Online lending apps can be convenient when you need emergency cash, but a wrong click can expose you to illegal fees, harassment, contact-list shaming, identity misuse, or fake “loan” schemes. In the Philippines, the safest way to verify a legitimate online lending app is not just to ask, “Is it SEC registered?” You need to check the company behind the app, its Certificate of Authority, whether the specific app or platform is recorded with the SEC, whether it is under SEC or BSP supervision, and whether its loan terms and app permissions comply with Philippine law.
What Makes an Online Lending App Legitimate in the Philippines?
A legitimate online lending app usually has four things:
- A real legal entity behind it — not just an app name, Facebook page, or generic “customer service” account.
- Authority to lend — for lending companies, this means a valid SEC Certificate of Authority to operate as a lending company.
- A recorded online lending platform — the specific app, website, or fintech-enabled system should appear in the SEC’s recorded online lending platform list.
- Compliant disclosures and collection practices — the lender must show clear loan costs, protect personal data, and avoid abusive debt collection.
Under the Implementing Rules of Republic Act No. 9474, or the Lending Company Regulation Act of 2007, a lending company is a corporation engaged in granting loans from its own capital funds or from funds sourced from not more than 19 persons, and a Certificate of Authority (CA) is the SEC-issued authority allowing it to engage in lending. The rules also require lending companies to be organized as stock corporations. (Lawphil)
This is important because ordinary SEC registration is not enough. A corporation may be SEC-registered for corporate existence, but that does not automatically mean it can legally operate as a lending or financing company.
Key Philippine Laws and Rules That Protect Borrowers
Several laws work together when you borrow from an online lending app.
| Law or Rule | What It Means for Borrowers |
|---|---|
| Republic Act No. 9474, Lending Company Regulation Act of 2007 | Lending companies need SEC authority to operate as lending companies. |
| Republic Act No. 8556, Financing Company Act of 1998 | Financing companies are separately regulated and may also offer credit products. |
| Republic Act No. 3765, Truth in Lending Act | Lenders must disclose the true cost of credit, including finance charges. |
| Republic Act No. 11765, Financial Products and Services Consumer Protection Act | Financial consumers have rights to fair treatment, transparency, data privacy, and timely complaint handling. |
| Republic Act No. 10173, Data Privacy Act of 2012 | Borrowers’ personal information must be collected and used only for legitimate, proportionate, and disclosed purposes. |
| SEC Memorandum Circular No. 18, Series of 2019 | Prohibits unfair debt collection practices by lending and financing companies. |
| SEC Memorandum Circular No. 19, Series of 2019 | Requires disclosure in advertisements and reporting of online lending platforms. |
| NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02 | Regulates personal data processing for loan-related transactions, especially contact lists and app permissions. |
The Truth in Lending Act requires disclosure of finance charges in credit transactions so borrowers understand the real cost of the loan before agreeing. The law defines finance charges to include interest, fees, service charges, discounts, and other charges connected with the extension of credit. (Lawphil)
The Financial Products and Services Consumer Protection Act gives financial consumers rights to fair treatment, disclosure and transparency, protection against fraud, data privacy, and timely complaint handling. It also gives financial regulators such as the SEC and BSP powers to act against unreasonable fees, abusive practices, and consumer protection violations. (Supreme Court E-Library)
The Data Privacy Act protects personal information and gives data subjects rights such as access, correction, blocking, removal, and indemnity for damages caused by unlawful or unauthorized use of personal data. It can apply even to acts done outside the Philippines if the processing relates to Philippine citizens or residents and the entity has links to the Philippines. (National Privacy Commission)
Step-by-Step Guide: How to Verify a Legitimate Online Lending App
1. Identify the Exact Company Behind the App
Before installing or borrowing, look for the lender’s full legal identity. Do not rely only on the app name.
Check the following:
- App Store or Google Play developer name
- Website footer
- “About Us” page
- Privacy policy
- Terms and conditions
- Loan agreement
- Disclosure statement
- SMS, email, or in-app notices
You are looking for:
- Full corporate name
- SEC Registration Number
- Certificate of Authority number
- Registered office address
- Email address and official customer service channels
- Name of the online lending platform or app
- Privacy notice and data protection contact
A red flag appears when the app only gives a brand name such as “Fast Cash,” “Pera Now,” or “Quick Loan PH” but does not clearly identify the corporation operating it.
2. Check Whether the Company Is Registered With the SEC
Use official SEC verification channels. The SEC Check App is described as the official mobile application of the Securities and Exchange Commission Philippines, while the SEC Express System allows users to search using a company’s registered name or SEC registration number and request SEC documents. (Google Play)
When checking, use the exact corporate name. Small differences matter. For example, “ABC Lending Corp.” may be different from “ABC Financing Inc.” or “ABC Loan Services.”
