IslaMove

How to Spot a Legit Online Business in Siquijor (and Anywhere in the Philippines)

IslaMove Blogger

Running a delivery platform on a small island teaches you fast: anyone can put up a nice-looking app with a logo and a "DTI registered" badge. Last month we watched a local delivery service get a letter from DTI Siquijor telling it to stop claiming a DTI endorsement and to stop using an unofficial DTI logo. Badges cost nothing. Paperwork does.

Here is a quick checklist you can run in two minutes before handing anyone your money or your data.

1. Look at the homepage footer

Since the Internet Transactions Act (RA 11967) became fully enforceable, online merchants must show their business name, physical address and contact details on their homepage. And it has to be a real address: an email, a P.O. box, a Facebook page or a vague "we operate nationwide" does not count.

No address, no phone, just a Messenger link? Walk away.

2. Check for the BIR Certificate of Registration

The BIR goes further. Anyone doing business through a website, social media or any digital platform must display an electronic copy of their BIR Certificate of Registration (COR/eCOR) on that site, page or app. A TIN somewhere visible is the bare minimum. If a business takes your money online but has no COR anywhere, it probably isn't issuing proper receipts or paying taxes either.

3. Verify the business name yourself

Don't trust the logo. Take the registered name and look it up on DTI BNRS. It takes 30 seconds. If the name on the app doesn't match anything registered, that tells you everything.

4. See how they take payments

This one is underrated. Licensed payment providers (Xendit, PayMongo, Maya and others) don't let just anyone in. To get card payments approved we had to submit:

  • DTI registration and Mayor's Permit
  • BIR Certificate of Registration
  • IDs of the owner
  • A live website with terms, refund policy and privacy notice
  • Then wait for Visa/Mastercard scheme review, plus extra checks for foreign cards

It took us months. So a business accepting cards, GCash or Apple Pay through a proper checkout has been vetted by people whose job is catching fraud. "Send to my personal GCash" is the opposite signal.

5. Read the boring pages

A legit operator has a refund policy (RA 11967 requires an internal complaint mechanism) and a privacy notice under the Data Privacy Act (RA 10173) with a real contact. If the privacy page is missing, or claims they collect nothing while the app asks for your location and contacts, be careful.

How we do it at IslaMove

Here is ours, all public and checkable:

Every partner restaurant submitted its business registration, address and contact details before going live, as RA 11967 requires e-marketplaces to verify merchants before listing them. Payments go only through licensed providers, and our riders never collect cash.

TL;DR

Address on the homepage, BIR COR visible, name checks out on DTI, payments through a real provider, refund and privacy pages that exist. Five boxes. A real business ticks all of them without breaking a sweat. If someone gets defensive when you ask, you have your answer.