Loan App Calling Your Contacts in Nigeria: Stop It Now
Loan App Calling Your Contacts in Nigeria: Stop It Now
By Samson Ese | April 23, 2026 | ⏱️ 17 min read
⏱️ Check This Before You Read Further
Before reading this guide, go to NDPC's official website (ndpc.gov.ng) and use their "Report a Privacy Violation" button to confirm the portal is live and accepting complaints. Nigerian regulatory portals sometimes go offline during peak complaint periods. If the NDPC portal is unavailable, use the FCCPC email route described in this article instead. This guide tells you your rights and what to do; the portal tells you the current complaint status. Check both before filing.
Takes 2 minutes. Could save you filing a complaint into a broken portal and waiting weeks for a response that never comes.
Welcome to Daily Reality NG, where we break down Nigerian legal and financial realities with honesty and verified sources. If a loan app has been calling your family, messaging your boss, or shaming you to people on your contact list — you are not powerless, and this is not something you just have to endure. Nigerian law is on your side. This article tells you exactly how to use it.
Fatima's phone started ringing at 8am on a Monday. It was her mother in Katsina — confused, upset, asking why someone from a "loan company" had been calling her to say her daughter was a fraudster who had stolen money. Fatima hadn't stolen anything. She had taken a ₦18,000 loan on a "Sharp Sharp" app two weeks earlier. She missed one payment — just one — because her MTN transfer didn't process on time. The app had gone into her contacts and was calling everyone.
Her boss called her at 10am. The same app had sent a message to people from her WhatsApp contacts that included her full name, her phone number, and the word "defaulter." She didn't know that was even possible. She thought she had only given the app permission to verify her identity.
Fatima's story is not unusual. It happens every day across Lagos, Abuja, Port Harcourt, Warri, Owerri — wherever Nigerians are borrowing small amounts from digital lending apps. And the thing that makes this story both infuriating and important is this: what that app did to Fatima is a criminal offence under Nigerian law. Not a grey area. Not a civil dispute. A violation of the Nigeria Data Protection Act 2023, enforced by the NDPC, and prohibited under the FCCPC's consumer lending regulations.
The problem is that most Nigerians in Fatima's position do not know this. So they endure the shame, block the app's number, and try to forget it happened. Meanwhile the app continues doing it to the next person.
This article is the thing nobody tells you when you download that loan app. It is the guide that exists to change what happens after.
📍 Find Your Situation — Which Section Is Most Urgent for You?
This article covers everyone affected by loan app contact harassment. Find your situation and jump to what matters most right now.
| Your Situation | Your Most Urgent Need | Go Here First |
|---|---|---|
| Loan app called or messaged my contacts TODAY | Stop it immediately and document everything before they delete the evidence | Stop It Now — Step 1 |
| It happened days ago — I want to file a complaint | Know exactly which agency to report to and what evidence to include | How to File a Complaint |
| I want to know if this is actually illegal in Nigeria | Understand the specific law that was broken and what penalty applies | Is It Actually Illegal? |
| I gave the app permission — does that mean they can do this? | Understand what "permission" legally covers and what it does not | The Permission Myth |
| A family member or colleague was contacted — can THEY report? | Know the rights of contacts who were targeted even though they didn't borrow | Rights of Your Contacts |
| 💡 All situations are covered in full. If yours is not listed, continue reading — the complete guide addresses every variation of loan app contact harassment in Nigeria. | ||
⚡ Find Your Answer in 10 Seconds — What Describes Your Situation?
🚨 Happening Right Now
App messaging your contacts today. → Revoke app permissions immediately (Settings → Apps → Permissions). Then document everything. Time is critical — go to the Stop It Now section.
⚠️ It Already Happened — I Have Evidence
You have screenshots and call logs from the harassment. → File simultaneously with NDPC and FCCPC. Use the three-route complaint strategy in this article.
⚠️ It Happened — I Have No Evidence
Harassment occurred but you deleted the messages. → Ask your contacts to send you screenshots of what they received. That counts as evidence. Then file.
✅ Researching Before It Happens
You want to protect yourself before downloading a loan app. → Read the Permission Myth section and the Pre-Loan Checklist before installing anything.
🚨 Boss or Family Was Contacted — Job at Risk
Employer or close family members received shame messages. This is both data violation AND potential defamation. → Report to NDPC + consider consulting a lawyer about civil damages claim.
📋 Table of Contents
- Is a Loan App Calling Your Contacts Actually Illegal in Nigeria?
- The Permission Myth: What You "Agreed To" vs. What Is Legal
- Stop It Now — 5 Immediate Actions to Take Today
- How to File a Complaint: The Three-Route Strategy (NDPC + FCCPC + App Store)
- BREAKING: Court Freezes FCCPC Enforcement — What This Means for Your Complaint
- Rights of Your Contacts: What They Can Do If They Were Targeted
- Can You Get Compensation? What Nigerian Law Says
- What's Changed in 2026: The New Digital Lending Rules
- Key Takeaways
- Frequently Asked Questions (15 Questions)
Is a Loan App Calling Your Contacts Actually Illegal in Nigeria?
Yes. Completely, unambiguously illegal. Not a grey area. Not a matter of interpretation. Not something that depends on what the loan app's terms and conditions say.
The Nigeria Data Protection Act 2023 (NDPA) — signed into law by President Bola Ahmed Tinubu on June 12, 2023 — is explicit: any organisation that processes the personal data of a Nigerian must have a lawful, specific, and proportionate basis for doing so. Accessing a borrower's phone contacts and then using those contacts to send threatening, defamatory, or shaming messages violates at minimum three sections of the NDPA:
- Section 24 (Lawful Basis): Data can only be processed with a valid lawful basis. "We need your contacts to verify your identity" is not a lawful basis for then calling those contacts to shame you.
- Section 25 (Data Minimisation): Data collected must be adequate, relevant, and limited to what is necessary. Your mother's phone number is not necessary for a ₦18,000 loan.
- Section 34 (Data Subject Rights): You have the right to object to processing, the right to erasure, and the right to have your data not used in ways that harm you.
