An online lending website can look professional, use a Philippine phone number, display a “SEC registered” badge, and still be unsafe or unauthorized. In the Philippines, the real test is not whether the website looks legitimate, but whether the company behind it is properly registered, has authority to lend, has reported or recorded its online lending platform, clearly discloses loan costs, and follows privacy and collection rules. This guide explains how to check an online lending website before you submit your ID, selfie, phone number, bank details, or e-wallet account.

What “legitimate” means for an online lender in the Philippines

A legitimate online lending website is usually backed by either a lending company or a financing company regulated by the Securities and Exchange Commission (SEC).

A lending company is a corporation that grants loans from its own capital funds or from funds sourced from not more than 19 persons. Under Republic Act No. 9474, or the Lending Company Regulation Act of 2007, a lending company must be organized as a corporation and cannot conduct lending business unless it has authority to operate from the SEC. (Supreme Court E-Library)

A financing company is also regulated by the SEC under Republic Act No. 8556, or the Financing Company Act of 1998. Financing companies extend credit facilities through direct lending, discounting, factoring, financial leasing, or similar credit arrangements. RA 8556 also prohibits anyone from holding themselves out as a financing company without SEC authority. (Lawphil)

For ordinary borrowers, this means one important thing: SEC incorporation alone is not enough. A corporation may be registered with the SEC as a legal entity, but that does not automatically mean it may legally operate as a lending or financing company. You must check both:

Its SEC corporate registration, and
Its Certificate of Authority or other SEC-recognized authority to operate as a lending or financing company.

Quick legitimacy checklist before using any online lending website

What to check	Good sign	Red flag
Exact company name	Full corporate name appears on the website, loan agreement, disclosure statement, and SEC records	Only app name, brand name, Facebook page, or “customer service” name appears
SEC authority	Has SEC registration and Certificate of Authority to operate as a lending or financing company	Claims “SEC registered” but cannot show CA number
Online lending platform	Website or app is listed, recorded, or reported as the company’s online lending platform	Corporate name is registered, but the website/app name is not connected to it
Loan disclosure	Shows total amount borrowed, deductions, interest, fees, due date, penalties, and net proceeds before you accept	“Fast approval” but fees appear only after release
Data privacy	Requests only data reasonably needed for identity, credit checking, fraud prevention, and loan processing	Requests contact list, gallery, social media passwords, or unnecessary phone permissions
Collection practices	Uses formal reminders and official channels	Threats, public shaming, fake barangay/police notices, or messages to relatives and co-workers
Payment account	Payment is made to the company or authorized payment channel	Payment is sent to a random personal GCash, Maya, bank, or crypto account

Legal basis: your key protections as a borrower

SEC authority is required

RA 9474 says no lending company may conduct business unless it has SEC authority to operate. It also allows the SEC to supervise lending companies, require reports, exercise visitorial powers, and impose sanctions such as fines, suspension, or revocation of authority. (Supreme Court E-Library)

For financing companies, RA 8556 gives the SEC authority to regulate financing companies, while the Bangko Sentral ng Pilipinas (BSP) may prescribe maximum rates and charges in consultation with the SEC and industry when warranted. (Lawphil)

Loan costs must be disclosed clearly

Republic Act No. 3765, or the Truth in Lending Act, requires disclosure of finance charges in credit transactions so borrowers can understand the true cost of credit. The law covers finance charges such as interest, fees, service charges, discounts, and other charges connected with the extension of credit. (Lawphil)

For small short-term loans, SEC Memorandum Circular No. 3, Series of 2022 implemented BSP Circular No. 1133. It applies to unsecured, general-purpose loans offered by lending companies, financing companies, and their online lending platforms where the amount does not exceed ₱10,000 and the tenor is up to four months. The caps include a 6% monthly nominal interest ceiling, 15% monthly effective interest rate ceiling, 5% monthly cap on late-payment penalties, and a total cost cap of 100% of the total amount borrowed.

