The Borrower’s Safety Checklist: How to Vet Any Online Loan Offer

Taking out an online loan—especially a microfinance (MFO) loan—can be a quick fix, but it’s also a minefield of hidden fees, identity theft, and predatory terms. Before you click “Apply,” use this practical checklist. It’s designed to help you verify every critical detail: from the lender’s legal identity to the real cost of borrowing. No promises of instant approval, no claims of government backing, and no shortcuts. Just a systematic way to protect your money and your data.

Important: This guide uses official data sources where specified—primarily the Central Bank of Russia’s (CBR) register of MFOs. All other advice is based on general best practices for consumer protection. Regulatory details may change; always verify current rules with official sources.

1. Check the Official Domain (No Look-Alikes)

Why it matters: Scammers create fake websites that look identical to legitimate lenders. A single character difference (e.g., `example-l0an.com` vs `example-loan.com`) can lead to a phishing site.

How to do it:

• Examine the URL bar: Look for `https://` and a padlock icon. But don’t stop there—scammers can get SSL certificates too.
• Check the domain name: Use a tool like Whois (whois.domaintools.com) to see when the domain was registered. A legitimate lender’s domain is typically older. If it was created very recently, proceed with extreme caution.
• Compare with the CBR register: For MFOs, cross-reference the domain with the official website listed in the Central Bank’s register (see Step 4).
• Avoid direct links from ads or emails: Always type the URL yourself or use a trusted bookmark.

• Domain is a misspelling of a known lender.
• No padlock or a warning from your browser.
• Domain age very recent.

2. Read the Consent Text (Don’t Just Click “I Agree”)

Why it matters: The consent text (often hidden in a checkbox or a pop-up) authorizes the lender to access your personal data, credit history, and sometimes even your bank account. Scammers use vague wording to steal your information.

How to do it:

• Find the consent form: It’s usually on the application page or in the “Privacy Policy” link. Look for language like “I consent to the processing of my personal data.”
• Identify the specific purposes: Legitimate consent should list exactly what data will be collected (e.g., passport data, income, bank account) and why (e.g., credit scoring, loan servicing). It should NOT say “for any lawful purpose” or “as required by third parties.”
• Check for third-party sharing: If the text says “data may be shared with partners” without naming them, reject it.
• Look for an opt-out option: You should be able to withdraw consent later (though this may end the loan process).

• Consent is bundled with a “terms of service” you can’t read before agreeing.
• The text is in a tiny font or a pop-up that disappears quickly.
• No mention of data retention period or deletion rights.

3. Verify the Lender’s Legal Identity

Why it matters: A loan offer from “QuickCash” might be a front for a shell company. You need to know exactly who you’re borrowing from—a real legal entity with a registration number.

How to do it:

• Find the legal name and OGRN/INN: Every legitimate lender in Russia (including MFOs) must display their full legal name, OGRN (primary state registration number), and INN (taxpayer ID) on their website, usually in the footer or “About Us” section.
• Cross-check with the Federal Tax Service: Use the official FTS website (nalog.gov.ru) to search by OGRN or INN. The entity should match the name on the loan site, and its status should be “active.”
• Check for a physical address: A real address (not a P.O. box) is mandatory. If the site only lists an email or a mobile number, it’s a major red flag.

• No OGRN or INN displayed.
• The OGRN doesn’t match the business name in the FTS database.
• The address is a virtual office or a residential apartment in a different city.

4. Confirm the MFO Is Registered (Source: CBR Register)

Why it matters: In Russia, only MFOs listed in the Central Bank’s official register can legally issue consumer loans. Unregistered lenders are operating illegally and often engage in fraud.

How to do it:

• Go to the CBR website: Visit `cbr.ru` and navigate to “Financial Markets” → “Registers” → “Register of Microfinance Organizations.”
• Search by name or OGRN: Enter the lender’s legal name or OGRN. If it’s not in the register, do not proceed.
• Check the status: The register shows whether the MFO is “active” or “excluded.” Excluded MFOs cannot issue new loans.
• Note the license type: Some MFOs are “microcredit companies” (MCC) and others are “microfinance companies” (MFC). The latter have higher capital requirements but both are legal.

• The MFO is not in the register.
• The register shows a different legal name or OGRN.
• The MFO is listed as “excluded” or “under liquidation.”

5. Calculate the Full Cost (Not Just the Interest Rate)

Why it matters: Many loan offers advertise a low daily interest rate but hide fees for processing, insurance, or late payments. The true cost is the Full Cost of Credit (FCC) , which must be disclosed by law.

How to do it:

• Find the FCC: On the loan offer page, look for a section titled “Full Cost of Credit” or “Effective Interest Rate.” It must be expressed as a percentage per year (APR) and in rubles.
• Use a loan calculator: Enter the loan amount, term, and all fees (including insurance, if mandatory). A simple formula: `Total repayment = Loan amount + Interest + Fees`. Divide by the loan amount to get the total cost ratio.
• Compare with legal limits: MFOs are subject to maximum interest rates and total debt limits set by the Central Bank. These limits can change, so verify current caps on the CBR website. If the FCC clearly exceeds these limits, the loan is illegal.
• Watch for “free” periods: Some offers have a low or zero percent period for the first few days, then increase sharply. Calculate the cost if you repay one day late.

• The FCC is not displayed or is hidden in fine print.
• The lender requires mandatory insurance that doubles the loan cost.