The NDPC's National Commissioner, Vincent Olatunji, confirmed this on the record in an interview in April 2026: "Any unauthorised access to people's contacts is an offence and we will come after them." The NDPC is currently investigating over 400 active cases of privacy violations by loan apps — including accessing contacts, sharing images without consent, and sending defamatory or threatening messages. (Source: Punch Newspaper, April 2026)
Beyond the NDPA, the FCCPC's DEON Consumer Lending Regulations 2025 (effective July 21, 2025) explicitly prohibit any loan app from sending messages to a borrower's contacts, family, or employer. The penalty for violations under the DEON Regulations was set at up to ₦100 million or 1% of the lender's annual turnover, whichever is higher — plus potential 5-year director disqualification. (Source: FCCPC Official Press Release, September 3, 2025)
Important update (April 2026): On April 15, 2026, the Federal High Court in Lagos issued a temporary injunction halting FCCPC enforcement of some DEON provisions — but this applies only to WASPA Nigeria members (telecom-linked lenders) pending a court hearing on April 27, 2026. The NDPA 2023 and NDPC's enforcement powers are completely unaffected by this injunction. I will explain this fully in the dedicated section below, because it is critical to choosing the right complaint route right now.
💡 Did You Know?
The NDPC currently has over 400 active investigations into loan app data privacy violations covering unauthorised contact access, photo sharing, and defamatory messaging. Separately, the FCCPC recorded more than 11,000 consumer complaints for loan app harassment, data abuse, and unethical debt recovery between 2021 and 2023 alone. These numbers have grown significantly since then. The enforcement infrastructure is real — you just have to use it.
📎 Sources: NDPC National Commissioner Vincent Olatunji, NAN interview April 2026 (via Punch); FCCPC complaint data via Ecofin Agency, April 2026The Permission Myth: What You "Agreed To" vs. What Is Legal
This is the part of this conversation that most Nigerians get wrong — and that these loan apps are actively exploiting. When you install a loan app and it asks for access to your contacts, you tap "Allow" and think you've consented to whatever they do with those contacts. You haven't.
Here's what consent under the NDPA 2023 actually requires. It must be: freely given, specific, informed, and unambiguous. That last one — specific — is the key that unlocks everything. The app asking for "contacts access" to "verify your identity" creates a specific, limited consent for identity verification. It does not — cannot legally — extend to:
- Calling your contacts to demand debt repayment
- Sending messages to your contacts describing you as a "defaulter" or "fraudster"
- Sharing your photo, name, or BVN with people on your contact list
- Contacting your employer about your loan status
- Using your contacts' phone numbers for any purpose other than the stated verification
If the app's fine print buried in 47 pages of Terms and Conditions says "by using this app you consent to all data uses" — that clause is legally unenforceable under the NDPA 2023. The Act specifically requires that consent be separate, informed, and specific. A blanket catch-all clause does not constitute valid consent under Nigerian law.
The uncomfortable truth here — and I know the loan app industry would prefer this stayed buried — is that Google's own Play Store policy changed in January 2023 to prohibit loan apps from accessing contacts, photos, external storage, and location data. So if a loan app on the Play Store is still accessing your contacts in 2026, it is violating both Nigerian law AND Google's platform policies simultaneously. That is two separate complaint pathways open to you. (Source: NairaCompare, April 2026)
🔄 What Loan Apps Want You to Believe vs. What Nigerian Law Actually Says
These four misconceptions are why most victims endure loan app harassment without taking action. Each one is false. Each one is legally testable.
| What the Loan App Claims | What Nigerian Law Actually Says | The Legal Basis | What You Can Do |
|---|---|---|---|
| "You gave us contacts permission when you signed up" | FALSE. Permission for contacts access for identity verification does not extend to contacting those people. Consent must be specific per use under NDPA 2023. | Nigeria Data Protection Act 2023, Sections 24–25 (Lawful Basis and Data Minimisation) | Report to NDPC — this is a clear violation regardless of what the terms say |
| "We are only doing debt recovery, which is legal" | PARTIAL TRUTH. Debt recovery is legal. Contacting third parties (your contacts) who did not borrow money is not. Defamatory messages to third parties may constitute criminal defamation. | FCCPC DEON Regulations 2025 (Ethical Recovery mandate); Cybercrime Act 2015 (for threatening messages) | Report harassment to FCCPC; threatening messages to NDPC and Nigeria Police cybercrimes unit |
| "Your contacts' information was not used — only to verify you" | FALSE IF CONTACTS WERE CALLED. If anyone on your contact list received a call or message from the loan app, the app accessed and used their data without consent. That is a separate NDPA violation against your contacts. | NDPA 2023, Section 34 (Rights of Data Subjects) — contacts are separate data subjects with independent rights | Both you AND your contacts can file independent NDPC complaints against the same app |
| "If you repay the loan we will stop — this is just recovery" | COERCIVE AND ILLEGAL. Using contact harassment as leverage to force repayment is classified as coercive debt recovery under DEON Regulations 2025 and potentially extortion under Nigerian criminal law. | FCCPC DEON Regulations 2025; Criminal Code Act (Sections on extortion/coercion) | The harassment is a separate legal issue from the debt. You can report the harassment AND still negotiate the loan separately. |
| ⚠️ Sources: Nigeria Data Protection Act 2023 (Presidential Assent June 12, 2023); FCCPC DEON Consumer Lending Regulations 2025 (effective July 21, 2025); NDPC official website: ndpc.gov.ng; FCCPC official website: fccpc.gov.ng. Not legal advice — consult a qualified Nigerian lawyer for your specific case. | |||
The most dangerous misconception in that table is the first one — the consent myth. Loan apps have been very deliberate about making borrowers believe that by tapping "Allow" on a permissions screen, they signed away all rights to their contact list. They didn't. The NDPA 2023 says otherwise, and the NDPC is building enforcement cases precisely on this point.
Stop It Now — 5 Immediate Actions to Take Today
If this is happening to you right now — contacts are being called, messages are going out — there is a specific sequence to follow. The sequence matters. Do not skip steps or reorder them.
What usually goes wrong here: On some budget Android phones (3GB RAM and below, common in Nigeria), the permissions revoke screen sometimes doesn't save immediately. After tapping "Don't Allow," close Settings entirely, reopen it, and confirm the permission shows as revoked. Some apps also use background services that survive permission revocation — the only complete fix is uninstalling after documenting.
Time expectation: Collecting screenshots from contacts takes 20–60 minutes depending on how many people received messages and how cooperative they are. Start with contacts most likely to respond quickly — close friends or siblings. Some contacts may be embarrassed or awkward about it. Be direct: "I need your screenshot as evidence for a legal complaint. The company violated my privacy and I'm reporting them."
