To check if a lender is legitimate, look up the company’s NMLS ID number on the free Consumer Access portal at nmlsconsumeraccess.org and confirm an active license with your state’s financial regulator. Those two checks take a few minutes and will catch nearly every fraudulent operation before you share a Social Security number or bank details. Everything else below is the supporting work: what the license status actually means, which fees and payment requests give a scam away, and what to do if you’ve already handed something over.
Look Up the Lender’s NMLS ID
The Nationwide Multistate Licensing System assigns every licensed mortgage company, branch, and individual loan originator a permanent, unique NMLS ID. The number follows the person or company across employers and states.1Nationwide Multistate Licensing System (NMLS). Required Use of NMLS ID
A legitimate lender displays its NMLS ID on its website, usually in the footer, and on marketing materials. Enter the company name or ID number at nmlsconsumeraccess.org. The results page shows the license status in each state, any other names the company has used, when it was established, and any enforcement actions regulators have taken against it. If a lender can’t produce an NMLS ID, or the number doesn’t return that company when you search, stop there.
Cross-reference name and number together. Scammers sometimes copy a real NMLS number from a legitimate company and paste it on a fraudulent site. Searching the number should pull up the exact company you’re dealing with, not a different one.
What the License Status Means
The wording on the portal matters. “Approved” or “Active” means the lender is currently authorized to operate in that state. “Suspended” means a regulator has temporarily halted the license. “Revoked” means the regulator has permanently pulled it, and under federal SAFE Act rules, a loan originator revoked in one state cannot obtain or keep a license in any other state.2NMLS Glossary. License Status Definitions
You may also see “Transition Requested” or “Transition Rejected,” which relate to a company moving between license types or regulatory systems. Those aren’t automatic red flags, but a company stuck in a transition status without an active license shouldn’t be originating loans. If you see anything other than active or approved in your state, ask the lender to explain before going further.
Confirm the License With Your State Regulator
Non-bank lenders (mortgage companies, online lenders, consumer finance companies) must hold a license in every state where they do business. Each state assigns that oversight to a banking commission, department of financial institutions, or similar agency.3Nationwide Multistate Licensing System & Registry (NMLS). Licensing Checklists, Requirements, and Fees Go to your state regulator’s site and search by company name.
If the company doesn’t appear at all, that’s the clearest warning sign. In most states, courts have held that loans made by unlicensed lenders are void and unenforceable as against public policy. The lender may have no legal right to collect, but you may also have no practical recourse if the deal goes wrong.
When a Lender Won’t Be in These Databases
Federally chartered banks and credit unions play by different rules. They operate under federal charters from the Office of the Comptroller of the Currency or the National Credit Union Administration, which preempt state licensing. You won’t find Chase or a federal credit union in a state licensing database, and that’s normal. The licensing check matters most for non-bank lenders, fintech platforms, and mortgage brokers, which is where most lending fraud happens.
Red Flags in Fees and Payment Requests
The single most reliable indicator of a lending scam is a demand for money before you receive your loan. Legitimate lenders deduct origination fees from loan proceeds or roll them into closing costs. Scammers tell you that you’ve been “approved” and then ask you to send money for “insurance,” “processing,” or “paperwork” before they’ll release the funds. The FTC flags this as the hallmark of advance-fee fraud and notes that under the Telemarketing Sales Rule, it is illegal for a telemarketer to promise a loan and then charge an upfront fee before delivering it.4Federal Trade Commission. What To Know About Advance-Fee Loans
The payment method is a second filter. Any request for payment through wire transfers, cryptocurrency, gift cards, or prepaid debit cards is a scam. These methods are untraceable by design, and no legitimate lender uses them to collect fees. Standard closing costs flow through regulated bank accounts and are documented in writing.
Credit report fees deserve a quick note. Lenders typically charge to pull your credit, and Regulation Z requires that fee to be “bona fide and reasonable in amount” for real-estate-secured transactions. A few dozen dollars is normal. Several hundred is not.
The Written Disclosures a Real Lender Must Give You
Federal law gives you a concrete legitimacy test. Under the Truth in Lending Act and its implementing Regulation Z, a lender must provide written disclosures showing the annual percentage rate, the total finance charge in dollars, and other key terms before you become legally obligated on the loan.5eCFR. 12 CFR Part 226 – Truth in Lending (Regulation Z) For high-cost mortgages, those disclosures must arrive at least three business days before closing.6Consumer Financial Protection Bureau. 1026.31 General Rules
If a lender resists putting terms in writing, or pressures you to sign before you’ve had time to review disclosures, that alone is reason to stop. A borrower harmed by TILA violations can sue for actual damages plus statutory damages and attorney’s fees under 15 U.S.C. ยง 1640.7Office of the Law Revision Counsel. 15 USC 1640 – Civil Liability A legitimate operation follows the disclosure rules because the cost of ignoring them is real.
