If an online lending app is asking for “processing fees,” threatening to message your contacts, or using a company name you cannot verify, pause before sending money or uploading more personal data. In the Philippines, a legitimate online lender should be tied to a real corporation, should have the proper authority from the Securities and Exchange Commission (SEC) when it is a lending or financing company, should clearly disclose the cost of credit, and should follow strict rules on data privacy and debt collection. This guide explains how to check if an online lender is legitimate, what warning signs usually point to an online lending scam, and where to report abusive or illegal conduct.
What makes an online lender legitimate in the Philippines?
An online lending platform, or OLP, usually means a mobile app, website, or other fintech system where lending or financing products are offered to borrowers. The 2026 joint public advisory of the DICT, National Privacy Commission (NPC), and SEC describes OLPs as mobile lending applications, websites, and other fintech-enabled programs or systems where financing or lending companies make their services available.
For non-bank lenders, legitimacy is not proven by a nice-looking app, a Facebook page, a Google Play listing, or screenshots of “SEC registration.” A legitimate lender should pass three checks:
- The company exists and is properly registered.
- The company has authority to engage in lending or financing, if required.
- The specific app, website, or online lending platform is properly recorded, disclosed, and connected to that company.
Under the Lending Company Regulation Act of 2007, Republic Act No. 9474, a lending company is a corporation engaged in granting loans from its own capital funds or from funds sourced from not more than 19 persons; the law’s implementing rules define a Certificate of Authority as the SEC certificate allowing the company to engage in the lending business. (Lawphil) Financing companies are separately governed by the Financing Company Act of 1998, Republic Act No. 8556, which regulates financing and leasing companies and their authority to operate. (Lawphil)
A common scam tactic is to show only an SEC Certificate of Incorporation. That proves, at most, that a corporation was registered. It does not automatically prove that the company can legally operate as a lending or financing company.
The main laws and rules that protect borrowers
Several Philippine laws work together in online lending cases:
| Law or rule | What it means for borrowers |
|---|---|
| RA 9474, Lending Company Regulation Act of 2007 | Lending companies must be organized and authorized under SEC rules before doing lending business. The IRR requires lending companies to be stock corporations and obtain the required authority. (Lawphil) |
| RA 8556, Financing Company Act of 1998 | Financing companies are regulated entities and may need SEC authority, especially when offering credit, leasing, or financing products. (Lawphil) |
| RA 3765, Truth in Lending Act | Creditors must disclose the true cost of credit, including finance charges such as interest, fees, service charges, discounts, and similar credit charges. (Lawphil) |
| RA 10173, Data Privacy Act of 2012 | Lenders must process personal data lawfully, fairly, and only for legitimate purposes; the NPC can receive complaints, investigate, issue orders, and impose privacy-related remedies. (National Privacy Commission) |
| RA 11765, Financial Products and Services Consumer Protection Act | Financial consumers have rights to fair treatment, disclosure, data privacy, protection against fraud, and timely complaint handling. The SEC can act against supervised financial service providers, including through fines, suspension, cease-and-desist orders, and consumer redress mechanisms. (Supreme Court E-Library) |
| SEC Memorandum Circular No. 18, Series of 2019 | Prohibits unfair debt collection practices by financing and lending companies, including through third-party collectors. The SEC’s official issuances page identifies MC No. 18 as the circular on unfair debt collection practices. (SEC Appointment System) |
| SEC Memorandum Circular No. 19, Series of 2019 | Requires disclosures in advertisements and reporting of online lending platforms. The SEC’s official issuances page identifies MC No. 19 as the circular on disclosure requirements and reporting of OLPs. (SEC Appointment System) |
| 1987 Constitution, Article III, Section 20 | A person cannot be imprisoned merely for debt or non-payment of a poll tax. This does not protect fraud, identity theft, threats, or other crimes; it simply means a normal unpaid loan is generally a civil matter. (Supreme Court E-Library) |
| Revised Penal Code and RA 10175, Cybercrime Prevention Act | Fraud, threats, identity theft, cyber libel, illegal access, computer-related fraud, and other online acts may become criminal depending on the facts. RA 10175 defines and penalizes cybercrime offenses. (Lawphil) |
How to check if an online lender is legitimate
1. Get the exact company name, not just the app name
Before borrowing, look for these details inside the app, website, privacy policy, loan agreement, disclosure statement, and advertisements:
- Full corporate name
- SEC Registration Number
- Certificate of Authority number
- Business address
- Official website and email address
- Name of the specific app or platform
- Privacy notice
- Loan disclosure statement showing interest, service fees, penalties, total amount payable, and due date
Do not rely on the app name alone. Scammers often use names that sound similar to legitimate companies. A platform called “Fast Peso,” for example, may claim to be connected to a registered company even if the actual SEC-recorded platform has a different name.
