An online lending app can look professional, have thousands of downloads, and still be unauthorized or unsafe. In the Philippines, the best test is not the app’s rating, advertisements, or claim that it is “SEC registered.” You must identify the exact company behind the app, confirm that the company has authority from the Securities and Exchange Commission (SEC) to operate as a lending or financing company, and verify that the specific app or online platform is recorded with the SEC.

This guide explains how to perform those checks, review the app’s interest and fees, spot dangerous permissions and collection practices, preserve evidence, and report an illegal or abusive online lender.

What Makes an Online Lending App Legitimate in the Philippines?

A legitimate online lending app should pass three separate checks:

Check	What you must confirm	Why it matters
Corporate identity	The app clearly identifies the corporation operating it	You need to know who is legally responsible for the loan
Authority to lend	The corporation has a valid SEC Certificate of Authority as a lending or financing company	Ordinary SEC incorporation does not automatically authorize lending
Recorded online platform	The specific app or platform is included in the SEC’s list of recorded online lending platforms	A licensed company cannot simply operate undisclosed apps under unrelated names

Do not stop after finding a company with a similar name. Match the exact corporate name, SEC registration number, Certificate of Authority number, app name, developer, website, email domain, and contact details whenever those details are available.

An app appearing on an official SEC list means it has passed an important regulatory check. It does not mean the SEC guarantees the loan, recommends the product, or confirms that every collection agent is behaving lawfully.

Philippine Laws That Apply to Online Lending Apps

Lending companies need SEC authority

Under the Lending Company Regulation Act of 2007, Republic Act No. 9474, a lending company may not conduct lending business without authority from the SEC. A Certificate of Incorporation only proves that the corporation was formed. It is the Certificate of Authority, sometimes described as a secondary license, that authorizes the corporation to operate as a lending company. (Lawphil)

Financing companies are separately regulated under the Financing Company Act of 1998, Republic Act No. 8556. They likewise need SEC authority before holding themselves out as financing companies. (Lawphil)

The Supreme Court has emphasized that only corporations with validly subsisting SEC authority may engage in lending under RA 9474. This is why a screenshot of an SEC incorporation certificate is not enough. (Lawphil)

Borrowers have financial consumer rights

The Financial Products and Services Consumer Protection Act, Republic Act No. 11765, protects financial consumers dealing with providers supervised by regulators such as the SEC. These protections include fair treatment, clear disclosure, protection of consumer information and assets, and access to complaint-handling mechanisms.

The law also gives regulators authority to act against unreasonable interest, charges, abusive conduct, fraud, and other practices that harm financial consumers.

Loan costs must be disclosed

Under the Truth in Lending Act, Republic Act No. 3765, a creditor must provide required written disclosures before the credit transaction is completed. The borrower should be able to see, among other things:

The amount financed or actual loan proceeds
Each processing, service, verification, handling, or similar fee
The finance charge in pesos
The applicable interest or effective interest rate
The total amount payable
The number, amount, and due dates of payments

Article 1956 of the Civil Code also provides that interest is not due unless it has been expressly stipulated in writing. A properly presented and retainable electronic loan agreement may satisfy writing requirements under the Electronic Commerce Act, Republic Act No. 8792.

A legitimate app should therefore let you read the loan agreement and disclosure statement before you press the final acceptance or disbursement button.

Personal data cannot be collected without limits

Online lenders are covered by the Data Privacy Act of 2012, Republic Act No. 10173, as well as rules issued by the National Privacy Commission.

The joint DICT-NPC-SEC Public Advisory on Online Lending Platforms dated March 18, 2026 states that online lending platforms must not demand unnecessary or excessive device permissions. Access to photographs, cameras, contacts, and other information must be tied to a legitimate, declared, and proportionate purpose. (National Privacy Commission)

How to Check If an Online Lending App Is Legitimate

1. Find the exact legal name of the lender

Before searching the SEC database, open the following parts of the app or website:

“About Us” page
Privacy notice
Terms and conditions
Loan agreement
Disclosure statement
App-store developer information
Customer-service page
Data protection officer contact information

Write down the complete corporate name. Do not rely solely on the brand name.

For example, an app may be called “Mabilis Cash,” while its legal operator is “ABC Lending Corporation.” You need to search for ABC Lending Corporation, not merely “Mabilis Cash.”

