A Philippine legal article on how to verify whether an online lending app is lawful, properly authorized, fair in practice, and compliant with Philippine rules on lending, collections, privacy, and consumer protection

I. Introduction

Online lending apps have become a major part of the Philippine consumer credit landscape. Through a mobile phone, a borrower can apply for a short-term loan, upload identification, receive approval quickly, and obtain funds without entering a physical branch. For many Filipinos, especially those without easy access to traditional banks, these apps appear convenient and immediate.

But convenience has been accompanied by serious legal and practical problems. Many apps have been accused of charging abusive rates, hiding fees, engaging in harassment, accessing contact lists without lawful basis, sending shame messages to relatives and co-workers, threatening criminal cases for unpaid debt, using fake collection agents, misrepresenting registration status, or operating without proper authority. Some platforms are truly licensed lending or financing companies. Others may be unauthorized, deceptive, abusive, or completely fraudulent.

For that reason, checking whether an online lending app is legitimate is not a cosmetic precaution. It is a legal-risk assessment.

In the Philippines, legitimacy is not determined by a flashy interface, a large number of downloads, celebrity endorsements, social media advertising, or claims of “SEC registered” in an app description. The real questions are legal and regulatory:

Is the entity behind the app properly organized and authorized to lend?
Does it have the correct registration and, where required, certificate of authority?
Does it make legally meaningful disclosures to borrowers?
Are its collection practices lawful?
Does it comply with data privacy rules?
Does it impose charges and penalties in a transparent, non-deceptive way?
Does it threaten or shame borrowers unlawfully?
Does it use contracts that match what it actually does?

This article explains how to evaluate the legitimacy of an online lending app in Philippine legal context.

II. What is an online lending app?

An online lending app is generally a digital platform—usually mobile-based, sometimes web-based—through which a person may:

apply for a loan,
submit personal data and documents,
receive credit evaluation,
agree to loan terms electronically,
obtain disbursement,
and repay according to the app’s system.

Legally, the app itself is only the front-facing tool. The important issue is who is behind it. The actual lender may be:

a lending company,
a financing company,
a bank or bank-affiliated institution,
a cooperative under a different legal structure,
or a totally unauthorized entity pretending to be a lawful lender.

An app cannot become lawful merely by existing on an app store. Distribution through a platform does not equal government approval of its lending activity.

III. Core rule: an app is not legitimate merely because it is downloadable

Many consumers assume that if an app appears in a mainstream app marketplace, it must already have passed legal review. That assumption is unsafe.

App stores are distribution channels, not Philippine regulatory adjudicators of lending legality. A listed app may still be:

unlicensed,
misleading,
privacy-invasive,
abusive in collections,
operated under a shell entity,
falsely using a registered corporate name,
or tied to a company whose legal authority has been revoked, suspended, or questioned.

The legitimacy inquiry must therefore go beyond:

app store appearance,
user ratings,
advertisements,
and claims on social media.

The question is whether the lending activity in the Philippines is backed by proper legal authority and lawful conduct.

IV. Main legal regulators and frameworks in the Philippines

A proper legitimacy check usually touches several regulatory areas.

1. Securities and Exchange Commission (SEC)

The SEC is central in the regulation of lending companies and financing companies. In Philippine practice, many online lenders that are not banks fall into this area. A key legitimacy issue is whether the entity behind the app is:

validly registered as a corporation or juridical entity where applicable; and
properly authorized to operate as a lending or financing company if the law requires it.

A mere corporate registration is not the same as authority to engage in lending.

2. Bangko Sentral ng Pilipinas (BSP)

If the lender is a bank, digital bank, quasi-bank, or another BSP-supervised financial institution, BSP-related rules may be relevant. Some entities market loans digitally but are not banks. Borrowers should not confuse “financial-looking app” with “bank.”

3. National Privacy Commission (NPC)

Because online lending apps collect highly sensitive personal information, privacy law is crucial. The NPC framework becomes relevant where the app:

accesses contacts, photos, messages, device data, or location;
processes sensitive personal information;
uses personal data for credit scoring, profiling, or collection;
or discloses borrower information to third parties without lawful basis.

4. Department of Trade and Industry (DTI) and general consumer protection norms

Although lending is not identical to ordinary retail trade, deceptive advertising, unfair acts, misleading disclosures, and abusive practices may raise broader consumer protection concerns.

