Before giving an online lending app your ID, selfie, contacts, bank details, or money, verify three separate things: the company behind the app, its authority to lend, and the exact app or online lending platform it operates. An app may use the words “SEC registered” even when the company has no authority to offer loans, the app has not been reported to the Securities and Exchange Commission, or scammers are merely copying the name of a legitimate lender.

The safest approach is to check the lender through official SEC records, examine the loan’s full cost before accepting it, review the app’s permissions, and watch for abusive or deceptive practices. These checks usually take only a few minutes and can prevent identity theft, hidden charges, unauthorized loan releases, and harassment.

What Makes an Online Lending App Legitimate in the Philippines?

A legitimate online lending app should satisfy all three requirements below.

1. A real Philippine company operates the app

The app should clearly identify its complete corporate name—not merely a brand name such as “Fast Peso,” “Quick Cash,” or “Loan Now.”

Look for the company’s:

Complete corporate name
SEC registration number
Certificate of Authority number
Philippine business address
Official email address and telephone number
Privacy notice
Loan terms and conditions
Complaints or customer-service channel

These details should be consistent across the app, its website, its privacy policy, the app-store listing, the loan agreement, and SEC records.

2. The company has a valid Certificate of Authority to lend

Registration as a corporation is not enough.

Under the Lending Company Regulation Act of 2007, or Republic Act No. 9474, a lending company must be registered with the SEC and must obtain a Certificate of Authority, commonly called a CA, before it may offer loans to the public.

Financing companies are similarly required to obtain SEC authority under the Financing Company Act of 1998, or Republic Act No. 8556. Operating a lending or financing business without the required authority may result in administrative and criminal penalties. (Lawphil)

A company may therefore be:

Registered as a corporation but not authorized to lend
Previously authorized, but currently suspended or revoked
Authorized to lend through one company, while the app falsely claims to belong to that company
Using an unreported or misleading online lending brand

3. The exact app or online platform is connected to the authorized company

The borrower-facing app name may be different from the corporation’s legal name. For example, “Juan Cash” may be operated by “ABC Lending Corporation.”

The SEC maintains a separate list of recorded online lending platforms. The exact app, website, or brand should be traceable to the lending or financing company that holds the Certificate of Authority.

Under SEC rules, advertisements and online lending platforms should disclose the operator’s corporate name, SEC registration number, and Certificate of Authority information. (SEC Appointment System)

Philippine Laws That Protect Online Loan Borrowers

Several laws and SEC regulations apply to online lending.

Republic Act No. 9474: Lending Company Regulation Act

RA 9474 regulates lending companies and requires SEC authority before a company may engage in lending.

Its implementing rules also require lenders to provide borrowers with a written disclosure statement before the loan transaction is completed. The statement should identify matters such as:

Principal loan amount
Interest rate
Processing or service fees
Amortization schedule
Late-payment penalties
Collection charges
Notarial fees
Other charges
Method of calculating the amount due after default

A lender that hides these details until after disbursement is not following the transparency expected under Philippine lending law. (Lawphil)

Republic Act No. 3765: Truth in Lending Act

The Truth in Lending Act requires creditors to disclose the true cost of credit before the borrower becomes obligated.

For an online loan, the borrower should be able to see—not merely guess—the following before pressing “Confirm,” “Accept,” or a similar button:

Amount borrowed
Amount actually received
Interest and finance charges
Processing, platform, verification, or service fees
Payment dates
Total amount payable
Late-payment consequences

A PHP5,000 loan is not truly a PHP5,000 cash release if PHP800 is deducted immediately for “processing” and “service” charges. The lender should show both the stated principal and the net amount that will reach the borrower.

Republic Act No. 11765: Financial Products and Services Consumer Protection Act

The Financial Products and Services Consumer Protection Act of 2022 reinforces financial consumers’ rights to:

Fair and equitable treatment
Clear disclosure and transparency
Protection of personal and financial information
Effective complaint handling and redress

A legitimate lender should have a functioning complaints process, not merely a collection hotline.