Look for:
- Whether the company exists
- Whether the SEC registration number matches
- Whether the company status is active
- Whether the company’s primary purpose includes lending or financing
- Whether there are suspicious name variations
But remember: SEC company registration only proves the corporation exists. It does not, by itself, prove the app is allowed to lend.
3. Confirm the Certificate of Authority to Lend or Finance
A lending company must have a Certificate of Authority to Operate as a Lending Company. A financing company must have the appropriate authority to operate as a financing company.
The SEC maintains pages for lending and financing companies, including a List of Recorded Online Lending Platforms and lists related to lending and financing companies. (Securities and Exchange Commission)
When checking the SEC lists, confirm all of these:
- The corporate name appears in the proper active list.
- The SEC Registration Number matches the app’s disclosures.
- The CA number matches the app’s disclosures.
- The company is not listed as revoked, suspended, or subject to a warning.
- The app name itself is recorded as an online lending platform.
This last point is often missed. A company may be legitimate, but a particular app, rebranded product, or newly launched platform may not yet be properly recorded.
4. Check the SEC’s List of Recorded Online Lending Platforms
An online lending platform (OLP) includes mobile lending apps, websites, and fintech-enabled systems where lending or financing products are made available. A 2026 public advisory by the DICT, NPC, and SEC expressly refers to OLPs as mobile lending applications, websites, and other fintech-enabled programs or systems where services and products of financing companies and lending companies are made available.
When checking the SEC’s recorded OLP list:
- Search by app name.
- Search by corporate name.
- Search by CA number if available.
- Check spelling carefully.
- Watch for copied names or logos.
- Compare the app icon, developer, and website with the recorded platform.
If the app is missing from the recorded OLP list, do not assume it is safe just because the operator claims to be “SEC registered.”
5. Check Whether It Is Actually BSP-Supervised Instead
Some digital credit products are offered by banks, digital banks, electronic money issuers, or other BSP-supervised financial institutions. These are usually under the Bangko Sentral ng Pilipinas (BSP) rather than the SEC.
Use the BSP’s directories and lists if the lender claims to be:
- A bank
- A digital bank
- An electronic money issuer
- A remittance or payment company
- A non-bank financial institution supervised by the BSP
The BSP states that its Consumer Assistance Mechanism is a second-level recourse for issues involving BSP-supervised institutions. Consumers should first report the concern to the institution’s own consumer protection assistance mechanism, then escalate to BSP if unsatisfied.
For ordinary lending and financing companies, complaints usually go to the SEC, not the BSP.
6. Read the Loan Disclosure Before Accepting
Before tapping “Accept,” look for the disclosure statement or key loan summary. A compliant lender should clearly show:
- Principal amount
- Amount actually released to you
- Interest rate
- Effective interest rate or annual percentage rate, if provided
- Processing fee
- Service fee
- Notarial or documentation fee, if any
- Late payment penalties
- Due date and payment schedule
- Total amount payable
- Prepayment terms
- Customer assistance or complaint channel
Under the Civil Code, obligations arising from contracts have the force of law between the parties and must be complied with in good faith. For a loan contract, that means you should not agree unless you can see and understand the real terms. (Lawphil)
For small-value short-term loans, also check whether the loan is covered by SEC rules on interest and fee ceilings. SEC Memorandum Circular No. 14, Series of 2025 introduced recalibrated ceilings for certain unsecured general-purpose loans not exceeding ₱10,000 and with terms up to four months, with implementation beginning in 2026. Reported ceilings include limits on nominal interest, effective interest, late penalties, and total cost. (Philippines Law Firm)
7. Review App Permissions Before Installing or Applying
Be very careful if the app requests access to:
- Your full contact list
- SMS messages
- Call logs
- Photo gallery
- Files and storage
- Location
- Camera and microphone beyond identity verification
- Social media accounts
The DICT, NPC, and SEC’s 2026 advisory states that unnecessary app permissions and unauthorized, excessive, or disproportionate processing of personal data are prohibited. It also says contacting persons in the borrower’s contact list other than named guarantors is prohibited for debt collection.
The advisory further warns that OLPs must use separate interfaces for character references and guarantors, and that a guarantor must separately consent to assume responsibility for the loan in case of default.
This means an app should not force you to surrender your entire phonebook just to borrow money.
Red Flags of Illegal or Risky Online Lending Apps
Avoid or investigate further if you see any of these signs:
- The lender refuses to give its full corporate name.
- The app shows only a DTI business name, not an SEC-registered corporation.
- The company has SEC registration but no Certificate of Authority.
- The app name is not in the SEC’s recorded OLP list.