5. Cybercrime and criminal law enforcement

Some practices of fake or abusive lending apps may cross into identity theft, extortion, grave threats, unjust vexation, coercion, defamation-related exposure, cyber harassment, unauthorized access, or other criminal issues depending on facts.

V. First distinction: lender legitimacy versus collection legitimacy

An app may be problematic in two different ways:

A. It may be unauthorized from the start

This means the lender may lack proper authority to lend or may be posing as a registered entity.

B. It may be authorized to lend but behave unlawfully in operations

Some entities may have formal legal status but still engage in:

unlawful collection harassment,
deceptive pricing,
abusive penalties,
privacy violations,
or misleading disclosures.

So the legitimacy check is not satisfied by finding only a company name. The borrower must examine both:

authority to operate, and
lawfulness of actual conduct.

VI. What “legitimate” should mean in Philippine context

For an online lending app to be treated as meaningfully legitimate in practical legal terms, the following should generally be true:

the operating entity is identifiable;
it is properly registered under Philippine law or otherwise authorized to operate in the relevant manner;
if it is a lending or financing company, it has the necessary authority associated with that business;
its terms are disclosed clearly and not deceptively;
its interest, fees, charges, and penalties are transparent;
its collection methods comply with law and regulation;
its privacy practices are lawful and proportionate;
it does not engage in public shaming, threats, or improper third-party disclosures;
its contracts are real, accessible, and consistent with the actual transaction;
and the borrower is not being lured into a disguised, predatory, or fraudulent arrangement.

VII. The company behind the app must be clearly identifiable

A legitimate app should not hide the identity of the lender.

A borrower should be able to identify:

the exact legal name of the company,
its registration details,
its principal office or official address,
customer service channels,
complaint-handling contact points,
and the fact of its authority to lend.

Major warning signs include:

only a brand name is shown, but no legal entity is named;
the app uses a generic or invented lender identity;
contact details are limited to social media chat or disposable mobile numbers;
no official email domain or office address is provided;
the app’s legal disclosures are vague, inconsistent, or missing.

A real lender should not be difficult to identify. If the borrower cannot determine who the lender actually is, that alone is a serious red flag.

VIII. Corporate registration is not enough

One of the most common tricks is the phrase “SEC registered.”

This can be misleading because:

many corporations are registered with the SEC for the purpose of legal personality;
but not every SEC-registered company is authorized to engage in lending or financing;
and not every claim of being “SEC registered” is true in the sense consumers assume.

A company may exist as a corporation yet still lack the correct authority to operate a lending business. Therefore, the borrower must distinguish between:

mere corporate existence, and
authority to engage in lending or financing activity.

This distinction is fundamental.

IX. Lending company and financing company concerns

In Philippine legal structure, online consumer lenders often operate through business forms such as lending or financing companies rather than banks.

A. Lending company

A lending company is generally in the business of granting loans from its own capital or from certain allowed funding structures, subject to the relevant legal framework.

B. Financing company

A financing company may engage in broader financing transactions, subject to its own regulatory regime.

C. Why the distinction matters to borrowers

The exact category affects:

the regulatory basis of operation,
capital and authority issues,
disclosure obligations,
and the legal expectations applicable to the lender.

For practical purposes, a borrower should not assume that an app may lawfully lend simply because it says it is a “financial technology platform.” The entity must still fit into a lawful structure.

X. Online presence does not remove the need for legal authority

A company cannot avoid Philippine lending laws by calling itself:

a “platform,”
a “technology company,”
a “service provider,”
a “facilitator,”
or a “credit-matching app,”

if in substance it is engaged in lending, arranging regulated credit activity, or collecting repayments as the real economic lender. Law looks at substance, not merely labels.

Some apps try to create distance between the app brand and the actual lending contract. The borrower must therefore inspect:

who is giving the money,
who is named in the agreement,
to whom repayment is due,
who imposes the charges,
and who sends collection notices.

Those answers reveal the real regulated actor.

XI. Essential disclosures a legitimate app should provide

A legitimate app should make the credit transaction understandable before the borrower is bound.

Important disclosures include:

principal loan amount,
amount actually to be received by the borrower,
interest charges,
service fees,
processing fees,
documentary or platform charges if any,
penalties for late payment,
total repayment amount,
due dates,
method of computation,
consequences of default,
privacy policy,
complaint channels,
and the legal identity of the lender.