Republic Act No. 10173: Data Privacy Act

The Data Privacy Act of 2012 requires personal data to be collected and used for a lawful, declared, and proportionate purpose.

The National Privacy Commission has specifically prohibited online lenders from harvesting borrowers’ phone or social-media contact lists for harassment. Access to contacts, photos, text messages, or call logs should not be demanded merely to pressure the borrower or shame them publicly. (National Privacy Commission)

SEC rules against unfair debt collection

Even when a borrower is genuinely late, the lender and its collection agency may not use abusive methods such as:

Threats of violence
Insults, obscenities, or degrading language
Public shaming
False claims that an arrest warrant has already been issued
Pretending to be a police officer, court employee, or government agency
Disclosing the debt to unrelated people
Messaging everyone in the borrower’s contact list
Treating references as guarantors without their separate consent
Contacting borrowers at unreasonable hours
Publishing the borrower’s photograph or ID

The SEC has penalized lenders for threatening borrowers, contacting people who were not guarantors, and using fabricated legal threats. (SEC Appointment System)

Important 2026 Update for Online Lending Platforms

SEC Memorandum Circular No. 20, Series of 2026 takes effect on August 1, 2026. It establishes an updated framework for the registration and operation of online lending platforms and lifts the previous moratorium on new platforms.

The lifting of the moratorium does not mean that every newly launched lending app becomes legitimate. A lending or financing company must still hold the appropriate SEC authority and comply with disclosure, capitalization, consumer-protection, data-privacy, and reporting requirements. (Home)

Under the updated framework:

An online lending platform is treated as a borrower-facing channel of the licensed company, not as a separate lender with its own independent authority.
The company remains responsible for all platforms it operates.
The app or platform name must be properly disclosed and connected to the authorized company.
Borrowers must affirmatively acknowledge the loan disclosures before confirmation.
Unauthorized loan disbursements are prohibited.
Automatic loan renewals without proper borrower consent are prohibited.
A person listed as a contact or reference cannot automatically be treated as a guarantor.
The SEC may suspend, correct, reclassify, or remove misleading platform identities.

For checks made on or after August 1, 2026, confirm that the lender’s records reflect the updated SEC framework. If an app cannot yet be found but claims that its application is “pending,” do not borrow based solely on that statement. Confirm its status directly through SEC channels.

How to Check If an Online Lending App Is Legitimate

1. Identify the exact legal company name

Open the app’s:

About page
Privacy policy
Terms and conditions
Loan agreement
App-store “developer” information
Customer-service page

Write down the exact corporate name. Do not search using only the app’s marketing name.

Be cautious when the app provides only:

A first name for its “agent”
A Facebook page
A Gmail or Yahoo address
A mobile number
A generic business name without “Lending Corporation,” “Financing Corporation,” or another identifiable legal entity

2. Search the company through Check with SEC

Use the official Check with SEC system.

Search the complete corporate name and check whether:

The spelling matches exactly
The company exists
Its registration status is active
Its stated business is consistent with lending or financing
The registration details match those shown in the app

A search result showing that the corporation exists does not complete the verification. You must still check its Certificate of Authority.

3. Confirm the Certificate of Authority

Check the SEC’s official lists of lending and financing companies or ask the SEC to confirm the company’s authority.

Compare:

Corporate name
SEC registration number
Certificate of Authority number
Status of the authority
Registered address

A legitimate lender should not object when asked for its CA number.

Statements such as “DTI registered,” “BIR registered,” “mayor’s permit complete,” or “SEC registered” do not substitute for a valid SEC Certificate of Authority to operate as a lending or financing company.

4. Match the app name to the SEC’s online lending platform records

Search the SEC list of recorded online lending platforms.