Financial consumers have rights

Republic Act No. 11765, or the Financial Products and Services Consumer Protection Act, covers financial products and services including credit and digital financial products delivered through digital channels. It gives financial regulators such as the SEC and BSP authority over providers under their jurisdiction, including market conduct surveillance, enforcement actions, fines, suspension, cease-and-desist orders, and restrictions on excessive or unreasonable charges. (Supreme Court E-Library)

RA 11765 also states that financial service providers are responsible for statements in their marketing materials, must make disclosures available through websites or digital platforms, must give clear information on complaint handling, and are responsible for acts or omissions of authorized representatives and accredited third-party service providers, including debt collectors. (Supreme Court E-Library)

Your phone contacts and private data cannot be abused

The Data Privacy Act of 2012, Republic Act No. 10173, protects personal information handled by private companies and government agencies. The National Privacy Commission (NPC) explains that data subjects have rights over the collection, storage, and processing of their personal data. (National Privacy Commission)

For online lending apps, the NPC has specifically said lenders are prohibited from harvesting phone contacts, email lists, or social media contacts for harassment or debt collection. Camera access may be allowed for legitimate know-your-customer purposes, but a borrower’s photo must not be used to embarrass or harass the borrower. (National Privacy Commission)

The NPC has also acted against online lending firms for data privacy violations. In one case, it recommended prosecution of an online lending operator after complaints that the app accessed phone contacts, discussed borrower information with third persons, and used personal information to harass or shame borrowers. (National Privacy Commission)

A loan contract is binding, but illegal or abusive terms can still be challenged

Under the Civil Code, obligations arising from contracts have the force of law between the parties and must be complied with in good faith. But contract freedom is not unlimited: terms that violate law, morals, good customs, public order, or public policy are not protected. The Civil Code also provides that no interest is due unless it is expressly stipulated in writing. (Lawphil)

This is why borrowers should separate two issues:

If you received a real loan from a legitimate lender, you generally remain responsible for the principal and lawful charges.
If the lender is unauthorized, hides charges, violates disclosure rules, charges above applicable caps, or uses harassment, those violations may be reported and challenged.

Step-by-step guide: how to check if an online lending website is legitimate

1. Find the exact corporate name behind the website

Do not start with the brand name. Start with the legal name.

Look for these on the website, app, loan agreement, disclosure statement, privacy policy, and terms and conditions:

Full corporate name, such as “ABC Lending Corporation” or “XYZ Financing Corporation”
SEC registration number
Certificate of Authority number
Registered business address
Official email address
Name of the online lending platform, website, or app
Customer service channels
Data privacy contact or Data Protection Officer contact

A website that only shows “FastCash PH,” “Peso Loan Online,” or a Telegram username without the corporate operator is already suspicious.

2. Check SEC records, not just the website’s badge

The SEC’s online services include eSEARCH and Check with SEC, and the SEC iMessage portal also links to SEC online services. (Securities and Exchange Commission)

When checking SEC records, compare the following carefully:

Exact spelling of the corporate name
SEC registration number
Certificate of Authority number
Company status
Whether it is listed as a lending company or financing company
Whether the website/app is connected to that company

A common scam pattern is to copy the name or SEC number of a real company and place it on a fake lending website. The safest approach is to verify whether the contact details, domain name, app name, and payment channels match the official company records or SEC-recognized information.

3. Check whether the website or app is a recorded online lending platform

Under SEC rules on disclosure and reporting of online lending platforms, financing and lending companies were required to disclose their corporate name, SEC registration number, Certificate of Authority number, and borrower advisory in advertisements and online lending platforms. They were also required to register online lending platforms as business names and report them to the SEC. (Scribd)

This matters because a company may be legitimate, but a particular website, app, or Facebook page may be unauthorized.

Check whether the exact platform appears in SEC materials as a recorded or authorized online lending platform. The SEC has previously directed the public to verify lending companies, financing companies, and recorded online lending platforms through the SEC website’s lending and financing company pages. (www.foi.gov.ph)

4. Search for SEC advisories, suspensions, revocations, and complaints

Before applying, search the company name, app name, domain name, and phone number together with words like:

“SEC advisory”
“revoked”
“suspended”
“unrecorded online lending platform”
“harassment”
“data privacy complaint”
“cease and desist”
“NPC”

Also check if the company’s Certificate of Authority has been revoked or suspended. Some companies remain visible online even after regulatory action.

