Being asked to “pay first before withdrawal” is one of the clearest red flags in online loan app scams in the Philippines. If the app says your loan is “approved” but you must first send a “processing fee,” “unlocking fee,” “verification fee,” “advance interest,” “tax,” “AML fee,” “OTP fee,” or any amount through GCash, Maya, bank transfer, Telegram, Facebook Messenger, or a personal account before the money is released, treat it as a likely scam and stop paying immediately. The SEC has warned that advance fee loan scammers often pretend to be legitimate lending companies, use fake websites or IDs, promise easy large loans, and ask for upfront payments; legitimate registered lending or financing companies do not ask for advance payments before releasing the loan, and processing fees are usually deducted from the loan proceeds instead. (Philippine Information Agency)

This guide explains what the law says, why you usually do not owe a “loan” that was never released, what evidence to save, where to report the scam, what to do if the app threatens or shames you, and what Filipinos abroad or foreigners dealing with a Philippine online lender should know.

What “Pay Before Withdrawal” Usually Means

In a genuine loan transaction, the lender evaluates your application, discloses the loan terms, releases the money, then collects according to the agreement. In a pay-before-withdrawal scam, the supposed lender reverses the process: it shows a fake approved amount or “loan wallet balance,” then repeatedly invents obstacles to make you send more money.

Common scripts include:

“Your loan is approved, but you must pay a processing fee before withdrawal.”
“Your account was frozen because of wrong bank details. Pay to correct it.”
“Your credit score is low. Deposit a guarantee fee.”
“Your money is ready, but you need to pay tax or insurance first.”
“Pay the OTP fee so we can transfer to your GCash.”
“You breached the contract, so you must pay penalties even if you did not receive the loan.”
“If you do not pay, we will report you to the barangay, NBI, police, immigration, or your employer.”

This is different from a legitimate loan where charges are clearly disclosed in writing before the transaction and are deducted from or included in the computation of the loan. Under the Truth in Lending Act, Republic Act No. 3765, creditors must give the borrower a clear written statement before consummation of the credit transaction, including the finance charge in pesos and centavos and the simple annual rate. (Lawphil)

Is There a Valid Loan If No Money Was Released?

Usually, no loan is perfected if the loan money was never delivered.

Under the Civil Code of the Philippines, a simple loan or mutuum involves one party delivering money or another consumable thing to another, who must later pay the same amount of the same kind and quality. Article 1934 is especially important: even if there is an accepted promise to deliver a simple loan, the simple loan itself is not perfected until delivery of the object of the contract. (Lawphil)

In plain English: if the app never actually released the money to your bank account, e-wallet, or cash pickup channel, it should not collect from you as if you already borrowed the money.

There may be documents or app screens saying “loan approved,” “contract generated,” or “borrower confirmed.” But for an ordinary money loan, the key practical question is still: Did you actually receive the loan proceeds? If the answer is no, preserve proof that no disbursement occurred.

Useful proof includes:

Bank or e-wallet transaction history showing no credit from the lender
Screenshots of the “frozen,” “pending,” or “wallet” screen
Chats where they demand payment before release
Payment receipts for any upfront fees you already sent
The recipient’s name, account number, mobile number, QR code, or e-wallet number
App name, package name if visible, website URL, Facebook page, Telegram handle, and phone numbers used
Any “loan agreement” or promissory note they sent

The Main Philippine Laws That Apply

Lending companies must be authorized by the SEC

A lending company in the Philippines must be a corporation, and it cannot conduct lending business unless it has authority to operate from the Securities and Exchange Commission under Republic Act No. 9474, the Lending Company Regulation Act of 2007. The law also penalizes those who engage in lending business or hold themselves out as a lending company without valid SEC authority. (Supreme Court E-Library)

This matters because many scam loan apps use the name of a real company, a fake SEC certificate, or a screenshot of another company’s registration. SEC registration of a corporation is not the same as authority to operate as a lending or financing company, and a lending company’s online lending platform should also be properly disclosed or recorded with the SEC. Government reports in 2025 noted SEC cease-and-desist orders against online lending firms whose unrecorded online lending platforms violated SEC Memorandum Circular No. 19, Series of 2019. (Philippine News Agency)

Financial consumers have rights against fraud, abusive collection, and misuse of data

Republic Act No. 11765, the Financial Products and Services Consumer Protection Act, protects financial consumers’ rights to fair treatment, disclosure and transparency, protection against fraud and misuse of assets, data privacy, and timely complaint handling. It applies to financial products and services, including digital financial products accessed through digital channels. (Supreme Court E-Library)

RA 11765 also gives regulators like the SEC authority to act against covered financial service providers, including enforcement actions, cease-and-desist orders, suspension, fines, and consumer redress mechanisms. It also requires financial service providers to have a consumer assistance mechanism and prohibits abusive collection or debt recovery practices. (Supreme Court E-Library)

Advance-fee deception may be estafa or cybercrime

If someone deceives you into sending money by pretending that a loan will be released after you pay a fee, the facts may support a complaint for estafa, also called swindling, under Article 315 of the Revised Penal Code.