Treat the app as high-risk when it provides only:

A first name or agent’s nickname
A mobile number
A Facebook or Telegram account
A personal Gmail or Yahoo address
A vague business name without “Corporation” or “Inc.”
An SEC number that cannot be matched to the legal operator

2. Check the company through the SEC

Use the official Check with SEC portal. Search the exact legal name and review the result carefully.

Confirm that:

The corporation exists.
Its registration status is active or otherwise valid.
Its registered name matches the name in the app.
It is identified as a lending or financing company.
It has a Certificate of Authority, not merely a Certificate of Incorporation.

You may also consult the SEC’s official pages for the:

Check the date of the list. Do not rely on a PDF saved several years ago because a company’s authority may later be suspended or revoked.

3. Verify the specific online lending platform

Next, check the SEC’s List of Recorded Online Lending Platforms.

The app or website should be listed under the same corporation whose Certificate of Authority you verified.

This catches a common problem: an unauthorized app may copy the name, SEC number, logo, or address of a legitimate company. Other operators use a licensed corporation’s name while directing borrowers to a different app, website, APK file, or payment account.

A proper match should look like this:

App name → Corporate operator → SEC registration → Certificate of Authority

If any part of the chain does not match, do not provide identification documents, facial scans, bank details, contacts, or payment.

4. Compare the app-store publisher with the SEC information

Being available on Google Play or Apple’s App Store is not proof of SEC authority. App stores perform platform-level reviews, but they do not replace Philippine financial regulation.

Compare:

Developer or publisher name
Official website
Privacy-policy domain
Customer-service email
Business address
Telephone numbers
Name printed on the loan agreement
Name that appears on the disbursement or payment account

Be especially careful when the SEC-listed company uses one domain but the app directs you to an unrelated website or personal social-media account.

Also avoid installing an APK file sent through Messenger, text message, Telegram, WhatsApp, or a pop-up advertisement unless you have independently verified the file and the company. An APK installed outside the official app store may contain spyware or may impersonate a recorded platform.

5. Read the disclosure before accepting the loan

Do not accept a loan based only on the amount displayed on the first screen.

Before proceeding, identify:

Approved principal
Actual amount that will enter your account
Upfront deductions
Nominal interest
Effective interest rate
Total repayment
Due date
Late-payment charges
Extension or rollover fees
Collection expenses
Automatic-debit authority

Suppose an app describes the loan as ₱5,000 but releases only ₱4,100 after deducting fees, then requires ₱5,600 after a short period. Your actual borrowing cost is not limited to the amount labelled “interest.” Fees deducted before release are part of the economic cost of the loan and should be clearly disclosed.

Save a PDF or take screenshots of the complete disclosure and agreement before accepting. Some borrowers later discover that the terms shown after disbursement differ from the promotional screen they relied on.

6. Check whether the interest and fees follow current SEC ceilings

Under SEC Memorandum Circular No. 14, Series of 2025, revised ceilings apply beginning April 1, 2026 to covered loans entered into, renewed, or restructured from that date.

The ceilings generally cover unsecured, general-purpose loans issued by lending or financing companies, including their online platforms, when:

The principal does not exceed ₱10,000
The repayment term does not exceed four months

Charge	Maximum for a covered loan
Nominal interest	6% per month, approximately 0.2% per day
Effective interest rate, including covered fees	12% per month, approximately 0.4% per day
Late-payment penalty	5% per month on the outstanding scheduled amount due
Total interest, fees, charges, and penalties	Not more than 100% of the principal

The effective interest calculation generally includes interest and charges such as processing, service, handling, verification, and similar fees, while late-payment penalties are treated separately. The total-cost ceiling prevents all covered interest, fees, charges, and penalties from growing beyond the amount of the principal. (Facebook)

These ceilings do not automatically apply to every credit product. A loan above ₱10,000, a term longer than four months, a secured loan, or a product issued by another type of regulated institution may follow different rules.

A lender must not evade the ceilings by splitting one loan into several smaller loans, disguising interest as another fee, artificially changing the term, or using sham collateral or guaranty arrangements.

7. Examine the permissions requested by the app

A legitimate lender may need information for identity verification, fraud prevention, credit assessment, and payment processing. That does not justify unrestricted access to your entire phone.

