MR
María Rodríguez, JD · Reviewed by Lisa Thompson, AFC®
Published May 14, 2026 · Last reviewed May 24, 2026 · ~1,800 words · 8 min read

The seven red flags

Almost every payday-loan scam follows the same playbook. If a lender's offer has even one of these features, treat the entire offer as suspect and verify independently before clicking, calling back, or paying anything.

1. Upfront fee before disbursement

The single most common scam pattern. The fake "lender" says you've been approved for a $1,500 loan but you must first pay a $187 "processing fee" or "insurance premium" or "first month's interest" — usually by wire, gift card, or cryptocurrency. Legitimate lenders deduct fees from the disbursement; they do not collect them upfront. If you are asked to pay anything before the loan funds, it is a scam. No exceptions.

2. Payment requested in gift cards, wire, or crypto

Real lenders accept ACH bank transfers, checks, and standard debit/credit. They do not ask you to mail a Google Play gift card, Western Union a fee to a person in another country, or send Bitcoin to a wallet address. Any of those payment requests is conclusive evidence of a scam.

3. No state license, no NMLS number, no physical address

A licensed payday or installment lender is registered with at least one state department of financial institutions and, increasingly, with the National Mortgage Licensing System (NMLS) Consumer Access database. Their disclosure pages list a state license number and a physical business address. A "lender" with no license, no NMLS, and only a P.O. box (or no address at all) is operating illegally even if they aren't running an outright advance-fee scam.

4. Pressure to act in minutes ("expires in 15 minutes")

Real loans don't expire in 15 minutes. The pressure tactic is designed to short-circuit your check-list. A legitimate offer is good for at least 24 hours and usually 7–10 days. If the caller or chat agent is screaming about a countdown clock, hang up.

5. Asks for your online-banking password (not just routing number)

Lenders need your bank routing and account number to ACH the funds in and the payment out. They never need your online-banking login password. Some scammers ask under the guise of "verifying your account"; what they're actually doing is logging into your bank to drain it. Never share an online-banking password with any lender.

6. Threats of arrest or wage garnishment without court process

Federal law (the Fair Debt Collection Practices Act, FDCPA) prohibits debt collectors from threatening arrest, threatening wage garnishment without a court order, or impersonating law enforcement. Failing to repay a consumer loan is a civil matter, not a criminal one. A "lender" or "collector" threatening arrest for nonpayment is committing a federal violation. Document the call (date, time, number, transcript) and report.

7. Domain registered in the last 12 months with no business footprint

Legitimate payday lenders have been around for years. Their domains are 5–25 years old. They have employees on LinkedIn, BBB pages, Yelp reviews, news mentions. A "lender" whose entire web presence is a domain registered last month, with no LinkedIn, no BBB page, no reviews, no news coverage — that's a one-shot scam site. Check the domain age at whois.com; it takes 30 seconds.

Common scam scripts (verbatim, slightly redacted)

These are real scripts pulled from FTC complaint records and consumer-protection bulletins, lightly edited for brevity. If your caller sounds like any of these, it's a scam.

"Congratulations, you've been pre-approved for a $1,800 loan from [Fake Lender Name]. To release the funds, we need you to pre-pay one month of interest — $187 — via Walmart gift card or wire. Once we receive the payment, your funds will be deposited within 30 minutes."
"This is the [Fake Sheriff's Department / Federal Court]. There is a warrant for your arrest for the unpaid loan from [Lender Name]. If you do not pay $487 by 5:00 PM today, officers will be dispatched to your workplace."
"To verify your bank account before we disburse, please confirm your online-banking username and password. This is a routine verification."

How to verify a lender's license

Three minutes, three steps:

  1. Find your state's licensing authority. Each state has a name; the most common are "Department of Financial Institutions," "Office of Financial Regulation," "Department of Banking," or "Department of Financial Protection and Innovation" (California). The Conference of State Bank Supervisors keeps a directory at csbs.org.
  2. Search the public license roster. Every state publishes a searchable license list, usually for free. Type the lender's exact business name. If the lender claims a "DBA" (doing business as), search that too. If they're not on the roster, they're not licensed in your state.
  3. Cross-check NMLS Consumer Access. nmlsconsumeraccess.org is the federal aggregator. Many state-licensed lenders are also listed here. If a lender appears nowhere on a state roster and nowhere on NMLS, that's a five-alarm signal.

