You can tell if a loan company is legit by confirming three things before you share any information: it holds an active license in your state, it never asks for a fee before funding your loan, and it evaluates your credit and income before approving you. Everything else — the website polish, the friendly rep, the impressive-sounding company name — is downstream of those checks. The verification itself takes under ten minutes.
Start With the License
Every company offering consumer loans must be licensed or registered in the state where you live. Search the company name or its NMLS ID at the free NMLS Consumer Access portal, which is the official system of record for lender licensing across all participating states, D.C., and U.S. territories.1Nationwide Multistate Licensing System & Registry. NMLS Consumer Access FAQs2Alabama State Banking Department. NMLS Consumer Access – Verify Service Providers If the company doesn’t appear, or its license shows as suspended, revoked, or expired, stop there.
Your state’s Department of Financial Institutions or Banking Commission keeps a second layer of records, including disciplinary actions, administrative fines, and consent orders. A status of “active” or “approved” means the company met capital requirements and passed background checks. An absence from those records, or a trail of enforcement actions, tells you what you need to know.
The Consumer Financial Protection Bureau also runs a searchable Consumer Complaint Database where you can look up a company and see the volume and nature of complaints filed against it.3Consumer Financial Protection Bureau. Consumer Complaint Database Hundreds of unresolved complaints about deceptive practices is a different picture than a handful of routine billing disputes. The database won’t confirm licensing, but it fills in context licensing alone doesn’t give you.
Never Pay to Get a Loan
This is where most scams reveal themselves. A company tells you you’re approved, then asks you to send money before it releases the funds. The payment gets labeled an insurance premium, a processing fee, or a refundable deposit. The method is almost always untraceable: prepaid debit cards, wire transfers through Western Union or MoneyGram, gift card codes, or cash-reload products like MoneyPak.4Federal Trade Commission. FTC Amends Telemarketing Rule to Ban Payment Methods Used by Scammers Once that money leaves your hands, it’s gone.
The FTC’s Telemarketing Sales Rule makes this practice illegal in a specific way: any seller or telemarketer who guarantees or represents a high likelihood of loan approval cannot request or receive a fee before the loan is actually delivered.5eCFR. 16 CFR Part 310 – Telemarketing Sales Rule The FTC puts it plainly: “Any up-front fee that the lender wants to collect before granting the loan is a cue to walk away, especially if you’re told it’s for ‘insurance,’ ‘processing,’ or just ‘paperwork.'”6Federal Trade Commission. What To Know About Advance-Fee Loans Violations carry civil penalties of up to $53,088 per occurrence.7Federal Register. Adjustments to Civil Penalty Amounts
Origination fees and closing costs do exist. They work differently. A real lender discloses those costs in a formal loan estimate before closing and deducts them from the loan proceeds at funding. You do not wire money to a stranger to unlock your own loan.
“Guaranteed Approval” Is Not How Lending Works
A promise of guaranteed approval regardless of credit history is the second clearest giveaway. The FTC flags language like “Bad credit? No problem,” “No hassle — guaranteed,” and “We don’t care about your past. You deserve a loan!”6Federal Trade Commission. What To Know About Advance-Fee Loans Real lenders don’t talk that way because they can’t. They have to decide whether you can repay what you borrow.
For mortgage lenders, federal law is explicit: Regulation Z requires creditors to make a reasonable, good-faith determination that a borrower can repay a residential mortgage loan before funding it, based on verified income, assets, and existing debt.8Consumer Financial Protection Bureau. Ability-to-Repay/Qualified Mortgage Rule9Federal Register. Ability-to-Repay and Qualified Mortgage Standards Under the Truth in Lending Act (Regulation Z) For personal loans, auto loans, and other non-mortgage consumer credit, no identical federal mandate exists, but legitimate lenders still pull credit and verify income as standard underwriting.
Some real lenders do work with borrowers who have poor credit. They’ll ask for pay stubs, bank statements, or tax returns. They’ll quote a higher interest rate to reflect the risk. What they won’t do is promise you money with no questions asked.
Interest Rates That Don’t Match the Market
An interest rate dramatically higher than what comparable lenders charge is worth investigating even when the lender is technically licensed. Most states cap consumer interest rates, but the ceiling varies by state, loan type, and whether the lender holds a federal banking charter. National banks and credit card issuers are often exempt from state caps under federal preemption, which is why credit card APRs can legally reach 30% or higher.
