Quick answer

A fake salary-loan approval letter is usually bait, not proof that a loan exists. Do not pay a “release,” “processing,” “insurance,” “tax,” “verification,” or “cancellation” fee. Do not click its links, install an app, disclose an OTP or PIN, or send more identification documents.

Verify the letter directly with the named lender using contact details obtained independently from the lender’s official website—not the number, email address, QR code, or link in the letter. If money or account information has already been exposed, immediately contact the bank or e-wallet through its official fraud channel and ask it to flag the transaction and secure the account. Then report the incident to the PNP Anti-Cybercrime Group or the NBI. Also notify the appropriate regulator: the BSP for a BSP-supervised institution, or the SEC for a lending or financing company.

A fake letter does not automatically create a valid debt. Whether any enforceable loan exists depends on evidence of a genuine application, consent, agreement, release of proceeds, and the applicable law. Do not acknowledge or pay a supposed debt merely because a scammer threatens collection, payroll deduction, arrest, or a lawsuit.

How the scam usually works

The sender may claim that a salary loan has been “approved,” sometimes without any application. The document may imitate a bank, lending company, government agency, cooperative, employer, or benefits institution. It may contain a logo, reference number, signature, employee details, or a convincing payment schedule.

The scammer then asks the recipient to:

pay a fee before the loan can be released;
provide an OTP, PIN, password, card number, e-wallet credentials, selfie, or additional ID;
open a link or install an application;
send money to a personal or unfamiliar account;
“cancel” an unwanted loan by paying a charge;
surrender access to online banking, email, social media, or a mobile device; or
allow the use of an account to receive and forward funds.

Some letters misuse the name of a real institution. Others promote an unlicensed lender or invent a company entirely. A real company name on the document does not mean the company sent it.

What to do immediately

1. Stop communicating through the letter’s channels

Do not reply, call the listed number, scan its QR code, or open an attachment. If continued communication is necessary for an investigation, first ask law enforcement how to proceed. Do not arrange an entrapment or confrontation yourself.

2. Verify the supposed lender independently

Find the institution through an official government registry or type its known official website address yourself.

For banks, e-wallet issuers, payment providers, and other BSP-supervised institutions, use the BSP Financial Institution Verifier.

For a lending or financing company, verify both its corporate identity and its authority to operate with the SEC. Under the Lending Company Regulation Act, corporate registration alone is not enough: a lending company must also have SEC authority to operate. Use the SEC’s official lending-and-financing-company resources or contact the SEC directly. An online brand or app name may differ from the corporation operating it, so check both names.

Call the institution using a number from its official website, app, bank card, or account statement. Ask whether:

the reference or application number is genuine;
an application or account exists in your name;
any loan proceeds were released;
the named employee or agent works for the institution; and
the payment destination belongs to the institution.

Record the date, time, department, representative’s name, and official case number. Ask for written confirmation if the letter is fraudulent or no application exists.

3. If money was sent, contact the bank or e-wallet at once

Use the institution’s official fraud hotline or in-app support—not contact information supplied by the scammer. Provide the amount, date and time, transaction reference, recipient account or mobile number, and a short explanation that the transfer was induced by fraud.

Ask the institution to:

flag the transaction as disputed or fraudulent;
secure or restrict compromised access;
begin coordinated verification with the receiving institution;
preserve relevant records; and
issue a complaint or incident reference number.

The Anti-Financial Account Scamming Act provides mechanisms for institutions under BSP jurisdiction to address disputed transactions, including coordinated verification and temporary holding of funds in circumstances governed by BSP rules. Recovery is not automatic: it may depend on how quickly the incident is reported, whether funds remain traceable, and the results of verification.

Change compromised passwords from a clean device. Revoke unknown sessions, enable multi-factor authentication, lock affected cards, and tell your mobile provider immediately if your SIM suddenly loses service.

4. Notify your employer when employment information is involved

Contact HR, payroll, or the company data-protection officer through an established internal channel if the letter contains nonpublic salary, employee-number, payroll-account, or employment information, or if it threatens salary deduction.

Ask whether the company has any arrangement with the supposed lender and whether it received a deduction request. Tell payroll in writing that you dispute any unauthorized loan or deduction. Preserve HR’s response.

An employer should not be treated as the lender’s authenticating agent unless it actually administers the benefit or payroll arrangement. Likewise, the appearance of an employer’s name or logo does not establish consent to a loan.

Preserve evidence before blocking or deleting

Electronic records can disappear quickly. Keep the original material in its native form whenever possible.

