Before giving a lender your ID, selfie, payslip, bank details, or access to your phone, verify two things: the exact legal company behind the loan and its authority to lend. A professional-looking app, Facebook page, office, or SEC registration number is not enough. Scammers sometimes copy the name, documents, or Certificate of Authority of a real company, while some registered corporations operate lending businesses without the required secondary license.

The checks below work for traditional lending companies, financing companies, online lending platforms, loan apps, and lenders advertising through social media.

What Makes a Lending Company Legitimate in the Philippines?

A legitimate lender must be registered with the correct regulator and authorized to conduct the specific lending activity it offers.

Type of provider	Main regulator	What you should verify
Lending company	Securities and Exchange Commission (SEC)	Corporate registration and a valid Certificate of Authority to Operate as a Lending Company
Financing company	SEC	Corporate registration and a valid Certificate of Authority to Operate as a Financing Company
Bank or digital bank	Bangko Sentral ng Pilipinas (BSP)	Inclusion in the BSP’s list of supervised or authorized financial institutions
Credit cooperative	Cooperative Development Authority (CDA)	Valid cooperative registration and authority to provide credit to qualified members
Pawnshop or similar BSP-supervised entity	BSP	Appropriate BSP registration or authority

An ordinary individual may occasionally lend personal money under a private loan agreement. However, an entity that regularly solicits borrowers and operates a lending business is subject to regulatory requirements.

SEC registration is not the same as authority to lend

This is the most important distinction.

Under the Lending Company Regulation Act of 2007, or Republic Act No. 9474, a lending company must generally be organized as a stock corporation and obtain a Certificate of Authority, commonly called a CA, from the SEC before operating as a lending company.

A Certificate of Incorporation merely proves that the corporation was registered. It does not automatically authorize the corporation to offer loans to the public. Operating without a valid Certificate of Authority may result in administrative and criminal penalties. (Lawphil)

Financing companies are governed principally by the Financing Company Act of 1998, or Republic Act No. 8556. Although financing and lending companies have different statutory definitions, both are regulated by the SEC and require the appropriate authority to operate. (Lawphil)

How to Check If a Lending Company Is SEC-Registered and Authorized

1. Identify the lender’s exact corporate name

Do not search only the app name or brand shown in an advertisement. Find the full legal name of the corporation.

Look for it in the lender’s:

Loan agreement
Disclosure statement
Terms and conditions
Privacy policy
Website footer
App-store developer information
Official email address
Payment instructions
SEC registration and Certificate of Authority details

For example, an app called “Quick Peso” might legally be operated by “ABC Lending Corporation.” You must verify ABC Lending Corporation, not merely “Quick Peso.”

Treat the offer as suspicious when the lender refuses to reveal its corporate name or gives different company names in its advertisement, contract, privacy policy, and collection messages.

2. Search the company through the official SEC verification portal

Use the SEC’s official Check with SEC portal.

Search using the exact corporate name. When available, also compare the SEC registration number shown in the lender’s documents.

Check whether the results indicate that:

The corporation exists in SEC records.
The corporate name exactly matches the lender’s documents.
The company has the necessary secondary license or Certificate of Authority for lending or financing.
The authority belongs to the same corporation dealing with you.

The SEC promotes Check with SEC as a way to verify both corporate registration and required secondary licenses. (Facebook)

A search result showing only that the corporation is registered does not complete the verification. Look specifically for its authority to operate as a lending or financing company.

3. Match the Certificate of Authority information

Ask the lender for its:

Full corporate name
SEC registration number
Certificate of Authority number
Registered office address
Official website
Name of the online lending platform, if applicable

Compare these details with SEC records. Watch for small but meaningful differences, such as:

“ABC Lending Corp.” versus “ABC Credit and Finance Corp.”
A registration number belonging to another company
A Certificate of Authority issued to a similarly named corporation
An address that does not match the company’s official documents
A certificate image with altered names or numbers

A screenshot or photocopy of a Certificate of Authority is not conclusive. Scammers can copy a real lender’s certificate and use it for a different app, website, or social-media account.