2. Check the SEC lists
The SEC has official pages for lending and financing companies, including the list of lending companies with Certificate of Authority and the list of recorded online lending platforms. In a 2025 FOI response, the SEC directed the public to its official pages for the List of Lending/Financing Companies, List of Online Lending Platforms, procedures and compliance requirements, and filing of complaints. (www.foi.gov.ph)
When checking the SEC lists, match all of the following:
| What to compare | Why it matters |
|---|---|
| App name or website | A legitimate company may have only specific recorded platforms. A different app using the company’s name may be fake. |
| Corporate name | The app should be clearly connected to the registered lending or financing company. |
| SEC Registration Number | This helps confirm the corporation exists. |
| Certificate of Authority number | This is crucial for lending or financing authority. |
| Status of the company | Watch for revoked, suspended, cancelled, or unrecorded entities. |
If the company appears on an SEC corporate registration search but not on the proper lending/financing or OLP list, treat that as a serious warning sign.
3. Check the disclosures required in the app and advertisements
Under the SEC rules on online lending disclosures, lending and financing companies should clearly show their corporate identity, SEC registration details, Certificate of Authority details, and loan terms. News reports quoting SEC enforcement reminders also note that lending and financing firms must display corporate names, SEC registration numbers, Certificate of Authority numbers, and disclose interest rates and charges before loan consummation, consistent with the Truth in Lending Act. (Philippine News Agency)
A legitimate lender should not hide the real cost of borrowing. Watch for vague phrases such as:
- “Low interest” without showing the actual amount
- “Service fee” deducted only after approval
- “Penalty will depend on account status”
- “Processing fee required before release”
- “Pay first to unlock your loan”
- “No disclosure statement needed”
The Truth in Lending Act requires disclosure of credit costs so borrowers understand the true cost of credit before entering the transaction. (Lawphil)
4. Check app permissions and privacy notices
Online lending scams often ask for broad access to contacts, photos, storage, camera, microphone, SMS, location, and social media accounts. Some permissions may be legitimate for identity verification or know-your-customer checks, but they must be necessary, proportionate, and explained.
The 2026 DICT-NPC-SEC advisory states that unnecessary processing of personal data through mobile apps, including unnecessary permissions, is prohibited. It also says unauthorized, excessive, or disproportionate processing of personal data—especially access to borrowers’ contact lists—is prohibited when it leads to harassment, debt collection outside named guarantors, or unfair collection practices.
The same advisory reminds borrowers that OLPs may only access contact lists to allow selection of character references, guarantors, or proportional metadata for specified legitimate purposes; unbridled processing of contact lists is prohibited.
5. Verify through SEC iMessage if still unsure
The SEC uses iMessage, its official web-based ticketing platform, for public inquiries, complaints, incidents, and requests. The SEC user guide explains that iMessage generates a unique electronic ticket for every submission and lets users track ticket status in real time. (Securities and Exchange Commission)
For a lender status inquiry, prepare:
- App name and screenshot
- Company name claimed by the app
- SEC Registration Number and CA number shown
- Website or app store link
- Screenshots of advertisements
- Loan agreement or disclosure statement, if already provided
- Your specific question: “Is this lender authorized?” or “Is this online lending platform recorded under this company?”
Red flags of online lending scams in the Philippines
The lender asks for money before releasing the loan
Advance-fee scams are common. The app may ask for “verification fee,” “wallet activation,” “processing fee,” “tax,” “insurance,” or “anti-money laundering clearance” before releasing funds. After payment, the scammer asks for another fee or disappears.