Preserve:

the complete email, including headers and attached files;
the original PDF, image, or document—not only a cropped screenshot;
screenshots showing the profile name, account handle, phone number, URL, dates, times, and full conversation;
SMS messages, call logs, voicemail, and audio recordings lawfully in your possession;
the fraudulent website address and screenshots of each relevant page;
payment instructions, QR codes, account names and numbers, receipts, and transaction references;
the envelope and courier details if the letter arrived physically;
the application or app-package name, permissions requested, and download source;
copies of IDs or forms already submitted;
official fraud-report and complaint reference numbers; and
a chronological written account of what happened while your memory is fresh.

Do not edit the original files. Store copies in a secure location and note when and how each item was received. The Supreme Court’s Rules on Electronic Evidence recognize electronic documents, subject to requirements concerning authenticity and reliability. Screenshots are useful, but preserving the underlying email, file, chat export, or device data may provide stronger context.

Where to report

PNP or NBI: for the criminal scam

You may report an attempted or completed scam even if no money was lost. Bring a government-issued ID, a clear timeline, the fake letter, communications, transaction records, and the institution’s verification if available.

Official channels listed by the BSP include:

PNP Anti-Cybercrime Group: acg@pnp.gov.ph; telephone (02) 3414-1560; mobile 0998-598-8116
NBI Anti-Fraud and Action Division: afad@nbi.gov.ph; (02) 8523-8231 to 38, local 3529 or 3456
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38, local 3455; (02) 8252-6228

These details are published on the BSP’s official scam-reporting page. Confirm contact information on the agency’s official site before sending sensitive documents.

A blotter or incident report may document the event, but ask the receiving office what additional complaint-affidavit, authentication, or supporting records are needed for investigation or prosecution.

BSP: when a BSP-supervised institution is involved

First report the matter to the institution’s Financial Consumer Protection Assistance Mechanism or official customer-service channel. Keep its reference number and response.

If the institution does not act within a reasonable period or its response is unsatisfactory, escalate through the BSP Consumer Assistance Mechanism:

use the BOB chatbot on the BSP website;
use the Message function on the BSP’s official Facebook page; or
if BOB is inaccessible, complete the BSP Complaint/Inquiry/Reply form and email it, with proof of your first-level complaint, to consumeraffairs@bsp.gov.ph.

The BSP’s current complaint instructions warn complainants not to include PINs, passwords, full account or card numbers, passbooks, passports, or identification cards that are unnecessary for processing. Redact irrelevant sensitive details from attachments.

BSP consumer assistance addresses complaints involving BSP-supervised institutions; it is not a substitute for a criminal complaint to the PNP or NBI.

SEC: when a lending or financing company is involved

For complaints involving lending or financing companies, use the SEC iMessage system or the SEC’s official complaint process. The SEC’s published instructions require a completed complaint form, a valid government-issued ID, supporting evidence, and one complaint form for each respondent company.

The SEC’s complaint guidance explains that it may evaluate the evidence, obtain the company’s answer, refer the matter internally, or begin administrative proceedings when warranted. The SEC cannot, through that complaint process alone, rewrite a contract, declare it void, or cancel a loan obligation. Contract validity and civil liability may require separate legal proceedings.

If the company denies issuing the letter, include that denial in the law-enforcement report. If the supposed company cannot be verified or lacks authority to operate, clearly state that fact without assuming who created the letter.

NTC or the relevant platform: for the communication channel

Report the number, account, advertisement, page, or app to the telecommunications provider or platform so it can assess blocking or removal under its rules. For scam texts, the BSP lists the National Telecommunications Commission’s Consumer Welfare and Protection Division at consumer@ntc.gov.ph.

Platform reporting helps limit further contact, but it does not replace reports to the financial institution, regulator, or law enforcement.

What laws may apply

The precise charge depends on what the sender did, the document used, the information obtained, whether money or property changed hands, and the available evidence.

Potentially relevant laws include:

Estafa by false pretenses. Article 315 of the Revised Penal Code may apply when false representations made before or during the fraud induce a person to part with money or property and cause damage. A fake approval letter alone does not establish every element; reliance and loss must be proved for this form of estafa.
Falsification or use of a falsified document. Articles 171 and 172 may apply depending on the document’s character, the falsification committed, intent or damage, knowledge, and use. Not every inaccurate or fabricated-looking letter automatically satisfies the elements of criminal falsification.
Cybercrime-related liability. Section 6 of the Cybercrime Prevention Act covers crimes under the Revised Penal Code and special laws when committed through information and communications technology, with the statutory consequence stated there. The Supreme Court upheld this treatment in Disini v. Secretary of Justice.
Financial-account scamming. The Anti-Financial Account Scamming Act addresses social-engineering schemes that obtain sensitive identifying information through deception and result in unauthorized access and control of a financial account. It also prohibits specified money-muling conduct and certain uses of another person’s identity. Its application is fact-specific.
Other offenses. Unauthorized access, misuse of personal information, threats, impersonation, or account trafficking may engage other provisions of the Cybercrime Prevention Act, the Data Privacy Act, the Access Devices Regulation Act, or the Revised Penal Code. Investigators and prosecutors determine which provisions the evidence supports.