Check the following:

Detail	What should match
App or platform name	Exact or clearly documented borrower-facing name
Operator	Same corporation shown in the app and loan agreement
Website or domain	Official address used by the lender
Developer information	Consistent with the operator or its disclosed service provider
Certificate of Authority	Belongs to the operating lending or financing company

If the corporate lender is authorized but the app cannot be connected to it, ask for written clarification and verify the answer through SEC iMessage. The SEC’s iMessage platform creates a ticket that can be tracked, making it more reliable than relying on social-media comments or screenshots supplied by the lender. (www.foi.gov.ph)

5. Check for SEC advisories, suspensions, or revocations

Search the company name and app name together with phrases such as:

“SEC advisory”
“Certificate of Authority revoked”
“SEC cease and desist”
“unfair debt collection”
“online lending platform”

Use SEC publications as the primary source. A company may have been legitimate in the past but later suspended, penalized, or stripped of its authority.

Also watch for clone apps. Scammers sometimes copy a legitimate lender’s:

Name
Logo
Certificate number
Website design
Loan documents

Compare the app-store developer, website domain, email address, payment account, and telephone numbers with the lender’s official records.

6. Review the loan disclosure before accepting

Do not rely only on advertisements such as “0% interest,” “instant approval,” or “no hidden fees.”

Before confirming, the app should show:

Principal amount
Net proceeds you will actually receive
Interest rate
Effective interest rate or total finance cost
All processing and service fees
Due date or installment schedule
Total amount payable
Late-payment penalty
Collection charges, if any
Cancellation, renewal, and prepayment rules

Take screenshots before pressing the final confirmation button. Some borrowers discover later that the screen changed or that deductions were not clearly shown in the final contract.

7. Check whether the loan falls under the SEC interest-rate caps

Specific caps apply to an unsecured, general-purpose loan of PHP10,000 or less with a term of four months or less.

For loans within this category, SEC Memorandum Circular No. 3, Series of 2022 provides the following limits:

Charge	Maximum
Nominal interest	6% per month, approximately 0.2% per day
Effective interest, including most fees	15% per month, approximately 0.5% per day
Late-payment penalty	5% per month on the outstanding scheduled amount due
Total interest, fees, and penalties	Generally no more than 100% of the amount borrowed

The effective-interest calculation includes charges such as processing, service, notarial, handling, and verification fees. A lender cannot avoid the cap merely by renaming interest as a “platform fee” or “convenience charge.”

These caps do not apply to every type or amount of loan. Do not assume that any rate above 6% per month is automatically illegal without first checking whether the loan falls within the covered category.

8. Audit the app’s permissions

A loan app may reasonably need access to the camera to capture an ID or selfie. It does not automatically need unrestricted access to:

Your complete contact list
Text messages
Call history
Photo gallery
Microphone
Precise location at all times
Social-media accounts
Other files unrelated to verification

Read the privacy notice and ask:

What data will be collected?
Why is each category necessary?
Who will receive it?
How long will it be stored?
How can consent be withdrawn?
How can data be corrected or deleted?
Who is the company’s data protection officer?

A broad “I agree” button does not give a lender unlimited authority to use personal data for harassment or public shaming.

9. Examine how the lender releases and collects money

Major warning signs include:

Requiring an advance “release,” “insurance,” or “verification” fee
Asking you to send money before any loan is released
Directing payment to an employee’s personal bank, GCash, or Maya account
Requesting your ATM PIN, online-banking password, or one-time password
Depositing money without your final confirmation
Automatically renewing or “reloaning” without informed consent
Changing the payment account shortly before the due date
Refusing to issue an official receipt or statement of account

A legitimate lender may charge disclosed processing fees, but such charges are normally reflected in the loan documents and deducted or collected through an official company channel. A demand to send an advance fee to “unlock” a loan is a common scam pattern.

