Quick answer

An online lending app is legitimate only if the business behind it is legally authorized to lend and the particular app can be traced to that authorized business. For an ordinary lending or financing company, verify all three:

The exact corporate operator is registered with the Securities and Exchange Commission (SEC).
The operator has a valid Certificate of Authority to operate as a lending or financing company.
The app or website appears under that operator in the SEC’s list of recorded online lending platforms.

A Google Play or App Store listing, SEC company registration alone, a mayor’s permit, or a certificate displayed inside the app is not enough. Even a duly licensed app can charge unlawful fees, misuse personal data, or employ prohibited collection practices.

Check the app before giving any personal information

1. Identify the real company behind the brand

Look for the app’s:

Exact corporate name—not merely its brand or app name
SEC registration number
Certificate of Authority number
Registered business address
Official email address, telephone number, and website
Privacy notice and contact details of its data protection officer
App-store developer name

SEC rules require financing and lending companies to display their corporate name, SEC registration number, and Certificate of Authority number conspicuously in advertisements and online lending platforms. They must also advise prospective borrowers to study the disclosure statement before proceeding. See SEC Memorandum Circular No. 19, Series of 2019.

Stop if the app does not identify its operator, uses inconsistent company names, or gives only a brand name and mobile number.

2. Confirm that the operator has authority to lend

Search the SEC’s current list of lending and financing companies. Match the operator’s:

Corporate name
SEC registration number
Certificate of Authority number
Current status, if shown

Under the Lending Company Regulation Act of 2007 and its implementing rules, an SEC-registered corporation cannot legally operate as a lending company without a validly subsisting Certificate of Authority. A Certificate of Incorporation merely establishes the corporation; it is not permission to engage in lending.

Do not rely solely on a screenshot of a certificate. Names and numbers can be copied from a legitimate company and used by an impersonator.

3. Match the app to the authorized operator

Check the SEC’s list of recorded online lending platforms. The app’s exact name should be associated with the same corporate operator you found in the licensed-company list.

Compare carefully:

Spelling, punctuation, and logo
Developer name in the app store
Website domain and support email
App-store link
Corporate name and Certificate of Authority number

A legitimate company’s name may be misused by a cloned app, fake social-media page, or fraudulent loan agent. If the company is licensed but the app is absent, differently named, or linked to another developer, do not proceed until the SEC or the company confirms the relationship through independently verified contact details.

Because official lists and regulatory status can change, an old screenshot or reposted list is not reliable. The absence of an SEC advisory also does not, by itself, prove legitimacy.

4. Check the correct regulator when the operator is not an SEC-regulated lender

The SEC licensing test applies principally to lending and financing companies. If the app is operated directly by a bank, digital bank, pawnshop, electronic-money issuer, or another institution supervised by the Bangko Sentral ng Pilipinas (BSP), use the official BSP Verifier.

A cooperative should be checked with the Cooperative Development Authority. Do not assume that a missing SEC lending-company certificate makes every differently regulated institution illegal.

Conversely, the BSP registration of an e-wallet or payment service does not automatically authorize a separate company using that payment channel to lend money.

Examine the loan terms, not just the license

Before accepting the loan, demand a readable copy of the loan agreement and disclosure statement. Under the Truth in Lending Act, the creditor must provide a clear written disclosure before the transaction is completed, including the amount financed, finance charge in pesos, and applicable rate.

Verify the following against the amount you will actually receive:

Principal or stated loan amount
Net proceeds after every deduction
Nominal and effective interest rates
Processing, service, handling, verification, insurance, membership, or notarial fees
Number, amount, and dates of payments
Late-payment penalties
Total amount payable
Official payment channels
Consequences of default

Do the arithmetic yourself. A “low daily rate” may hide substantial upfront deductions or fees.

Current ceilings for certain small, short-term loans

For loans entered into, restructured, or renewed beginning April 1, 2026, SEC Memorandum Circular No. 14, Series of 2025 applies when all these conditions are present:

The lender is a financing or lending company, including its online lending platform.
The loan is unsecured.
It is for a general purpose.
The principal does not exceed ₱10,000.
The term does not exceed four months.