If an app emphasizes “instant cash” but obscures the real cost of credit until after submission of data or after disbursement, that is a danger sign.

XII. Actual amount received versus nominal loan amount

A classic problem in online lending is the gap between:

the advertised loan amount, and
the net proceeds actually disbursed.

For example, an app may claim to approve a certain amount, but deduct multiple upfront charges so that the borrower receives far less while still being required to repay the full nominal amount plus penalties.

A borrower performing a legitimacy check should compare:

the stated principal,
the amount credited,
all deductions,
the repayment obligation,
and the timeline.

If the structure is confusing or misleading, legality concerns arise. Even where a charge is not automatically unlawful per se, lack of clarity and deceptive presentation are serious concerns.

XIII. Interest rates, fees, and unconscionability

In the Philippines, the issue is not simply whether there is a numerical ceiling in the abstract. The more practical legal question is whether the total charges, penalties, and effective cost of borrowing are:

properly disclosed,
contractually grounded,
not contrary to law or regulation,
and not unconscionable under the circumstances.

An app may appear to impose a “small fee” but, when annualized or when measured against the short loan period, the effective cost may become extraordinarily high. This is especially concerning where:

repayment periods are very short,
penalties stack rapidly,
extension fees accumulate,
and the borrower never clearly saw the real total cost before acceptance.

A legitimacy check should therefore assess not only authorization, but also whether the app’s pricing model appears predatory or grossly excessive.

XIV. Red flag: refusal to show a clear loan agreement before disbursement

A lawful lender should present a credit agreement or electronic equivalent that the borrower can reasonably review.

Danger signs include:

no accessible contract text;
borrower is rushed to click “agree” without readable terms;
key financial terms appear only after approval;
the app changes due dates or amounts without contractual basis;
the borrower cannot download or screenshot the final agreement;
the app’s in-app terms differ from SMS or collection demands.

A legitimate loan transaction should create an identifiable, reviewable contractual record.

XV. Privacy and data access: one of the biggest legitimacy tests

One of the strongest indicators of whether an online lending app is abusive is its treatment of borrower data.

A. Why privacy matters especially in lending apps

Lending apps often request access to:

contacts,
camera,
microphone,
storage,
location,
call logs,
SMS,
and device identifiers.

Not every requested permission is necessarily lawful or necessary.

B. Lawful processing requires more than broad intimidation consent

The fact that a borrower clicked “allow” does not automatically validate every kind of data collection or every downstream use of the data. Consent under privacy law must be assessed in light of transparency, lawfulness, necessity, proportionality, and the actual purpose of processing.

C. Major privacy red flags

An app is highly suspect if it:

scrapes the borrower’s contacts for collection purposes;
messages friends, relatives, or co-workers about the debt;
posts the borrower’s name or photo publicly;
sends defamatory payment reminders to third parties;
accesses photos or unrelated files without clear necessity;
or threatens to expose the borrower’s debt to the public.

These practices are among the clearest indicators of unlawful and abusive operations.

XVI. Public shaming and third-party disclosure are major warning signs

A legitimate lender collects lawfully. It does not enforce by humiliation.

Highly suspicious and often legally problematic conduct includes:

texting all persons in the borrower’s contact list,
sending messages such as “criminal,” “estafador,” or “wanted”;
creating social media posts about the borrower;
sharing the borrower’s debt with employer, neighbors, family, classmates, or clients without lawful basis;
editing the borrower’s photo with defamatory captions;
threatening exposure unless payment is made immediately.

Debt is generally a private civil matter. Public humiliation is not a lawful substitute for collection procedure.

XVII. Threats of imprisonment for nonpayment of debt

A major sign of illegitimacy or abusive collection is the threat that the borrower will be jailed simply for failure to pay.

As a rule in Philippine legal understanding, mere nonpayment of debt is not automatically a criminal offense. Civil debt collection is not the same as imprisonment for debt. While separate criminal issues may arise in distinct factual settings involving fraud, bouncing checks, or falsification, the bare failure to pay a loan does not by itself justify threats of arrest.

Thus, if an app or collector says:

“Makukulong ka kapag hindi ka nagbayad bukas,”
“May warrant na para sa utang mo,”
“Estafa ka agad for simple nonpayment,”

that is a major warning sign of intimidation and likely abuse.

