Quick answer

An online lender is not legitimate merely because its app appears in an app store, has many downloads, displays an SEC registration number, or uses the logo of a known company.

Before applying or sending any ID, verify all three of these:

The operator’s exact legal name is registered with the Securities and Exchange Commission (SEC).
The operator has a valid Certificate of Authority to operate as a lending company or financing company.
The particular app, website, or other online lending platform is connected to that operator and has been reported or recorded with the SEC.

A Certificate of Incorporation alone is not enough. Under the Lending Company Regulation Act of 2007, a lending company cannot conduct lending business without SEC authority to operate.

If the company, authority, and platform cannot all be matched—or the SEC record is unclear—do not proceed until the SEC confirms the lender’s status.

The three-part legitimacy check

1. Identify the company behind the app

The app’s brand name may be different from its operator’s corporate name. Find the exact legal name in the:

app-store developer information;
website footer;
privacy notice;
terms and conditions;
loan agreement or disclosure statement;
customer-service page; and
payment instructions.

Also record any SEC registration number and Certificate of Authority number shown.

Treat the lender as high-risk if it does not clearly identify the corporation responsible for the loan. A legitimate operator should not make borrowers guess which company will receive their information, release the money, collect payments, or enforce the agreement.

2. Verify both registration and authority with the SEC

Search the exact corporate name or registration number through the SEC’s official Check with SEC service.

Confirm that:

the search result refers to the same corporation named in the app and contract;
its company status does not indicate that it is revoked, suspended, dissolved, expired, or otherwise unable to operate;
it is licensed as a lending company or financing company; and
it has a valid Certificate of Authority, which is the secondary authority needed to engage in that regulated business.

Corporate registration and lending authority are different. Registration establishes the corporation; the Certificate of Authority permits it to conduct lending or financing operations.

If the online result is incomplete, ambiguous, or unavailable, request confirmation through SEC iMessage. Select the service for the status of a Certificate of Authority or an inquiry involving financing and lending companies. Do not rely solely on a screenshot or certificate sent by the lender, because documents and registration numbers can be copied, altered, or used by impersonators.

3. Match the app or website to the licensed company

A real corporation may operate under one or more brands, but the connection must be verifiable. Check the SEC’s current lending-and-financing-company records and list of recorded online lending platforms through the official SEC website.

Compare all available details:

exact app or website name;
corporate operator;
developer or publisher name;
official website and email domain;
office address and customer-service contacts;
SEC registration and Certificate of Authority numbers; and
privacy notice and loan-contract issuer.

A platform’s absence from a current SEC list, an unexplained name mismatch, or a claim that the lender is “using another company’s license” is a reason to stop and ask the SEC directly.

Recording of a platform is not a government guarantee that every loan term, collection act, or data-processing practice is lawful. It is one required verification point, not an endorsement.

Who regulates the lender?

The correct verification route depends on the institution offering the loan.

Lending and financing companies: principally supervised by the SEC.
Banks and other BSP-supervised financial institutions: verify through the Bangko Sentral ng Pilipinas.
Cooperatives: verify through the Cooperative Development Authority.
Pawnshops: generally subject to BSP regulation for their regulated activities.

A company may use words such as “credit,” “cash,” “finance,” or “microfinance” in its branding without being the type of institution the name suggests. Confirm the legal entity and regulator instead of relying on the brand.

Examine the loan before accepting it

A licensed company can still present a loan that is unsuitable, incorrectly disclosed, or potentially noncompliant. Read the final disclosure and contract before accepting the proceeds.

Under the Truth in Lending Act, the borrower must receive written disclosure of the cost of credit before the transaction is completed. Check for:

principal or loan amount;
deductions taken before release;
net amount you will actually receive;
interest rate and effective interest rate;
processing, service, verification, insurance, notarial, and other charges;
payment dates and installment amounts;
late-payment penalties;
total amount payable;
collection and attorney’s fees, if any;
conditions that can make the entire balance immediately due; and
authorized payment channels.

Do the arithmetic. The advertised amount may not equal the cash released, and a rate described as “low” may exclude substantial fees.

Do not accept a loan when the final figures differ from the advertisement or pre-approval screen unless the lender explains the change and gives you a complete disclosure that you understand.

Interest and fee limits for covered small loans

The limits below do not apply to every loan. Under BSP Circular No. 1133, they cover unsecured, general-purpose loans offered by lending companies, financing companies, or their online platforms when:

the loan amount does not exceed ₱10,000; and
the loan term does not exceed four months.

For a covered loan, the ceilings are:

nominal interest: 6% per month;
effective interest, including applicable fees and charges but excluding late-payment penalties: 15% per month;
late-payment or nonpayment penalties: 5% per month on the outstanding scheduled amount due; and
total cost: no more than 100% of the amount borrowed, counting interest, fees, charges, and penalties, regardless of how long the loan remains outstanding.