Legitimate lenders usually deduct disclosed fees from proceeds or collect according to a transparent loan agreement. Requiring repeated payments before release is a major red flag.
The app claims you can be arrested for not paying
A collector may say, “May warrant ka na,” “NBI na ang pupunta,” or “Ipapahuli ka namin.” For ordinary unpaid debt, that threat is misleading. The Constitution prohibits imprisonment merely for debt. (Supreme Court E-Library)
A lender may file a civil collection case if a debt is valid. For smaller money claims, Philippine first-level courts have small claims procedures for claims not exceeding ₱1,000,000, exclusive of interest and costs, under the Rules on Expedited Procedures. (Supreme Court of the Philippines) That is very different from a collector pretending that a borrower can be arrested without a proper criminal case.
The app threatens to message your contacts
This is one of the clearest signs of abuse. The 2026 advisory expressly states that contacting persons in the borrower’s contact list other than named guarantors is prohibited for debt collection; for debt collection, lending and financing companies and persons acting for them may contact only the guarantor.
A character reference is not the same as a guarantor. The advisory states that character references are provided only for identification or verification, while guarantors must have expressly consented to assume responsibility for the loan in case of default.
The app uses fake legal documents
Scammers send fake subpoenas, fake warrants, fake barangay summons, fake court notices, or letters with copied government logos. Real court processes usually identify the court, branch, case number, parties, and proper mode of service. Real law enforcement officers do not collect private loan payments through personal e-wallets.
The interest and penalties are extreme or hidden
High interest alone does not automatically mean a loan is a scam, but hidden charges and oppressive penalty structures may violate disclosure, consumer protection, or civil law principles.
Philippine courts can reduce or invalidate unconscionable interest and penalty stipulations. In a 2023 Supreme Court case involving a loan, the Court emphasized that if a compounded interest rate is absent or unconscionable, legal interest may apply instead. (Lawphil) In another case involving Manila Credit Corporation, the Supreme Court held that interest and penalties may be void when patently exorbitant and unconscionable, applying Civil Code principles that contract terms cannot be contrary to law, morals, good customs, public order, or public policy. (Supreme Court E-Library)
What a legitimate lender may do—and what it cannot do
| Situation | Generally allowed | Not allowed |
|---|---|---|
| Loan application | Ask for identity, income, and verification documents reasonably needed for KYC and credit assessment | Demand excessive app permissions unrelated to the loan |
| Loan pricing | Charge disclosed interest, service fees, and penalties that are lawful and not unconscionable | Hide fees, change terms after approval without proper notice, or impose oppressive penalties |
| Collection | Send reminders, demand letters, account statements, and lawful notices | Threats, public shaming, profanity, fake criminal cases, or contacting unrelated contacts |
| Legal action | File a civil case or small claims case for a valid unpaid debt | Claim that a borrower can be jailed merely for unpaid debt |
| Data use | Process personal data for legitimate loan-related purposes | Harvest contacts or photos to pressure, shame, or intimidate the borrower |
RA 11765 also requires financial service providers to use clear language, disclose pricing and costs, handle consumer complaints, respect data privacy, and avoid abusive collection or debt recovery practices. (Supreme Court E-Library)
What to do if you already borrowed from a suspicious online lender
1. Stop giving additional access and preserve evidence
Do not delete the app immediately if it contains loan details you still need to screenshot. First, save:
- Loan agreement
- Disclosure statement
- Repayment schedule
- Amount released
- Amount deducted as fees
- Payment instructions
- Screenshots of threats or harassment
- Caller IDs, phone numbers, emails, chat handles, and e-wallet accounts
- App store page and developer name
- Privacy policy and permissions screen
- Proof of payment
Then consider revoking unnecessary permissions in your phone settings. The 2026 advisory states that when the purpose for an app permission has been achieved, OLPs should prompt the data subject to turn off, disallow, or revoke the permission.
2. Ask for a written statement of account
A proper statement of account should show:
- Principal loan amount
- Net proceeds actually released
- Interest
- Service fees
- Penalties
- Previous payments
- Current balance
- Due date
- Official payment channels
If the lender refuses to identify itself or cannot give a clear computation, that helps support a complaint.