For a covered loan, the ceilings are:

Charge	Maximum
Nominal interest	6% per month, approximately 0.20% per day
Effective interest rate, including interest and loan-related fees but excluding late-payment penalties	12% per month, approximately 0.40% per day
Late-payment penalty	5% per month on the outstanding scheduled amount due
Accumulated interest, fees, charges, and penalties	100% of the amount borrowed

The 100% total-cost cap limits the accumulated charges to the principal amount; it does not permit the lender to disregard the monthly ceilings.

These numerical limits do not automatically apply to every loan. A larger, longer-term, secured, business-specific, bank, or other differently regulated loan may fall under another framework. It must still comply with applicable disclosure, consumer-protection, contract, and regulatory rules. Charges outside the table are not automatically lawful merely because these particular ceilings do not apply.

Review the app’s permissions and privacy practices

The March 18, 2026 joint DICT-NPC-SEC advisory confirms that unnecessary, excessive, or disproportionate processing of personal data is prohibited, whether an online lending platform is recorded or unrecorded.

Be cautious if the app demands unrestricted access to:

Your entire contact list
Messages, call logs, or social-media accounts
Photos or files unrelated to identity verification
Your microphone or continuous location
Other information with no clear connection to the loan

An app may use the camera or photo gallery for a specified legitimate purpose such as identity verification or know-your-customer checks. It should prompt you to disable the permission once that purpose is complete.

Contact-list access must not become unrestricted harvesting. An app may provide limited access so that you can select your own character references or guarantors, or derive proportionate metadata for a specified legitimate purpose. It should provide separate interfaces for references and guarantors.

A character reference is not automatically a guarantor. A guarantor must separately and expressly consent to assume responsibility for the loan. For debt collection, the lender may not contact people in your contact list other than a consenting guarantor.

Read the privacy notice for:

What data will be collected
The specific purposes for collection
Who will receive the data
How long the data will be retained
How to withdraw consent or exercise your privacy rights
How to contact the data protection officer

Pre-ticked consent boxes, hidden privacy-preserving options, or an easy “accept” button paired with a difficult withdrawal process are warning signs.

Red flags that should make you stop

Do not continue when:

The operator cannot be matched across the SEC’s licensed-company and recorded-platform lists.
The corporate name, Certificate of Authority number, developer name, or payment recipient does not match.
The app asks you to install an APK from a message or unfamiliar website instead of an official source.
A supposed agent asks for your password, PIN, one-time password, or remote control of your phone.
You must pay an “activation,” “verification,” or “release” fee to a personal bank or e-wallet account before receiving the loan.
The lender will not provide the agreement, disclosure statement, or complete cost computation before acceptance.
The amount advertised differs materially from the amount disbursed.
The app requests excessive permissions or threatens to message your contacts.
The lender uses threats, insults, false legal claims, public shaming, or disclosure of your debt to uninvolved people.
You are pressured to decide immediately or prevented from reading or saving the documents.

A single red flag may have an innocent explanation, but several mismatches are a strong reason not to proceed.

Evidence to preserve

Before revoking permissions or uninstalling a suspicious app, save:

The app-store page, developer name, download link, version, and date
The app’s corporate details and displayed certificates
Advertisements and promises about rates or approval
Privacy notices, consent screens, and requested permissions
The loan application, disclosure statement, contract, and payment schedule
The amount approved, deductions, net proceeds, and repayment computation
Bank or e-wallet transaction records and recipient account details
Emails, text messages, chats, call logs, voicemails, and collection notices
Screenshots of threats, public posts, or messages sent to other people
Statements from relatives, colleagues, references, or other contacts who were approached
Your written complaint to the lender and proof that it was received

Keep original electronic files where possible. Record dates, times, telephone numbers, usernames, URLs, and the names used by collectors. Do not publicly repost other people’s personal information while documenting the incident.