Move in this order, fast:

  1. Stop further payments. If you gave bank info, call your bank's fraud line within the hour, freeze the account, dispute any pending transactions.
  2. Gift-card refunds. Most gift-card brands (Apple, Google Play, Amazon, Walmart, Steam) have a scam-recovery process. Call the card issuer's fraud line immediately — sometimes refunds are possible within hours.
  3. Wire-transfer recall. Western Union, MoneyGram, and other wire providers have a recall window measured in hours. Call. Sometimes it works.
  4. Report to FTC. ReportFraud.ftc.gov. The FTC aggregates complaints and shares them with law enforcement. It also feeds the FTC's annual scam-loss statistics.
  5. Report to your state AG. Every state has an attorney general consumer-protection office. They issue press releases naming bad actors and sometimes recover funds.
  6. File a police report. Even if local police won't actively investigate, the report number is required by many financial institutions for fraud claims.
  7. Freeze your credit. Equifax, Experian, TransUnion. Free, online, takes 10 minutes total.

The Quick Cash fake-domain database

We track 1,247 confirmed fake-lender domains as of May 2026. Sources: FTC complaint records, state AG press releases, BBB scam reports, user submissions to [email protected]. Each entry is corroborated by at least two independent sources before listing. The database is queryable in the lookup tool above. If a domain you're looking at is in our database, it has been associated with a documented scam pattern; do not transact.

To submit a suspected fake lender: email [email protected] with the domain, a screenshot, and any phone or email contact info. We review within 7 business days.

Where to report — quick reference

  • FTC: ReportFraud.ftc.gov · 1-877-FTC-HELP
  • CFPB: consumerfinance.gov/complaint · 1-855-411-CFPB
  • Your state attorney general: NAAG.org maintains a state-by-state directory
  • Your state's department of financial institutions
  • Internet Crime Complaint Center (IC3): ic3.gov (FBI-run, for online financial fraud)
  • Better Business Bureau Scam Tracker: bbb.org/scamtracker

Your legal protections

Federal and state law give you teeth in scam recovery:

  • FDCPA (Fair Debt Collection Practices Act): Collectors cannot threaten arrest, contact you at unreasonable hours, contact you at work after you've told them not to, or use abusive language. Violations carry statutory damages up to $1,000 plus actual damages, attorney's fees, and costs.
  • TCPA (Telephone Consumer Protection Act): Robocalls and text-message marketing without your prior express written consent are illegal. Statutory damages of $500 per violation, $1,500 if willful. This is one of the most powerful borrower protections.
  • FCRA (Fair Credit Reporting Act): If a scammer pulls your credit report under false pretenses, that's a federal violation. You're entitled to a free credit-report freeze in all 50 states.
  • Regulation E: Unauthorized electronic transfers can be disputed. Time limits matter: 2 business days for full protection, 60 days for partial. Move fast.
  • State UDAAP statutes: Most states have "unfair, deceptive, abusive acts or practices" laws that mirror the federal CFPB UDAAP authority. Your state AG enforces these and often has a private right of action for consumers.

Compliance note: Quick Cash maintains the fake-domain database on a best-effort basis using public data and user reports. We do not guarantee that every fake lender is in our database, nor that every domain in our database is conclusively a scam — we recommend independent verification with your state regulator before any transaction. We do not promise legal advice; for case-specific questions, consult a licensed attorney or your state attorney general's consumer-protection office.

FAQ

How can a fake lender look so real?

Stolen logos, copied legal pages, polished website templates. Sophisticated scam sites are visually indistinguishable from real ones. License verification on the state roster is the only conclusive test.

Is "no credit check" itself a red flag?

Not on its own. Many legitimate payday lenders use alternative-data underwriting instead of traditional bureau pulls. The phrase becomes a red flag when combined with other signals like upfront fees, no license, or pressure tactics.

What if the lender claims to be tribal?

Verify the tribal affiliation independently with the named tribe. Many "rent-a-tribe" lenders use a tribal name without the tribe's meaningful involvement. The National Indian Gaming Commission and the tribe's own enrollment office can confirm.

Can I recover money sent via Cash App, Venmo, or Zelle?

Hard. Peer-to-peer payment apps offer minimal fraud protection compared to credit cards or even bank ACH. Report to the platform immediately; sometimes a freeze on the receiving account works if it's caught fast. Generally, P2P scam losses are not recovered.

How often does the fake-domain database update?

Weekly. New domains added every Monday based on FTC, state AG, and user reports. Removals are rarer; once a domain is associated with a scam pattern, it usually stays in the database even if the site goes dark, because operators recycle the same templates under new domain names.

Next steps

If a specific lender's offer is suspect, run it through the lookup above. If you're ready to apply with a verified-licensed lender, the Quick Cash application takes ~30 seconds and only matches you with state-licensed lenders. If you've already taken a payday loan and the repayment is going wrong, see the crisis guide. Know your rights: Borrower's Bill of Rights.