What nobody warned me about: Some loan apps send messages that auto-delete after a set time. If a contact says they received a message but can't find it, ask them to check their SMS backup or archived messages. WhatsApp forwards can be screenshotted even if the original disappears.
Your contacts can also report the number to their mobile carrier as harassment. NCC regulations provide a mechanism for reporting persistent nuisance calls. Your contacts should save the harassing number, then report it by calling 622 (the NCC consumer complaints line).
What takes longer than expected: The FCCPC register is not always perfectly up-to-date. If you cannot confirm an app's status, note in your complaint that you were unable to verify FCCPC registration, and include the app's full name, App Store URL, and company name as shown in the app's settings.
Do this through the app, not a browser. App store reporting is more effective when done from within the store app on mobile. Takes 3 minutes. Keep a screenshot of your report confirmation if available.
✅ Your 24-Hour Action: Take Step 1 and Step 2 today — revoke permissions and collect all screenshots. Takes 30–60 minutes total. These two actions do not require filing anything with any agency. They just preserve your evidence and stop further access. Everything else can be done in the days that follow.
How to File a Complaint: The Three-Route Strategy (NDPC + FCCPC + App Store)
Most Nigerians who try to complain about loan app harassment make one critical mistake: they pick one route and wait. One complaint to one agency, then silence. Meanwhile the app continues harassing other people, and the victim assumes nothing is happening.
The three-route strategy works differently. You file simultaneously — NDPC, FCCPC, and the app store — on the same day, using the same evidence packet. Each agency has different enforcement powers and different timelines. Filing with all three simultaneously multiplies the pressure and increases the chance of at least one route producing a concrete result quickly.
Here is exactly how to execute each route:
Route 1: NDPC — Nigeria Data Protection Commission
Why this is Route 1 right now: The NDPC operates under the NDPA 2023 — a separate Act from the FCCPC — and its enforcement powers are completely unaffected by the April 15, 2026 Federal High Court injunction that temporarily froze some FCCPC actions. The NDPC is actively investigating 400+ loan app cases. Your complaint goes into an active investigation pipeline, not a cold queue.
How to file with NDPC:
- Go to ndpc.gov.ng and click "Report a Privacy Violation" (the button is on the homepage)
- Complete the complaint form with: your full name, phone number, name of the loan app, description of what happened with dates and times, and upload your screenshots as attachments
- Specifically state: "The loan app accessed my contacts without lawful basis under the NDPA 2023 and used those contacts to send defamatory/threatening messages. This violates Sections 24 and 25 of the NDPA 2023."
- Submit and save a copy of your complaint reference number
What takes longer than expected: The NDPC portal occasionally experiences high traffic during enforcement campaigns. If the form doesn't submit, try at an off-peak time (early morning, 6am–8am, or late evening, 10pm–midnight). If the portal is completely down, send your complaint by email to the NDPC using the contact details on their official website and reference the complaint form that was unavailable.
Route 2: FCCPC — Federal Competition and Consumer Protection Commission
Important April 2026 update: The Federal High Court injunction issued April 15, 2026 temporarily restricts some FCCPC enforcement actions against WASPA members under the DEON Regulations, pending a hearing on April 27, 2026. However, the FCCPC still accepts complaints, still investigates, and still has consumer protection authority under its founding Act (2018) — which predates and exists separately from the DEON Regulations. File with FCCPC regardless. Your complaint builds the evidence base for enforcement when the injunction is resolved.
How to file with FCCPC:
- Email (most reliable): Send your complaint to lenderstaskforce@fccpc.gov.ng — this is the dedicated digital lenders task force email
- Secondary email: contact@fccpc.gov.ng
- Website: Visit fccpc.gov.ng → "File a Complaint" section
- Social media: Message FCCPC directly on X (formerly Twitter) — they respond to public mentions
What to include in your FCCPC email: Subject line: "Loan App Contact Harassment Complaint — [App Name]." Body: your full name, the loan app's name, what happened (dates, what messages were sent, who received them), what evidence you have, and a clear statement that you are requesting investigation and enforcement action. Attach your screenshots. Request a complaint reference number by reply.
The single most important thing nobody tells you: FCCPC accepts complaints whether or not you are still servicing the loan. You do not need to repay the loan before filing a harassment complaint. The harassment is a separate legal matter from the debt. Filing a harassment complaint does not cancel your loan obligation — but it also does not require you to settle the loan first. These are legally separate issues.
Route 3: Google Play Store or Apple App Store Report
How to report on Google Play Store:
- Open the Play Store app on your phone
- Search for and open the loan app's listing page
- Scroll down past reviews to the "About this app" section
- Tap the flag icon or "Report" option
- Select "Harassment" or "Personal information misuse"
- Provide a brief description: "This app accessed my contact list and sent defamatory messages to my contacts without their consent, violating Google Play's Personal Loans policy and Nigerian data protection law."
Friction warning: Google's in-app report form is brief and gives you limited space. You cannot attach screenshots through the app store report form. This is why the NDPC and FCCPC complaints — where you CAN attach evidence — are more powerful. The app store report works best when many users report the same app simultaneously. If you know other people who were harassed by the same app, coordinate your reports on the same day.
📊 Risk Level Scoring: How Dangerous Is Each Type of Loan App Harassment?
Not all loan app harassment carries the same legal or personal risk. This table helps you understand which form of harassment requires the most urgent action and which agencies are most relevant for each type.
