(Philippine legal context; general information, not legal advice.)

1) What “non-withdrawable winnings” scams look like

These scams usually involve a mobile app, website, or social media “game” that shows you’ve “won” money, credits, or a jackpot—but blocks cash-out unless you do one or more of the following:

Pay “processing/withdrawal fees,” “tax,” “AML verification,” “membership upgrade,” or “account activation” fees (often escalating amounts).
Deposit more to “unlock” a withdrawal tier or “reach minimum turnover.”
Invite referrals or complete “tasks” to become “eligible.”
Provide sensitive personal data (IDs, selfies, bank details) as “KYC,” then still refuse withdrawal.
Use a specific e-wallet/crypto address with time pressure and threats (account freeze, forfeiture).

A common pattern is: small initial withdrawal succeeds to build trust → larger “winnings” appear → withdrawal blocked → repeated payments demanded → zero payout.

2) Why this is usually a scam (and not a legitimate gaming rule)

In legitimate regulated platforms, withdrawal conditions are clear, stable, and enforced by published terms, and fees are not repeatedly demanded in escalating “unlock” steps. Scams rely on:

Deceptive representations (fake winnings, fake “regulatory” requirements, fake customer support).
Pressure tactics (deadlines, threats, “one-time chance”).
Moving goalposts (new requirements after you comply).

Even if the app calls itself “casino,” “investment game,” “reward app,” or “task platform,” the core issue is often fraud and deceit, not a real entitlement to winnings.

3) Key Philippine laws that can apply

A. Criminal liability

Estafa / Swindling (Revised Penal Code) If you were induced to part with money due to false pretenses (e.g., “pay fee to withdraw” when withdrawal will never happen), that is commonly treated as estafa. Estafa also covers schemes where deceit causes damage.
Cybercrime Prevention Act (RA 10175) When fraud is committed using ICT (apps, websites, messaging, online payment channels), the conduct may qualify as a computer-related offense, typically pursued alongside or as “estafa through computer” theories in practice. RA 10175 also supports preservation/disclosure and cybercrime investigative procedures.
E-Commerce Act (RA 8792) Recognizes electronic data messages and electronic documents and supports the admissibility of electronic evidence (screenshots, logs, messages), subject to rules on authenticity and integrity.
Other possible offenses depending on facts

Identity theft / misuse of personal info (often prosecuted under cybercrime-related provisions where applicable, plus privacy laws below).
Illegal gambling aspects may arise if the app is effectively an unlicensed gambling platform (see PAGCOR discussion).

B. Civil liability (money recovery)

You may pursue civil action to recover amounts paid (fees/deposits), damages, and possibly attorney’s fees, often anchored on the same fraudulent acts. In Philippine practice, civil liability may be pursued together with the criminal case (as the civil liability arising from the offense), unless reserved or filed separately.

C. Data privacy liability

Data Privacy Act (RA 10173) may apply if scammers collected, processed, or exposed your personal data unlawfully (IDs, selfies, bank details, contacts), or used it to harass/blackmail. Complaints can be brought before the National Privacy Commission (NPC).

D. Regulatory issues (gaming, payments, investments)

Gaming / gambling regulation (PAGCOR) If the scheme presents itself as an online casino/sportsbook/slots, it may be operating illegally if not properly authorized. Even where a platform claims “licensed,” scammers often misuse logos and fake certificates. Reporting can be made as an illegal gambling concern and consumer harm issue.
Securities/investment angle (SEC) Some “game apps” are really investment solicitations (promise returns, “earn by topping up,” “profit sharing,” referral commissions). If it resembles an investment contract, pooling, or solicitation to the public, it may be an unregistered securities offering or involve investment fraud—reportable to the Securities and Exchange Commission.
Payments and e-money (BSP, banks, e-wallets) If you sent money via bank transfer, card, or e-wallet, report immediately to the provider. Banks/e-wallets may freeze funds, flag accounts, and generate records useful for law enforcement. If the entity is regulated (payment institution), BSP consumer assistance channels may be relevant.

4) Where to report in the Philippines (primary routes)

Because these scams are cyber-enabled, reporting is typically most effective through cybercrime units plus the payment channel and (when applicable) sector regulators.

