Match the identity across documents
Compare the company name, legal entity, domain, privacy notice, terms and final contract. A brand name can differ from a legal name, but the relationship should be explained. Navigate to the official domain independently when a link arrives through an unexpected message.
Determine whether the service is a direct provider, broker, aggregator or lead generator. An intermediary should not be assumed to make the final lending decision.
Check supervision without overgeneralizing
The Superintendencia Financiera publishes a directory of supervised entities. Absence from that directory does not, by itself, prove fraud, because not every company or activity belongs to the same supervisory framework. It does mean you should identify the applicable authority and business role carefully.
- Check the exact legal name rather than only the brand.
- Review written rate, cost, term and complaint information.
- Confirm who receives personal data and applications.
- Keep evidence of the domain and documents consulted.
Signals that require a pause
Guaranteed approval, advance transfers to release funds, pressure to act immediately, mismatched company names and informal-only communication are reasons to stop and investigate. Do not send passwords or one-time codes.
Reviews and social profiles can provide context but are not proof on their own. Give more weight to consistent legal identity, official documents and verifiable channels.
Repeat the checks at the point of acceptance. A legitimate company name does not validate a message sent from an unrelated account, and an impersonator may substitute different payment instructions after the initial contact.
Verify changes through a separately obtained official contact channel before paying.