The Borrower’s Safety Checklist: How to Vet Any Online Loan Offer Before You Click “Apply”

The promise of fast cash can be tempting when you need money quickly. But the digital lending space is crowded with both legitimate services and predatory operators who hide fees, misuse your data, or simply take your information and disappear. Before you enter your passport number or grant access to your phone contacts, run through this 10-point safety checklist. This guide is based on general consumer protection principles and common industry practices. No lender can guarantee approval or instant speed—if they claim any of these, treat that as a red flag.

---

1. Verify the Official Domain (Not Just the Logo)

The first line of defense is the website address. Scammers often create lookalike domains that differ by a single character.

What to check:

• Look at the URL in your browser’s address bar—not the company name displayed on the page.
• Confirm the domain is registered to the legal entity. Use a free WHOIS lookup tool (e.g., whois.com) to see the registrant’s name. It should match the lender’s legal name.
• Look for HTTPS (the padlock icon). While HTTPS alone doesn’t guarantee legitimacy, its absence is a clear warning sign.
• Check how long the domain has been active. A domain registered three months ago for a company claiming “20 years of experience” is a major red flag.

Practical tip: Open a new tab and manually type the company’s official URL from the state registry or their official social media page. Never click links from emails, SMS, or ads.

---

2. Read the Consent Text Carefully (Don’t Just Click “Agree”)

Before you can apply, most sites present a consent form or terms of service. This is where many borrowers unknowingly grant permission for aggressive data collection and automatic payments.

What to check:

• Look for explicit permission to access your phone contacts, SMS history, camera, or gallery. Legitimate lenders may request access for verification, but they must explain why and limit the scope.
• Identify whether you’re agreeing to automated payment deductions from your bank card or account. Some terms allow the lender to withdraw the full loan amount plus fees without further notice.
• Check if you’re waiving your right to dispute charges or join class-action lawsuits (common in predatory terms).
• Confirm the consent text includes a clear statement that you can withdraw consent at any time.

Practical tip: Take a screenshot of the consent page before you click “Agree.” If the lender later claims you authorized something you didn’t, you have evidence.

---

3. Confirm the Lender’s Legal Identity

A legitimate lender must be a registered legal entity with a clear name and registration number. Vague terms like “our company” or “financial partner” without specifics are suspect.

What to check:

• Find the company’s full legal name, tax ID (INN in Russia, EIN in the US, etc.), and state registration number.
• Cross-check this information with the official state registry of legal entities. In Russia, use the Federal Tax Service’s website (egrul.nalog.ru). In the US, use your state’s Secretary of State business search.
• Look for a physical address that matches their registration. A PO Box alone is not sufficient.
• Check if the lender is registered with the financial regulator. For microfinance organizations (MFOs) in Russia, this is the Central Bank of Russia’s register of microfinance organizations.

Practical tip: If the lender’s website has no “About Us” page with legal details, or if the details are hidden behind a login, do not proceed.

---

4. Check the Official Financial Registry

For microfinance organizations (MFOs) specifically, registration with the state regulator is mandatory. Operating without it is illegal in most jurisdictions.

What to check (for MFOs):

• Go to the official website of your country’s financial regulator. In Russia, this is the Central Bank of Russia’s register of MFOs (cbr.ru). In India, check the RBI’s list of NBFC-MFIs.
• Search for the lender’s name or registration number. The registry will show their legal status, date of registration, and any sanctions or license revocations.
• Verify that the lender’s website domain matches the one listed in the registry. Some scammers use the name of a registered MFO but operate a different website.

Important note: For non-MFO lenders (banks, credit unions), check their specific regulator (e.g., central bank, credit union administration).

---

5. Calculate the Full Cost of the Loan (APR, Not Just Interest Rate)

Lenders often advertise a low daily or monthly interest rate but hide the total annual percentage rate (APR), which includes all fees, insurance, and processing charges.

What to check:

• Find the APR in the loan agreement or disclosure statement. In many countries, lenders are legally required to display this in a clear box or table.
• Add up all fees: origination fee, service fee, late payment penalty, prepayment penalty, and any mandatory insurance.
• Use an online APR calculator to verify the lender’s numbers. Enter the loan amount, total fees, and repayment term.
• Compare the APR to the legal maximum in your jurisdiction. Many jurisdictions cap APRs for small loans.

Practical tip: If the lender cannot or will not provide a written APR before you apply, walk away.

---

6. Assess Your Repayment Ability Honestly

Legitimate lenders will ask about your income and expenses, but the final responsibility is yours. Do not rely on the lender’s “affordability check” alone.