Check the Website, Address, and Complaint Record
Scam lenders often look polished online but crumble under basic scrutiny. Look for a full street address on the site, not just a P.O. box, and check it on a mapping tool to confirm it corresponds to an actual office. The site URL should begin with “https” for an encrypted connection. Watch the email domain the lender uses for correspondence: messages from a corporate domain matching the website are expected, and official business conducted through Gmail, Yahoo, or another free provider almost never comes from a regulated operation.
Search the company in the Consumer Financial Protection Bureau’s Consumer Complaint Database. Complaints post after the company responds or after 15 days, whichever comes first, along with the company’s response and whether it was timely.8Consumer Financial Protection Bureau. Consumer Complaint Database A few complaints against a large servicer may mean little. Look for patterns: repeated complaints about the same issue, high rates of unresolved disputes, or complaints alleging deceptive practices around fees and disclosures.
A Better Business Bureau rating is not the same thing as a license. A company can hold an A+ BBB rating and still lack the state license required to legally offer loans. Use the BBB for customer-satisfaction context; use the NMLS portal and CFPB database for regulatory compliance.
Tribal and Offshore Lenders
Some online lenders operate under the sovereign authority of federally recognized Native American tribes. Tribal lenders claim sovereign immunity from state laws, arguing that as “domestic dependent nations” they aren’t bound by state licensing requirements or interest rate caps.9National Indian Law Library – Native American Rights Fund. Dunn v Global Trust Management Loan agreements from these lenders often include clauses stating the loan is governed exclusively by tribal law, which may contain no interest rate limits.
Courts have reached mixed results on whether that immunity holds, especially when the tribal entity is essentially a front for a non-tribal company. For borrowers, the practical effect is the same: if you borrow from a tribal lender at a triple-digit APR and the deal goes bad, your legal options are limited. Arbitration clauses in these agreements typically funnel disputes into tribal arbitration systems rather than state court.
Offshore lenders operating from outside the United States pose a similar problem with even less accountability, hiding behind anonymously registered websites and lead-generator networks. If you can’t verify a lender in the NMLS database or with a state regulator, and the agreement references tribal or foreign law, that absence of a verifiable NMLS ID is the filter that matters most.
Extra Protections for Active-Duty Military
Active-duty service members and their dependents get an additional layer of protection under the Military Lending Act. The law caps the military annual percentage rate at 36 percent for covered consumer credit products and prohibits mandatory arbitration clauses and unreasonable prepayment penalties, among other terms.10Office of the Law Revision Counsel. 10 USC 987 – Terms of Consumer Credit Extended to Members and Dependents: Limitations The 36 percent cap includes fees rolled into the cost of credit, not just interest.
A lender that ignores MLA protections for a covered borrower faces consequences including voiding of the loan agreement. If you’re active-duty or a military dependent and a lender offers terms above 36 percent or asks you to waive your right to legal action, the lender is either ignorant of the law or violating it. Report them.
If You Already Shared Information or Sent Money
Move quickly. Start at IdentityTheft.gov, the federal identity theft recovery portal. The site walks you through what happened and generates a personalized recovery plan with checklists and pre-filled dispute letters.11Federal Trade Commission. IdentityTheft.gov
Place a fraud alert or credit freeze with each of the three major credit bureaus (Equifax, Experian, and TransUnion) to block new accounts opened in your name. Watch your bank statements for unauthorized transactions. If you sent money, contact your bank or payment provider immediately to attempt a reversal, though recovery is unlikely for wire transfers, cryptocurrency, or prepaid cards.
Then report the lender. File at ReportFraud.ftc.gov, which feeds the Consumer Sentinel database shared with more than 2,800 law enforcement agencies.12Federal Trade Commission. ReportFraud.ftc.gov If the scam happened online, also file with the FBI’s Internet Crime Complaint Center at ic3.gov.13Internet Crime Complaint Center (IC3). Complaint Form File a complaint with your state financial regulator too, since the state has direct authority to investigate and shut down unlicensed lenders operating in its territory. If the lender has an NMLS ID, add a complaint through the CFPB. No agency will guarantee an investigation of your individual case, but the reports accumulate and trigger enforcement once a pattern emerges.