4. Verify that the loan app belongs to the authorized company

Finding a real lending company in SEC records does not automatically prove that a particular app belongs to it.

Compare the app or website with the verified corporation by checking:

The app developer’s legal name
The company identified in the privacy policy
The corporation named in the loan agreement
The official website domain
Customer-support email addresses
The beneficiary name for repayments
The company named in the disclosure statement

These details should point to the same legal entity.

Beginning August 1, 2026, SEC Memorandum Circular No. 20, Series of 2026 lifts the previous moratorium on new online lending platforms but imposes stricter disclosure, registration, market-conduct, and prudential requirements. Online lending platforms remain channels of their parent lending or financing companies—not separate corporations with independent Certificates of Authority. Platform and trade names must be disclosed and registered under the applicable SEC framework. (CLTV36)

This means borrowers should verify both:

The parent company’s authority to lend; and
The parent company’s connection to the specific app, website, or platform.

5. Ask the SEC directly when the result is unclear

Automated search results may be incomplete, delayed, or difficult to interpret. When the company cannot be found, multiple records appear, or its Certificate of Authority status is unclear, submit a ticket through the SEC’s official iMessage system.

The SEC’s Financing and Lending Companies Department accepts requests involving:

Certification of the status of a Certificate of Authority
Complaints against financing and lending companies
Company records that cannot be found
Multiple or unclear company records

The SEC’s public iMessage guide specifically lists requests for Certificate of Authority status and complaints involving financing and lending companies. (Securities and Exchange Commission)

Provide the exact corporate name, registration or CA number, app name, website address, screenshots, and copies of documents supplied by the lender.

Review the Loan Documents Before Accepting the Money

Legitimacy is not limited to SEC registration. A duly registered company can still offer a confusing, abusive, or noncompliant loan.

Under the Truth in Lending Act, or Republic Act No. 3765, borrowers must receive meaningful written information about the cost of credit before the transaction is completed. SEC Memorandum Circular No. 7, Series of 2011 further prescribes disclosure requirements for lending and financing companies. (SEC Appointment System)

Before accepting the loan, obtain a disclosure statement showing at least:

Principal or amount financed
Actual amount you will receive
Interest rate
Finance charge
Processing, service, platform, or documentary fees
Payment schedule
Total amount payable
Late-payment charges
Other penalties
Effective interest rate, where applicable

Pay close attention to the difference between the advertised loan and the net proceeds.

For example, a lender may describe a loan as ₱10,000 but deduct ₱1,500 before release. If you receive only ₱8,500 but must repay based on ₱10,000 plus other charges, the real cost of borrowing is much higher than the headline rate suggests.

Do not sign or accept:

Blank loan documents
A contract that can be changed without notice
Automatic loan renewals you did not request
Automatic releases of additional loans
Agreements that do not identify the lender
Terms that appear only after the money has been released

Article 1956 of the Civil Code of the Philippines also provides that interest is not due unless it has been expressly stipulated in writing. This does not mean every written interest charge is automatically enforceable; courts may still examine whether rates and penalties are unlawful or unconscionable.

Interest-Rate Limits for Certain Small Online and Consumer Loans

BSP Circular No. 1133 and SEC Memorandum Circular No. 3, Series of 2022 impose special caps on certain loans offered by lending companies, financing companies, and their online lending platforms.

The caps apply when the loan is:

Unsecured;
For general purposes;
₱10,000 or less; and
Payable within four months or less.