5. Review the disclosure statement before accepting the loan

A legitimate lender should show the cost of borrowing before you agree. Look for:

Principal loan amount
Processing fee
Service fee
Disbursement fee
Documentary stamp tax, if any
Net proceeds you will actually receive
Nominal interest rate
Effective interest rate
Due date and loan tenor
Late payment penalty
Total amount payable
Consequences of default
Collection policy
Complaint channel

Be careful with “₱5,000 approved” loans where you receive only ₱3,500 after deductions but must repay ₱5,000 or more within seven days. Hidden deductions and unclear charges are classic signs of an abusive online lending setup.

6. Check if the charges exceed applicable caps

For covered small loans of ₱10,000 or below with a tenor of up to four months, check the SEC/BSP caps:

Charge	Cap for covered loans
Nominal interest	6% per month
Effective interest rate, including applicable fees and charges except late penalties	15% per month
Late payment or non-payment penalty	5% per month on outstanding scheduled amount due
Total cost cap	100% of total amount borrowed

If the website says the loan is “service fee only” but the total repayment effectively doubles in a few weeks, compute the real cost. Calling a charge an “admin fee,” “platform fee,” “verification fee,” or “membership fee” does not automatically remove it from regulatory scrutiny.

7. Inspect the privacy policy and app permissions

A legitimate lender may ask for identity documents, proof of income, employment details, billing address, bank or e-wallet details, and fraud-prevention information. But it should not demand excessive access.

Major warning signs include:

Permission to read your entire contact list
Permission to access photos unrelated to identity verification
Permission to post or send messages from your account
Requirement to give social media passwords
Threats that your contacts will be informed if you do not pay
Vague privacy policy copied from another company
No Data Protection Officer or privacy contact

The NPC has made clear that harvesting contact lists and using personal data for harassment is prohibited. (National Privacy Commission)

8. Check the payment instructions

Legitimate lenders normally use official payment channels, company bank accounts, accredited payment partners, or verified merchant accounts.

Be very careful if payment is demanded through:

A personal GCash or Maya number
A personal bank account with a name different from the lender
Cryptocurrency wallet
Telegram, WhatsApp, or Facebook-only instructions
“Processing fee first before release”
“Insurance fee” or “unlocking fee” before disbursement
Repeated advance fees after you already paid once

Advance-fee scams often pretend that the loan is approved but require you to pay taxes, notarial fees, insurance, or verification fees before release. If no loan is released and the “lender” keeps asking for more fees, the issue may already involve fraud, not just lending regulation.

9. Verify BSP registration if the website claims to be a bank, e-wallet, or payment company

Not all online credit providers are SEC-regulated lending companies. If the website claims to be a bank, e-money issuer, payment operator, or wallet provider, also check the BSP’s directories and verifier. The BSP website has a Consumer Corner that includes a BSP Verifier, and its Financial Stability section provides directories and lists. (Bangko Sentral ng Pilipinas)

A company claiming to be “BSP licensed” should appear in the appropriate BSP list for the service it offers. A lending website should not misuse BSP logos or imply BSP approval if it is not actually a BSP-supervised institution.

Common red flags of fake or unsafe online lending websites

“SEC registered” but no Certificate of Authority

Many businesses are registered corporations. That is not the same as being authorized to lend. For lending companies, the key document is the SEC authority to operate under RA 9474. (Supreme Court E-Library)

The lender refuses to give its corporate name

A legitimate lender should not hide behind a brand name, app name, or agent name. If customer support refuses to identify the corporate operator, stop.

The app is not in official app stores or requires sideloading

Downloading an APK outside official app stores increases risk. Even if an app appears in an app store, that alone does not prove Philippine lending authority.

The loan is released too quickly without clear documents

Fast approval is not illegal. But a loan should still have a clear contract and disclosure statement. If the website asks for your ID and selfie first but shows loan costs only after approval, you are giving away sensitive data before seeing the terms.

The lender threatens criminal charges for non-payment

Non-payment of a debt is generally a civil matter. A lender may file a proper civil collection case when legally justified, but threats like “you will be arrested today,” “we will send police to your house,” or “we will file estafa automatically” are often used to scare borrowers.

