If an online lending app promises “instant cash” but asks for your ID, contacts, selfies, payslip, or an advance fee, pause before you proceed. In the Philippines, a legitimate online lending company is not proven by a Facebook page, a Google Play listing, a DTI certificate, or a screenshot of an SEC certificate alone. You need to check whether the company is properly registered, authorized to lend or finance, and whether its online lending platform is recorded with the Securities and Exchange Commission (SEC). This guide explains what to verify, where to check, what red flags to watch for, and what to do if the lender turns out to be unregistered, abusive, or a scam.
What “legitimate online lending company” means in the Philippines
A legitimate online lender in the Philippines generally means the business has the correct legal authority for the type of loan it offers.
For ordinary online lending apps and websites, the main regulator is usually the Securities and Exchange Commission (SEC). Under Republic Act No. 9474, or the Lending Company Regulation Act of 2007, a lending company is a corporation engaged in granting loans from its own capital funds or from funds sourced from not more than 19 persons. The law specifically excludes banks, financing companies, pawnshops, cooperatives, insurance companies, and other credit institutions already regulated by other laws. (Supreme Court E-Library)
This is important because SEC registration alone is not enough. A corporation may be registered with the SEC for a completely different purpose, such as marketing, trading, consulting, or software development. To legally operate as a lending or financing company, it must have the appropriate authority, such as a Certificate of Authority to Operate as a Lending Company or Financing Company.
For financing companies, Republic Act No. 8556, or the Financing Company Act of 1998, as amended by Republic Act No. 10881, also applies. RA 10881 allows lending and financing companies to be owned up to 100% by foreign nationals, subject to Philippine constitutional restrictions involving land and other applicable laws. (Supreme Court E-Library)
An online lending platform, often called an OLP, may be a mobile app, website, or other fintech-enabled system where loans are offered. In practice, you should verify both:
- The corporate lender or financing company, and
- The specific app, website, brand name, or online platform being used.
A company may be real, but the app using its name may be fake. An app may look professional, but the company behind it may not be authorized to lend.
Main laws and rules protecting borrowers
Several Philippine laws and government issuances protect borrowers from fake, misleading, or abusive online lenders.
| Law or rule | Why it matters when checking an online lender |
|---|---|
| RA 9474, Lending Company Regulation Act of 2007 | Requires lending companies to operate under SEC regulation and authority. |
| RA 8556, Financing Company Act of 1998, as amended | Covers financing companies, including companies engaged in direct lending, leasing, factoring, and similar financing activities. |
| RA 3765, Truth in Lending Act | Requires disclosure of finance charges and the true cost of credit before a borrower enters into the loan. (Lawphil) |
| RA 11765, Financial Products and Services Consumer Protection Act of 2022 | Protects financial consumers’ rights to fair treatment, disclosure, data privacy, protection against fraud, and timely complaint handling. (Supreme Court E-Library) |
| RA 10173, Data Privacy Act of 2012 | Protects personal information and gives borrowers rights over data collected, processed, disclosed, corrected, blocked, or deleted. (National Privacy Commission) |
| SEC Memorandum Circular No. 18, Series of 2019 | Prohibits unfair debt collection practices by financing and lending companies and their collection agents. |
| SEC Memorandum Circular No. 19, Series of 2019 | Requires disclosures in advertisements and reporting of online lending platforms. |
| Civil Code, Article 1956 | Interest is not due unless expressly stipulated in writing. (Lawphil) |
| Civil Code, Article 1229 | Courts may reduce penalties if they are iniquitous or unconscionable. (Lawphil) |
| Revised Penal Code and Cybercrime Prevention Act | May apply if collectors use threats, coercion, public shaming, identity misuse, cyberlibel, or fraud. |
The Supreme Court has repeatedly held that extremely high interest rates may be reduced when they are excessive, iniquitous, unconscionable, or exorbitant. In Medel v. Court of Appeals, the Court found 5.5% monthly interest excessive; in Spouses Solangon v. Salazar, it found 6% monthly interest outrageous and inordinate. (Supreme Court E-Library)
Step-by-step guide to checking if an online lending company is legitimate
1. Get the exact legal name of the lender
Before downloading the app or submitting documents, look for the lender’s exact:
- Corporate name
- SEC registration number
- Certificate of Authority number
- Business address
- Official website
- Customer service email and hotline
- Name of the online lending app or website
- Name of the company operating the app
Do not rely only on the app name. Many online lending apps use short brand names that do not match the corporate name. For example, an app may be called “Fast Peso Loan,” but the actual company may be “ABC Financing Corporation.” You need to verify the company behind the brand.