- The app uses a different developer name from the disclosed lending company.
- The loan agreement has no disclosure statement.
- Fees are hidden until after approval.
- The amount released is much lower than the amount you must repay.
- The app requires access to your entire contact list.
- Collectors threaten to message your employer, family, or friends.
- Collectors threaten arrest for ordinary nonpayment.
- The lender asks for advance “processing fees” before releasing the loan.
- The app uses fake government seals or fake SEC/BSP certificates.
- Customer service only uses personal numbers, Telegram, Viber, or random Facebook accounts.
- The lender pressures you to borrow again to pay an old loan.
A legitimate lender may collect a valid debt, but it cannot use threats, insults, public shaming, false statements, or unlawful exposure of personal information.
What Debt Collectors Cannot Do
SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair debt collection practices by financing and lending companies. Examples include threats of violence, threats to take actions that cannot legally be taken, obscene or insulting language, publication of borrowers’ personal information, false representations, contacting borrowers at unreasonable hours, and contacting people in the borrower’s contact list other than named guarantors or co-makers.
The circular also requires financing and lending companies to keep borrower information confidential, subject only to specific allowed circumstances, and makes companies ultimately responsible for outsourced collectors.
For repeated violations, penalties may include fines, suspension of lending or financing activities, or revocation of the Certificate of Authority, depending on the facts and gravity of the offense.
If threats include hacking, identity misuse, fake public posts, extortion, or defamatory online accusations, other laws may become relevant, including the Revised Penal Code and Republic Act No. 10175, or the Cybercrime Prevention Act of 2012. (Lawphil)
Documents and Evidence to Save Before You Borrow
Keep copies before and after approval. Many borrowers lose evidence because the app changes screens after the loan is released.
| What to Save | Why It Matters |
|---|---|
| App store page | Shows app name, developer, privacy policy, and update history. |
| Corporate name and CA number | Needed for SEC verification. |
| Screenshots of fees and due date | Proves what was disclosed before acceptance. |
| Loan agreement | Shows legal terms. |
| Disclosure statement | Shows finance charges and total amount payable. |
| Privacy policy | Shows claimed basis for data collection. |
| Permission prompts | Proves what phone access the app requested. |
| Payment receipts | Proves amounts already paid. |
| Collector messages and call logs | Needed for complaints involving harassment. |
| Screenshots of posts or messages to contacts | Important for SEC, NPC, police, or cybercrime complaints. |
For online evidence, take screenshots that show the date, time, sender number or account, and full message thread. Do not crop too tightly. If possible, export chat histories and save files in cloud storage.
What to Do If You Already Borrowed From a Suspicious App
1. Separate the Debt Issue From the Harassment Issue
If you received money, there may still be a civil obligation to repay the lawful principal and legitimate charges. But unlawful collection tactics, illegal disclosure of personal data, and excessive or undisclosed fees are separate violations.
Do not ignore the account completely. Instead:
- Request a statement of account.
- Ask for a copy of the loan agreement and disclosure statement.
- Compare the charges with the amount released.
- Keep proof of all payments.
- Communicate through written channels as much as possible.
2. Revoke Unnecessary App Permissions
On your phone, check the app permissions and revoke access to contacts, photos, SMS, call logs, location, and storage unless truly necessary. The 2026 DICT-NPC-SEC advisory says OLPs should prompt data subjects to turn off, disallow, or revoke permissions once the purpose has been achieved, and borrowers should review permissions carefully.
3. File the Right Complaint With the Right Agency
| Problem | Agency or Office |
|---|---|
| Unfair collection by a lending or financing company | SEC Financing and Lending Companies Department / SEC iMessage |
| Data privacy violation, contact-list harvesting, unauthorized disclosure | National Privacy Commission |
| BSP-supervised bank, e-wallet, or financial institution | BSP Consumer Assistance Mechanism |
| Threats, fraud, hacking, extortion, identity misuse | NBI Cybercrime Division, PNP Anti-Cybercrime Group, or DICT Cyber Hotline |
| Defamatory public posts or online shaming | May involve SEC, NPC, and cybercrime remedies depending on facts |
The 2026 joint advisory lists SEC iMessage for unfair debt collection complaints and identifies cyber-related reporting channels such as the DICT Cyber Hotline, NBI Cybercrime Division, and PNP Anti-Cybercrime Group.
The SEC lending complaints contact listed by BSP’s financial education page is the Financial and Lending Company Division at flcd_complaints@sec.gov.ph and direct line (02) 8818-5990. (Bureau of the Treasury)
For BSP-supervised institutions, BSP instructs consumers to complain first through the institution’s own complaint mechanism, then escalate to BSP through BOB or other BSP consumer assistance channels if unsatisfied.