Estafa under Article 315 of the Revised Penal Code requires specific elements such as deceit or fraudulent representation made before or at the time the offended party parted with money or property. The Supreme Court has explained that estafa by false pretenses requires a false representation, reliance by the offended party, and resulting damage. (Supreme Court E-Library)

They message your employer, relatives, or contact list

Debt collectors may contact legitimate guarantors or co-makers when legally relevant, but harassment of unrelated contacts, public shaming, and disclosure of borrower information can violate SEC debt collection rules and data privacy law. The NPC has documented cases where online lenders contacted third persons and used borrower information to harass or shame them. (National Privacy Commission)

What documents and screenshots to save

Before applying, and especially before complaining, keep evidence. Screenshots disappear quickly when a website changes or an app is removed.

Evidence	Why it matters
Website homepage and URL	Shows the platform used and public representations
App page or download page	Shows developer name, app name, claims, and permissions
Terms and conditions	Shows contract terms and hidden charges
Disclosure statement	Proves what costs were or were not disclosed
Privacy policy	Shows what data the lender claimed it would collect and use
SEC number and CA number displayed	Allows comparison with SEC records
Chat messages and SMS	Proves threats, harassment, or advance-fee demands
Call logs	Helps establish repeated collection calls
Payment receipts	Proves money sent and recipient account
Bank/e-wallet transaction IDs	Helps trace payments
Screenshots of contact-list access or app permissions	Important for privacy complaints
ID requests and selfie instructions	Helps show what personal data was collected

For formal complaints, the NPC states that a complaint may require a filled-out and notarized complaint-assisted form or verified complaint, with evidence and witness affidavits, submitted personally, by registered mail, courier, or authorized email. (National Privacy Commission)

Where to verify or report problems

Concern	Office or portal	Practical use
Is the lending/financing company registered and authorized?	SEC website, eSEARCH, Check with SEC, SEC iMessage	Verify corporate status, CA, recorded OLP, advisories
Complaint against lending/financing company	SEC iMessage / SEC Financing and Lending Companies Department	Report unregistered lending, excessive charges, disclosure violations, unfair collection
Privacy violation, contact harvesting, public shaming	National Privacy Commission	File data privacy complaint with notarized form and supporting documents
Bank, e-wallet, payment, or BSP-supervised entity issue	BSP Consumer Corner / BSP Verifier	Check BSP-supervised institutions and consumer channels
Online scam, fake website, phishing, identity theft	PNP Anti-Cybercrime Group, NBI Cybercrime Division, CICC channels	Preserve evidence and seek cybercrime investigation
Official SEC documents	SEC Express	Request plain or authenticated SEC documents online; delivery is generally 3–5 working days in Metro Manila and up to 7 working days for provincial deliveries from SEC release. (SEC Express)

The SEC iMessage portal allows the public to open tickets and check ticket status for feedback, reports, issues, and complaints. (Securities and Exchange Commission)

Special notes for OFWs and foreigners

OFWs borrowing from abroad

Many OFWs use Philippine online lending websites while overseas. A lender operating in the Philippines or targeting Philippine borrowers still needs to comply with Philippine lending, disclosure, consumer protection, and data privacy rules.

Practical issues for OFWs include:

Time-zone delays in responding to verification calls
Difficulty notarizing complaint documents abroad
Need to preserve screenshots because apps may be deleted before you return home
Use of Philippine mobile numbers and e-wallets even while overseas
Family members in the Philippines receiving collection harassment

If notarization abroad is needed for affidavits or supporting documents, Philippine embassies or consulates may provide notarial services. Foreign-issued documents intended for use in the Philippines may also need apostille or consular authentication depending on the document and country of origin.

Foreigners borrowing in the Philippines

Foreigners may be asked for additional know-your-customer documents such as passport, visa status, ACR I-Card, local address, proof of income, or local bank account. A legitimate lender may verify identity and repayment capacity, but it should not ask for immigration documents unrelated to the loan or demand original passports as “collateral.”