If the app, website, or agent refuses to give the corporate name and Certificate of Authority number, treat that as a serious warning sign.
2. Check the SEC lists for lending and financing companies
The SEC maintains public verification resources for lending companies, financing companies, and recorded online lending platforms. In SEC-FOI responses, the SEC has directed the public to check the official lists of registered lending companies, registered financing companies, and recorded online lending platforms before dealing with online lenders. (www.foi.gov.ph)
Use these official SEC pages:
- SEC list of registered lending companies
- SEC list of registered financing companies
- SEC list of recorded online lending platforms
- SEC iMessage portal for inquiries, complaints, and ticket tracking
- SEC Check App for mobile access to SEC announcements, investor alerts, and related information
When checking the list, search using:
- The full corporate name
- The app name
- The website name
- The SEC registration number
- The Certificate of Authority number
Be careful with spelling. Scammers often copy the name of a legitimate company but change one word, punctuation mark, logo, address, or phone number.
3. Confirm that the company has a Certificate of Authority, not just SEC incorporation
A common trick is showing a Certificate of Incorporation and claiming, “SEC registered kami.”
That is not enough.
A Certificate of Incorporation only means the company exists as a corporation. It does not automatically mean the company may engage in lending or financing. For lending and financing activities, you must look for a Certificate of Authority issued by the SEC for that specific activity.
| Document shown by lender | What it proves | Is it enough? |
|---|---|---|
| DTI Business Name Certificate | A business name is registered with DTI | No |
| Mayor’s Permit | A local business permit was issued | No |
| BIR Certificate of Registration | The business is registered for tax purposes | No |
| SEC Certificate of Incorporation | The corporation exists | No |
| SEC Certificate of Authority to Operate as Lending or Financing Company | The company is authorized for lending or financing | Usually necessary |
| SEC recorded online lending platform listing | The app, website, or OLP has been reported or recorded | Necessary for online lending platform verification |
A legitimate lender should not be offended when you ask for these details. A properly regulated company knows borrowers have the right to verify.
4. Check if the specific online lending app or website is recorded
Even if the corporation is registered, the app or website must still be checked.
Under SEC rules and advisories, online lending platforms are treated separately because borrowers often interact with the app, not the corporate office. The 2026 public advisory by the DICT, NPC, and SEC defines OLPs as mobile lending applications, websites, and other fintech-enabled systems where lending or financing products are made available.
This means you should ask:
- Is this exact app name on the SEC’s recorded OLP list?
- Is the app operated by the same company shown in the SEC records?
- Does the app disclose the corporate name, SEC registration number, and Certificate of Authority number?
- Does the website domain match the official company website?
- Is the app downloaded from an official or verified source?
If a company says, “We are registered, but our new app is not yet listed,” verify directly with the SEC before submitting personal data.
5. Review the loan disclosure before accepting
A legitimate lender should clearly show the total cost of the loan before you agree.
Under the Truth in Lending Act, the borrower must be informed of the finance charges and true cost of credit. (Lawphil)
Before clicking “accept,” check for:
- Principal amount
- Net proceeds you will actually receive
- Interest rate
- Service fee or processing fee
- Other charges
- Penalties for late payment
- Due date
- Installment schedule
- Total amount payable
- Effective cost of the loan
- Whether the fee is deducted from proceeds or paid separately
A red flag is when the app says “₱10,000 approved” but only releases ₱6,000 or ₱7,000 after deductions, while still requiring repayment based on ₱10,000 within a very short period.
Another red flag is when the app refuses to show the actual interest and charges until after you upload your ID, give phone permissions, or pay a “verification fee.”
6. Check app permissions and privacy notices
Online lenders may request data for identity verification, fraud checks, and credit evaluation. But they cannot demand unlimited access to your private life.
The DICT-NPC-SEC advisory on online lending platforms states that unnecessary processing of personal data, unnecessary app permissions, excessive access to contact lists, and contacting persons other than guarantors for debt collection are prohibited. It also reminds borrowers to download OLPs only from official or verified sources and to review privacy notices, consent forms, and app permissions carefully.
Be cautious if the app asks for access to:
- All contacts
- SMS
- Call logs
- Photos and videos unrelated to KYC
- Social media accounts
- Location at all times
- Microphone access without a clear purpose
- Storage access beyond documents you choose to upload
Camera access may be reasonable for identity verification. Gallery access may be reasonable if you voluntarily upload IDs or documents. But the app should not use these permissions for harassment, public shaming, or debt collection against your contacts.
7. Check whether “references” are being treated as “guarantors”
Many borrowers are confused by the difference between a character reference and a guarantor.