3. Do not admit to inflated or unclear amounts
If you owe money, you may acknowledge the amount you actually received and payments you actually made. Avoid messages like “I admit I owe ₱50,000” when the amount includes unexplained penalties, hidden charges, or fees you dispute.
A safer wording is: “I request a complete statement of account showing the principal, fees, interest, penalties, payments received, and legal basis for each charge.”
4. Report the correct issue to the correct agency
| Problem | Where to report | Practical notes |
|---|---|---|
| Unregistered or unrecorded online lender; unfair debt collection by lending/financing company | SEC Financing and Lending Companies Department through SEC iMessage | The 2026 advisory lists SEC iMessage and the 1-4SEC hotline for unfair debt collection practices. |
| Contact harvesting, public shaming, misuse of personal data, threats to message contacts | National Privacy Commission | NPC formal complaints generally require the complaint form or verified complaint, evidence, and notarization; NPC allows submission in person, by courier, or scanned by email. (National Privacy Commission) |
| Cyber threats, fake warrants, identity theft, hacking, phishing, scam payment accounts | PNP Anti-Cybercrime Group, NBI Cybercrime Division, DICT/CICC 1326 hotline | The 2026 advisory lists DICT Cyber Hotline 1326, NBI Cybercrime Division, and PNP Anti-Cybercrime Group for harassment, threats, frauds, and scams. |
| Bank, e-wallet, or payment channel used in the scam | Bank, e-wallet provider, or relevant regulator | Report quickly because reversal or freezing is time-sensitive. |
| Lender files a court case | Court where the case is filed | Read all court papers carefully and respond within the stated period. Small claims cases move quickly. |
5. For OFWs and foreigners dealing with Philippine lenders
If you are abroad, keep Philippine-related evidence in a clean file: screenshots with timestamps, SIM records, payment receipts, emails, app store links, and identity documents you submitted. The Data Privacy Act can apply to acts done outside the Philippines when the processing relates to personal information of a Philippine citizen or resident, or when the entity has links to the Philippines such as carrying on business in the Philippines or collecting information in the Philippines. (National Privacy Commission)
If a Philippine agency or court later requires a sworn statement executed abroad, ask the receiving office what form it accepts. Depending on the country and document, a notarized document abroad may require an apostille or consular notarization before it is accepted in Philippine proceedings. The Philippines has been treated as a party to the Apostille Convention in consular practice, and Philippine consulates have issued notices explaining changes to authentication of foreign public documents. (Philippine Consulate LA)
Required documents for complaints
| Document or evidence | Why it helps |
|---|---|
| Valid ID | Establishes identity of complainant |
| Screenshots of app profile, app permissions, and privacy policy | Shows the platform and data access requested |
| Loan agreement and disclosure statement | Shows whether terms were disclosed |
| Proof of disbursement and payments | Establishes actual amount received and paid |
| Messages, calls, voicemails, emails, and social media posts | Proves harassment, threats, or public shaming |
| Names and numbers contacted by the collector | Supports contact-list misuse complaint |
| Written request for statement of account | Shows you tried to clarify the debt |
| Notarized complaint-affidavit, when required | Often needed for formal administrative or criminal complaints |
| Police blotter or incident report, if there were in-person threats | Helps document urgent safety issues |
For SEC documentary verification, SEC Express allows online requests for plain or authenticated SEC documents, with delivery generally within 3 to 5 working days in Metro Manila and up to 7 working days for provincial deliveries from release by the SEC for delivery. (SEC Express)
Common mistakes borrowers make
Mistake 1: Assuming “SEC registered” means “authorized lender”
A corporation can be SEC-registered for general corporate existence but still lack the proper authority to operate as a lending or financing company. Always check the Certificate of Authority and the specific OLP recording.
Mistake 2: Paying “clearance fees” out of fear
Scammers use urgency: “Pay in 10 minutes or your contacts will be messaged.” Paying may not stop the harassment. It may only prove that the victim is willing to pay under pressure.
