act as guarantors;
Request the legal name of the lender and collection agency;
Ask where the company obtained each contact’s information;
Request restriction or deletion of contact-list data no longer necessary;
Require all future communication to be made directly to you and in writing;
Ask for an itemized statement of the legitimate outstanding balance; and
Request a complaint-ticket number and written investigation result.

Keep the debt issue separate from the harassment issue. You may dispute collection tactics without falsely denying a legitimate loan.

6. Verify the company behind the app

The app’s brand name may be different from the SEC-registered company that operates it. Review the loan agreement, privacy notice, disclosure statement, app-store page, receipts, and payment account to identify:

The company’s full legal name;
SEC registration number;
Certificate of Authority number;
Registered office;
Official email and telephone number;
Name of any third-party collection agency; and
Official bank or digital-wallet account.

Be cautious when a collector demands payment to a personal e-wallet account. Ask the lender to confirm the account through an official channel and request an official receipt.

7. File an SEC complaint

Use the SEC iMessage complaint portal to open a ticket and track its status. The SEC’s Financing and Lending Companies Department handles complaints involving lending and financing companies, including unfair collection practices and unauthorized online lending operations. (Securities and Exchange Commission)

Attach:

A concise incident chronology;
Loan documents;
Screenshots and recordings;
Names and numbers of collectors;
Messages sent to contacts;
Your written demand and the company’s response;
Proof of payments; and
Information identifying the app and operating company.

As of the March 18, 2026 joint advisory, the SEC also identified its 1-4732 or 1-4SEC hotline for relevant reports. Government contact details can change, so confirm them on the portal before filing.

8. File a National Privacy Commission complaint

Use the NPC’s official complaint-filing page and download the latest Complaint-Affidavit form.

The NPC procedure generally requires:

Completion of the prescribed Complaint-Affidavit;
A clear statement of the personal-data violation;
Copies of supporting evidence;
Notarization of the complaint;
Payment of any applicable filing fee under the current schedule; and
Filing personally, by authorized courier, or through the submission method stated on the current NPC page.

The NPC introduced a new Complaint-Affidavit template effective July 1, 2025. Using an outdated form can delay or prevent acceptance, so download a fresh copy immediately before filing. (National Privacy Commission)

Both the borrower and contacted individuals may file if their personal information was processed unlawfully.

9. Report criminal threats or cyber harassment

The March 2026 advisory lists the following reporting channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph; onlinecims.ocs@gmail.com; (02) 8723-0401 local 7491

These channels are particularly relevant when the conduct involves threats of violence, account hacking, identity theft, extortion, fake social-media posts, doxxing, or coordinated harassment.

Bring printed and electronic copies of your evidence. Ask for a complaint reference, police blotter entry, or investigation record.

10. Address the legitimate loan separately

Harassment does not automatically cancel the principal loan.

Request:

An itemized statement of account;
The original amount released;
Interest and fees charged;
Payments credited;
Current balance;
Basis for penalties; and
Available restructuring or settlement options.

Pay only through a verified official channel. Obtain a receipt and a written statement showing how the payment was applied. Do not assume that paying an unknown collector will close the account.

Where to Report Online Loan Harassment

Problem	Primary office	Useful evidence	Likely purpose
Unfair collection by a lending or financing company	SEC Financing and Lending Companies Department	Loan documents, messages, app details, collection demands	Administrative investigation and regulatory sanctions
Misuse of contacts, photographs, or other personal data	National Privacy Commission	Permissions, privacy notice, contact messages, proof of disclosure	Privacy investigation, compliance orders, administrative penalties
Threats, extortion, hacking, impersonation, or cyberlibel	PNP Anti-Cybercrime Group or NBI Cybercrime Division	Original electronic evidence, URLs, account details, recordings	Criminal investigation and referral for prosecution
Immediate physical danger	911 or nearest police station	Threat messages, location information, identification of suspect	Emergency protection and immediate police response
Humiliation, reputational damage, or financial loss	Appropriate civil court	Proof of wrongful conduct and actual harm	Damages, injunction, or other civil relief
Harassing app still available for download	Google Play or Apple App Store reporting system	App page, screenshots, complaint details	Platform review or removal; does not replace a government complaint

A barangay blotter may help document local threats or visits. However, a barangay ordinarily cannot investigate national data-processing practices, revoke a lender’s authority, remove an app, or conduct digital forensics. Do not rely on barangay reporting alone when the conduct falls within SEC, NPC, police, or NBI jurisdiction.

Documents, Costs, and Practical Timelines

Prepare one organized evidence folder with an index. Name files by date, such as 2026-07-10_Message-to-Employer.jpg, instead of submitting dozens of unexplained screenshots.

Action	Documents or expense	Practical timing
Preserve evidence and revoke permissions	No government fee	Same day
Send written demand	Email or courier cost	Same day or within 24 hours
SEC iMessage complaint	Electronic evidence and identification; online submission generally begins through the portal	Ticket creation may be immediate; evaluation and investigation can take weeks or months
NPC complaint	Latest form, valid identification, notarization, attachments, and applicable filing fee	Preparation may take several days; investigation may take months depending on evidence and responses
Police or cybercrime report	Printed evidence, electronic copies, identification, witness details	Initial report may be made immediately; digital investigation can take months
Civil action	Filing fees, certified documents, possible lawyer and service expenses	Frequently longer than administrative complaints and may take a year or more

Common bottlenecks include:

The app brand cannot be linked to its legal operator;
Screenshots omit the sender, date, or complete conversation;
The borrower deleted the app before preserving evidence;
Contacts refuse to provide their original messages;
The collector uses disposable SIM cards or fake accounts;
The complaint names only the collector, not the lending company;
The NPC form is outdated or not properly notarized;
Evidence is submitted without an incident chronology; and
The borrower changes numbers and becomes difficult for investigators to reach.