What to do if the app appears suspicious

Do not send more personal information or pay an unverified account. Ask the corporate operator in writing for the agreement, itemized computation, authority details, and official payment channel.
Preserve the evidence. Save the records before uninstalling the app or deleting conversations.
Revoke unnecessary permissions. Change compromised passwords and PINs using a secure device. Never disclose an OTP.
Contact the bank or e-wallet immediately if there was an unauthorized or fraud-induced transfer. Ask whether the transaction can be flagged and preserve the case reference number.
Notify affected contacts. Tell them not to pay, disclose information, or engage with the collector. Ask them to save the messages they received.
Report the lender to the SEC. Complaints involving financing or lending companies and unfair collection practices may be submitted through the SEC iMessage system. The March 2026 joint advisory identifies the SEC Financing and Lending Companies Department and SEC hotline 1-4732 (1-4SEC) as official channels.
Report privacy violations to the NPC. Use the NPC’s current complaint page and form. For an ordinary formal complaint, the 2021 NPC Rules of Procedure generally require you first to notify the company in writing and give it an opportunity to act. If it does not take timely and appropriate action or does not respond within 15 calendar days after receiving your written notice, you may proceed. The NPC may waive these requirements for good cause or a serious violation presenting a risk of harm.
Use the BSP complaint process if the operator is a BSP-supervised institution. First complain directly to the institution, then escalate an unresolved matter through BSP Online Buddy or the BSP consumer-assistance channels.
Report threats, fraud, or cybercrime. The joint government advisory lists the DICT Cyber Hotline at 1326@dict.gov.ph, the NBI Cybercrime Division at ccd@nbi.gov.ph, and the PNP Anti-Cybercrime Group at acg@pnp.gov.ph. Contact the police immediately if there is a credible threat of violence or an immediate risk to your safety.

Do not ignore a genuine loan obligation solely because the app behaved improperly. Legitimacy, enforceability, the correct balance, and liability for unlawful conduct can be separate questions. Pay only through a verified official channel and seek legal advice when the operator, computation, or contract is disputed.

Common mistakes

Treating an app-store listing as a government license
Checking only the brand name instead of the corporate operator
Accepting an SEC registration number without verifying a Certificate of Authority
Finding the company on the SEC list but failing to match the specific app
Assuming an e-wallet’s BSP registration also licenses the lender
Agreeing before seeing the disclosure statement
Comparing rates against the advertised principal instead of the net amount received
Allowing all requested permissions without checking their purpose
Deleting messages or uninstalling the app before saving evidence
Paying a collector’s personal account without written confirmation from the verified operator
Waiting until threats or privacy violations escalate before making a written complaint

Frequently asked questions

Is an app legitimate because it is in Google Play or the App Store?

No. An official app store reduces some installation risks but does not replace government licensing checks. Confirm the operator, Certificate of Authority, recorded platform, developer, and official contact details.

Is an SEC registration number enough?

No. A lending or financing company needs the appropriate Certificate of Authority. The particular online platform must also be traceable to that authorized operator.

What if the app is not on the SEC platform list?

Do not proceed until the SEC confirms its status. Lists can be updated, and some institutions are supervised by another regulator, but a purported SEC-regulated lending platform should not rely on a vague explanation for its absence or mismatch.

Does inclusion in an official list guarantee that the app is safe and affordable?

No. It establishes regulatory status at the time reflected by the list; it does not guarantee good service, lawful charges, sound privacy practices, or future compliance.

May a lender call my relatives, friends, or employer?

A lender may communicate with you and, within the applicable rules, a guarantor who expressly consented. It may not contact other people in your phonebook to collect your debt. A character reference is not automatically a guarantor.

Does a high interest rate prove that the app is fake?

Not by itself. It may indicate an unlawful or unfair charge, particularly when the loan falls within the current SEC ceilings, but licensing and loan-pricing compliance are separate checks. Preserve the contract and obtain an itemized computation.

Can a licensed lender use threats or public shaming?

No. A license does not excuse harassment, threats, deceptive legal claims, disclosure of the debt to uninvolved people, or misuse of personal data. See SEC Memorandum Circular No. 18, Series of 2019 and the current joint government advisory.

Official sources

This article provides general legal information, not legal advice for a particular loan, dispute, or document. Regulatory status and procedures can change; verify the latest official records or consult a Philippine lawyer before acting on a fact-sensitive matter. Sources checked as of July 20, 2026.