A lending app messaged my contacts about my debt — what can I do?
Last updated: 2026-07-11 · Educational content; not legal advice.
Short answer
It is illegal, and you can report it to the National Privacy Commission (NPC). When a lending app pulls the contacts from your phone and messages your friends, family, or co-workers about your loan, it commits unauthorized processing and unauthorized disclosure of your personal data under the Data Privacy Act (RA 10173), and it breaches NPC Circular No. 20-01 (2020), which bars lending and financing companies from harvesting a borrower's contact list for debt collection. The same conduct is also an unfair collection practice under SEC Memorandum Circular 18 (2019). Screenshot every message, then file with the NPC (privacy.gov.ph) and the SEC — both can order the lender to delete your data and can fine or suspend it. LabanPH builds both complaints for free.
Primary sources
Frequently asked
Which law did the app break by messaging my contacts?
Two, at least. RA 10173 (Data Privacy Act) — the app processed and disclosed your contacts' personal data, and your own, for a purpose that is neither necessary nor proportional to your loan; NPC Circular 20-01 flatly prohibits harvesting a contact list for collection. Separately, SEC MC 18 (2019) makes contacting anyone other than a co-maker or guarantor an unfair collection practice.
What evidence should I keep?
Screenshot the messages your contacts received (with sender name, number, date, and time), the app's permission-request screen, and your loan record. Ask the contacts who were messaged to save and forward what they got — their statements are evidence for your NPC and SEC filings.
What can the NPC actually order?
The NPC can order the lender to stop, to delete your and your contacts' data, issue a compliance or cease-and-desist order, impose administrative fines, and refer the case for criminal prosecution under RA 10173. The SEC can suspend or revoke the lender's Certificate of Authority.
Take action
Got a similar problem?
File a complaint and we'll pre-fill BSP, SEC, DTI, and small-claims letters for you.
Contact-list scraping, unauthorized data use, and how to file with the NPC.