6. Assess Your Repayment Ability (Be Honest)

Why it matters: MFOs are designed for short-term, small loans. If you can’t repay within a short period, the interest will snowball. Never borrow more than you can realistically repay.

How to do it:

• Calculate your disposable income: Subtract all monthly expenses (rent, utilities, food, transport, existing debts) from your net income. The loan payment should be a manageable portion of what’s left.
• Plan for the worst case: What if you lose your job or have an emergency? Can you still repay? If not, don’t borrow.
• Check the loan term: MFO loans are typically short-term (e.g., 7–30 days). If you need longer, consider a bank loan or a credit card—they may have lower interest rates.
• Avoid rollovers: Rolling over a loan (extending it by paying only the interest) is a trap. The lender may allow it, but it multiplies the total cost.

• You’re borrowing to pay off another loan.
• The loan payment exceeds a significant portion of your income.
• You have no savings to cover unexpected expenses.

7. Review Card Requirements (Not Just Any Card)

Why it matters: Some lenders require you to use a specific bank card or a card from a particular bank. This can limit your control and may be used to auto-debit payments without your consent.

How to do it:

• Check the supported cards: The lender should accept major cards (Visa, Mastercard, Mir) from any bank. If they only accept cards from a small, obscure bank, that’s suspicious.
• Look for “card binding” vs “voluntary payment”:
• Card binding: You authorize the lender to automatically debit payments. This is common but risky—they can take more than agreed if you miss a payment.
• Voluntary payment: You manually transfer money each time. Safer, but you risk forgetting.
• Check for upfront card fees: Some lenders charge a fee for using a card (e.g., a percentage of the loan amount). This should be disclosed before you apply.

• The lender asks for your card’s CVV or PIN (legitimate lenders never need these).
• They require a card from a specific bank that you’ve never heard of.
• The loan agreement says you agree to “unlimited auto-debits.”

8. Gather Required Documents (No Shortcuts)

Why it matters: Legitimate lenders must verify your identity and income. If a lender asks for minimal documents (e.g., just a phone number and passport), they may be a scam or a data harvester.

How to do it:

• Standard documents for MFOs:
• Passport (main page and registration).
• Second ID (e.g., driver’s license, SNILS, INN).
• Proof of income (bank statement, payslip, or tax return). Note: Some MFOs offer loans without income proof, but these have higher rates and lower limits.
• What to avoid:
• Lenders who ask for your bank login/password.
• Lenders who request a copy of your credit card (front and back).
• Lenders who demand payment for “processing” documents.

• The lender asks for your bank card’s PIN or online banking credentials.
• They request a selfie with your passport (legitimate lenders may ask for a photo, but not with your face visible).
• They offer a loan with zero documents—this is illegal.

9. Scrutinize the Privacy Policy (Your Data Is at Stake)

Why it matters: Your personal data (passport, income, bank account) is valuable. A weak privacy policy means the lender can sell it to third parties or lose it in a breach.

How to do it:

• Find the Privacy Policy: It should be a separate page, not buried in the Terms of Service.
• Check for compliance with data protection laws: The lender should state they comply with applicable personal data regulations. Look for references to relevant laws.
• Look for data retention period: The policy should say how long they keep your data (e.g., a defined period after the loan is repaid). If it says “indefinitely,” reject.
• Check for third-party sharing: The policy should list exactly which third parties (e.g., credit bureaus, collection agencies) receive your data. Vague terms like “affiliates” or “partners” are red flags.
• Check for data breach notification: The lender should have a procedure for notifying you if your data is compromised.

• No privacy policy at all.
• The policy says “we may share data with any third party without your consent.”
• The policy is written in a different language (e.g., English) for a Russian lender.

10. Identify Scam Signals (The Final Check)

Why it matters: Even after verifying everything above, you might still encounter a sophisticated scam. Look for these final red flags:

How to do it:

• Check for unrealistic promises: “Approval in minutes,” “100% guaranteed,” “No credit check needed.” Legitimate lenders always check your credit history and have a rejection rate.
• Look for pressure tactics: “Limited time offer,” “Only a few loans left,” “Apply now or lose this rate.” Scammers create urgency to make you act without thinking.
• Verify contact information:
• Legitimate lenders have a physical address, a landline phone number, and a working email.
• Scammers often have only a mobile number or a WhatsApp contact.
• Call the number before applying. If no one answers or the call goes to a generic voicemail, be wary.
• Search for complaints: Use search engines and forums to look for “lender name + scam” or “lender name + complaints.” If you find multiple reports of fraud, avoid.
• Check for fake reviews: Look for reviews that are all 5-star, written in the same style, or posted on the same day. Legitimate lenders have a mix of positive and negative reviews.

• The lender’s website has no “Contacts” page or only a contact form.
• They ask for payment upfront (e.g., “processing fee,” “insurance deposit”).
• They promise to “fix” your credit history for a fee.
• They use aggressive language or threaten legal action if you don’t apply.

Final Step: If in Doubt, Walk Away

No loan is worth your financial safety. If any step in this checklist raises a red flag, close the tab. There are hundreds of legitimate lenders—you don’t need to take a risk with a questionable one. And remember: Always verify that a lender is properly registered with the relevant authorities. That’s the single most important rule.

Stay safe, borrow only what you can repay, and protect your personal data at every step.