A different loan amount, purpose, security arrangement, or term may fall outside these specific ceilings. That does not automatically make any charge lawful: disclosure rules, the contract, consumer-protection law, and court rules on excessive or unconscionable charges may still matter.

Check the app’s permissions and privacy practices

The March 2026 joint DICT–NPC–SEC advisory on online lending platforms warns against unnecessary, unauthorized, excessive, or disproportionate processing of borrowers’ data.

Before installing or using an app:

download it only from an official or verified source linked to the confirmed operator;
read the privacy notice before granting access;
review permissions for contacts, camera, photos, files, location, microphone, SMS, call logs, and social-media information;
reject permissions that are not necessary for a clearly stated, legitimate purpose;
watch for pre-ticked consent boxes or designs that make refusal or withdrawal difficult; and
turn off access once its legitimate purpose has been completed.

Camera or photo access may be appropriate at a particular stage for identity verification, know-your-customer checks, fraud prevention, or payment verification. It should not become unrestricted continuing access.

Under NPC Circular No. 2020-01, as amended by NPC Circular No. 2022-02, unbridled processing of contact lists is prohibited. Limited access may be used to let the borrower select a character reference or guarantor, or to derive proportionate metadata when necessary for a specified legitimate purpose. It cannot be used to indiscriminately contact, shame, or harass people in the borrower’s phone.

A character reference is not automatically a guarantor. A guarantor must separately and expressly consent to assume responsibility for the loan.

Red flags that should stop the transaction

Do not send money, identification documents, selfies, one-time passwords, or account credentials if the supposed lender:

cannot be found under its exact corporate name in official records;
shows only a Certificate of Incorporation but no Certificate of Authority;
uses an SEC number belonging to another company;
cannot prove the relationship between the app and the licensed corporation;
asks for an advance “release,” “activation,” “insurance,” or “verification” payment before disbursement;
requires payment to an unrelated personal account, e-wallet, or crypto wallet;
communicates only through disposable social-media accounts or private messaging;
promises guaranteed approval without meaningful identification or assessment;
pressures you to act immediately or threatens consequences before any loan exists;
asks for your PIN, password, card security code, or one-time password;
demands access to excessive phone data before showing the loan terms;
does not provide a readable contract and disclosure statement;
changes the amount, term, deductions, or repayment schedule after acceptance;
asks you to install an app from an unknown link or file rather than a verified source;
threatens arrest merely for inability to pay an ordinary debt; or
threatens violence, public shaming, or messages to uninvolved contacts.

One red flag may have an innocent explanation, but several together strongly justify walking away and reporting the approach.

A practical verification checklist

Before applying:

Write down the app name, website address, developer name, and exact corporate operator.
Search the corporate operator through Check with SEC.
Confirm its active status and Certificate of Authority.
Verify that the particular platform belongs to that corporation.
Check current SEC advisories, suspension orders, revocations, and recorded-platform lists.
Compare the official contact details with those used by the person or app approaching you.
Read the privacy notice and inspect requested permissions.
Obtain the complete loan disclosure and contract.
Calculate the net proceeds, each payment, and total cost.
Verify the payment account through the lender’s independently confirmed official channel.

If any essential item remains uncertain, submit an inquiry through SEC iMessage before continuing.

Evidence to preserve

Save evidence even if you decide not to borrow. Keep unedited copies of:

app-store and website pages showing the app, developer, and operator;
advertisements and promised rates or terms;
SEC and Certificate of Authority claims;
privacy notices, consent screens, and permission requests;
application screens and final loan disclosures;
contracts, promissory notes, and repayment schedules;
disbursement and payment records;
account names and numbers supplied for payment;
emails, text messages, call logs, and chat conversations;
collection messages sent to you or your contacts;
threats, altered photos, social-media posts, or public disclosures; and
complaint reference numbers and the lender’s responses.

Screenshots should show the date, time, sender, account identifier, and complete message where possible. Export original messages or files before deleting an app. Ask affected contacts to preserve what they received rather than merely forwarding cropped screenshots.

Do not publicly repost IDs, account numbers, addresses, or other sensitive evidence. Provide them only through official complaint channels or to your lawyer.

If you have already shared information or paid money

Act promptly:

Stop further payments until you independently verify the recipient and obligation. If a genuine loan has been released, do not assume that suspected regulatory violations automatically erase the debt; obtain advice on the correct amount and lawful payment channel.
Revoke unnecessary app permissions and uninstall suspicious software after preserving evidence.
Change passwords for affected email, banking, and e-wallet accounts using a trusted device.
Contact the bank or e-wallet immediately if you disclosed credentials or sent money to a suspected scammer.
Tell your mobile provider and financial institutions if your SIM or accounts may have been compromised.
Notify contacts if their information was accessed or if impersonation messages may be sent.
Report the platform and preserve the complaint or incident number.

