10-Point Safety Checklist for Online Loans: How to Verify a Lender Before You Borrow

Before you click "submit" on any online loan application, take 15 minutes to run through this practical checklist. The steps below are designed to help you verify a lender’s legitimacy, understand the true cost of borrowing, and avoid common scams. No legitimate lender can guarantee approval or instant funding—any claims to the contrary are red flags. Use this guide to protect your personal data and your wallet.

1. Check the Official Domain and Website Security

Start with the lender’s website address. A legitimate lender will use a secure, verifiable domain. Look for these signs:

• HTTPS and padlock icon in the browser address bar. This indicates the site uses encryption to protect your data.
• No misspellings or odd suffixes (e.g., `.loan` instead of `.com` or a legitimate country code like `.kz` for Kazakhstan). Scammers often use domains that look like well-known banks but add extra letters or numbers.
• Check the domain registration date using a WHOIS lookup tool. A domain registered less than 6 months ago is a major red flag—scammers frequently create new domains and abandon them after a few months.
• Verify the company’s official website through the relevant financial regulator (see Step 4). Never trust a link from an unsolicited email, SMS, or social media ad—type the URL manually into your browser.

2. Examine the Consent and Data Processing Text

Every legitimate lender must provide clear, readable text about how they collect, store, and use your personal data. Look for:

• A separate “Consent to Personal Data Processing” document. This must be presented before you enter any sensitive information.
• Plain language: The text should explain exactly what data is collected (passport number, income, contacts), why it’s needed (credit scoring, identity verification), and how long it will be stored.
• No hidden clauses: Watch for phrases like “data may be transferred to third parties without notification” or “you agree to receive unlimited marketing calls.” Legitimate lenders list specific partners (e.g., credit bureaus, collection agencies) and require separate consent for marketing.
• Easy opt-out: The consent form should include a clear way to withdraw consent (e.g., a written request to the lender’s official email).

If the consent text is missing, illegible, or buried in a multi-page PDF you cannot download, do not proceed.

3. Verify the Lender’s Legal Identity

A real financial company has a registered legal name, tax ID, and primary state registration number. Find these on the website’s “About Us” or “Legal Information” page. Then:

• Cross-check the tax ID and registration number on the relevant government registry (e.g., the Russian Federal Tax Service website at egrul.nalog.ru). The company must be listed as active and match the name on the loan offer.
• Confirm the legal address matches the one on the website. Scammers often use fake or “mass registration” addresses (e.g., a mailbox in a business center used by hundreds of shell companies).
• Look for a full company name, not just a brand name. For example, “ООО ‘Микрокредитная компания ‘Быстрый Заем’” is a legal entity; “FastLoan” alone is not.

If the lender cannot provide clear legal identifiers, or if the registry shows the company is inactive or dissolved, do not borrow.

4. Check the Relevant Financial Regulator's Register

In many jurisdictions, microfinance organizations must be registered with the national financial regulator. For example, in Russia, check the State Register of Microfinance Organizations maintained by the Central Bank of Russia (CBR). For other countries, check the equivalent financial regulator (e.g., the National Bank in Kazakhstan, the Central Bank in Belarus).

• Go to the regulator's website (e.g., cbr.ru for Russia) and navigate to the relevant register.
• Search by the company’s full name, tax ID, or registration number. The registry shows the date of entry, legal address, and whether the organization is active or has had its license revoked.
• Check for any warnings or penalties listed on the regulator's site. If the lender is not in the registry, they are operating illegally—do not borrow from them.
• For lenders outside the microfinance system (e.g., banks, credit unions), verify their license on the regulator's register.

Important: The regulator's registry is the only official source for lender legitimacy. Any claim of “government support” or “special program” that does not reference this registry is false.

5. Understand the Full Cost of the Loan (Total Cost of Credit)

The Total Cost of Credit (TCC) —known in Russia as ПСК (Полная стоимость кредита)—includes the interest rate, fees, insurance, and any other mandatory charges. By law, the lender must display the TCC in a clear box on the first page of the loan agreement.

• Calculate the TCC as an annual percentage rate (APR) . For example, a 30-day loan of 10,000 rubles with a 1% daily interest rate equals 365% APR—far above typical legal limits for microfinance organizations.
• Look for hidden fees: “Service fees,” “account maintenance,” “early repayment penalties,” or “insurance premiums” added after you agree. Legitimate lenders list all fees in the TCC.
• Use the regulator's online TCC calculator (if available) to double-check the numbers. If the lender’s TCC differs significantly from the calculator’s result, ask for a written explanation.
• Never accept a verbal quote. The TCC must be in writing, signed by both parties.