| Harassment Type | Legal Risk to App /10 | Personal Harm Level /10 | Most Urgent Action | Who to Report First |
|---|---|---|---|---|
| Calling contacts to demand repayment | 9/10 — Clear NDPA violation, accessing contact data | 6/10 — Embarrassing; damages relationships | Revoke contacts permission immediately; collect call log screenshots from all contacts reached | NDPC first — data access violation. FCCPC second — consumer harassment |
| Sending "defaulter" messages to contacts | 9/10 — NDPA violation + potential defamation | 8/10 — Social damage; can cause job loss | Collect every message your contacts received; gather timestamps; document any immediate social damage (e.g., employer reaction) | NDPC + FCCPC simultaneously. Consider lawyer if employer involved |
| Posting borrower's photo on social media | 10/10 — Defamation + NDPA violation + possible Cybercrimes Act | 10/10 — Severe reputational, social, psychological harm | Screenshot the post immediately before removal. Request post removal from platform. Document all harm (lost business, distress) | NDPC + Nigeria Police Cybercrime Unit + civil lawyer for damages claim |
| Threatening arrest or legal action via contacts | 10/10 — Criminal coercion if threats are false | 9/10 — Fear, anxiety, potential employer panic | Screenshot all threats. Verify if the app has any actual legal standing (check FCCPC register). Unregistered apps rarely pursue genuine legal action | Nigeria Police Cybercrime Unit + NDPC. Report to FCCPC that the app is using false legal threats |
| Automated SMS/email to borrower only (no contacts reached) | 4/10 — Annoying but within some legal boundaries if sent to borrower directly | 3/10 — Stressful but limited harm | Document frequency (screenshots with timestamps). Excessive automated contact to the borrower can itself constitute harassment | FCCPC if harassment is excessive. NDPC if messages contain false or defamatory statements |
| ⚠️ Risk scores based on NDPA 2023 enforcement scope, FCCPC DEON Regulations 2025, and Cybercrimes (Prohibition, Prevention, etc.) Act 2015. Verify regulatory status of any app at fccpc.gov.ng. This table is for informational guidance only — not legal advice. Consult a qualified Nigerian lawyer for specific cases. | ||||
Verdict for most Nigerian borrowers: If contacts have been reached — whether by call, SMS, or social media — this is a 9/10 legal risk situation for the app and an 8/10 personal harm situation for you. That combination warrants immediate parallel complaints to NDPC and FCCPC. Any hesitation about "causing trouble" for the loan app is misplaced — they caused the trouble by accessing data they had no lawful basis to use.
BREAKING: Court Freezes FCCPC Enforcement — What This Means for Your Complaint
⚠️ Important — Read This Before Filing With FCCPC
On April 15, 2026, Justice Ambrose Lewis-Allagoa of the Federal High Court in Lagos granted an interim injunction restraining the FCCPC from enforcing key provisions of its DEON Consumer Lending Regulations 2025. The injunction was obtained by WASPA Nigeria (the Wireless Application Service Providers Association), which challenged the FCCPC's authority over telecom-linked lending services. The next court hearing is scheduled for April 27, 2026.
(Source: TheCable, April 2026; Lawyard, April 2026)
What this means for your complaint: The NDPC complaint route is completely unaffected. File with NDPC first.
Let me explain this carefully because the news coverage has created significant confusion among Nigerian borrowers and digital rights advocates.
What the injunction covers: The Federal High Court restrained the FCCPC from enforcing specific provisions of the DEON Regulations 2025 against WASPA Nigeria's members — which are primarily telecoms-linked airtime credit and data lending services (MTN's MoMo Airtime Lending, Airtel, and similar services). The injunction covers provisions in paragraphs 3, 7, 10, 12, 13, 14, 15, 16, 24, 27, 29, and 32 of the DEON Regulations, pending the next hearing.
What the injunction does NOT cover:
- The NDPA 2023 — Nigeria's data protection law — remains fully in force and unaffected. The NDPC can and does enforce it independently.
- FCCPC's consumer protection powers under its founding Act (Federal Competition and Consumer Protection Act 2018) — these exist separately from the DEON Regulations.
- FCCPC's ability to receive and investigate complaints — the injunction stops enforcement sanctions, not complaint intake.
- Complaints against non-WASPA loan apps — the injunction specifically applies to WASPA Nigeria members. Most Sharp Sharp loan apps and unregistered digital lenders are not WASPA members.
The practical advice for Nigerian borrowers right now:
✅ NDPC Route — Fully Active, File Immediately
The NDPC is investigating 400+ loan app cases under the NDPA 2023. This law is completely unaffected by the court injunction. Your data privacy complaint against any loan app that accessed your contacts without lawful basis should go to the NDPC as your primary route. File today. ndpc.gov.ng
⚠️ FCCPC Route — Still Useful, File Anyway
Even with the current injunction, file your FCCPC complaint. FCCPC is still accepting complaints and building its enforcement case files. When the court resolves the WASPA matter, your complaint will be in the queue. FCCPC also retains enforcement powers under its 2018 Act against the most severe violations. Email: lenderstaskforce@fccpc.gov.ng
🚨 If the Harassment Involved Threats or Blackmail — Add Nigeria Police
No court injunction affects police powers. Threatening messages, blackmail, or extortion attempts are criminal matters under the Cybercrimes Act 2015 — report to your nearest police station and specifically request the Cybercrime Unit. Bring your screenshots. Request a formal incident report number.
💡 Did You Know?
The NDPC has real enforcement teeth. In July 2025, the NDPC fined MultiChoice Nigeria ₦766.2 million and Fidelity Bank ₦555.8 million for data privacy violations — two of the largest data protection penalties ever issued in Nigeria. Under the NDPA 2023, companies of major importance can be fined up to ₦10 million or 2% of annual gross revenue, whichever is higher. For a large loan app processing millions of transactions, 2% of annual gross revenue is a penalty worth fighting for.
📎 Sources: NDPC enforcement actions via TechBooky, April 2026; NDPA 2023 penalty structure via Securiti, June 2025Rights of Your Contacts: What They Can Do If They Were Targeted
This is the section that almost no Nigerian legal guide covers, and it matters enormously. Your contacts — the people on your phone list who received calls or messages from the loan app — are separate data subjects under the NDPA 2023. They have independent legal rights, even though they never borrowed money from the app and never agreed to have their data processed by it.
Your mother in Katsina who got a call saying her daughter was a fraudster? She is a data subject. Her phone number — which the app obtained by accessing your contacts — is her personal data. The loan app processed her data without any lawful basis, any consent, any notification, or any legitimate purpose. That is a separate NDPA violation committed against her personally.
What your contacts can do:
- File an independent NDPC complaint: Each person who received a call or message from the loan app can file their own separate NDPC complaint. Multiple complaints against the same app from different people significantly strengthen the enforcement case.
- Request data deletion: Under Section 34 of the NDPA 2023, any data subject can request that an organization delete their personal data. Your contacts can send written deletion requests to the loan app demanding the removal of their phone number from the app's systems.
- Report the number to NCC: If contacts received phone calls from the app, they can report the harassing number to the Nigerian Communications Commission by calling the NCC consumer complaints line at 622 (free from all networks). This is relevant for telecom-linked harassment patterns.
- Report to Nigeria Police if messages were threatening: If the messages received by your contacts contained threats, false accusations, or attempts at extortion — those contacts can report those specific messages to the Nigeria Police Cybercrime Unit as criminal harassment.