A. Law enforcement & prosecution (core)

PNP Anti-Cybercrime Group (PNP-ACG) Handles cybercrime complaints nationwide; commonly accepts walk-in complaints and can coordinate investigations.
NBI Cybercrime Division Also investigates cyber-enabled fraud; useful especially where there are larger networks, multiple victims, or cross-border elements.
DOJ Office of Cybercrime (DOJ-OOC) Coordinates cybercrime policy and international cooperation and can be involved in cybercrime-related matters; prosecution is generally through the Office of the City/Provincial Prosecutor where the complaint is filed, but cybercrime coordination may be relevant in certain cases.

B. Regulators / administrative bodies (as applicable)

National Privacy Commission (NPC) – for unlawful processing, breach, doxxing, harassment using your personal data.
Securities and Exchange Commission (SEC) – for investment-style scams, unregistered solicitation, “earn by topping up,” referral-based profit schemes.
Bangko Sentral ng Pilipinas (BSP) / your bank/e-wallet – for payment tracing, disputed transactions, mule accounts, and consumer complaints about regulated payment firms.
PAGCOR / authorities addressing illegal gambling – if the app is an illegal gambling site/app or uses gambling mechanics without authorization.

C. Platform and telecom reports (supporting)

Report the app to Google Play / Apple App Store and the scam accounts to Facebook/Instagram/TikTok/Telegram etc.
Report fraudulent numbers to your telco (helps disrupt but doesn’t replace a case filing).

5) Before you report: what to do immediately (damage control)

Stop paying further “fees” or “unlock” deposits.
Secure your accounts: change passwords, enable 2FA, revoke app permissions, remove unknown devices/sessions.
Notify your bank/e-wallet immediately (time matters). Ask about:
- dispute/chargeback options (cards),
- fund recall (transfers),
- freezing of recipient accounts,
- transaction documentation (official transaction reference, beneficiary details).
Preserve evidence (see evidence checklist below).
If you shared IDs/selfies, consider a privacy incident plan: monitor accounts, watch for loan/credit fraud attempts, and keep copies of what you submitted.

6) Evidence checklist (make your case easier to act on)

Prepare a folder (cloud + offline) with:

A. Identity and contact info

Government ID (for complaint filing), contact number, email, address.

B. App / site proof

App name, package name (if available), developer name, store listing link, version, screenshots of listing.
Website URL(s), domain info you can capture, screenshots of pages.
Screenshots/screen recordings showing: “winnings,” withdrawal attempt, error messages, “verification needed,” and the demanded fees.

C. Communication proof

Chat logs (in-app support, Messenger/Telegram/WhatsApp/SMS), including usernames, IDs, phone numbers, and timestamps.
Voice call logs, any recorded calls (if you have them).

D. Money trail (most important)

Receipts, transaction IDs, reference numbers, screenshots from bank/e-wallet.
Amounts, dates, channels used (bank transfer, e-wallet, card, crypto).
Recipient details: account number, account name, bank/e-wallet, wallet address, QR codes used.
Any “invoice” or “tax” documents sent to you (often fake but still evidence).

E. Device metadata (helpful)

Screenshots showing date/time, device details if possible.
Exported chat files where available.

Tip: Don’t edit screenshots. Keep originals. If you must annotate for clarity, keep an unmarked copy too.

7) How to file a complaint (practical Philippine process)

Step 1: Draft a clear incident narrative

Write a chronological story (1–3 pages) including:

When/how you found the app, who contacted you, promises made.
What “winnings” were displayed and when.
Every payment you made (date, amount, channel, recipient).
What was demanded for withdrawal and how it escalated.
The final outcome (no withdrawal, threats, account locked, etc.).

Step 2: Choose where to lodge the complaint

If you want police action: PNP-ACG.
If you want NBI investigation: NBI Cybercrime.
If it has strong investment solicitation elements: include SEC report too.
If your data was abused: include NPC complaint too. You can pursue multiple channels; just keep your statements consistent.

Step 3: Execute an affidavit-complaint (common requirement)

Often, you’ll be asked to execute an affidavit attaching your evidence. In many settings, this is notarized. Your affidavit typically includes:

Your identity and competency
Detailed narration of facts
Identification of suspects (even if only handles/accounts)
Specific amounts lost
Attached annexes (screenshots, receipts, chat logs)

Step 4: Submit evidence and get a reference/case number

Ask for documentation that your complaint was received. Keep names, office, and dates.