XVIII. Fake legal notices and fake law enforcement references

Some abusive apps or collectors send:

fake subpoenas,
fake warrants,
fabricated legal demand forms,
notices using law firm names without authority,
messages pretending to come from police,
or logos resembling courts or government offices.

These are serious red flags. A legitimate lender pursuing collection may send proper demand letters, but it should not simulate court processes or state authority to terrorize borrowers.

A borrower should be suspicious where the notice:

is badly formatted,
has no verifiable sender,
uses generic signatures,
contains absurd deadlines,
or threatens immediate arrest by text message.

XIX. Collection practices: what legitimacy requires

A legitimate lender may collect lawfully. It may:

send reminders,
call the borrower reasonably,
send formal demand letters,
endorse the account to a collection agency under lawful arrangements,
or file a civil action if warranted.

But a legitimate lender should not:

harass at unreasonable hours,
use obscene or threatening language,
contact unrelated third parties to shame the borrower,
misrepresent legal consequences,
pretend to be government agents,
or use access to contacts and photos as coercive leverage.

The method of collection often tells more about the app’s legitimacy than its advertisements do.

XX. Must the lender have a privacy policy?

Yes, in any meaningful compliance environment, a privacy policy and related transparency mechanisms are essential.

The borrower should look for:

what data is collected,
why it is collected,
how it is processed,
who receives it,
how long it is retained,
whether it is shared with affiliates or third parties,
whether it is used for credit scoring, marketing, or collections,
and how the borrower can exercise privacy rights.

A missing or vague privacy policy is a serious problem. A policy that looks polished but is inconsistent with the app’s actual behavior is even worse.

XXI. Device permissions as a practical legality test

A strong real-world test is this: Are the requested permissions proportionate to the loan transaction?

Reasonable data may include identity details, repayment information, and limited verification tools. But an app becomes suspicious when it requests sweeping access unrelated to underwriting or servicing.

Examples of disproportionate permissions may include:

full contact list access for short-term consumer loans,
broad photo and file access without justification,
continuous location tracking unrelated to loan servicing,
call log monitoring,
or access patterns that appear designed for coercion rather than credit evaluation.

A borrower should treat excessive permissions as a major legitimacy problem, not a minor inconvenience.

XXII. The role of electronic consent

Online lenders typically rely on electronic acceptance. This is not inherently invalid. Philippine law can recognize electronic transactions and electronic evidence in proper circumstances.

But electronic consent must still be:

informed,
tied to readable terms,
not procured by deception,
and supported by records showing what the borrower actually agreed to.

A lender should not hide behind “you clicked agree” if the app:

failed to disclose material terms,
buried abusive clauses,
used dark patterns,
or processed unrelated personal data far beyond the stated purpose.

XXIII. App branding and false authority claims

A suspicious app may misuse phrases like:

“government approved,”
“fully legal,”
“trusted by regulators,”
“certified collection authority,”
or “official SEC lending app,”

without any clear legal basis.

A legitimacy check should be skeptical of:

official-looking seals without explanation,
logos implying government endorsement,
vague claims of “licensed” without naming the entity,
or legal jargon intended to discourage scrutiny.

Legitimate entities usually provide verifiable disclosures, not merely authority-sounding slogans.

XXIV. Use of aliases, multiple brands, and shell structures

Some problematic operators use multiple app names under obscure corporate arrangements. One company may run several brands, or several brands may point to unclear contractual counterparts.

This matters because:

complaints become harder to trace,
borrowers may not know whom to sue or report,
corporate identity can be obscured,
and one abusive brand may disappear while another brand continues.

A legitimate app should not make it difficult to determine:

which legal entity issued the loan,
which entity collects,
which entity handles complaints,
and which entity is accountable for privacy processing.

XXV. Borrower rights that a legitimate lender should respect

A lawful lender should recognize that the borrower has rights, including the right to:

know the identity of the lender;
understand the loan terms;
receive transparent disclosure of charges;
be treated fairly in collection;
have personal data processed lawfully;
refuse unlawful threats and public shaming;
receive an accounting of the obligation;
question unauthorized charges;
and pursue complaint remedies before proper authorities.

If an app behaves as though the borrower has no rights once “agree” is clicked, that itself is a bad sign.

