Why Kenyan Loan Apps Keep Calling Your Contacts — And What the Law Says

The phone call comes to your mother, your employer, or your neighbour. "Your relative owes us money and has not paid. Please tell them to pay immediately." Maybe it is a recorded message. Maybe it is an actual person reading from a script. Either way, it is deliberate, calculated, and in many cases, deeply damaging.

Contact-shaming — the practice of calling a borrower's contacts to pressure repayment — became one of the defining scandals of Kenya's mobile lending boom. It cost people jobs. It damaged marriages. In the most extreme documented cases, it contributed to mental health crises. And for years, it was largely unchecked.

The good news is that Kenya's legal landscape has changed significantly. Here is a full breakdown of why loan apps do this, what the law now says, and what you can do if you are experiencing it.

Why Do Loan Apps Call Your Contacts?

The answer is simple: it works. Traditional debt collection relies on legal processes — demand letters, court judgments, asset seizure — that are slow and expensive. For a lender owed KES 2,000 on a mobile loan, taking someone to court makes no commercial sense.

But borrowers have something more valuable than assets: reputations. Social relationships in Kenya — with family, employers, church members, colleagues — carry real weight. The threat of shame and social pressure is an effective collection mechanism, especially in communities where debt is stigmatised.

Loan apps were designed to weaponise this. By requiring access to your contact list as a condition of lending, they built a leverage mechanism that cost them almost nothing to deploy. A KES 100 WhatsApp text to twenty contacts is cheaper than one minute of a lawyer's time — and often more effective.

The Legal Position Before 2022

Until Kenya's Data Protection Act came into force in 2019 and the CBK's DCP licensing regime became operative in 2022, contact-shaming existed in a legal grey area. There was no specific law prohibiting a private company from contacting third parties about a borrower's debt, provided those contacts were obtained with some form of consent — however coerced that consent might have been.

The "consent" was buried in app permissions. When you installed the loan app and clicked "Allow" on the contacts permission, the terms and conditions — which almost nobody reads — typically included language permitting the app to contact those people for debt collection purposes. Consent, in the eyes of the app's lawyers, had been obtained.

What the Data Protection Act 2019 Says

Kenya's Data Protection Act 2019 fundamentally changed the legal basis for personal data processing. Key provisions that apply to loan app contact practices:

• Lawful basis for processing: Personal data may only be processed for a specific, legitimate purpose. Using a borrower's contacts for debt collection requires a lawful basis that is much harder to establish under the Act
• Third-party data rights: The contacts in your phone are also data subjects with their own rights. Processing their data — including contacting them — without their own consent is generally unlawful
• Proportionality: Even where some data processing is lawful, it must be proportionate. Contacting 200 contacts about a KES 500 debt is difficult to justify as proportionate
• Right to withdraw consent: Any consent you gave through an app permission can be withdrawn; if you revoke contact access, the app cannot lawfully use that data going forward

What the CBK's DCP Framework Adds

The CBK's Digital Credit Provider licensing requirements added a further layer of protection. Licensed lenders are explicitly prohibited from:

• Using harassment, threats, or humiliation as debt collection tactics
• Disclosing borrower information to third parties without legitimate basis
• Accessing borrower data beyond what is necessary for the lending activity

A licensed lender that contacts your employer or family members without lawful basis risks losing its CBK licence — a severe commercial consequence that acts as a genuine deterrent.

What You Can Do If It Happens to You

If a loan app is contacting your contacts to pressure repayment, you have several avenues available:

1. Document everything: Screenshot the app permissions you granted, save any messages sent to your contacts, note the dates and times of calls
2. Complain to the lender: Send a formal written complaint through the app's complaints mechanism. Licensed lenders are required to respond
3. Complain to the CBK: If the lender is CBK-licensed and the contact-shaming continues after your complaint, escalate to the CBK's consumer protection department
4. Complain to the ODPC: The Office of the Data Protection Commissioner handles violations of the Data Protection Act. File a complaint at odpc.go.ke
5. Seek legal advice: Organisations like the Consumer Federation of Kenya (COFEK) and some legal aid clinics have helped borrowers pursue civil claims for data misuse and harassment

What If the App Is Unlicensed?

This is where things are more complicated. If the app contacting your contacts does not have a CBK licence, it is operating illegally. You can report it to the CBK and to the Director of Public Prosecutions. However, many of these operators are based offshore — often in China or India — and regulatory enforcement across borders is difficult.

Practically speaking, if you are dealing with an unlicensed app: stop using it, revoke any permissions it has on your phone, and change any PIN or password you may have shared. The aggressive collection tactics these apps use are designed to intimidate, but their actual legal power in Kenya is very limited.

How to Protect Yourself Before It Happens

The simplest protection is to only borrow from licensed lenders who do not require contact access as a condition of lending. A legitimate lender can assess your creditworthiness through M-Pesa transaction history, CRB records, and income verification — none of which requires reading your contacts.

SwiftCash does not access your contacts. The application process uses financial data to assess your loan eligibility, and your personal relationships remain private regardless of your repayment status. When you borrow from a lender that respects your privacy from the start, you protect not just yourself but everyone in your phone book.

The Cultural Shift

Contact-shaming worked in Kenya because it exploited social norms around debt and reputation. As awareness of borrower rights grows, those same social norms are shifting. More borrowers are recognising that an aggressive collection call to their employer says something about the lender, not just about them — and are reporting it rather than paying out of shame.

That cultural shift, combined with regulatory enforcement, is slowly pushing contact-shaming out of the mainstream lending market. The predatory apps that relied on it are finding that they cannot operate legally in Kenya, and that Kenyan borrowers are less intimidated than they used to be. That is progress worth acknowledging.