Be cautious when the app demands access to:

Your complete contact list
Call logs
Text messages
Files unrelated to the application
The entire photo gallery
Microphone or location at all times
Social-media accounts
Passwords, one-time passwords, ATM PINs, or mobile-wallet PINs

Camera or photo access may be justified for identification or payment verification, but access should be limited to that purpose. Unrestrained collection of contacts, messages, or photos is inconsistent with the principles of transparency, legitimate purpose, and proportionality under Philippine privacy law. (National Privacy Commission)

The privacy notice should clearly state:

The legal name of the company
What information is collected
Why each category is needed
Who receives the information
How long the information is retained
How you can exercise privacy rights
How to contact the data protection officer
Whether information is processed or stored outside the Philippines

8. Distinguish a character reference from a guarantor

An app may ask for a character reference to help confirm your identity or the truthfulness of your application. A character reference does not automatically become responsible for the debt.

A guarantor is different. A guarantor undertakes to answer for the borrower’s obligation under the requirements of the Civil Code and must separately and expressly consent to that role.

The March 2026 joint advisory requires online lending platforms to distinguish between character references and guarantors. A lender may not convert a person into a guarantor merely because the borrower entered that person’s name and mobile number. Platforms must also avoid contacting people from the borrower’s contact list for collection when those people are not guarantors. (National Privacy Commission)

9. Verify the payment channel

Before paying, confirm that the account belongs to the lender or an authorized payment partner.

Warning signs include instructions to:

Send money to an employee’s personal GCash or Maya account
Pay an “activation,” “insurance,” or “release” fee before receiving the loan
Transfer money to unlock a larger approved amount
Pay through cryptocurrency or gift cards
Use a changing series of personal accounts
Send payment without receiving an official receipt
Communicate only through a personal messaging account

Advance-fee schemes often promise that a loan has already been approved but require a payment before release. Do not send money merely to “verify” your account, fix a supposed credit score, pay taxes, or increase your loan limit.

Red Flags That an Online Lending App May Be Illegal or Unsafe

Treat the following as serious warning signs:

The company is absent from SEC records.
The company is incorporated but has no lending or financing Certificate of Authority.
The app is not on the SEC’s recorded online-platform list.
The app uses another company’s SEC certificate.
The developer name does not match the declared operator.
The lender refuses to provide its legal name or Certificate of Authority number.
The app releases money before you knowingly accept final terms.
Fees and repayment amounts appear only after disbursement.
The app deducts unusually large charges from the stated principal.
You must pay money before the loan will be released.
The app demands your OTP, ATM PIN, or mobile-wallet PIN.
It requires unrestricted contacts, messages, call logs, or gallery access.
It threatens arrest merely because you cannot pay a private debt.
Collectors threaten violence, fabricate court papers, or impersonate police, lawyers, judges, or government officers.
Collectors post your photograph or loan information publicly.
The lender contacts unrelated relatives, coworkers, employers, or social-media friends to shame you.
Payments are directed to changing personal accounts.
The app has no usable complaint channel, business address, or privacy contact.

A polished interface does not cancel these warning signs.

What Legitimate Collectors May and May Not Do

A lender may contact a borrower, send payment reminders, request payment of a valid obligation, offer restructuring, and use lawful court processes.

However, SEC rules prohibit unfair debt-collection practices. Depending on the facts, unlawful conduct may include:

Threats of violence or criminal acts
Obscene, insulting, or degrading language
False claims that arrest is imminent
Threatening legal action that the collector cannot or does not intend to take
Impersonating a lawyer, police officer, court employee, or government official
Publicly posting the borrower’s debt, photograph, or personal information
Disclosing the debt to unrelated third parties to embarrass the borrower
Using phone contacts for mass messaging or harassment
Repeated communications designed primarily to intimidate or humiliate

Nonpayment of an ordinary loan is generally a civil matter. A borrower is not imprisoned simply for being unable to pay a debt. Fraud committed when obtaining a loan is a separate issue and depends on evidence of deceit, not mere later inability to pay.

An unlawful collection method does not automatically erase money that was actually borrowed. The borrower may still need to account for the valid principal and lawful charges while separately disputing illegal fees, privacy violations, threats, or harassment.