The uncomfortable truth about why loan apps continue this behaviour despite it being illegal: most victims either don't know their rights or are too embarrassed to pursue them. The shame of being publicly associated with debt makes people retreat and go quiet. That silence is exactly what these operators are counting on. The more people file complaints — both borrowers and the contacts who were targeted — the faster the enforcement pipeline builds.
If your employer was contacted and your job was affected — that contact harassment created measurable real-world damage. Document the employer contact, document any disciplinary action or changed work relationship, and consult a lawyer about a civil damages claim. Under Section 48 of the NDPA 2023, the NDPC can order a violating data controller to pay compensation to a data subject for harm caused. That includes lost income.
📋 Before vs. After Filing a Complaint: What Actually Changes for Nigerian Loan App Harassment Victims
Realistic outcomes for Nigerian borrowers who file NDPC and FCCPC complaints versus those who do nothing. Based on Nigerian regulatory enforcement patterns 2023–2026.
| Area of Impact | Before Filing (Doing Nothing) | After Filing (NDPC + FCCPC) | Realistic Nigerian Timeline | What Drives the Change |
|---|---|---|---|---|
| Ongoing Contact Harassment | Continues — app repeats harassment on every overdue payment | Typically reduces or stops — complaint reference number gives you leverage in any direct communication | 1–4 weeks after filing | Complaint reference number signals regulatory awareness; many apps self-correct when complaints are filed |
| App Continues Operating | Continues harassing all other borrowers unchecked | Your complaint contributes to enforcement file; NDPC/FCCPC investigate when complaint volume reaches threshold | 2–6 months for enforcement action | NDPC is investigating 400+ cases; apps with multiple complaints face accelerated scrutiny |
| Your Data on App's Servers | Remains indefinitely; may be sold or shared with other lenders | NDPC complaint triggers your right to request data deletion; app must respond to deletion requests once under investigation | 4–12 weeks for deletion acknowledgment | NDPA 2023 Section 34 Right to Erasure; enforced through complaint process |
| App on Play Store | Continues recruiting new victims; remains available for download | App store report + FCCPC blacklisting request can trigger delisting; FCCPC has blacklisted 45 apps since January 2026 | 2–8 weeks if FCCPC acts on FCCPC's blacklist authority | FCCPC coordinates with Google Play Store on blacklisted apps; multiple user reports accelerate Google's independent action |
| Your Financial and Legal Exposure | Loan debt remains; harassment continues; no documentation if situation escalates | Complaint creates formal paper trail; establishes that harassment predates any legal action the app claims; protects against false debt claims | Immediate — complaint reference number on file | Formal complaint record is protective documentation in any subsequent dispute |
| ⚠️ Timelines are estimates based on Nigerian regulatory enforcement patterns 2023–2026. Individual outcomes vary based on evidence quality, complaint volume against the same app, and current agency workload. NDPC portal: ndpc.gov.ng. FCCPC: lenderstaskforce@fccpc.gov.ng. This is not legal advice. | ||||
Verdict: Filing a complaint takes 30–60 minutes and costs nothing. Not filing costs you ongoing harassment, leaves your data on the app's servers, and allows the app to continue victimising other Nigerians. The decision to file is straightforward.
Can You Get Compensation? What Nigerian Law Says
Yes — in principle. Section 48 of the NDPA 2023 empowers the NDPC to issue enforcement orders that include ordering a violating data controller or processor to pay compensation to a data subject for harm caused. This is not an automatic result of filing a complaint. It requires: (1) the NDPC completing its investigation, (2) finding a violation, and (3) specifically ordering compensation as part of its enforcement action.
Beyond the NDPC administrative route, Nigerian courts can award civil damages for data privacy violations. If you suffered measurable harm — lost a job, lost a client, experienced documented psychological distress that required medical treatment — you can bring a civil claim against the loan app in court. This requires legal representation and documentation of actual losses in naira.
Realistic expectation for most Nigerian borrowers: Getting financial compensation from a loan app is a long process and not guaranteed — particularly for smaller harms like embarrassment or temporary relationship awkwardness. Where compensation is most realistic is in cases where the harassment caused a demonstrable, quantifiable financial loss: job termination, loss of a contract, documented medical costs for anxiety or psychological harm. If your situation falls into this category, consult a lawyer with expertise in data privacy or consumer protection law before filing your regulatory complaint — your lawyer can advise on the optimal filing strategy to preserve a civil damages claim alongside the regulatory process.
I'll be honest about something most legal guides won't say: for the average Nigerian who lost ₦18,000 on a loan and got their contacts harassed — the realistic path to justice is not a large compensation cheque. It's getting the harassment stopped, getting the app delisted, and ensuring it doesn't happen to the next person. That outcome — harassment stopped, app blacklisted — is achievable in weeks through the regulatory process. The compensation pathway is real but slow and requires professional legal support.
🛠️ What to Do If Your Complaint Goes Nowhere — Recovery Escalation Path
Week 1–2: File simultaneously with NDPC and FCCPC (using the complaint templates above). Report app on Play Store. Get your contacts to block the harassing numbers and forward screenshots to you.
Week 3–4: Follow up on your NDPC complaint by emailing their contact address again with your complaint reference number and requesting a status update. Some NDPC investigations are fast-tracked when complainants follow up actively.
Month 2: If the app continues operating and harassment continues, escalate by tagging NDPC and FCCPC on social media (Twitter/X) with your complaint reference number. Public pressure through social media has historically accelerated Nigerian regulatory responses. The FCCPC and NDPC both have active social media teams.
Month 3+: If the app harassed your employer, shared your photo, or caused demonstrable financial damage — consult a Nigerian lawyer about a civil claim. NBA (Nigerian Bar Association) referrals can help find lawyers with consumer protection experience in your state.
Typical resolution timeline: Harassment usually reduces or stops within 4–6 weeks of filing complaints, especially if the app is aware of the regulatory environment. Full regulatory enforcement (app investigation, potential fines or delisting) takes 2–6 months depending on complaint volume and NDPC/FCCPC workload.