For loans within that coverage, the principal limits include:

Charge	Maximum
Nominal interest rate	6% per month, or approximately 0.2% per day
Effective interest rate, including most fees and charges	15% per month, or approximately 0.5% per day
Late-payment or nonpayment penalty	5% per month on the outstanding scheduled amount due
Total interest, fees, and penalties	Not more than 100% of the amount borrowed

The 100% total-cost cap means that, for a covered loan, accumulated interest, fees, penalties, and similar charges should not exceed the principal borrowed. These limits do not apply automatically to every type or amount of loan, so first confirm whether the transaction falls within the circular’s defined coverage.

Check What the Loan App Wants to Access

A loan app should collect only information that is necessary and proportionate to a legitimate lending purpose.

The Data Privacy Act of 2012, or Republic Act No. 10173, requires personal data to be processed for a declared, specified, and lawful purpose. Online lenders must also comply with National Privacy Commission rules specifically addressing online lending applications. (Lawphil)

Be cautious when an app demands access to:

Your entire contacts list
Photos and videos unrelated to identity verification
Personal messages
Call logs
Social-media accounts
Precise location when it is unnecessary
Microphone or continuous camera access
Files unrelated to your application

A March 2026 joint advisory from the DICT, National Privacy Commission, and SEC emphasized that unauthorized, excessive, or disproportionate processing is prohibited. It also states that persons in a borrower’s contact list may not be contacted for debt collection merely because their numbers were stored on the borrower’s phone. A properly named guarantor is treated differently because that person has expressly undertaken responsibility for the debt.

Before installing or using an app:

Read its privacy policy.
Identify the company acting as the personal information controller.
Review every requested permission.
Deny access that is unrelated to the loan.
Take screenshots of the permissions and privacy notices.
Revoke unnecessary permissions after preserving evidence of any improper conduct.

Warning Signs That a Lending Offer May Be Fake or Illegal

Advance fees before loan release

One of the strongest scam indicators is a demand to pay money before receiving the loan.

Common labels include:

Processing fee
Insurance fee
Account activation fee
Tax clearance
Anti-money laundering deposit
Verification fee
Release fee
Wallet-unlocking charge
Refundable security deposit

Legitimate charges are normally disclosed in the loan documents and accounted for transparently. Be especially suspicious when payment must be sent to a personal bank or e-wallet account before any funds are released.

The lender guarantees approval

Statements such as “100% approved,” “no rejection,” or “guaranteed loan regardless of credit history” are often used to pressure vulnerable borrowers. A responsible lender normally performs some form of identity, affordability, fraud, or credit assessment.

The lender asks for passwords, PINs, or one-time passwords

A lender may need account details for disbursement or repayment, but it should not ask for:

Your ATM PIN
E-wallet PIN
Online-banking password
Email password
One-time password or OTP
Remote access to your phone

An OTP authorizes a particular login or transaction. Giving it to another person may allow that person to take over an account or transfer money.

The company communicates only through private messaging

A lender operating only through Messenger, Telegram, WhatsApp, Viber, or text messages—without verifiable corporate records, an official domain, a physical address, and proper loan documents—deserves heightened scrutiny.

Repayment accounts keep changing

A payment instruction bearing the verified company’s name is easier to trace than payments to unrelated personal accounts. A personal account is not conclusive proof of fraud, but repeated instructions to transfer funds to different individuals are a serious warning sign.

Money is released without informed consent

Some abusive lenders send a small amount to a borrower’s e-wallet or bank account without a clearly accepted loan agreement, then demand a much larger repayment a few days later.

Do not spend the money. Preserve the transaction record, notify the financial institution, request written proof of consent and the complete loan documents, and report the incident promptly.

The lender threatens immediate arrest for ordinary nonpayment

Failure to pay a genuine civil debt does not, by itself, automatically result in arrest or imprisonment. Criminal exposure may arise from separate conduct, such as fraud, falsified documents, or violations involving checks, but a collector cannot truthfully claim that every missed payment is automatically estafa.