A character reference is someone who may confirm your identity or contact details. A guarantor is someone who expressly agrees to be responsible for the loan if you default.
The 2026 DICT-NPC-SEC advisory states that OLPs must have separate interfaces for character references and guarantors, and that guarantors must expressly consent to assume responsibility for the loan. It also states that, for debt collection, lending companies, financing companies, or persons acting for them may contact only the guarantor, not random persons from the borrower’s contact list.
So if an app says, “We will call your contacts if you are late,” that is a major red flag.
8. Watch for advance-fee loan scams
A common scam works like this:
- You apply for a loan online.
- The “lender” says you are approved.
- They claim there is a typo, AMLA issue, bank verification issue, tax clearance, release code, insurance fee, or account unlocking fee.
- They ask you to send money first through GCash, Maya, bank transfer, crypto, or remittance.
- After you pay, they demand another fee or disappear.
Legitimate lenders may charge documented processing fees, but these must be clearly disclosed. Be very suspicious if you are asked to pay an upfront amount to a personal account before any loan proceeds are released.
A real lender does not need you to send money to “unlock” a loan that supposedly already exists.
9. Verify the payment channel
Before paying any loan, check whether the payment account belongs to the actual lending or financing company.
Red flags include:
- Payment to an individual’s GCash or Maya account
- Payment to a different company name
- Payment to a foreign account unrelated to the Philippine lender
- Refusal to issue an official receipt or payment confirmation
- Changing payment details every few days
- Pressure to pay through screenshots only, without a proper borrower account statement
If the company is legitimate, it should be able to provide an official payment channel, customer service confirmation, and records of your loan balance.
10. Search for SEC, NPC, DICT, NBI, and PNP advisories
Before borrowing, search the lender’s:
- Corporate name
- App name
- Website
- Phone number
- Email address
- Names of collection agents
- GCash or bank account name
Look for official advisories from:
- SEC
- National Privacy Commission
- Department of Information and Communications Technology
- NBI Cybercrime Division
- PNP Anti-Cybercrime Group
Do not rely only on social media posts or app store reviews. Some fake lenders use paid reviews, fake borrower testimonials, and copied “news” articles.
Quick checklist before using an online lending app
| What to check | Good sign | Warning sign |
|---|---|---|
| Corporate identity | Full company name is clearly shown | Only app name or Facebook page is shown |
| SEC registration | Company appears in SEC records | Only screenshot is provided |
| Certificate of Authority | CA number is verifiable | Company shows only incorporation papers |
| Online platform | App or website appears in SEC recorded OLP list | App name cannot be found |
| Loan disclosure | Charges, due date, and total payment are shown before acceptance | Charges appear only after approval |
| Data privacy | Clear privacy notice and limited permissions | Forced access to contacts, gallery, SMS, or social media |
| References | References and guarantors are clearly separated | All contacts may be messaged or threatened |
| Payment channel | Account is under the company’s name | Personal GCash, Maya, or bank account |
| Collection practice | Professional reminders | Threats, insults, public shaming, fake warrants |
| Upfront fees | No suspicious “release” or “unlocking” fee | Borrower must pay before loan release |
Common red flags of fake or abusive online lenders
They show only a DTI certificate
A DTI certificate is not proof of authority to operate as a lending company. It only proves registration of a business name for a sole proprietorship. A lending company under RA 9474 is a corporation, and the proper regulator is the SEC. (Supreme Court E-Library)
They use a real company’s SEC certificate but a different app name
Some scammers copy public SEC documents from real companies. Always match the company name, SEC number, Certificate of Authority number, app name, website, contact number, and payment account.
If one detail does not match, verify directly with the SEC.
They ask you to install an APK file
An APK file sent through Messenger, Telegram, WhatsApp, SMS, or email is risky. It may contain malware or excessive data permissions. The 2026 advisory specifically reminds borrowers to download OLPs from official or verified sources only.
They threaten to post your face, ID, or debt online
Debt collectors cannot use threats, intimidation, public shaming, or unauthorized disclosure of personal data. Depending on the facts, this may involve SEC violations, Data Privacy Act violations, and possible criminal liability under the Revised Penal Code or Cybercrime Prevention Act.
They say your contacts automatically became guarantors
No. A person does not become a guarantor just because their name or number was uploaded as a reference. The 2026 DICT-NPC-SEC advisory states that guarantors must give separate consent before being bound to any obligation.
They claim you will be arrested for not paying a loan
Non-payment of debt is generally a civil matter. However, fraud, falsification, identity theft, or other criminal acts are different issues. A collector who uses fake warrants, fake police threats, or threats of imprisonment to force payment may be engaging in abusive or unlawful collection behavior.