Avoid publicly accusing a named individual unless the identity and facts are verified. Give evidence to the proper authorities instead.

Does the letter mean you owe a loan?

Not by itself. An approval letter is evidence to examine, not conclusive proof of a valid loan or debt.

Request from the institution:

the application and proof of how it was authenticated;
the signed or electronically accepted loan agreement;
required disclosures and the repayment schedule;
records identifying where and when proceeds were released;
the destination account;
consent for any payroll deduction; and
the institution’s investigation result.

If proceeds were released to an account you do not own or control, state that clearly and provide proof if available. If money entered your account unexpectedly, do not spend or forward it. Contact the institution through official channels because the transfer may require controlled reversal and may be connected to fraud.

A dispute about consent, electronic signatures, identity theft, or receipt of proceeds is highly document-dependent. Obtain legal advice before signing an acknowledgment, restructuring agreement, settlement, waiver, or promissory note.

Common mistakes to avoid

Paying a small fee because the promised loan is much larger
Trusting a document merely because it has a logo, signature, seal, or QR code
Calling only the number printed in the suspicious letter
Sending an OTP or screen-sharing with a supposed verification officer
Installing an app sent as a file or through an unofficial link
Deleting the conversation after blocking the sender
Posting unredacted IDs, account numbers, or evidence on social media
Moving scam proceeds through your account for a commission
Assuming a corporate registration automatically authorizes lending
Waiting for a regulator’s response before notifying the bank about a recent transfer
Treating a platform report as a criminal complaint
Paying a disputed debt simply because the sender threatens immediate arrest

Ordinary nonpayment of a genuine civil debt does not by itself authorize a private lender to arrest a borrower. However, threats, court papers, payroll deductions, or an identity-based loan should not be ignored; verify them promptly and seek advice.

When legal help is urgent

Consult a Philippine lawyer or the Public Attorney’s Office promptly if:

a substantial amount was transferred;
a loan was actually opened or proceeds were released in your name;
payroll deductions have started or are about to start;
the scammer possesses your IDs, biometrics, signature, or account credentials;
you receive a subpoena, prosecutor’s notice, demand letter, summons, or court order;
the lender reports or threatens to report the disputed account as yours;
your account was used to receive or forward suspected criminal proceeds;
the incident involves an insider, organized group, repeated victims, or cross-border transfers; or
there are threats to safety, extortion, stalking, or disclosure of personal information.

Call emergency services or go to the nearest police station if there is an immediate threat to a person’s safety.

FAQ

Can I report the scam if I did not send money?

Yes. Preserve the attempted scam and report it. The evidence may help authorities connect the sender, account, domain, or payment destination to other complaints.

Should I pay a cancellation fee for a loan I never requested?

No. Verify the supposed loan directly with the named institution. A demand for money to cancel an unsolicited loan is a strong warning sign.

Can the scammer deduct money from my salary using the letter?

A letter alone does not prove authority to deduct wages. Notify payroll and HR in writing that you dispute the transaction and request copies of any application, authorization, or deduction instruction received.

Is an SEC-registered company automatically a legitimate lender?

No. A lending company must have the required SEC authority to operate. Also verify that the person, page, app, and payment account actually belong to that company.

Will reporting guarantee that my money is returned?

No. Reporting quickly may improve the chance that an institution can trace or hold remaining funds, but recovery depends on the transaction, timing, account trail, applicable rules, and investigation.

Should I send my complete ID and bank statement to every agency?

Send only what the official process requires, through verified channels. Redact unrelated account numbers, balances, passwords, PINs, OTPs, and other unnecessary sensitive information. Keep an unredacted evidence copy securely for investigators if formally requested.

Is the sender automatically guilty of estafa or falsification?

No. Criminal liability must be established through evidence and the elements of the particular offense. Describe the facts accurately and let investigators, prosecutors, and courts make the legal determination.

Official resources

This article provides general legal information, not legal advice or a prediction of any case’s outcome. The proper remedy depends on the documents, communications, transactions, institutions, and other facts involved. Laws, procedures, and official contact details were checked against primary and official sources current as of September 5, 2026.