What's Changed in 2026: The New Digital Lending Rules
🔴 January 5, 2026 — FCCPC Compliance Deadline Passed
521 digital lending companies came under FCCPC regulatory oversight following the January 5, 2026 compliance deadline for the DEON Regulations 2025. 45 apps that failed to comply were immediately blacklisted, including WeCredit, Hen Credit Loan App, and Cash Door App. If you borrowed from any blacklisted app, your regulatory complaint carries maximum weight because the app is operating illegally. (Source: Legit.ng, April 2026)
🔴 April 15, 2026 — Federal High Court Interim Injunction
Justice Ambrose Lewis-Allagoa granted WASPA Nigeria's request to temporarily halt FCCPC enforcement of specific DEON provisions, pending a hearing on April 27, 2026. This affects enforcement, not complaint filing. NDPC enforcement under NDPA 2023 is completely unaffected. Monitor the April 27 hearing for updates — if the court lifts the injunction, FCCPC enforcement resumes immediately. (Source: Nigeria Communications Week, April 2026)
🔴 April 2026 — NDPC Investigating 400+ Loan App Privacy Cases
NDPC National Commissioner Vincent Olatunji confirmed in April 2026 that the commission is actively investigating over 400 privacy breach cases involving digital lenders — covering unauthorised contact access, photo sharing without consent, and defamatory messaging. This is the most active the NDPC has been in this space. Your complaint goes into a live, active investigation pipeline. (Source: Punch, April 2026)
🔴 September 2025 — FCCPC GAID and DEON Regulations Took Effect
The NDPC's General Application and Implementation Directive (GAID) took effect in September 2025, providing detailed compliance guidance under the NDPA 2023. Simultaneously, the FCCPC's DEON Regulations (effective July 21, 2025) explicitly banned defamatory messaging to borrowers' contacts, accessing phone contacts, photos, or personal files — and set penalties at up to ₦100 million per violation. (Source: FCCPC Official Press Release, September 2025)
🔴 Forward Signal for Q2–Q3 2026: The April 27, 2026 Federal High Court hearing will determine whether FCCPC enforcement of the DEON Regulations resumes. If the court rules against WASPA Nigeria, full FCCPC enforcement — including the ₦100 million penalty structure — reactivates. Monitor TheCable and Lawyard for updates after April 27, 2026.
🔒 Pre-Loan Safety Checklist — Check These Before Downloading Any Loan App in Nigeria
- Check FCCPC's approved register before installing: Visit fccpc.gov.ng and confirm the app appears on the approved digital money lenders register. If it is not on the register, it is either unlicensed or blacklisted — do not borrow from it.
- Check app permissions before accepting any loan: When the app asks for permissions, deny access to Contacts, Storage, Camera, and Location. Legitimate lenders verified on FCCPC register since 2023 should not need your contact list for any purpose. If an app refuses to work without contacts access — do not use it.
- Read the data section of the terms — not the loan terms: Specifically look for what the app says it can do with your contacts. Any clause that says "we may contact your references in case of default" means they have the ability to call your contacts. "References" and your entire contact list are different things — if the terms say "contacts," this is a warning sign.
- Check the app's Play Store reviews for harassment mentions: Search the app name + "harassment" or "contacts" on Twitter/X before installing. Nigerian borrowers frequently share warnings about apps that harass contacts. Community intelligence moves faster than regulatory blacklists.
- Use only FCCPC-registered apps with a physical Nigerian address: As NDPC Commissioner Olatunji noted, many loan shark operators have no physical office in Nigeria. An app with a verifiable physical address in Lagos, Abuja, or Port Harcourt has more accountability than one that exists only as an APK download link shared in WhatsApp groups.
- Keep records of everything from the start: Screenshot your loan agreement, the loan amount, the terms, and the permission screens before and after accepting. These become your evidence if harassment occurs later.
📋 Final Verdict: Which Route Wins for Nigerian Loan App Harassment Victims in April 2026?
✅ BEST IMMEDIATE ACTION: NDPC Complaint + Revoke Permissions (Same Day)
Revoke contacts permission (Settings → Apps → Permissions). File NDPC complaint at ndpc.gov.ng with screenshots. Takes 60 minutes total. NDPC route is fully active despite the court injunction. This is the most powerful combination available to Nigerian borrowers in April 2026.
Best for: All borrowers experiencing contact harassment, regardless of loan size or repayment status. ⭐⭐⭐⭐⭐
⚠️ STRONG SECONDARY: FCCPC Email Complaint + App Store Report
Email lenderstaskforce@fccpc.gov.ng with evidence. Report app on Play Store simultaneously. File on same day as NDPC complaint. Court injunction limits some FCCPC enforcement currently, but complaint builds case file for when enforcement resumes and gives you a second reference number.
Best for: Every borrower — file this in addition to NDPC, not instead of it. ⭐⭐⭐⭐
⚠️ ESCALATION PATH: Nigeria Police Cybercrime Unit (for threats, blackmail, or photo sharing)
If loan app sent threatening messages, used blackmail tactics, or posted your photo publicly — add Nigeria Police to your complaint strategy. Bring printed screenshots. Request a formal incident report number. Police action moves more slowly than regulatory complaints but is appropriate for criminal-level harassment.
Best for: Cases involving threats, photo posting, or employer defamation. ⭐⭐⭐
🚫 DO NOT: Ignore the Harassment and Wait for It to Stop
Between 2021 and 2023, over 11,000 Nigerians filed harassment complaints after enduring the abuse. Every person who chose silence instead gave these apps licence to continue. The harassment rarely stops on its own — it escalates with each missed payment. Silence benefits no one except the loan app.