Never give an OTP to a caller claiming that it is needed to cancel a loan, reverse a transfer, or process a refund.

Where to report problems

Unlicensed lending or unfair collection

File a ticket through SEC iMessage and choose the service for complaints involving financing and lending companies. Attach the company and app details, contract, payment records, messages, screenshots, and a clear chronology.

The 2026 joint advisory also identifies the SEC’s 1-4732 (1-4SEC) hotline for unfair debt-collection complaints.

Misuse or disclosure of personal data

Use the National Privacy Commission’s current complaint instructions and form. A formal complaint generally requires the prescribed complaint or verified format, supporting evidence, and compliance with the NPC’s procedural requirements.

Because procedural time limits may apply, do not delay. The appropriate deadline can depend on when the violation occurred, when you learned of it, your last communication with the company, and whether you first gave the company an opportunity to address the issue.

Threats, fraud, impersonation, or account compromise

For immediate danger, contact local law enforcement or emergency services. The March 2026 joint advisory also identifies:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph; (02) 8723-0401 local 7491

Verify contact information on the agency’s official website before sending sensitive documents.

Common mistakes when checking a lender

Searching only the app’s brand name

The SEC record may be under the operator’s corporate name. Find that name in the contract and privacy notice, then match it to the platform.

Treating SEC registration as a lending license

A registered corporation is not necessarily authorized to lend. Look for the Certificate of Authority.

Trusting a certificate image

Verify the number and company independently. A genuine document belonging to one company can be displayed by an impersonator.

Assuming an app-store listing proves legality

App stores are distribution platforms, not Philippine lending regulators.

Checking only once

Authority may later be suspended or revoked, and platforms or corporate names may change. Recheck immediately before accepting a loan.

Focusing only on the stated interest rate

Deductions, fees, penalties, and a short repayment term may substantially change the real cost. Review the effective rate, net proceeds, and total amount payable.

Paying through an unverified channel

A scammer may impersonate a legitimate lender. Confirm payment instructions using contact details obtained independently from the verified operator.

When legal or professional help is urgent

Seek prompt help from a Philippine lawyer, the proper regulator, law enforcement, or your financial institution when:

you receive threats of violence or harm;
private information or altered photos are being circulated;
the lender contacts your employer, relatives, clients, or unrelated phone contacts;
someone uses your identity to obtain a loan;
money was transferred through deception;
your bank, e-wallet, email, or SIM may be compromised;
you receive a summons, subpoena, court filing, or formal demand;
a vehicle, title, ATM card, payroll account, or other important property is involved;
the amount claimed materially differs from the contract or your records; or
a complaint deadline may be approaching.

Do not ignore genuine court papers. At the same time, distinguish an actual document issued through lawful process from a collector’s message designed to resemble one.

Frequently asked questions

Is every SEC-registered online lender legitimate?

No. Verify the corporation’s current status, its Certificate of Authority, and its connection to the specific platform. Registration alone does not authorize lending or guarantee lawful conduct.

Is an online lender legitimate if it has an SEC registration number?

Not necessarily. The number may relate only to incorporation, may belong to another company, or may be outdated. Check it through an official SEC channel.

What if the app name is different from the company name?

That can be legitimate if the brand is clearly and verifiably operated by the licensed company. The app, privacy notice, contract, developer details, and SEC records should consistently identify the operator.

Does absence from the platform list conclusively prove the app is illegal?

It is a serious warning, but records may require clarification or updating. Do not use the platform until the SEC confirms its status.

Can a lender require access to all my contacts?

Unbridled or disproportionate processing of contact lists is prohibited. Access must be limited to a specified legitimate purpose and the minimum extent necessary. Uninvolved contacts cannot be used for debt collection or harassment.

Can a character reference be forced to pay my loan?

Not merely because the person was named as a reference. A guarantor must expressly consent to assume responsibility. Whether a person is legally bound ultimately depends on valid documents and the applicable law.

Does an illegal collection practice cancel the debt?

Not automatically. The validity and amount of the debt, the enforceability of particular charges, and liability for unlawful collection or data use are separate questions. Obtain advice based on the actual contract, payment history, and communications.

Can I be arrested simply because I could not pay an ordinary online loan?

The Constitution prohibits imprisonment for debt. However, allegations involving fraud, falsified documents, or other independent offenses are different. Do not ignore authentic legal notices, and obtain counsel if criminal conduct is alleged.

Should I pay an advance fee to release an approved loan?

An unexpected demand to pay first—especially to a personal account—is a major fraud warning. Verify the charge, contract, and payment channel independently before sending anything.

Official legal and regulatory sources

This article provides general legal information, not advice for a specific loan, complaint, or dispute. Legal consequences depend on the lender’s current regulatory status, the documents signed, the loan terms, and the surrounding facts. Official sources and procedures were checked as of 27 July 2026.