Foreigners should also be careful when a website says foreign ownership or foreign management makes it exempt from Philippine rules. Lending companies under RA 9474 have Philippine ownership and reciprocity rules, and no foreign national may own stock in a lending company unless their country grants reciprocal rights to Filipinos. (Supreme Court E-Library)

What to do if you already borrowed from a suspicious online lender

Do not delete the app immediately without saving evidence. Screenshot the loan terms, permissions, messages, account details, and payment instructions first.
Ask for the full corporate identity in writing. Request the legal company name, SEC registration number, CA number, registered address, official email, and statement of account.
Pay only through traceable channels. Avoid sending money to personal accounts unless you can confirm the account is an official collection channel.
Separate principal from disputed charges. If you received money, record the exact amount received and compare it with the amount demanded. Hidden fees, excessive charges, and unlawful penalties should be documented.
Block harassment, not evidence. Keep screenshots before blocking numbers or accounts. If collectors contact relatives or employers, ask those people to forward screenshots to you.
Report the correct issue to the correct office. SEC for lending authority, disclosure, charges, and collection practices; NPC for privacy violations; BSP for banks/e-wallets/payment entities; cybercrime authorities for phishing, identity theft, fake websites, or advance-fee scams.

Frequently Asked Questions

How do I know if an online lending website is SEC registered?

Look for the exact corporate name, SEC registration number, and Certificate of Authority number. Then verify them through SEC records or SEC online services. Do not rely only on a logo, screenshot, or “SEC registered” badge.

Is SEC registration enough for an online lender?

No. SEC incorporation only means the corporation exists. A lending company must also have authority to operate from the SEC under RA 9474, and a financing company must be authorized under the financing company law. (Supreme Court E-Library)

What if the company is registered but the website is not listed as an online lending platform?

That is a serious red flag. The company may be real, but the website or app may be unauthorized, newly created, or using the company’s identity without permission. Check whether the exact website, app, or platform is connected to the company in SEC records or advisories.

Are online lending apps allowed to access my contacts?

They should not harvest your phone contacts, email contacts, or social media contacts for harassment or debt collection. The NPC has specifically warned online lenders against using borrower contact lists and private information for harassment. (National Privacy Commission)

Can an online lender post my photo or call my relatives if I miss payment?

Using your photo, personal information, or contact list to shame, threaten, or pressure you may violate privacy and collection rules. Save evidence and report privacy issues to the NPC and lending-related misconduct to the SEC.

What interest rate is legal for online loans in the Philippines?

It depends on the loan type. For covered unsecured, general-purpose loans of ₱10,000 or below with a tenor of up to four months, SEC rules implementing BSP Circular No. 1133 set ceilings on nominal interest, effective interest, late penalties, and total cost. For other loans, charges still must be disclosed, lawful, and not unconscionable.

Can I ignore the loan if the online lender is not legitimate?

Not automatically. If you actually received money, there may still be a civil obligation to return the principal or lawful amount. But unauthorized lending, hidden charges, excessive fees, privacy violations, or harassment can be reported and may affect what charges are enforceable.

Is a barangay complaint required before reporting an online lender?

Usually, complaints to regulators like the SEC or NPC are separate from barangay conciliation. Barangay proceedings may be relevant for local civil disputes between individuals, but online lending violations involving regulated companies, privacy breaches, or cybercrime are usually handled through the appropriate government agency.

What if the lender is based outside the Philippines?

If it targets Philippine borrowers, processes personal data of Philippine citizens or residents, uses Philippine payment channels, or operates through a Philippine entity, Philippine laws and regulators may still become relevant. Cross-border enforcement can be slower, so evidence preservation is especially important.

Can a fake online lender be charged criminally?

Possibly. Fake lending websites that use false identities, collect advance fees, steal personal data, or impersonate companies may involve estafa, identity theft, computer-related fraud, phishing, or other cybercrime-related offenses depending on the facts. The specific complaint should match the evidence.

Key Takeaways

Do not trust a lending website just because it looks professional or displays an SEC logo.
Check the exact corporate name, SEC registration, Certificate of Authority, and whether the website or app is a recorded online lending platform.
SEC registration alone is not enough; lending and financing activities require proper authority.
Legitimate lenders should disclose the true cost of credit before you accept the loan.
Online lenders should not harvest your contacts, shame you publicly, or threaten your family, employer, or friends.
Save screenshots, contracts, disclosure statements, payment receipts, and messages before reporting.
Use the SEC for lending authority and collection issues, the NPC for privacy violations, BSP for banks/e-wallet/payment entities, and cybercrime authorities for fake websites, phishing, or scams.