They refuse to give a statement of account
A legitimate lender should be able to show:
- Principal borrowed
- Amount released
- Payments received
- Remaining balance
- Interest and charges
- Penalties
- Due dates
- Official payment channels
If the collector only sends threatening messages but cannot provide a proper statement, preserve the messages and verify with the company directly.
What to do if the lender is not listed or becomes abusive
1. Preserve evidence immediately
Do not rely on memory. Save proof before the app, website, or chat disappears.
| Evidence | Why it helps |
|---|---|
| Screenshots of the app page | Shows app name, developer, download source, and representations |
| Screenshots of the loan offer | Shows principal, fees, interest, due date, and deductions |
| Loan agreement or disclosure statement | Proves the terms shown to you |
| Privacy notice and permissions screen | Shows what data the app requested |
| SMS, chat, email, and call logs | Shows threats, harassment, or misleading claims |
| Payment receipts | Shows where your money went |
| Screenshots of messages sent to contacts | Proves third-party harassment or public shaming |
| IDs or names used by collectors | Helps identify agents or impersonators |
| SEC search results | Shows whether the company or OLP appears in official records |
Keep full screenshots showing dates, phone numbers, URLs, and account names. Avoid cropping out details that prove where the message came from.
2. Revoke unnecessary app permissions
On your phone, review the app permissions and revoke anything unnecessary, especially contacts, photos, SMS, call logs, location, and microphone. If you uninstall immediately, you may lose in-app records, so first take screenshots of the loan terms, account page, notices, messages, and permissions.
3. File with the SEC for lending or financing violations
For complaints involving lending companies, financing companies, online lending platforms, unfair collection, or lack of authority to operate, use the SEC iMessage portal. The SEC iMessage page states that users can submit feedback, issues, and complaints and track tickets through the platform. (imessage.sec.gov.ph)
The 2026 DICT-NPC-SEC advisory identifies the SEC Financing and Lending Companies Department as the proper authority for unfair debt collection practices and gives the SEC complaint portal as imessage.sec.gov.ph and hotline 1-4732 (1-4SEC).
When filing, include:
- Your full name and contact details
- Name of the lending company or app
- SEC registration number and CA number, if known
- Description of what happened
- Dates and amounts
- Screenshots and documents
- Names or numbers of collectors
- Proof that contacts were messaged, if applicable
4. File with the National Privacy Commission for data privacy violations
If the issue involves unauthorized use of your contacts, public posting of your personal data, misuse of your ID, disclosure to your employer or relatives, or refusal to correct/delete unlawfully processed data, the National Privacy Commission may be involved.
The NPC states that a formal complaint must be filed in a specific format, notarized, and submitted in person, by courier, or by scanned email. (National Privacy Commission) The NPC also provides a Complaint-Assisted Form and reminds complainants to attach supporting documents. (National Privacy Commission)
Useful evidence for NPC complaints includes:
- App permissions showing access to contacts or files
- Screenshots of messages sent to third parties
- Posts exposing your name, photo, ID, address, or debt
- Privacy notice or consent screen
- Proof you withdrew consent or requested correction/deletion
- Names of contacts who received messages
5. Report threats, fraud, or cybercrime
If the conduct involves threats, blackmail, impersonation, identity theft, fake warrants, hacking, phishing links, or extortion, report to cybercrime authorities.
The 2026 DICT-NPC-SEC advisory identifies the following channels for other forms of harassment, threats, frauds, or scams:
- DICT Cyber Hotline: 1326@dict.gov.ph
- NBI Cybercrime Division: ccd@nbi.gov.ph
- PNP Anti-Cybercrime Group: acg@pnp.gov.ph and onlinecims.ocs@gmail.com
For urgent physical threats, go to the nearest police station or barangay and bring printed screenshots, IDs, and contact details.
6. If the lender is a bank, e-wallet, pawnshop, cooperative, or insurer, go to the right regulator
Not all lenders are SEC-regulated lending companies.
| Type of provider | Usual regulator |
|---|---|
| Bank, e-money issuer, money service business, pawnshop, payment operator | Bangko Sentral ng Pilipinas |
| Lending or financing company | SEC |
| Cooperative offering credit | Cooperative Development Authority |
| Insurance-related credit product | Insurance Commission |
| Data privacy issue | National Privacy Commission |
| Cybercrime, threats, fraud | PNP ACG, NBI Cybercrime, DICT |
For BSP-supervised financial institutions, the BSP says consumers may escalate unresolved complaints through the BSP Online Buddy (BOB) after first raising the concern with the financial institution’s customer service channel. (Bangko Sentral ng Pilipinas)
Special notes for OFWs, foreigners, and Filipinos abroad
If you are outside the Philippines, you can still check the SEC lists and file online reports. Many complaints begin with scanned documents and screenshots.