One useful federal benchmark: the Military Lending Act caps the Military Annual Percentage Rate at 36% for covered loans to active-duty servicemembers and their dependents, including credit cards, payday loans, and installment loans.10Consumer Financial Protection Bureau. Military Lending Act (MLA) That figure reflects what Congress treats as the upper bound of fair consumer credit. A rate well above 36% on anything other than a very short-term or high-risk product is worth questioning.
Direct Lender or Lead Generator
Not every site with a loan application on it is a lender. Many are lead generators that collect your personal and financial information and sell it to multiple lenders, data brokers, or marketing firms. The experience feels like applying for a loan. You’re filling out a data-harvesting form.
The giveaway is in the fine print. Look in the footer, terms of use, or privacy policy for phrases like “we are not a lender,” “by submitting this form you consent to be contacted by our lending partners,” or “your information may be shared with third parties.” A Federal Reserve review of online lending sites found that some bury consent for data sharing in their terms of use, specifying that the “user expressly consents to be contacted” by the lender and its affiliates.11Board of Governors of the Federal Reserve System. Uncertain Terms: What Small Business Borrowers Find When Browsing Online Lender Websites Submit your Social Security number and bank details there and they may end up with companies you’ve never heard of.
A direct lender has its own NMLS number, its own licensing in your state, and issues loan documents under its own name. If you can’t find the company’s NMLS record and the site disclaims being a lender anywhere in its terms, you’re dealing with a middleman at best.
What Real Loan Paperwork Looks Like
A real lender gives you written disclosures before you commit. For mortgage loans, federal TILA-RESPA rules require the lender to provide a standardized Loan Estimate within three business days of receiving your application. That document itemizes your loan amount, interest rate, monthly principal and interest payment, and estimated closing costs broken down by category, along with any prepayment penalty or balloon payment.
For personal loans, auto loans, and other non-mortgage consumer credit, you should still receive a written agreement spelling out the APR, total amount financed, repayment schedule, and any fees. A lender that rushes you to sign, or provides no written terms at all, is not operating professionally. “Act now before the rate expires” is a sales tactic, not a lending practice.
Website and Contact Basics
Any site collecting Social Security numbers, bank account details, or tax documents must encrypt that data in transit. Look for “https” at the start of the URL and a padlock in your browser’s address bar. A site running plain “http” with no padlock has no business asking for financial information.
Check the URL character by character against the lender’s official web address, which you can pull from the NMLS record. Scammers register domains that look nearly identical to well-known lenders, swapping a letter or using “.net” or “.biz” in place of the real company’s “.com.”
Legitimate lenders disclose a street address, and that address corresponds to a real commercial office you can find on a map. A P.O. Box alone, a residential address, or a virtual-office suite is not proof of fraud, but it should raise your guard. A working customer service phone answered by live representatives during business hours is another baseline. Scam operations tend to rely on messaging apps, auto-reply emails, or numbers that ring to voicemail indefinitely. If you can’t reach a human before you sign, you won’t reach one after your money is gone.
Your state’s Secretary of State business registration database gives you one more check. The entity name in the state filing should match the name on the loan offer. A mismatch between the marketing name and the legal entity name isn’t always disqualifying, but it warrants an explanation you should ask for directly.
If You’ve Already Been Scammed
If you sent money to a fraudulent lender or gave one your personal information, act fast. The damage isn’t only the money you lost. A scammer with your Social Security number, bank details, and employer information can open accounts and file tax returns in your name.
File a complaint with the FTC at ReportFraud.ftc.gov. For lending, credit, and debt collection specifically, the FTC’s system routes you to the Consumer Financial Protection Bureau at consumerfinance.gov.12ReportFraud.ftc.gov. Assistant – ReportFraud.ftc.gov If the scam reached you online, file a report with the FBI’s Internet Crime Complaint Center at ic3.gov.13Federal Bureau of Investigation. Common Frauds and Scams These agencies won’t recover your money directly, but the reports build cases against repeat offenders.
If you gave a scammer your Social Security number, go to IdentityTheft.gov to create an official Identity Theft Report and get a personalized recovery plan.14Federal Trade Commission: IdentityTheft.gov. Identity Theft Steps Place a fraud alert with one of the three credit bureaus (Experian, TransUnion, or Equifax); that bureau is required to notify the other two. A fraud alert is free and lasts one year. A credit freeze is also free under federal law and blocks new accounts from being opened in your name until you lift it. Review your Social Security work history at socialsecurity.gov/myaccount to see whether someone is using your number for employment, and consider locking your SSN through E-Verify. Call your bank the same day if you shared account numbers so they can flag the account or issue new numbers. The first 48 hours after a scam matter more than anything else.