Most advice about avoiding financial fraud arrives too late to be useful – after the transfer, after the data has moved. The Daily Tribune has reported that financial scams and AI-driven fraud remain the Philippines’ top cyber threats, and the reporting around AI-assisted impersonation has been consistent: synthetic voices, cloned interfaces, convincing counterfeits of things that look like institutions.
Against that, one piece of low-tech diligence has become disproportionately valuable. Before you install a lending app, read its permissions list.
Why contacts is the line
A lending app has defensible reasons to request some access. Camera, for ID capture. Storage, for document uploads. Notifications, for repayment reminders. None of those are unusual.
Contact list access is different, because there is no underwriting use for it. Its function in this sector has historically been collection – messaging the people in a borrower’s phone when a payment slips. That single mechanism produced most of the complaints that led the Securities and Exchange Commission to freeze registration of new online lending platforms in November 2021.
That freeze ended on 1 August 2026, under Memorandum Circular No. 20, Series of 2026. But the circular did not simply reopen the market. It explicitly prohibits lenders from harvesting a borrower’s contact list or contacting third parties without written consent, consistent with the Data Privacy Act of 2012. It also requires the full breakdown of principal, interest, fees, penalties and repayment schedule to be disclosed before approval, and bars releasing funds without the borrower’s active confirmation of those terms. A single Certificate of Authority may now cover no more than five platforms, and violations carry suspension, fines or revocation.
Which means the permissions screen is no longer just a privacy preference. It is a compliance tell. An app that still requests your contact list is telling you something about how it intends to operate.
The three-minute check
Before installing, on the store listing itself:
Look at the permissions. Contacts, full SMS history and full photo gallery access are the ones to stop on. Camera and single-file document access are normal.
Look at the developer name, not the app name. The store listing shows the entity that published the app. A licensed lender publishes a corporate name you can check – and a Certificate of Authority number, usually in the app description or on the company site. Brand names are trivially cloneable; registration numbers are not.
Look at how the loan cost is presented. In a compliant flow the annual percentage rate and the total repayable amount appear on screen before you accept. If the cost only resolves after disbursement, that is not a design quirk.
What a compliant design looks like from the outside
It is worth knowing what you are looking for, because “no contacts access” sounds like an absence rather than a feature. In practice it forces the rest of the product to carry more weight – assessment has to work without the borrower’s social graph as leverage, and tenor has to be long enough that repayment is realistic rather than enforced.
PeraSure, one of the licensed platforms operating in this market, is a reasonable illustration: it verifies identity in-app from a single government-issued ID, states that it does not call employers or family members, sends reminders only by SMS and in-app notification, and sets repayment across three to six months rather than weeks. Whether or not that particular app suits you, that combination – minimal data collection, no third-party contact, tenor matched to a pay cycle – is the shape the new rules push lenders toward.
If something looks wrong
The SEC has repeatedly urged consumers to verify the legitimacy of lending and financing firms before sharing personal information or entering into loan transactions online. Suspicious platforms can be reported through the SEC hotline at 1-4732 or 1-4SEC, or the SEC iMessage Portal.
And a general rule that holds up well against AI-assisted fraud: never reach a financial app through a link. Search for the company name yourself, open the store listing directly, and check that the developer name on the listing matches the corporate name on the company’s own site. Cloning a design is easy. Cloning a registration is not.