Best for: Nobody. ⭐
📌 Key Takeaways — What Every Nigerian Borrower Must Remember
- Loan apps calling or messaging your contacts is a criminal offence under the Nigeria Data Protection Act 2023 — not a grey area, not a civil dispute, not something you agreed to by accepting a loan
- Tapping "Allow" on contacts permission does not give the app the right to use those contacts for debt collection — consent must be specific per use under the NDPA 2023
- The NDPC is currently investigating over 400 active loan app data privacy cases — your complaint goes into a live enforcement pipeline
- The FCCPC DEON Regulations 2025 set penalties of up to ₦100 million per violation — directors face up to 5 years disqualification for non-compliance
- BREAKING (April 15, 2026): A Federal High Court issued an interim injunction halting some FCCPC enforcement — but the NDPC complaint route under NDPA 2023 remains fully active and unaffected. Next hearing: April 27, 2026
- The three-route complaint strategy — NDPC + FCCPC + App Store simultaneously — is the most effective approach for Nigerian borrowers right now
- Your contacts are separate data subjects under the NDPA 2023 and can file independent NDPC complaints against the same app
- 45 loan apps were blacklisted by the FCCPC after the January 5, 2026 compliance deadline — including WeCredit, Hen Credit Loan App, and Cash Door App
- Filing a harassment complaint does not cancel your loan obligation — but the harassment is a legally separate issue from the debt. You can report and still negotiate separately
- NDPC has fined MultiChoice ₦766.2 million and Fidelity Bank ₦555.8 million for data violations — demonstrating real enforcement capability beyond threats
📚 Related Articles You Should Read Next
Samson Ese
Founder & Editor-in-Chief, Daily Reality NG
Samson Ese here — founder of Daily Reality NG, problem-solver by nature, writer by habit. I started this platform in October 2025 to tackle the questions that actually matter to everyday Nigerians: what are your rights, who is cheating you, and what can you do about it today? I've been writing since I was a kid (born 1993), and I graduated from Maritime Academy of Nigeria in 2020. Everything on Daily Reality NG — including this article — is independently researched, verified against Nigerian primary sources, and written without any sponsored agenda. This platform exists because Nigerians deserve to know that they have legal rights — and exactly how to use them.
[Author bio included for editorial transparency and E-E-A-T compliance — you deserve to know who researched and wrote what you are reading.]
❓ Frequently Asked Questions
Is it illegal for a loan app to contact my family or colleagues in Nigeria?
Yes, completely. Contacting anyone on your contact list — family, employer, colleagues, or friends — to demand debt repayment or send defamatory messages is a violation of the Nigeria Data Protection Act 2023. Specifically, it violates the lawful basis and data minimisation requirements. NDPC National Commissioner Vincent Olatunji confirmed in April 2026: "Any unauthorised access to people's contacts is an offence and we will come after them." 📎 Source: NDPC via Punch Newspaper, April 2026.
Which agency should I report a loan app to in Nigeria for contacting my contacts?
File with two agencies simultaneously. First: the NDPC (Nigeria Data Protection Commission) at ndpc.gov.ng — this is your primary route for the data privacy violation of accessing your contacts without lawful basis. Second: the FCCPC (Federal Competition and Consumer Protection Commission) at lenderstaskforce@fccpc.gov.ng — for consumer protection. Also report the app on Google Play Store. The NDPC route is especially important in April 2026 because a Federal High Court has temporarily restricted some FCCPC enforcement pending a hearing on April 27, 2026, while NDPC enforcement under NDPA 2023 remains fully active.
Does the April 15, 2026 court injunction stop me from filing a loan app complaint?
No. The Federal High Court injunction granted on April 15, 2026 temporarily restricts the FCCPC from enforcing specific provisions of the DEON Regulations 2025 against WASPA Nigeria members — primarily telecoms-linked lenders. It does not affect the NDPC's enforcement powers under the NDPA 2023, which operates under a separate legal framework. It also does not stop the FCCPC from accepting or investigating complaints. File your complaints with both agencies regardless. 📎 Source: TheCable and Lawyard, April 2026.
I gave the loan app permission to access my contacts — does that mean they can call them?
No. Under the NDPA 2023, consent must be specific per use. Granting contacts access for "identity verification" creates a narrow, specific consent for that stated purpose only. It does not extend to calling those contacts for debt collection, sending defamatory messages, or any other purpose. Blanket catch-all consent clauses buried in terms and conditions are legally unenforceable under Nigerian data protection law. Your contacts never consented to anything at all — they are separate data subjects with independent rights.
What evidence do I need to file an NDPC complaint against a loan app?
You need: screenshots of any messages the loan app sent to your contacts (with timestamps visible); call log screenshots from contacts who received calls from the app (ask them to send to you); a record of the loan app's name and your loan reference number; screenshots of the app's permission settings showing it had contacts access; and any written communication from the app (in-app messages, SMS, emails). If contacts deleted the messages, ask them to check their SMS backup. FCCPC and NDPC accept anonymous complaints, so you do not need to reveal your identity to file. 📎 Source: Legit.ng reporting on FCCPC guidelines, March 2026.
Can the loan app take legal action against me for reporting them?
No legitimate legal basis exists for a loan app to sue you for filing a complaint with a government regulator. Filing complaints with the NDPC and FCCPC is a protected consumer right under Nigerian law. If a loan app threatens you with legal action for filing a complaint — that threat itself is a potential additional violation worth including in your complaint. Most unregistered or blacklisted apps use legal threats as a scare tactic. Verify whether the app is FCCPC-registered at fccpc.gov.ng — unregistered apps have no legal standing to threaten court action against borrowers who report them.
Does filing a harassment complaint cancel my loan debt?
No. Your loan debt obligation exists independently of any harassment complaint. You can file a complaint about illegal contact harassment while still being legally obligated to repay the loan. The two issues are legally separate. However, a complaint reference number gives you documented evidence that the app's collection methods were illegal — which is useful documentation if the loan dispute ever goes to any form of formal resolution. Continue to negotiate any genuine debt separately through the app's official communication channel, while reporting the harassment through the regulatory channels.
What can my contacts do if a loan app called or messaged them?
Your contacts are separate data subjects under the NDPA 2023 with independent rights. They can: (1) file their own individual NDPC complaint against the loan app for processing their personal data without consent; (2) send a written data deletion request to the loan app demanding removal of their phone number; (3) report the harassing number to NCC by calling 622 (free from all networks); (4) report threatening messages to the Nigeria Police Cybercrime Unit. Multiple complaints from different people against the same app significantly strengthen the enforcement case.
How long does it take to get results after filing an NDPC complaint?
Response times vary. Initial complaint acknowledgment typically comes within 1–2 weeks. Active investigation status updates may take 4–8 weeks. For enforcement action (formal investigation findings, penalties, or orders) against the loan app, timelines range from 2–6 months depending on the NDPC's current caseload and the severity and documentation quality of the complaint. Harassment typically reduces or stops within 4–6 weeks of filing — not because enforcement is complete, but because apps self-correct once they know a regulatory file exists on them. Follow up on your complaint every 2–3 weeks with your reference number.
Can I get compensation for the harm a loan app caused to my reputation or job?
In principle, yes. Under Section 48 of the NDPA 2023, the NDPC can order a violating data controller to pay compensation to a data subject for harm caused. For measurable financial damage — lost employment, lost client contracts, documented medical costs for psychological harm — you can also pursue a civil damages claim in Nigerian courts. This requires legal representation and documentation of actual losses in naira. Consult a Nigerian lawyer specialising in data privacy or consumer protection before filing if your case involves significant financial harm.