What to Do If You Already Borrowed From a Suspicious App

1. Preserve evidence before deleting anything

Save:

App name and icon
App-store page and developer information
Download link or APK filename
Website address
Privacy notice and terms
Permission screens
Loan offer
Disclosure statement
Electronic agreement
Amount requested, approved, and actually received
Bank or electronic-wallet transaction record
Payment instructions
Receipts
Text messages, emails, call logs, and chat conversations
Collector names, numbers, and account details
Threats, social-media posts, and messages sent to third parties
SEC and NPC complaint reference numbers

Screen-recording the relevant app pages can be useful when the app prevents ordinary screenshots.

Do not edit the original files. Keep backup copies in another device or secure cloud account. Record dates and times because digital evidence becomes more useful when its sequence can be shown clearly.

2. Revoke unnecessary permissions

Use your phone settings to remove access to contacts, photographs, location, microphone, messages, and files that the app no longer needs.

Changing permissions will not retrieve data that was already copied, but it can limit further access. Change passwords if you reused credentials, enable multifactor authentication, and contact your bank or electronic-wallet provider if financial credentials may have been exposed.

Never give a collector your OTP or PIN, even when the person already knows details about your loan.

3. Ask for a written statement of account

Request an itemized statement showing:

Original principal
Actual proceeds released
Interest
Each fee
Payments credited
Penalties
Remaining balance
Legal name of the creditor
Official payment account

Communicate in writing whenever possible. Avoid agreeing to a rollover, extension, or replacement loan until you receive the full cost in writing.

4. Pay only through a verified channel

Do not send money to a personal account simply because a collector threatens immediate consequences. Verify the payment instructions through the lender’s official website, published hotline, or SEC-recorded contact details.

Keep proof of every payment and ask for a receipt or updated statement. A screenshot of a transfer alone may not show which obligation the payment was meant to settle.

5. Report urgent threats separately

A financial-regulatory complaint and a criminal or cybercrime report address different problems. File them in parallel when necessary.

For example:

Report licensing, disclosure, interest, or collection-rule issues to the SEC.
Report misuse of personal information to the NPC.
Report phishing, identity theft, extortion, impersonation, hacking, or serious online threats to cybercrime authorities.
Report an immediate threat to personal safety to the police.

Where to Report an Illegal or Abusive Lending App

Problem	Government office	How to report
No authority to lend, unrecorded app, unfair fees, or abusive collection	Securities and Exchange Commission	File through the SEC iMessage ticketing system and select the lending or financing complaint category
Unauthorized access, contact-list abuse, public disclosure, or other privacy violation	National Privacy Commission	Follow the NPC complaint procedure and use the prescribed complaint-affidavit form
Phishing, identity theft, fake apps, extortion, or cyber-enabled threats	DICT Cybercrime Investigation and Coordinating Center, NBI Cybercrime Division, or PNP Anti-Cybercrime Group	Submit the digital evidence and transaction details through the agency’s official reporting channels
Immediate danger or threats of physical harm	Philippine National Police or local police station	Make an urgent police report and preserve all messages, recordings, and caller information

The SEC iMessage system allows users to submit and track tickets electronically. Include the app name, legal company name if known, SEC details, loan agreement, payment records, screenshots, and a chronological explanation of what happened. (Securities and Exchange Commission)

For an NPC complaint, the complainant normally uses the prescribed complaint-affidavit, has it notarized, attaches a valid ID and evidence, and submits one complaint for each respondent. The NPC commonly expects the complainant to have first given the company or its data protection officer a written opportunity to address the privacy concern, unless an applicable exception exists. (National Privacy Commission)

Incomplete company information is a common practical obstacle. This is another reason to capture the developer page, privacy notice, email addresses, payment-account names, and loan documents before the app disappears or changes its details.

Common Online Lending Scenarios

The app is in the app store but not on the SEC list

App-store availability does not replace SEC authority. Do not borrow or submit sensitive information until the company and platform can be matched to current SEC records.

The company is SEC registered, but the app is not listed

The company may exist as a corporation, but that does not prove the specific platform is authorized or recorded. Contact the company through independently verified details and ask whether it operates the app. Report suspected misuse of its identity to the SEC.

The app sent money without clear final acceptance

Do not spend the funds until the situation is documented. Notify the operator in writing that you dispute the unauthorized disbursement, request the complete agreement and disclosure, and ask for verified instructions for returning the exact amount actually received without accepting undisclosed charges.