XXVI. Common scam or illegitimacy markers

A borrower should be highly cautious if the app or collector shows any of the following:

no clear legal entity behind the app;
no office address or official complaint channel;
no readable loan contract;
drastic discrepancy between loan amount and amount received;
immediate demand for phone permissions unrelated to lending;
access to contact list followed by collection threats;
public shaming or third-party messaging;
threats of arrest for simple nonpayment;
fabricated court or police notices;
rapidly escalating hidden fees;
refusal to provide payment computation;
use of many different bank accounts or e-wallet names;
collectors using personal accounts or random numbers;
pressure to repay through unofficial channels;
app disappearing or becoming inaccessible after disbursement;
customer support that cannot explain the legal identity of the lender;
or statements that privacy invasion is “normal in online lending.”

Each red flag matters. Several together strongly suggest serious illegitimacy or abuse.

XXVII. Are online loans always illegal if interest is very high?

Not every high-cost loan is automatically void in every aspect. But extremely oppressive or hidden charges may be challenged under principles of unconscionability, fairness, and proper disclosure, depending on the facts and governing rules.

The critical practical point is that even where a borrower received money and incurred a real obligation, abusive or unlawful collection methods remain unlawful. A lender does not become entitled to violate privacy or harass simply because a debt exists.

Thus, two things can be true at once:

a borrower may still owe a legally recognizable debt or some portion of it; and
the lender or app may still be violating law through its methods.

XXVIII. Civil debt versus criminal threats

A legitimacy check must separate:

the borrower’s contractual obligation to pay, and
the lender’s methods of enforcement.

Even where the borrower is in default, the lender’s remedies are not unlimited. Philippine law does not allow private collection by terror, humiliation, or fake legal process. An app that blurs civil collection into threats of criminal punishment is behaving suspiciously and often unlawfully.

XXIX. The importance of audit trail and records

A legitimate digital lender should be able to provide a coherent record of the transaction, including:

application details,
approval notice,
contract,
disbursement amount,
payment ledger,
due dates,
penalties,
and communications.

If the borrower cannot obtain a clear statement of account or the figures change arbitrarily, the app’s reliability is doubtful.

A borrower should preserve:

screenshots,
payment receipts,
chat logs,
SMS notices,
email messages,
call recordings where lawful and appropriate,
bank or e-wallet transaction histories,
and the app’s terms as displayed at the time of borrowing.

These become vital if a complaint or dispute arises.

XXX. Is a collection agency automatically legitimate if it contacts the borrower?

No. Even if the original lender is real, the borrower should still verify the identity and authority of the collection party.

A collector should not be assumed legitimate merely because it has:

a law-firm-sounding name,
a stern message format,
or a claim that the account was “endorsed.”

The borrower should determine:

who the original lender is,
whether the account was actually endorsed or assigned,
whether the collector is acting with authority,
and whether the collection demand matches the loan records.

Fake collectors sometimes prey on borrowers by exploiting fear and confusion.

XXXI. Complaints that strongly suggest unlawful operations

The following recurring borrower complaints are especially serious in the Philippine setting:

“They messaged my entire contact list.”
“They called me a scammer and sent my photo around.”
“They threatened to jail me if I missed one payment.”
“I borrowed one amount but received much less.”
“They keep adding charges I never agreed to.”
“They used different company names.”
“I cannot identify who the lender really is.”
“They accessed my phone even after I uninstalled the app.”
“They sent fake legal notices.”
“They keep contacting my employer.”

These are not minor customer-service issues. Many point directly to regulatory, privacy, and possibly criminal concerns.

XXXII. Borrowers must also distinguish real debt from fake debt

Not every demand is genuine. Some scams involve persons receiving loan demands even though they never borrowed, or receiving inflated balances disconnected from actual transactions.

Therefore, part of a legitimacy check is verifying:

whether a real contract was entered into,
whether disbursement actually occurred,
whether the amount demanded matches the real account,
whether the collector can identify the loan date and transaction reference,
and whether the borrower actually dealt with that app or company.

Identity misuse and fabricated digital debt claims are real risks.

XXXIII. Is a cooperative or other entity automatically allowed to run a lending app?

Not automatically. Legal status under one framework does not necessarily authorize all kinds of app-based public lending activity. The actual business model matters.

An entity may be validly organized for one purpose but still operate beyond or outside proper authority if it runs a mass-market digital lending platform without fitting the applicable legal requirements. Borrowers should therefore focus on actual legal capacity and regulatory fit, not broad labels.