The Supreme Court in People v. Mateo described estafa by deceit as involving a false pretense or fraudulent representation made before or at the time of the fraud, reliance by the victim, inducement to part with money or property, and resulting damage. (Supreme Court E-Library)

If the scam is done through an app, website, social media account, messaging platform, fake computer record, or online identity, Republic Act No. 10175, the Cybercrime Prevention Act of 2012, may also be relevant. The law covers computer-related fraud, computer-related identity theft, and crimes under the Revised Penal Code or special laws committed through information and communications technology. (Supreme Court E-Library)

Harassment and contact-list shaming can violate SEC and privacy rules

Debt collection is not automatically illegal. A real lender may collect a real, released, due loan using lawful means. What is prohibited is abusive, deceptive, threatening, or privacy-invasive collection.

SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair debt collection practices by financing and lending companies and their third-party service providers. Examples include threats of violence or criminal means, threats to take action that cannot legally be taken, obscenities or insults amounting to abuse, disclosure or publication of borrowers’ names and personal information, false representation or deceptive means to collect, contacting at unreasonable hours, and contacting people in the borrower’s contact list other than guarantors or co-makers.

A 2026 public advisory issued by the DICT, NPC, and SEC also emphasized that online lending platforms must not engage in unnecessary, excessive, or disproportionate processing of personal data, especially access to contact lists. It states that contacting persons on a borrower’s contact list other than named guarantors is prohibited, and that for debt collection, lenders or persons acting as such may contact only the guarantor.

What To Do Immediately If the Loan App Asks You To Pay Before Withdrawal

Stop sending money. Scammers often ask for a small amount first, then say there is another error and demand a larger amount. Once you pay, they usually keep inventing new reasons.
Do not send OTPs, passwords, MPINs, selfies, IDs, or screen-sharing access. If you already sent sensitive information, immediately change passwords, revoke app permissions, contact your bank or e-wallet provider, and monitor for unauthorized transactions.
Take screenshots before blocking. Save the app screen, loan amount, supposed contract, payment instructions, QR codes, account names, mobile numbers, and threats. Export the chat if possible.
Do not install APK files sent through chat. A legitimate app should normally be obtained from official or verified sources. The 2026 DICT-NPC-SEC advisory specifically reminds borrowers to download online lending platforms only from official or verified sources and to ensure they are operated by duly registered and licensed entities.
Check whether the lender is real. Use the SEC’s official verification channels, including Check with SEC and the SEC iMessage complaint portal. The SEC iMessage portal allows the public to open a new ticket and check ticket status. (imessage.sec.gov.ph)
Contact your bank or e-wallet if you paid. Report the transaction as scam-related. Ask whether the receiving account can be flagged, frozen, or investigated. Provide screenshots and receipts.
Warn your contacts if the app accessed your phonebook. A short message is enough: “A fake loan app may contact you using my name. I did not authorize them to contact you. Please ignore, screenshot, and send me any messages.”
Report to the proper agency based on the problem. SEC handles lending and financing company complaints. NBI Cybercrime Division or PNP Anti-Cybercrime Group handles scams, threats, identity theft, and cybercrime. NPC handles privacy violations such as misuse of contacts, public shaming, and unauthorized processing of personal data.

Where To Report an Online Loan App Scam in the Philippines

Problem	Where to report	What to prepare	Practical notes
Fake lending company, unauthorized online lending platform, unfair collection by a lending or financing company	SEC Financing and Lending Companies Department through the SEC iMessage complaint portal	Screenshots, app name, company name, loan agreement if any, payment receipts, valid ID, proof you contacted the company if it is a known regulated company	SEC iMessage lets users open a ticket and check status. If the “company” is fake or cannot be contacted, explain that in your complaint. (imessage.sec.gov.ph)
Advance-fee scam, threats, identity theft, fake website, fake account, hacked account, cyber harassment	NBI Cybercrime Division, PNP Anti-Cybercrime Group, or DICT Cyber Hotline	Screenshots, transaction receipts, account numbers, URLs, phone numbers, chat handles, IDs used by scammer, timeline of events	NBI’s Citizen’s Charter for computer crime victims lists no initial checklist requirement and no fee for filing assistance, with initial complaint assistance and interview steps. (National Bureau of Investigation)
Misuse of contacts, public shaming, unauthorized access to personal data, threats to message your employer or relatives	National Privacy Commission	Notarized complaint form, screenshots, evidence of unauthorized data use, IDs, narrative of events	NPC formal complaints must be in the required format, printed, filled out, notarized, and submitted in person, by courier, or by scanned email to the NPC. (National Privacy Commission)
Urgent scam report or cyber incident coordination	DICT Cyber Hotline / CICC channels	Basic incident details, screenshots, links, phone numbers, receiving accounts	The 2026 DICT-NPC-SEC advisory lists DICT Cyber Hotline email, NBI Cybercrime Division, and PNP Anti-Cybercrime Group as reporting channels for harassment, threats, frauds, and scams.
Local threats, in-person intimidation, or need for a local record	Nearest police station or barangay for blotter, then NBI/PNP cyber unit for online evidence	Printed screenshots, phone number, account name, timeline	A barangay blotter can help document harassment, but cybercrime investigation usually requires police cyber units, NBI, or prosecutors.