Step 5: Cooperate with follow-ups

Investigators may request:

device access (sometimes forensic extraction),
additional statements,
bank certification/records,
identification of accounts,
sworn identification of screenshots/chats.

Step 6: Prosecutor filing and case build-up

Criminal complaints proceed to the prosecutor for evaluation (inquest/preliminary investigation, depending on circumstances). Expect requests for clarifications and possibly additional affidavits.

8) Legal characterization: “winnings” vs. actual loss

A frequent confusion: “I won ₱X, so I’m entitled to ₱X.” In scams, the displayed “winnings” are often fabricated. The legally provable loss is usually the money you actually paid (fees, deposits, transfers) plus potential damages. That doesn’t mean the scam is “smaller”—it means your strongest, most documentable claim is the out-of-pocket amounts you can trace.

If the platform is truly a gambling product, additional complexities exist (licensing, enforceability, terms). But with scam patterns (fake platform, fake KYC/tax demands), the case centers on fraudulent inducement, not legitimate gaming obligations.

9) If the scam involves crypto

Crypto adds tracing difficulty but is still reportable. Preserve:

wallet addresses, transaction hashes, exchange accounts used, screenshots of on-chain transfers, and any instructions given. If you used a centralized exchange (CEX), report to the exchange immediately; they may freeze funds if the destination is within their control or if recipients attempt cash-out through them. Investigators may seek exchange records through legal processes.

10) If you’re being threatened, blackmailed, or doxxed

Some scammers threaten to expose your photos/ID, contact your family, or accuse you of wrongdoing unless you pay. In that case:

Preserve the threats and sender identifiers.
Consider a parallel complaint involving harassment/extortion-related conduct, and a Data Privacy Act angle if personal data is being misused.
Do not pay “silence fees.” It usually escalates.

11) Common mistakes that weaken complaints

Deleting chats or uninstalling the app before preserving data.
Only providing screenshots of “winnings” but not the money trail.
Omitting exact transaction references and recipient account details.
Paying repeatedly after recognizing a pattern (still reportable, but scammers exploit sunk cost).
Letting too much time pass before notifying banks/e-wallets.

12) What outcomes are realistic

Account disruption (takedowns, freezes of mule accounts) can happen faster than full prosecution.
Recovery of funds is possible but not guaranteed; it depends on speed, traceability, and whether funds remain in accessible accounts.
Prosecution can be challenging if perpetrators are offshore or masked, but mule accounts, payment conduits, and local facilitators can still be pursued.

13) Template: incident timeline (copy format)

Date/Time: Found app/link via (FB ad / TikTok / friend / Telegram).
Date/Time: Registered account; username/ID: ____.
Date/Time: App displayed winnings of ₱____ after (game/task).
Date/Time: Attempted withdrawal; message shown: “____.”
Date/Time: “Support” (name/handle) instructed me to pay ₱____ to ____ (account name/number/wallet).
Payments made:
1. ₱____ on ____ via ____ ref no. ____ to ____
2. ₱____ on ____ via ____ ref no. ____ to ____
After payment: new requirement demanded: ____.
Current status: No withdrawal; account (locked / active but blocked); threats received: (yes/no).
Total amount paid: ₱____.

14) Quick guide: choosing the right reporting path

You paid fees/deposits and got nothing: file cyber-enabled fraud complaint (PNP-ACG / NBI Cybercrime).
The app promised “returns,” “profit,” “earnings,” referrals, top-ups: add SEC report.
Your ID/photos were collected or misused: add NPC complaint.
Bank/e-wallet used: immediately notify provider; request fraud handling and documentation.
It looks like an unlicensed online casino: include illegal gambling report channels (and still file cyber-fraud).

15) Prevention notes (so you can describe red flags in your affidavit)

Withdrawals that require paying money first are the biggest red flag.
Fake “tax” demands: Philippine taxes are not collected by random apps before releasing winnings.
“Anti-money laundering fee” demands by unverified apps are a common scam script.
Pressure tactics and constantly changing requirements signal deceit.