XXXIV. Signs of a better-quality, lower-risk lending app

While no app should be trusted blindly, the following features are generally more consistent with lawful operation:

clear identification of the lender’s full legal name;
accessible terms and privacy policy;
transparent statement of total borrowing cost;
no coercive device permissions;
reasonable and professional collection communication;
consistent records of disbursement and repayment;
formal support channels;
contract copies accessible within the app or by email;
no public shaming tactics;
and no fake legal threats.

These factors do not guarantee perfection, but they indicate a more serious compliance posture.

XXXV. Practical checklist for a legitimacy review

A Philippine borrower checking an online lending app should ask:

Who is the exact legal entity behind the app?
Is the company merely incorporated, or actually authorized to lend?
What kind of institution is it: lending company, financing company, bank, cooperative, or something else?
Can the borrower read the full loan terms before accepting?
What is the total cost of the loan, not just the headline amount?
What amount will actually be disbursed?
What fees are deducted upfront?
What penalties apply for delay?
Does the app demand unnecessary permissions?
Does the privacy policy clearly explain data use and sharing?
Does the app or its collectors contact third parties?
Does it threaten arrest, exposure, or humiliation?
Can the lender provide a statement of account?
Are customer service and complaint channels real and functional?
Are the app’s conduct and records consistent with the contract?

If the app fails several of these checks, it is legally and practically risky.

XXXVI. For borrowers already trapped in an abusive app

When an app appears abusive or illegitimate, the borrower should think in terms of evidence and legal classification.

Important steps include preserving:

screenshots of the app and permissions,
the lender name as displayed,
contract screens,
transaction references,
payment receipts,
collection messages,
third-party disclosures,
threatening calls or texts,
and images or social media posts used to shame the borrower.

This matters because disputes involving online lending often turn on proof of:

what was agreed,
what data was accessed,
who contacted whom,
what threats were made,
and how much money was actually disbursed and repaid.

XXXVII. The debt may be real, but abusive methods can still be unlawful

A borrower should avoid one common mistake: assuming that because the lender behaved unlawfully, the debt automatically disappears in all respects. That is not always correct.

Another mistake is the opposite: assuming that because the debt exists, the lender may do anything to collect. That is also false.

The proper legal view is more precise:

the underlying loan obligation and
the lawfulness of collection and data practices

must be analyzed separately. A lender can be right about the existence of debt and wrong about nearly everything else in how it enforces it.

XXXVIII. Special caution about reborrowing and refinancing traps

Some apps encourage repeated rollovers, renewals, extensions, or “repay to reloan” cycles. This may trap borrowers into:

serial fees,
mounting effective costs,
repeated data exposure,
and increasing vulnerability to pressure tactics.

A legitimacy check should therefore look not only at the first loan, but at the app’s business model. If the design appears built around desperation-based repeat borrowing, that is a structural red flag.

XXXIX. The strongest single signs of illegitimacy

If one must identify the most dangerous indicators in Philippine context, they are these:

the lender’s true identity cannot be verified;
the app hides or obscures the legal contracting party;
the app uses excessive phone permissions;
borrower contacts are used for collection;
threats of jail, warrants, or public disgrace are made;
fake legal notices are sent;
the amount received is far less than the advertised loan without clear disclosure;
and the app’s pricing and collections are opaque, coercive, or degrading.

An app that engages in any of these should be treated with extreme caution.

XL. Final legal synthesis

In the Philippines, a legitimate online lending app is not defined by convenience, popularity, or app-store visibility. It is defined by lawful identity, proper authority, transparent terms, respectful collections, and compliant data practices.

A meaningful legitimacy check should therefore ask four main questions:

First, is there a real, identifiable legal entity behind the app with proper authority to engage in lending or financing activity? Second, does the app disclose the loan terms clearly, including the real amount to be received and the total cost of borrowing? Third, does it respect borrower rights in collection, avoiding harassment, fake legal threats, and third-party shaming? Fourth, does it comply with data privacy norms by limiting data access and refusing to weaponize personal information?

The most common mistake borrowers make is checking only whether the app “looks formal.” The better approach is to test whether the app behaves like a lawful creditor under Philippine law. A real lender may demand payment. But a legitimate lender should not need deception, humiliation, privacy invasion, or terror to collect.