Quick Red-Flag Checklist

What you see	Why it is suspicious
“SEC registered” but no CA number	Corporate registration alone does not authorize lending
App not traceable to the licensed company	The platform may be unreported, unauthorized, or a clone
No written breakdown of fees	May violate truth-in-lending requirements
Advance payment required before release	Common loan-scam method
Payment requested through a personal account	Makes the true creditor difficult to verify
App demands contacts, SMS, and call logs	Creates serious privacy and harassment risks
Money arrives without final consent	Unauthorized disbursement is prohibited under the updated framework
Loan renews automatically	May create unauthorized additional debt
Collector threatens immediate arrest	Ordinary loan nonpayment is primarily a civil matter; false criminal threats may be abusive
Collector messages friends or coworkers	Disclosure to unrelated third parties may violate SEC and privacy rules
“Reference” is told to pay the debt	A reference is not automatically a guarantor
Company refuses to provide a contract	Legitimate obligations should be documented

What to Do If You Already Installed or Borrowed From a Suspicious App

1. Preserve evidence before deleting anything

Save copies of:

App-store listing and developer information
App name, icon, and version
Website address
Privacy policy
Loan disclosure screen
Promissory note or loan agreement
Disbursement record
Payment instructions
Receipts and transaction references
Collection messages
Call logs and recordings lawfully in your possession
Screenshots of threats or public posts
Permissions requested by the app
Names and numbers used by collectors

Arrange the evidence by date. A clear timeline is more useful to regulators than hundreds of unorganized screenshots.

2. Revoke unnecessary permissions

After saving evidence, use your phone settings to remove access to:

Contacts
Files and photos
SMS
Call logs
Microphone
Location

Change passwords if you gave the app access to an email or social-media account. Contact your bank or e-wallet provider immediately if you disclosed a PIN, password, one-time password, or card details.

3. Request a written statement of account

Ask the lender to provide:

Original principal
Net proceeds released
Payments already credited
Interest and fees
Penalties
Current balance
Official payment account

Do not pay a collector through a newly supplied personal account without confirming that the lender authorized it.

An unlicensed or abusive lender’s conduct does not necessarily mean that money actually received becomes free. There may still be a civil obligation to return the principal or another lawful amount, while excessive charges and unlawful collection practices are disputed.

4. File a complaint with the SEC

Use the SEC iMessage portal and select the appropriate lending or financing concern.

Include:

Your complete contact information
Company and app names
Certificate of Authority details, if shown
Loan amount and date
Short chronological explanation
Copies of the contract and disclosure statement
Proof of disbursement and payments
Screenshots of misconduct
App-store or website links
Names and numbers of collectors

Online verification may be completed in minutes. A formal investigation or administrative case can take weeks or months depending on the evidence, the company’s response, and the complexity of the complaint.

5. File a privacy complaint with the National Privacy Commission

Use the National Privacy Commission complaint procedure when the app misuses your personal information, accesses contacts without a proper purpose, or publicly discloses your debt.

The NPC generally requires its prescribed complaint form to be completed, printed, signed, notarized, and submitted personally, by courier, or through the accepted electronic procedure. Supporting evidence and the applicable fee under the NPC’s current schedule may also be required. (National Privacy Commission)

6. Report threats, extortion, or identity theft

Report possible crimes to the Philippine National Police, including its Anti-Cybercrime Group, or to the National Bureau of Investigation’s cybercrime authorities when the conduct involves:

Threats of violence
Extortion
Account hacking
Identity theft
Fake arrest warrants or government documents
Unauthorized online posts
Use of your ID to obtain other loans
Demands for intimate photographs or other coercive acts

Preserve the original messages and electronic files. Avoid editing screenshots in a way that removes dates, usernames, telephone numbers, or web addresses.