A person filing from abroad may need to have an affidavit notarized at a Philippine embassy or consulate, or notarized locally and apostilled where the Apostille Convention applies. Confirm the receiving agency’s current requirements before sending the document, because acceptance procedures may differ. (Philippine Embassy in New Delhi)

Common Mistakes That Can Weaken Your Complaint

Deleting everything immediately

Blocking the collector may bring temporary relief, but deleting the messages first can remove crucial evidence. Preserve, back up, and organize the evidence before blocking.

Paying a personal e-wallet because of a threat

A payment to an unverified account may not be credited to the loan. Confirm payment instructions with the lender’s official channel.

Assuming a character reference is a guarantor

A reference does not become liable merely because the borrower entered the person’s name or number. A guaranty must be express.

Retaliating through public posts

Do not publish the collector’s private information, issue threats, or encourage online harassment. Retaliation can create a separate complaint against you and distract from the original wrongdoing.

Believing that a complaint erases the debt

An SEC, NPC, or criminal complaint concerns the lender’s conduct. The valid portion of the debt may remain collectible through lawful methods.

Ignoring real court documents

A threatening text saying “a warrant will be issued today” is not a court order. However, do not ignore an actual summons, subpoena, or notice bearing a court or prosecutor’s docket number. Verify it directly with the named court or government office.

Relying only on cropped or edited screenshots

Investigators may need context. Preserve the full conversation and original files whenever possible.

What Your Contacts Should Do

A contacted relative, friend, employer, or co-worker can respond once in writing:

I am not a borrower, co-maker, or guarantor for this account. I do not consent to the use of my personal information for debt collection. Stop contacting me, identify your company and source of my information, and preserve all records relating to this communication.

After preserving the reply and any response, the contact may block the sender.

The contact should avoid arguing about the borrower’s debt, promising payment, confirming the borrower’s address, or sending identification. If the contact is threatened or publicly named, the contact may file a separate complaint with the NPC or cybercrime authorities.

Frequently Asked Questions

Can an online loan app legally message all my contacts?

No. An app cannot use your entire contact list as a collection network. Under the government’s March 2026 advisory, only a properly designated guarantor may be contacted for debt collection. Character references and ordinary contacts should not be pressured to pay.

Are my relatives or references required to pay my online loan?

Not unless they separately and expressly agreed to become co-borrowers, co-makers, or guarantors. Relationship to the borrower does not create liability.

Can I be jailed for failing to pay an online loan?

The Constitution states that no person may be imprisoned solely for debt. A lender may pursue lawful civil collection remedies, but nonpayment by itself does not authorize arrest. Separate criminal conduct—such as fraud, falsification, or issuing a bouncing check—may create a different issue depending on the facts. (Lawphil)

Should I uninstall the loan app immediately?

Preserve evidence first. Record the app details, permissions, messages, loan records, and collection activity. Then revoke unnecessary permissions and uninstall it if doing so will not remove evidence you still need.

Does clicking “Allow Contacts” make the harassment legal?

No. Consent must relate to a legitimate, disclosed, and proportionate purpose. Permission to select a reference or guarantor does not authorize mass messaging, threats, humiliation, or indefinite use of the entire contact list.

What if the lender or loan app is not registered with the SEC?

Include that information in your SEC report. Do not assume that an unregistered operator has no access to your data or cannot continue collection attempts. Secure your accounts, preserve evidence, and report criminal conduct separately when appropriate.

Can I complain even if I still owe money?

Yes. A borrower may owe a valid balance and still be protected from unlawful collection practices. State the facts accurately and address repayment separately.

Can a contacted friend or employer file a complaint?

Yes. The contacted person may be a data subject whose personal information was collected or used without a proper basis. The person may also report threats or defamatory communications received directly.

What if the collector threatens to arrest me today?

Ask for the court name, case number, branch, and copy of the supposed order, but do not provide more personal information. Verify the claim directly with the named court or prosecutor’s office. A lender or private collector cannot issue an arrest warrant.

Does filing with the SEC or NPC automatically stop the messages?

Not necessarily. Send a written demand, revoke permissions, block numbers after preserving evidence, and continue documenting new incidents. Administrative investigations may take time, especially when collectors use changing phone numbers or unidentified third-party agencies.

Key Takeaways

An online lender may collect a valid debt, but it cannot threaten, shame, or use unrelated contacts as leverage.
A character reference is not automatically a guarantor; a guaranty must be expressly accepted.
Preserve complete evidence before deleting messages, blocking numbers, or uninstalling the app.
Revoke unnecessary permissions and secure linked email, social-media, and device accounts.
Report unfair collection to the SEC, personal-data misuse to the NPC, and credible threats or cybercrime to the police or NBI.
A complaint against harassment does not automatically cancel a legitimate loan.
Contacts who were harassed may preserve their own evidence and file independent privacy or criminal complaints.
Pay only through verified official channels and keep written proof of every payment.