Do not transfer funds to an unverified personal account.

The collector contacted the borrower’s employer or family

A lender does not gain unlimited authority to disclose a debt merely because it has someone’s phone number. Save the messages sent to third parties, ask the recipients to preserve their own screenshots, and identify whether any recipient genuinely agreed to act as a guarantor.

Unauthorized disclosure or shaming may support complaints before the SEC and NPC.

The borrower is an OFW or foreign national

The same SEC verification steps apply when the lender operates or offers its services in the Philippines. An OFW should avoid assuming that a Philippine-looking social-media page is legitimate merely because it accepts overseas applications.

Foreign applicants may be asked for a passport, visa, Alien Certificate of Registration, proof of Philippine address, or local income documents as part of lawful identity and credit checks. Those requirements do not justify collecting unrelated device data or retaining documents without a stated purpose and retention policy.

For complaints filed from abroad, keep original electronic records and check the receiving agency’s current requirements for notarization, electronic submission, and identification. Apostille or consular authentication is usually relevant only when a particular formal proceeding requires an authenticated foreign document.

Frequently Asked Questions

Is a lending app legitimate if it is available on Google Play or the Apple App Store?

Not necessarily. App-store availability does not prove that the operator has an SEC Certificate of Authority or that the specific app is recorded with the SEC. Perform all three checks.

Is “SEC registered” enough?

No. A corporation may be SEC registered without being authorized to lend. Confirm its Certificate of Authority as a lending or financing company and verify the specific online platform.

How can I check an online lending app with the SEC?

Find the exact corporate operator in the app’s privacy notice or agreement. Search the company through the SEC’s Check with SEC portal, verify its authority to lend, and then match the app against the SEC’s list of recorded online lending platforms.

Can a legitimate lending app access my contacts?

Only limited, lawful, necessary, and proportionate processing may be justified. Unrestricted access or the use of contacts for mass debt-collection messages is prohibited. People named only as character references do not automatically become guarantors.

What is the maximum legal interest for online loans?

For covered unsecured, general-purpose loans not exceeding ₱10,000 and four months, the rules effective April 1, 2026 impose ceilings that include 6% monthly nominal interest, 12% monthly effective interest, a 5% monthly late-payment penalty, and a total-cost cap of 100% of principal. Other loans may follow different rules.

Can a lending app have me arrested for nonpayment?

Failure to pay an ordinary debt is generally a civil matter and does not, by itself, result in imprisonment. A lender may pursue lawful collection or a civil case. Separate criminal liability requires facts supporting an actual criminal offense, not merely inability to pay.

Can collectors post my photograph or contact my employer?

They may not use public shaming, unauthorized disclosure, or unrelated third-party contact as collection tools. Preserve proof and consider complaints to the SEC and NPC.

Do I still have to pay if the lending app is illegal?

The app’s lack of authority or unlawful conduct does not automatically mean you may keep money received without accounting for it. The enforceability of particular interest, fees, and contract terms may be disputed. Ask for an itemized statement and use only verified payment channels.

Should I pay a processing fee before the loan is released?

An instruction to transfer an advance fee to a personal account is a major fraud warning. Do not pay merely to release, activate, insure, or increase a supposed loan. Legitimate fees must be clearly disclosed as part of the credit transaction.

Where should I complain about contact-list harassment?

Complain to the SEC regarding unfair collection practices and to the National Privacy Commission regarding unlawful personal-data processing. Cybercrime authorities may also be appropriate when the conduct includes hacking, identity theft, extortion, impersonation, or serious threats.

Key Takeaways

Verify the exact company, its SEC Certificate of Authority, and the specific recorded app.
A Certificate of Incorporation, app-store listing, business permit, or “SEC registered” advertisement is not enough.
Read and save the disclosure statement before accepting any disbursement.
Compare the money actually received with the total amount you must repay.
Current special rate ceilings apply only to covered small, short-term, unsecured loans.
Do not provide OTPs, ATM PINs, mobile-wallet PINs, or unrestricted phone access.
A character reference is not automatically a guarantor.
Public shaming, threats, impersonation, and contact-list harassment are not lawful collection methods.
Preserve screenshots, agreements, transaction records, messages, and payment receipts.
Report regulatory issues to the SEC, privacy violations to the NPC, and fraud or serious online threats to cybercrime authorities.