Collectors threaten or publicly shame the borrower

SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair debt-collection practices by lending and financing companies. Prohibited conduct can include threats, insults, false representations, disclosure of the debt to unauthorized persons, and humiliating or abusive collection tactics. (SEC Appointment System)

A legitimate debt does not give a collector permission to harass the borrower, publish personal information, threaten violence, or shame the borrower’s family and coworkers.

Quick Legitimacy Checklist

What to check	Reassuring sign	Serious warning sign
Legal identity	Exact corporate name appears consistently	App, contract, and payment account use different names
SEC status	Registered corporation with appropriate CA	Registration only, no lending or financing authority
Online platform	Verifiable connection to the licensed parent company	Platform uses another company’s certificate
Loan documents	Complete disclosure before acceptance	Charges appear only after disbursement
Fees	Clearly itemized and included in cost calculations	Advance fee required before release
Payment channel	Traceable account connected to the company	Changing personal bank or e-wallet accounts
Phone permissions	Limited to necessary information	Demands contacts, messages, photos, and call logs
Collection conduct	Written notices and professional communication	Threats, public shaming, or contact-list harassment
Account security	Never asks for passwords or OTPs	Requests PINs, OTPs, or remote phone access

What to Do If You Suspect an Illegal or Fake Lender

1. Stop sending additional money or information

Do not pay another “release,” “verification,” or “refund” fee merely because the lender says your first payment is locked. Repeated fee demands are common in advance-fee scams.

Do not provide additional IDs, selfies, signatures, passwords, or OTPs until the entity has been verified.

2. Preserve evidence

Save copies of:

Advertisements
App-store pages
Website addresses
Social-media profiles
Chat messages and emails
Loan agreements
Disclosure statements
Privacy policies
Screenshots of app permissions
Collection messages and call records
Bank and e-wallet receipts
Account names and numbers
Names and phone numbers used by agents
SEC certificates sent by the lender

Keep the original electronic files where possible. Screenshots should show dates, account names, URLs, and transaction reference numbers.

3. Verify the company through the SEC

Search through Check with SEC. If the record is missing or unclear, submit a request through SEC iMessage and choose the category relating to financing and lending companies.

4. Report the appropriate violation

Problem	Where it may be reported
Unlicensed lending company or questionable Certificate of Authority	SEC Financing and Lending Companies Department through iMessage
Harassment or unfair collection by an SEC-regulated lender	SEC through iMessage
Misuse of contacts, photos, messages, or other personal data	National Privacy Commission
Advance-fee scam, account takeover, or fraudulent online transaction	NBI Cybercrime Division or the Philippine National Police Anti-Cybercrime Group
Unauthorized bank or e-wallet transaction	The bank or e-wallet provider’s official fraud channel
Immediate threats of physical harm	Nearest police station or emergency authorities

The NBI provides an official online complaint page and investigative assistance for victims of computer-related crimes. (National Bureau of Investigation)

5. Do not assume the debt automatically disappears

The absence of a valid license does not necessarily mean that a borrower may keep money actually received without consequence.

Depending on the documents and circumstances:

The lender’s authority to impose interest or exercise particular remedies may be challenged.
Undisclosed or unlawful charges may be disputed.
Courts may reduce unconscionable interest or penalties.
The principal actually received may still be recoverable under the contract or Civil Code principles preventing unjust enrichment.

Request a written statement of account showing the principal received, all payments, interest, fees, and penalties. Keep the undisputed amount available while the legitimacy and charges are being investigated.

Documents, Costs, and Typical Processing Times

Action	Useful information or documents	Likely cost and timing
Check with SEC search	Exact corporate name and registration number	Free; usually completed within minutes
SEC iMessage inquiry	Company name, CA number, app name, URL, and screenshots	Initial inquiry is generally online; response time depends on the agency queue
Formal SEC certification request	Corporate details and requested certification	Fees and processing requirements may apply
SEC complaint	Narrative, IDs, agreements, payment records, and communications	Initial electronic filing may be followed by requests for verified or notarized documents
NPC complaint	Evidence of data collection, disclosure, harassment, or unauthorized contact	Requirements depend on the remedy and complaint procedure
NBI or police complaint	Government ID, affidavit, messages, receipts, account details, and device evidence	Investigation timelines vary according to complexity and available evidence

For OFWs and foreigners outside the Philippines

SEC verification and initial online reporting can usually be done remotely.

