If an online loan app says your approved loan is “locked” and you must first pay an advance deposit, processing fee, tax, AML clearance, credit score repair fee, insurance fee, or “withdrawal unlock fee,” treat it as a serious red flag. In legitimate lending, the lender releases loan proceeds after approval and clearly discloses charges before you accept the loan. A demand for more money before you can withdraw the supposed loan is commonly an advance-fee scam. The safest first move is simple: do not pay another peso, preserve all evidence, secure your accounts, and report the app or persons involved to the proper Philippine authorities.

Why an “Advance Deposit to Unlock Withdrawals” Is Usually a Scam

The usual pattern looks like this:

You download a loan app or click a Facebook, TikTok, Telegram, WhatsApp, or SMS loan offer.
The app shows that you were approved for a large loan.
When you try to withdraw, the system says the funds are frozen.
“Customer service” tells you to pay a deposit or fee to unlock the withdrawal.
After you pay, they ask for another fee: wrong bank details, tax, anti-money laundering clearance, credit score correction, VIP upgrade, guarantor fee, notarization fee, or insurance.
The loan is never released.

This is not how a proper Philippine lending transaction should work.

A legitimate lender may charge interest, service fees, documentary stamp tax, notarial fees, insurance, or other lawful charges if properly disclosed. But these should be part of a clear loan agreement and disclosure statement, not an endless sequence of payments demanded through personal GCash numbers, Maya accounts, crypto wallets, QR codes, or bank accounts under unrelated names.

The biggest warning signs are:

The app says the loan is approved but cannot be withdrawn unless you pay first.
The fee recipient is an individual, not the registered lending company.
The app pressures you with a short deadline.
The “agent” refuses to provide a written loan agreement and disclosure statement.
The company name, SEC registration number, and Certificate of Authority number are missing or cannot be verified.
You are told not to report because it will “delay release.”
The app asks for your contacts, gallery, SMS, ID photos, face scan, or bank login beyond what is necessary.
The app threatens public shaming, barangay action, NBI action, deportation, or automatic arrest.

Is It Legal for an Online Loan App to Ask for Fees Before Releasing Money?

A fee is not automatically illegal simply because it is charged before or during a loan transaction. What matters is whether the lender is legitimate, whether the charge is lawful and clearly disclosed, and whether the borrower truly agreed to it.

In the Philippines, a lending company must generally be authorized by the Securities and Exchange Commission (SEC) before engaging in the business of lending. Under Republic Act No. 9474, the Lending Company Regulation Act of 2007, a lending company must be a corporation and must have authority to operate from the SEC.

Under Republic Act No. 3765, the Truth in Lending Act, creditors must disclose the true cost of credit, including finance charges, before the credit transaction is consummated. In plain English, you should know what you are paying, why you are paying it, and how it affects the total cost of the loan before you are bound.

So if an app says, “Pay ₱3,000 first so your ₱50,000 loan can be unlocked,” but gives no proper disclosure statement, no verifiable SEC authority, no signed loan contract, and no real release of funds, the issue is no longer an ordinary loan fee. It may be fraud.

Philippine Laws That May Apply

Estafa or Swindling Under the Revised Penal Code

If the app or agent used false representations to make you part with money, the facts may fall under estafa, or swindling, under Article 315 of the Revised Penal Code.

For example, estafa may be considered where a person falsely claims that:

your loan has already been approved;
the money is ready for withdrawal;
a deposit is required by law;
an “AML certificate” must be paid before release;
your bank account details are wrong and must be corrected for a fee;
the loan will be released immediately after payment.

In practical terms, investigators usually look for four things: a false representation, your reliance on that representation, payment of money because of it, and actual damage.

Cybercrime Issues Under RA 10175

If the scam was done through an app, website, fake account, electronic message, or hacked identity, the Cybercrime Prevention Act of 2012, RA 10175, may also become relevant depending on the facts.

Cybercrime authorities may look into issues such as identity theft, illegal access, computer-related fraud, phishing-style deception, fake websites, impersonation, and use of digital accounts to commit fraud.

Financial Account Scamming Under RA 12010

The Anti-Financial Account Scamming Act, RA 12010 of 2024, is also important where bank accounts, e-wallets, or payment accounts are used in scam operations.

This law targets conduct such as money muling, using financial accounts for proceeds of scams, opening accounts under fake identities, buying or selling financial accounts, and social engineering schemes involving sensitive financial information.

If the scammer made you send money to a GCash, Maya, bank, or other payment account, report the receiving account immediately to the provider. Speed matters because funds may be transferred out within minutes.

Data Privacy Violations

Many abusive online lending apps collect too much personal data. Some access contact lists, photos, call logs, SMS, or social media information and later use them for harassment.