Mistake 3: Deleting everything too soon
Deleting the app, chats, SMS, and call logs can make complaints harder to prove. Preserve evidence first.
Mistake 4: Ignoring a real court paper
Fake legal threats are common, but real court documents should not be ignored. A legitimate civil case or small claims case will have court details, docket information, and deadlines. If served with real papers, read them immediately and prepare a response.
Mistake 5: Treating character references as guarantors
A person listed as a character reference does not automatically become liable for the loan. The 2026 advisory states that guarantors must expressly consent to assume responsibility for the loan in case of default.
Frequently Asked Questions
How do I know if an online lending app is SEC registered?
Check both the company and the app. Look for the corporate name, SEC Registration Number, Certificate of Authority number, and the specific online lending platform name. Then compare them with the SEC’s official list of lending/financing companies and recorded online lending platforms. The SEC has directed the public to these official list pages and its complaints page for lending and financing concerns. (www.foi.gov.ph)
Is an SEC Certificate of Incorporation enough proof that a lender is legit?
No. A Certificate of Incorporation only shows corporate registration. A lending or financing business generally needs the proper authority to operate, and the online platform itself should be properly recorded or disclosed.
Can an online lending app contact my phone contacts?
Not for general debt collection. The 2026 DICT-NPC-SEC advisory says contacting persons in the borrower’s contact list other than named guarantors is prohibited for debt collection. Character references are not automatically guarantors.
Can I be jailed for not paying an online loan?
Not merely for unpaid debt. Article III, Section 20 of the 1987 Constitution says no person shall be imprisoned for debt or non-payment of a poll tax. Fraud, identity theft, threats, falsified documents, or other crimes are different matters and depend on evidence. (Supreme Court E-Library)
What if the app already messaged my relatives or employer?
Save screenshots from your relatives or employer, including the sender’s number, message content, date, and time. This may support complaints for unfair debt collection and data privacy violations. The NPC complaint process generally requires a formal complaint or complaint form, evidence, and notarization. (National Privacy Commission)
Are high interest rates illegal in the Philippines?
Not every high rate is automatically illegal, but hidden, excessive, or unconscionable charges may be challenged. The Supreme Court has repeatedly recognized that courts may reduce or invalidate unconscionable interest and penalty stipulations, especially when they become oppressive or contrary to morals or public policy. (Supreme Court E-Library)
What if the lender is based abroad?
Check whether it is targeting Philippine borrowers, using Philippine payment channels, collecting data from Philippine residents, or claiming Philippine registration. The Data Privacy Act may apply to entities outside the Philippines when the processing relates to Philippine citizens or residents or the entity has sufficient links to the Philippines. (National Privacy Commission)
Should I report to SEC, NPC, PNP, or NBI?
Report based on the problem. SEC is usually for unregistered lending, OLP recording, and unfair collection by lending or financing companies. NPC is for misuse of personal data. PNP Anti-Cybercrime Group, NBI Cybercrime Division, and DICT/CICC 1326 are for cyber threats, fraud, identity theft, and scams. The 2026 advisory lists these channels for abusive online lending conduct.
What if I actually owe the loan?
Owing money does not remove your rights. A lender may lawfully collect a valid debt, but it must disclose charges, avoid abusive collection, protect your data, and use lawful remedies. Ask for a written computation, pay only through official channels, and keep receipts.
Key Takeaways
- A legitimate online lender in the Philippines should have a real corporate identity, the proper SEC authority when required, and a recorded or properly disclosed online lending platform.
- “SEC registered” is not enough; check the Certificate of Authority and whether the specific app or website is connected to the authorized company.
- A lender must disclose the true cost of credit, including interest, fees, charges, and penalties.
- Online lending apps cannot freely harvest your contacts or use them to shame or pressure you.
- You cannot be jailed merely for unpaid debt, but fraud, threats, identity theft, and cybercrime are separate issues.
- Preserve evidence before deleting the app or messages.
- Report unfair collection and suspicious OLPs to the SEC, data misuse to the NPC, and cyber threats or scams to DICT/CICC 1326, PNP Anti-Cybercrime Group, or NBI Cybercrime Division.