If the TCC exceeds the legal maximum in your country, the loan is illegal.

6. Assess Your Repayment Ability Honestly

No lender can guarantee you can repay—that’s your responsibility. Before signing, do a realistic check:

• Calculate your debt-to-income ratio: Total monthly loan payments (including this new loan) divided by your net monthly income. A safe ratio is under 30%. Over 50% is dangerous.
• Include all existing debts: credit cards, other microfinance loans, mortgage, student loans, personal loans from friends.
• Estimate your monthly expenses: rent, utilities, food, transport, medical costs. Subtract these from your income. The remainder is your disposable income—if the loan payment exceeds this, you cannot afford it.
• Use the “30-day rule”: If you cannot repay the loan in full within 30 days (including all fees), do not take it. Rolling over or extending a microfinance loan leads to a debt spiral.

If you have any doubt about repayment, do not borrow. Seek free financial counseling instead.

7. Review the Card Requirements

Legitimate lenders only require a bank card for transferring funds and repayment. Be alert for these red flags:

• Never provide your card’s CVV code or PIN—these are for payment verification, not for receiving a loan. A legitimate lender only needs the card number and expiry date for transfers.
• No “card activation fees” : Scammers often ask for a small payment to “activate” your card for the loan. Real lenders never charge upfront fees.
• Check the card issuer: The loan should be sent to a card issued by a registered bank. If the lender asks you to use a prepaid card from an unknown issuer, stop.
• Ensure the card is in your name: Transfers to third-party cards are a hallmark of money laundering or scams.

8. Gather and Review All Required Documents

A legitimate lender will ask for a standard set of documents. Anything outside this list is suspicious:

• Passport (main page and registration) —always required.
• Second ID (e.g., driver’s license, social security number, tax certificate) for identity verification.
• Proof of income: bank statements, salary slips, or tax returns for the last 2–3 months. Some lenders may accept pension certificates or social benefit letters.
• Consent to personal data processing (see Step 2).
• Signed loan agreement with clear terms, TCC, and repayment schedule.

Red flags:

• Lender asks for copies of your passport pages that are not standard (e.g., marital status, children’s data).
• Lender requests your bank account login credentials or passwords.
• Lender demands a “deposit” or “insurance payment” before releasing the loan.

If you are asked for any of these, immediately exit the website and report the incident to the financial regulator or local police.

9. Protect Your Privacy and Personal Data

Your personal data is valuable—scammers can use it for identity theft or to take out loans in your name. Follow these steps:

• Read the privacy policy. It should explain how data is protected (e.g., encryption, access controls) and with whom it is shared.
• Check for data breach history using services like Avast or Kaspersky’s data leak checker. If the lender’s name appears in a known breach, avoid them.
• Use a dedicated email address for loan applications—not your primary email. This limits spam and phishing attempts.
• Enable two-factor authentication (2FA) on your bank account and email. This prevents scammers from accessing your accounts even if they get your password.
• Never share your loan application details on social media or public forums. Scammers monitor platforms for personal data.

10. Identify Common Scam Signals

If you see any of these signs, stop immediately:

• “Guaranteed approval” : No legitimate lender guarantees approval without a credit check. This is a classic scam hook.
• “No credit check required” : Real lenders always check your credit history. Some lenders may use alternative scoring, but they still verify your identity and income.
• “Government support program” : Governments typically do not run “special loan programs” through private lenders. If a lender claims this, they are lying.
• “Urgent, limited-time offer” : Scammers create false urgency to pressure you into skipping verification steps.
• “Pay us to release the loan” : Any upfront fee (processing, insurance, card activation) is a scam.
• “We are not a bank, so we don’t follow regulations” : All licensed lenders must follow financial regulations. If they say otherwise, they are illegal.
• No physical address or phone number : Legitimate lenders list a real office address and a working customer support line (not just a chatbot).
• Aggressive marketing on encrypted messaging apps : Scammers often use apps like Telegram or WhatsApp to avoid detection.

Final Step: Contact the Lender’s Support

Before signing, test the lender’s customer support:

• Call the official phone number listed on the website. Ask specific questions about the TCC, repayment terms, and data processing. A legitimate support agent will answer clearly and provide written confirmation.
• Send an email to the official contact address. Expect a response within a reasonable timeframe. If you get no reply or only automated messages, be wary.
• Check for a physical office using mapping services. If the address is a residential building or a mailbox center, it’s likely a virtual office—another red flag.

If the support team is unresponsive, evasive, or cannot provide basic legal information, do not borrow.

---

Summary Checklist

If you checked all 10 boxes, proceed with caution. If any step fails, walk away. Your financial safety is worth more than any quick loan.