For sworn statements, complaint-affidavits, or notarized forms signed abroad, practical requirements can vary depending on the agency and proceeding. Some offices may accept scanned notarized documents for initial filing, while later stages may require documents notarized abroad to be apostilled or acknowledged through a Philippine Embassy or Consulate. Ask the receiving agency what format it currently accepts before spending on authentication.
Foreigners in the Philippines may be asked for identity and immigration-related documents, such as a passport, visa status, ACR I-Card, work permit, proof of address, or employment documents. A lender may request reasonable KYC documents, but the request must still be proportionate and connected to a legitimate purpose. Being a foreigner does not mean the lender may access your entire phone, contact your employer without basis, or expose your personal data.
For OFWs, be extra cautious with lenders that use remittance pressure, threaten to contact your employer abroad, or demand payment through personal accounts. Save all messages and verify the lender through SEC channels.
Frequently Asked Questions
How do I know if an online lending app is SEC registered in the Philippines?
Check the SEC’s official lists of registered lending companies, registered financing companies, and recorded online lending platforms. Search both the corporate name and the app name. If only the corporation appears but the app does not, verify directly with the SEC before using the platform.
Is SEC registration enough for an online lending company?
No. SEC registration only means the corporation exists. A lending or financing company must also have the proper Certificate of Authority, and the specific online lending platform should be recorded or verifiable with the SEC.
Is a lending app on Google Play automatically legitimate?
No. App store availability does not prove Philippine regulatory authority. A fake or abusive lender may still appear professional online. Always check the company, Certificate of Authority, and online platform against SEC records.
Can an online lending app access my contacts?
An app should not require unnecessary or excessive access to your contacts. The 2026 DICT-NPC-SEC advisory states that unbridled processing of contact lists is prohibited and that contact list access must be limited to legitimate purposes, such as selecting references or guarantors.
Can a lender message my friends, relatives, or employer if I miss payment?
For debt collection, lending and financing companies may contact the guarantor. The 2026 advisory states that contacting persons on the borrower’s contact list other than named guarantors is prohibited.
What is the difference between a character reference and a guarantor?
A character reference helps verify identity or contact details. A guarantor expressly agrees to answer for the loan if the borrower defaults. A person does not become a guarantor simply because their name or number was uploaded as a reference.
Is very high interest illegal in the Philippines?
There is no simple fixed interest ceiling for all private loans, but interest must be disclosed and agreed in writing. Courts may reduce interest, penalties, or charges that are unconscionable. The Supreme Court has reduced excessive rates in cases such as Medel and Solangon. (Supreme Court E-Library)
What if I already borrowed from an unregistered online lender?
Do not ignore the situation. Save the loan terms, payment records, app screenshots, and messages. Verify whether money was actually released to you and whether the payment channel is legitimate. If the lender is unregistered, abusive, or using threats, report to the SEC and other proper agencies. Receiving money may still create a civil obligation, but abusive collection, hidden charges, and illegal data use are separate issues.
Where do I complain about online lending harassment?
For unfair debt collection by lending or financing companies, file through the SEC iMessage portal. For misuse of personal data, file with the National Privacy Commission. For threats, extortion, identity theft, or cybercrime, report to the NBI Cybercrime Division, PNP Anti-Cybercrime Group, or DICT Cyber Hotline, depending on the facts.
Should I pay an “advance fee” to release my approved loan?
Be very cautious. Advance-fee loan scams are common. If the lender says you must pay a bank correction fee, release fee, AMLA clearance fee, tax fee, or unlocking fee before receiving the loan, verify with the SEC and do not send money to a personal account.
Key Takeaways
- A legitimate online lender in the Philippines should have the proper SEC authority, not just a business name, mayor’s permit, or SEC incorporation certificate.
- Always verify both the corporate lender and the specific app, website, or online lending platform.
- Check the SEC lists of registered lending companies, registered financing companies, and recorded online lending platforms.
- Read the loan disclosure before accepting; the lender must show the true cost of credit.
- Do not install APK files or give unnecessary access to contacts, SMS, photos, or social media accounts.
- Character references are not automatically guarantors.
- Collectors cannot legally use threats, public shaming, or unauthorized disclosure of personal data.
- Save screenshots, payment records, loan documents, and call logs if you suspect fraud or harassment.
- File lending and financing complaints with the SEC, data privacy complaints with the NPC, and cybercrime or threat reports with the proper cybercrime authorities.