How To Write Your Complaint Narrative

Keep your complaint simple, chronological, and evidence-based. Avoid emotional conclusions and focus on facts that investigators can verify.

A useful format is:

Who you are. State your name, address or city, contact number, email, and whether you are the borrower, reference, family member, or victim of identity misuse.
How you found the loan app or person. Mention whether it came from Facebook, TikTok, Google ad, app store, APK link, Telegram, WhatsApp, SMS, or referral.
What they promised. State the supposed loan amount, term, interest, and release method.
What they demanded before release. List each payment request: date, amount, reason, account name, account number, and channel used.
Whether you received the loan proceeds. Be clear: “I did not receive any loan proceeds” or “I received only ₱___ but they are collecting ₱___.”
What happened after you refused or stopped paying. Include threats, contact-list messages, employer messages, public posts, fake warrants, or fake legal notices.
What evidence you attached. Number your screenshots and receipts so the agency can follow the story easily.

Example wording:

I applied for an online loan through [app/page name] on [date]. The app showed that I was approved for ₱[amount], but before withdrawal, the representative required me to pay ₱[amount] as [reason]. I paid through [GCash/Maya/bank] to [account name/number]. After payment, they demanded another ₱[amount] for [reason]. I never received the loan proceeds. When I refused to pay more, they threatened to contact my family/employer and send my information to my contacts. Attached are screenshots, payment receipts, account details, and my bank/e-wallet transaction history showing that no loan was released.

If They Threaten To File a Case Against You

Scam loan apps often use legal-sounding threats to scare victims into paying. They may send fake subpoenas, fake NBI notices, fake barangay summons, or fake “hold departure” warnings.

Remember these points:

A private loan app cannot issue a warrant of arrest.
Barangay officials do not collect online loan app debts for scammers.
NBI, police, prosecutors, and courts do not ask for settlement through random GCash numbers.
A real court case or prosecutor proceeding uses official processes, written notices, docket numbers, and identifiable offices.
A supposed lender cannot truthfully collect a loan amount that was never released.

If the message contains threats of violence, threats to shame you, threats to message all your contacts, or threats to take illegal action, preserve it. Those facts may support complaints for unfair debt collection, privacy violations, grave threats or coercion depending on the facts, estafa, or cybercrime.

If They Already Contacted Your Family, Employer, or Contacts

Contact-list harassment is common in online lending abuse. The important thing is to control the damage and preserve evidence.

Do this:

Ask the contacted person to send you screenshots showing the sender’s number, name, message, date, and time.
Ask them not to argue with the collector or scammer.
Tell them not to send money or personal information.
Save all screenshots in a folder.
Include the contacted person’s screenshot in your SEC, NPC, NBI, or PNP complaint.
If the message says you committed a crime, includes private information, or contains insults, note exactly who received it and when.

The DICT-NPC-SEC advisory makes the key rule clear: character references are not the same as guarantors, and a guarantor must separately consent to assume responsibility for the loan.

If You Are an OFW, Abroad, or a Foreigner

You can still report an online loan app scam even if you are outside the Philippines, especially if the lender, victim, phone number, e-wallet, bank account, data processing, or targeted person is connected to the Philippines.

For privacy issues, the Data Privacy Act applies to personal information processing in the Philippines and can also apply to acts outside the Philippines when they relate to personal information about a Philippine citizen or resident, or when the entity has links with the Philippines. (National Privacy Commission)

Practical tips:

Use online reporting first, especially SEC iMessage, NPC email submission, DICT/CICC channels, and the email channels listed by agencies.
Use your passport or foreign government ID if you do not have a Philippine ID.
State your current country and time zone.
If an agency later requires a sworn affidavit, Filipinos abroad can usually execute documents for use in the Philippines before a Philippine Embassy or Consulate; Philippine Consulates can notarize affidavits and other documents for use in the Philippines, and personal appearance is normally required. (Philippine Consulate LA)
Foreigners abroad should ask the receiving Philippine agency whether it will accept a locally notarized and apostilled affidavit, or whether consular notarization or another form is required.