If a Philippine agency later requires a sworn affidavit or formally authenticated foreign document, the document may need to be:

Executed before a Philippine embassy or consulate; or
Notarized in the foreign country and apostilled, when the country participates in the Apostille Convention and the receiving agency accepts that form.

Do not arrange apostille or consular authentication unless the agency handling the complaint confirms that it is required. Scanned copies are often sufficient for an initial inquiry.

Frequently Asked Questions

Is an SEC registration number enough to prove that a lender is legitimate?

No. A corporation may be SEC-registered without being authorized to operate a lending or financing business. Verify the appropriate Certificate of Authority or secondary license.

How do I check whether an online lending app is legitimate?

Identify the parent corporation, search it through Check with SEC, confirm its Certificate of Authority, and verify that the app, privacy policy, contract, developer, website, and repayment instructions all belong to that corporation.

Is a lending app legitimate because it appears in an app store?

No. An app-store listing is not a government license. Platforms may remove fraudulent or noncompliant apps, but publication in an app store does not replace SEC verification.

Can a legitimate lender ask for an advance fee?

A lender may impose properly disclosed charges, but a demand to transfer an activation, insurance, tax, or release fee before disbursement is a major scam warning. Never rely solely on a promise that the payment will be refunded.

What is a Certificate of Authority number?

It is the number connected to the SEC’s authority allowing a registered corporation to operate as a lending or financing company. It is different from the corporation’s SEC registration number.

Are high interest rates automatically illegal?

Not every high rate is automatically void, but special caps apply to covered small, short-term loans. Courts may also reduce rates and penalties found to be unconscionable. Interest must be expressly stipulated in writing.

Can a lender contact my family, friends, or employer?

A lender cannot freely use your contact list to pressure or shame you. People who merely appear in your phone contacts are not guarantors. Contact with a named guarantor or an authorized reference may be treated differently, but data use and collection communications must still be lawful and proportionate.

Can I be arrested simply because I could not pay an online loan?

Ordinary inability to pay a civil debt does not automatically result in arrest. Separate fraudulent acts, falsified documents, or other criminal conduct may create different issues, but collectors should not falsely represent every missed payment as estafa.

Do I have to repay an unregistered or illegal lender?

Do not assume that the principal is automatically cancelled. The legality of interest, penalties, and collection remedies may be disputed, but money actually received may still have to be returned. Obtain a detailed statement of account and preserve all documents.

Where should I report an illegal online lending app?

Report licensing and collection issues to the SEC through iMessage. Report misuse of personal data to the National Privacy Commission. Report fraud, account takeover, or online extortion to the NBI Cybercrime Division or PNP Anti-Cybercrime Group, and immediately notify the bank or e-wallet provider involved.

Key Takeaways

Verify the lender’s exact legal corporate name, not only its app or brand name.
SEC corporate registration alone is insufficient; look for a valid Certificate of Authority to operate as a lending or financing company.
Confirm that the specific app, website, contract, and payment account genuinely belong to the authorized corporation.
Use the official Check with SEC portal and SEC iMessage system.
Read the disclosure statement before accepting funds and compare the amount advertised with the amount actually released.
Never provide a password, PIN, OTP, or remote access to your device.
Broad contact-list access, advance fees, changing personal payment accounts, hidden charges, and threats of immediate arrest are major warning signs.
Preserve screenshots, contracts, transaction records, and app-permission evidence before reporting suspicious activity.
An illegal lender’s charges may be challenged, but the borrower should not assume that the principal actually received is automatically erased.