What to check:

• Calculate your monthly debt-to-income ratio: total monthly debt payments divided by gross monthly income. Keep it at a manageable level.
• Include the new loan payment in your calculation. If the new payment pushes your ratio too high, you are at risk of default.
• Consider the worst-case scenario: what happens if you lose your job or have an emergency expense? Do you have savings to cover the loan for a few months?
• Check the lender’s late payment policy. Some charge a flat fee plus a daily penalty that can increase your debt significantly.

Practical tip: Use a free debt calculator app or spreadsheet to model different repayment scenarios before you apply.

---

7. Review Card Requirements (What Access Are You Giving?)

Many online lenders require you to link a debit or credit card for repayment. This can be convenient but also risky.

What to check:

• Does the lender request your card number, CVV, and expiration date? Legitimate lenders need this for one-time or recurring payments, but they should use a secure payment gateway (look for “3D Secure” or “Verified by Visa”).
• Can you set up automatic payments on your own terms (e.g., date, amount) or does the lender have unilateral access to pull funds?
• Does the lender ask for your online banking login credentials (username and password)? This is a major red flag. No legitimate lender needs your bank login—they only need your card details or account number for transfers.
• Check if the lender is PCI DSS compliant (Payment Card Industry Data Security Standard). Look for a statement on their website or ask customer support.

Practical tip: Use a virtual card number (offered by many banks) for online lending applications. This limits the lender’s ability to charge more than the agreed amount. However, note that some lenders may not accept virtual cards, and terms of service may restrict their use.

---

8. Gather the Documents You’ll Actually Need

Legitimate lenders require identification and proof of income. Scammers often ask for minimal or no documents.

What to check:

• Standard documents include: government-issued ID (passport, driver’s license), proof of income (bank statements, pay stubs, tax returns), and proof of address (utility bill, lease agreement).
• Some lenders offer “no document” loans for very small amounts with a short term. These are high-risk and high-cost.
• If a lender asks for your passport photo, social security number, and bank account details but does not verify your identity through a secure portal (e.g., video call, government database), be suspicious.
• Never upload or email copies of your documents to an unsecured website or a generic email address (e.g., Gmail, Yahoo).

Practical tip: Create a secure folder on your computer with encrypted copies of your documents. Only upload them to lenders with verified HTTPS and a clear privacy policy.

---

9. Read the Privacy Policy (Where Does Your Data Go?)

Your personal and financial data is valuable. A legitimate lender will have a clear privacy policy that explains how they collect, store, share, and protect your information.

What to check:

• Does the privacy policy state that your data will not be sold to third parties for marketing? Many lenders share data with debt buyers, collection agencies, and marketing partners.
• Is your data stored in a secure data center with encryption (e.g., AES-256)? Look for phrases like “industry-standard security measures.”
• Does the lender use data processors (e.g., cloud storage, analytics companies) that are also compliant with privacy laws (e.g., GDPR, CCPA, Russian Federal Law 152-FZ)?
• Can you request deletion of your data after the loan is repaid? The policy should outline your rights and a contact email.

Practical tip: Search for the lender’s name + “data breach” in Google. If they’ve had a recent breach, avoid them.

---

10. Identify Common Scam Signals

Even if the lender passes the first nine checks, look for these specific scam signals.

What to check:

• Upfront fees: A legitimate lender deducts fees from the loan amount or adds them to the repayment. If they ask you to pay a “processing fee” or “insurance” before you receive the money, it’s a scam.
• Guaranteed approval: No lender can guarantee approval without checking your credit and income. “Approved regardless of credit history” is a classic scam line.
• Pressure to act fast: “Limited time offer – apply within 24 hours” is a tactic to prevent you from doing your research.
• Unusual payment methods: Requests for payment via gift cards, cryptocurrency, wire transfer to an individual, or a prepaid card are almost always scams.
• No physical presence: The website has no phone number, no address, and only an email contact form.
• Poor English or grammar: While not definitive, many scam websites have obvious spelling and grammar errors in their terms and conditions.

Practical tip: Do a quick search for the lender’s name + “scam” or “complaint” in forums like Reddit, Trustpilot, or consumer protection websites.

---

Final Checklist Summary

Before you submit any application, confirm:

• Domain is official and registered to the legal entity
• Consent text is clear and limited
• Legal identity matches state registry
• Lender is on the official regulator’s list (if applicable)
• Full APR and all fees are provided in writing
• You can afford the repayment with a safety margin
• Card requirements are standard (no login credentials)
• Documents are requested through a secure portal
• Privacy policy is transparent and compliant
• No scam signals are present (upfront fees, pressure, etc.)

Remember: No legitimate lender promises instant approval or speed that bypasses basic checks. If an offer seems too good to be true, it almost certainly is. Take your time, run through this checklist, and protect your financial health.

Responsible borrowing reminder: Borrow only what you can repay. Late payments can lead to additional fees, damage your credit score, and create financial hardship. If you are struggling with debt, consider seeking advice from a nonprofit credit counseling service.