Common Mistakes To Avoid

Paying “just one last fee”

Scammers rely on sunk cost. After you pay ₱1,000, they ask for ₱3,000. After you pay ₱3,000, they ask for ₱8,000. Each payment makes it harder emotionally to stop. Stop as soon as the loan is not released.

Believing a screenshot of SEC registration

A corporation may be registered with the SEC for ordinary corporate existence, but that does not automatically mean it has authority to operate as a lending company. RA 9474 requires lending companies to have SEC authority to operate. (Supreme Court E-Library)

Deleting the app before saving evidence

If you delete everything immediately, you may lose the app name, fake contract, transaction screen, and account details. Save evidence first, then revoke permissions and uninstall.

Sending more IDs to “cancel” the loan

Some scammers say you need to submit another ID, selfie, or video to cancel. That can worsen identity theft risk. Instead, document your cancellation request in writing and report the scam.

Secretly recording calls without thinking

Screenshots, chat exports, receipts, and call logs are usually safer evidence. If a threat is made by call, write down the date, time, number, speaker name if known, and exact words as soon as possible.

Ignoring data privacy harm because no money was lost

Even if you did not pay, unauthorized access to your contacts, public shaming, and threats to disclose personal information can still be reportable privacy and harassment issues.

Frequently Asked Questions

Is it legal for an online loan app to ask for payment before releasing the loan?

A demand for payment before withdrawal is a major scam warning. The SEC has warned that legitimate registered lending and financing companies do not ask for advance payments before release; processing fees are usually deducted from the loan itself. (Philippine Information Agency)

Do I have to pay if the app says I signed a loan contract but I never received the money?

For a simple money loan, Civil Code Article 1934 says the loan is not perfected until delivery of the object of the contract. If no money was released to you, preserve proof of non-release and dispute the collection. (Lawphil)

What if they deducted a “processing fee” from the approved loan amount?

A disclosed fee deducted from released proceeds can be different from an advance-fee scam. The issue is whether the fee was clearly disclosed before the transaction, whether the lender is authorized, whether the amount is lawful and reasonable, and whether you actually received the loan proceeds.

Can an online loan app contact my contacts?

They should not contact people in your phonebook just to pressure you. The 2026 DICT-NPC-SEC advisory states that contacting persons on the borrower’s contact list other than named guarantors is prohibited, and that only guarantors may be contacted for debt collection.

Where should I report first: SEC, NBI, PNP, or NPC?

Report to the SEC if the issue involves a lending or financing company, unauthorized online lending platform, or unfair debt collection. Report to NBI Cybercrime Division or PNP Anti-Cybercrime Group if there is fraud, threats, identity theft, fake accounts, or cyber harassment. Report to NPC if there is misuse of personal data, contact-list harassment, or public shaming.

Can I recover the money I already sent?

Recovery depends on how fast you report, whether the receiving account can be traced or frozen, and whether investigators can identify the account holder. Immediately report to your bank or e-wallet provider and include receipts in your NBI/PNP/SEC complaint.

What if the scammer used the name of a real lending company?

State that in your complaint. Attach the fake page, fake ID, fake certificate, phone number, payment account, and messages. Real companies may also want to know their name is being misused, but do not rely only on notifying the company; report to the proper government agencies.

Can foreigners complain about Philippine online loan app scams?

Yes, if there is a Philippine connection, such as a Philippine lender, Philippine e-wallet or bank account, Philippine phone number, Philippine resident victim, or personal data processed in or linked to the Philippines. Use online reporting channels and prepare a passport or government ID.

Should I block the collectors or scammers?

Save evidence first. After you have screenshots, receipts, phone numbers, and account details, you may block them to reduce harassment. If new numbers contact you, screenshot before blocking.

What if they threaten to post my photo or message my employer?

Treat that as urgent evidence. Save the threat, warn your employer or contacts briefly, and report to SEC, NPC, and NBI/PNP cyber channels. Threats, public shaming, and unauthorized disclosure of personal data may violate lending, privacy, and criminal laws depending on the facts.

Key Takeaways

Do not pay upfront fees before loan withdrawal. That is a classic advance-fee loan scam pattern.
No released money usually means no perfected simple loan under Civil Code Article 1934.
Legitimate lenders must be properly authorized and must disclose loan costs clearly.
Save evidence before blocking or deleting the app.
Report lending issues to SEC, cyber scam issues to NBI/PNP/DICT, and privacy abuse to NPC.
Contact-list harassment is not normal collection. Only true guarantors who consented separately may be contacted for debt collection.
If you already paid, act quickly with your bank or e-wallet provider and government complaint channels.