Common Scenarios
The app says “SEC registered” but I cannot find it on the OLP list
That is a serious warning sign. Ask for the full corporate name, SEC Registration Number, CA number, and exact recorded platform name. If the company exists but the specific app is missing, the platform may be unrecorded or using another company’s identity.
The app is owned by a foreign company
Foreign ownership alone does not automatically make a lender illegal. Republic Act No. 10881 lifted nationality restrictions in certain laws governing lending companies and financing companies, subject to the Constitution and applicable rules. (Supreme Court E-Library)
But a foreign-backed app serving Philippine borrowers still needs the proper Philippine legal entity, regulatory authority, and compliance with SEC, NPC, BSP, and consumer protection rules where applicable.
I am an OFW and the app is harassing my family in the Philippines
Save all messages, screenshots, and call logs. Your location abroad does not prevent you from filing online complaints or asking your family to preserve evidence. If collectors contact relatives who are not guarantors or co-makers, that may fall under unfair debt collection and data privacy concerns.
The app threatens arrest if I do not pay today
Ordinary unpaid debt is generally a civil matter. A lender may pursue lawful collection or court remedies, but threatening arrest for a simple loan default is a red flag. Criminal issues may arise only in separate circumstances, such as fraud, falsification, bouncing checks, identity misuse, or other acts punishable by law.
The app contacted my employer or posted about me online
This may involve unfair debt collection, malicious disclosure of personal data, or cyber-related violations depending on the content and manner of publication. Preserve evidence immediately, including screenshots showing the sender, recipient, date, and exact words used.
Frequently Asked Questions
How do I check if an online lending app is legit in the Philippines?
Check the company’s full legal name, SEC registration, Certificate of Authority, SEC recorded online lending platform list, privacy policy, loan disclosure statement, and app permissions. Do not rely only on app ratings or the phrase “SEC registered.”
Is SEC registration enough for a lending app?
No. SEC registration only shows that a corporation exists. A lending company also needs authority to operate as a lending company, and the specific online lending app or platform should be recorded with the SEC.
Where can I find the SEC list of legitimate online lending apps?
The SEC maintains pages for lending and financing companies, including the List of Recorded Online Lending Platforms. Search both the app name and the corporate name because many apps use brand names different from their legal company names. (Securities and Exchange Commission)
Can a lending app access my contacts?
An online lending app should not harvest or use your full contact list for debt collection or harassment. The DICT, NPC, and SEC have reiterated that contacting people in the borrower’s contact list other than named guarantors is prohibited for debt collection.
Can an online lending app contact my references?
An app may ask you to provide character references or guarantors through a separate interface. But a guarantor must separately consent to assume responsibility for the loan. A character reference is not automatically a guarantor.
What should I do if a loan app is harassing me?
Save evidence, revoke unnecessary app permissions, request a statement of account, and file the proper complaint. For unfair debt collection by lending or financing companies, report to the SEC. For contact-list misuse or unauthorized disclosure of personal data, report to the NPC. For threats, fraud, hacking, or extortion, report to cybercrime authorities.
Can I stop paying if the app is illegal?
Be careful. If you actually received loan proceeds, there may still be a civil obligation to return the lawful amount. But you may dispute illegal fees, undisclosed charges, harassment, and data privacy violations. Keep payment proof and communicate in writing.
Are online lending apps regulated by the BSP or SEC?
Most lending and financing companies are regulated by the SEC. Banks, digital banks, electronic money issuers, and certain non-bank financial institutions are under BSP supervision. Check the type of entity behind the app before deciding where to verify or complain.
Can foreigners use or complain against Philippine online lending apps?
Yes, if the transaction involves a Philippine-regulated lender or Philippine-based processing, foreigners may still use the relevant complaint channels. Foreigners should also check whether the company is properly registered and authorized in the Philippines, especially if the loan contract, app operations, or collection activity is connected to the Philippines.
Key Takeaways
- Do not rely on “SEC registered” alone. Verify the company, Certificate of Authority, and the specific online lending platform.
- Use official sources. Check SEC lists, SEC verification tools, and BSP directories when applicable.
- Read the loan disclosure before accepting. Look at the total amount payable, not just the advertised interest rate.
- Be cautious with app permissions. Full contact-list access is a major red flag.
- Debt collection has limits. Threats, shaming, false statements, and contacting non-guarantor contacts may violate Philippine rules.
- Save evidence early. Screenshots, agreements, disclosure statements, payment receipts, and permission prompts are crucial.
- Report to the correct agency. SEC for unfair lending and collection practices, NPC for data privacy violations, BSP for BSP-supervised institutions, and cybercrime authorities for threats, fraud, hacking, or extortion.