Documents and Evidence to Prepare

Purpose	Useful documents
SEC verification	Corporate name, app name, website, SEC number, CA number
SEC complaint	Loan contract, disclosure statement, screenshots, payment records, timeline
NPC complaint	Notarized complaint form, privacy notice, permissions, messages sent to contacts, public posts
Police or NBI report	Threats, account details, telephone numbers, transaction records, device information
Disputing the balance	Statement of account, proof of payments, loan-release record, fee computation
Proving a clone app	Official lender details compared with the fake domain, developer, email, or payment account

Keep the original electronic files whenever possible. Screenshots are helpful, but original emails, message exports, receipts, and downloadable contracts may contain metadata that supports a complaint.

Special Considerations for Foreign Borrowers

A foreign borrower in the Philippines should verify the same three elements: the local company, its Certificate of Authority, and the specific online platform.

An overseas registration or foreign financial license does not replace the Philippine SEC authority required when the lending business is being conducted in the Philippines.

Foreign borrowers should also:

Avoid uploading a passport or ACR I-Card until the operator is verified
Confirm where personal data will be stored and processed
Check whether the agreement identifies Philippine law and a Philippine address for notices
Keep copies of every document submitted
Confirm that repayment goes to the verified Philippine company
Request an English copy of any provision they do not understand

An apostille is not normally required merely to apply for an ordinary online loan. However, affidavits or complaint documents signed abroad may need notarization and, depending on the agency or proceeding, authentication or an apostille before they can be formally used in the Philippines.

Frequently Asked Questions

Is an online loan app legitimate because it is on Google Play or the Apple App Store?

No. App-store availability is not proof of Philippine SEC authority. Check the operating company, its Certificate of Authority, and the exact platform through SEC records.

Is “SEC registered” enough?

No. Many corporations are SEC registered but are not licensed to lend. A lending or financing company must also have a valid Certificate of Authority.

Where can I verify an online lending app?

Start with Check with SEC, the SEC lists of authorized lending or financing companies, and the SEC list of recorded online lending platforms. Submit an inquiry through SEC iMessage when the records are unclear.

What if the company is legitimate but the app name is not on the SEC list?

Do not assume the app is authorized. It may be an unreported platform, a recently changed trade name, or a clone. Ask the company for written proof and confirm it directly with the SEC before submitting personal data or accepting a loan.

Can a lending app access my contacts?

An app should collect only data that is necessary, proportionate, and properly disclosed. Harvesting contact lists to shame or harass borrowers is prohibited. Revoke unnecessary permissions and report misuse to the NPC.

Can the lender contact my employer, relatives, or friends?

A lender may use lawful methods to locate or communicate with a borrower, but it should not disclose the debt to unrelated people, shame the borrower, or pressure contacts to pay. A contact person or reference is not automatically a co-borrower or guarantor.

Are online loan interest rates capped?

Yes, for certain covered loans. The SEC caps apply to unsecured, general-purpose loans of PHP10,000 or less with a term of four months or less. Other loans may follow different rules, but all lenders must still provide clear and accurate cost disclosures.

Can I refuse to pay because the app is unregistered?

Do not assume that an unregistered app erases the underlying transaction. If you received money, you may still have an obligation to return the principal or lawful amount. You may dispute unauthorized charges, excessive fees, and illegal collection conduct while reporting the lender.

Can I be arrested simply because I missed an online loan payment?

Ordinary failure to pay a debt is generally a civil matter and does not by itself produce an arrest warrant. Separate criminal liability may arise from independent acts such as fraud, falsification, or other offenses, but a collector cannot truthfully claim that arrest is automatic merely because a payment is late.

Key Takeaways

Verify the company, Certificate of Authority, and exact app or online platform.
“SEC registered” does not necessarily mean authorized to lend.
Use official SEC records rather than screenshots supplied by the lender.
Never pay an advance “release fee” or provide a PIN, password, or one-time password.
Read the complete loan-cost disclosure before confirming.
Check whether the loan falls under the SEC’s interest and fee caps.
Treat unnecessary access to contacts, SMS, call logs, or photos as a serious warning sign.
Preserve evidence and report lending violations to the SEC, privacy violations to the NPC, and criminal threats or fraud to law-enforcement authorities.