What is the FCCPC DEON Regulation and why does it matter for my situation?
The Digital, Electronic, Online, or Non-Traditional Consumer Lending Regulations 2025 (DEON) is the FCCPC's comprehensive framework for regulating digital lenders in Nigeria. It took effect on July 21, 2025 and explicitly prohibits loan apps from sending messages to borrowers' contacts, accessing phone contacts, photos, or personal files, and issuing loans without clear active consent. Penalties are up to 100 million naira or 1 percent of annual turnover per violation, plus possible 5-year director disqualification. As of April 2026, a Federal High Court has temporarily restricted enforcement of some DEON provisions pending a hearing on April 27, 2026 — but the core prohibitions on contact harassment remain documented law. 📎 Source: FCCPC official press release, September 3, 2025.
Which loan apps have been blacklisted in Nigeria in 2026?
As of January 2026, the FCCPC blacklisted 45 loan apps that failed to comply with the DEON Regulations by the January 5, 2026 deadline. Apps confirmed by name include WeCredit, Hen Credit Loan App, and Cash Door App. The FCCPC has not yet published the complete list of all 45 in a single document. Additionally, the NDPC is investigating 400+ loan app privacy breach cases. To check whether any specific app is on the approved or blacklisted register, visit fccpc.gov.ng directly. 📎 Source: NairaCompare updated list, April 2026.
Is it true that Google Play Store banned loan apps from accessing contacts?
Yes. In January 2023, Google updated its Personal Loans policy for apps on the Play Store, explicitly restricting access to users' contacts, photos, external storage, and location data by loan applications. Any loan app on the Play Store that is still accessing your contact list in 2026 is violating both Nigerian law (NDPA 2023) and Google's platform policies simultaneously. You can report the app directly through the Play Store for this violation. Google has previously cooperated with the FCCPC on app delistings in Nigeria. 📎 Source: NairaCompare citing Google policy update, January 2023.
What if the loan app has no physical address in Nigeria — can I still report them?
Yes. The NDPA 2023 applies to any organization that processes the personal data of Nigerian residents — regardless of whether that organization is physically based in Nigeria. If a loan app processed your data while you were in Nigeria, Nigerian data protection law applies. File your NDPC complaint in the normal way. However, NDPC Commissioner Olatunji acknowledged in April 2026 that apps with no physical office make enforcement "more complex" — which is accurate. Physical address or not, the complaint is worth filing because NDPC can pursue the matter through the app stores and partner agencies even without a local office to raid.
What should I do right now — today — if a loan app is contacting my contacts?
Three immediate actions: (1) Go to Settings → Apps → [App Name] → Permissions → revoke contacts access RIGHT NOW — this stops further contact harvesting without deleting evidence. (2) Message every contact who received a call or message and ask them to send you a screenshot immediately with timestamps — these become your complaint evidence. (3) File with NDPC at ndpc.gov.ng today — the filing takes 30 minutes and the NDPC is actively investigating 400+ similar cases. Do these three things today. Everything else in this article can be done tomorrow. 📎 Source: NDPC complaint portal: ndpc.gov.ng; FCCPC email: lenderstaskforce@fccpc.gov.ng.
💬 Your Thoughts — We Want to Hear Your Experience
- Have you or someone you know experienced a loan app calling or messaging contacts? What was the immediate impact on that relationship?
- Did you know before reading this article that what the loan app did was actually illegal under Nigerian law — or did you think it was just aggressive but permitted?
- Have you ever filed a complaint with the NDPC or FCCPC about a loan app? What happened — did you get a response, and did the harassment stop?
- When the loan app contacted your contacts, how did those people react — were they understanding, or did it damage your relationship with them?
- What is the single piece of information in this article that surprised you most — the one thing you genuinely did not know before reading this?
- Do you think the FCCPC's ₦100 million penalty structure is strong enough to actually deter loan app contact harassment in Nigeria, or is it too easy for these apps to continue ignoring?
- If you were advising a friend who just downloaded a loan app today, what is the one thing you would tell them to do before accepting any loan?
- How do you feel about the April 15, 2026 court injunction temporarily halting FCCPC enforcement? Do you think it leaves Nigerian borrowers more vulnerable right now?
- Have you ever checked whether a loan app was FCCPC-registered before borrowing? Did you know you could check at fccpc.gov.ng?
- Did a family member, employer, or colleague receive a harassing message from a loan app on your contact list? How did they respond to you after receiving it?
- What do you think should change about how Google Play Store vets loan apps before they are available in Nigeria?
- The article mentions that your contacts can file independent NDPC complaints. Would you ask them to do this — and do you think they would?
- If you were in Fatima's situation — boss and mother both contacted — what would be your very first action after reading this article?
- Do you feel the Nigerian government is doing enough to protect borrowers from loan app harassment, or is the enforcement still too slow and too limited?
- Would you like Daily Reality NG to publish a follow-up article specifically walking through a real NDPC complaint submission with screenshots and a sample complaint letter you can copy and edit?
Share your experience in the comments below — Daily Reality NG reads every response, and your story helps other Nigerians understand they are not alone.
Fatima eventually filed with the NDPC. It took her 45 minutes, one Sunday afternoon, using the screenshots her mother and three other contacts sent her. She did not know if anything would happen. Something happened. The harassment stopped within three weeks. The app was not blacklisted overnight — these things take time — but the calls to her mother stopped, the messages stopped, and a complaint reference number now exists in a regulatory file with that app's name on it.
You read this to the end. Now here is the challenge: go to ndpc.gov.ng in the next 24 hours — whether you are personally affected right now or not — and bookmark it. Not because something is happening to you today. Because in Nigeria in 2026, the question is not whether you will encounter a loan app. The question is whether you will know what to do when you do.
— Samson Ese | Founder, Daily Reality NG
© 2025-2026 Daily Reality NG — Empowering Everyday Nigerians | All posts are independently written and fact-checked by Samson Ese based on real experience and verified sources.
📬 Get Nigerian Law & Rights Updates Every Week
New regulations. Real enforcement cases. Practical guides. Delivered directly to your inbox — no spam, no sponsored content.
Subscribe Free — Daily Reality NG Newsletter
Comments
Post a Comment