The Data Privacy Act of 2012, RA 10173, protects personal information. The National Privacy Commission (NPC) has specific complaint procedures through its official complaint filing page.

A 2026 joint public advisory by the DICT, NPC, and SEC on online lending platforms also reminds the public that unnecessary app permissions, excessive access to contact lists, harassment, intimidation, public shaming, and unlawful use of personal data in collection practices are prohibited.

Financial Consumer Protection

The Financial Products and Services Consumer Protection Act, RA 11765, strengthens protection for consumers of financial products and services. It supports rights such as fair treatment, disclosure and transparency, protection of consumer assets, data privacy, and proper complaint handling.

For lending and financing companies, the SEC is usually the main regulator. For banks, e-wallets, and BSP-supervised institutions, complaints may also go through the Bangko Sentral ng Pilipinas (BSP) Consumer Assistance Mechanism after first reporting to the financial institution.

What to Do Immediately

1. Stop Paying

Do not send any more money, even if the app says:

“last payment na ito”;
“system verification only”;
“refundable deposit”;
“release guaranteed”;
“pay now or your account will be blacklisted”;
“we will file a case against you.”

Scammers often keep asking until the victim runs out of money. Paying once usually does not unlock anything. It only confirms that you are willing to pay.

2. Do Not Send More Personal Information

Stop sending:

IDs;
selfies or face scans;
specimen signatures;
bank account screenshots;
OTPs;
passwords;
card numbers;
CVV codes;
e-wallet PINs;
passport pages;
work permits or visas;
proof of address;
photos of family members.

No real lender should ask for your OTP, password, or full card security details.

3. Preserve Evidence Before Blocking

Before deleting the app or blocking the agent, collect evidence.

Take screenshots or screen recordings of:

app name and logo;
Google Play or App Store page;
website URL;
chat messages;
loan approval screen;
withdrawal error screen;
payment instructions;
QR codes;
account names and numbers;
receipts and reference numbers;
phone numbers, email addresses, Telegram handles, Facebook pages, WhatsApp numbers;
threats or harassment;
permissions requested by the app;
the date and time of each event.

Export chat history where possible. Save files in cloud storage and on another device. Scammers may delete messages or change usernames quickly.

4. Secure Your Phone and Accounts

If you installed the app, assume it may have collected more data than necessary.

Do these as soon as possible:

Revoke app permissions for contacts, camera, photos, microphone, location, SMS, and storage.
Uninstall the app after preserving evidence.
Change passwords for email, e-wallets, online banking, and social media.
Enable two-factor authentication.
Call your bank or e-wallet if you shared account details.
Ask your mobile provider about SIM replacement or SIM security if your number may be compromised.
Warn close contacts not to respond if they receive messages using your name.

If the app accessed your contacts, send a calm warning to family or friends: “Please ignore any loan-related message about me. My information may have been accessed by a suspicious loan app. Do not send money or share information.”

5. Report the Payment Transaction Immediately

Report to the bank, GCash, Maya, or remittance provider used for the payment. Give them the reference number, recipient account, amount, date, and screenshots.

For example, GCash has an official help page on how to report a scam. Banks and e-wallets may not always reverse voluntary transfers, but early reporting can help flag accounts, preserve records, or freeze funds if still available.

If the financial institution is supervised by the BSP and your complaint is not properly addressed, you may check the BSP’s consumer assistance channels.

6. Check Whether the Lender Is Registered

A legitimate online lending platform should be connected to a registered lending or financing company with authority from the SEC.

Look for:

exact corporate name;
SEC registration number;
Certificate of Authority number;
business name or online lending platform name;
registered office address;
official email and website;
privacy notice;
loan disclosure statement.

Be careful: scammers often copy the name or logo of a real company. Verify the exact corporate name and platform. A registered company’s name being used in a chat does not automatically mean the person messaging you is connected with that company.

For complaints involving lending or financing companies and online lending platforms, the SEC uses its official iMessage complaint platform.

7. Report to Cybercrime Authorities

For online scams, harassment, fake profiles, account misuse, or threats, report to cybercrime authorities.

Useful government channels include:

Concern	Possible office	Practical notes
Online scam, fake app, phishing, threats	PNP Anti-Cybercrime Group	Prepare screenshots, payment receipts, account details, and links.
Online scam or cybercrime investigation	NBI Cybercrime Division	The NBI has a Citizens Charter page for investigative assistance for victims of computer crimes.
Cybercrime coordination and policy concerns	DOJ Office of Cybercrime	The DOJ Office of Cybercrime handles matters relating to cybercrime, including international cooperation.
Abusive lending or unfair collection	SEC Financing and Lending Companies Department	Use SEC iMessage and attach evidence.
Privacy violations and contact-list harassment	National Privacy Commission	NPC complaints generally require a notarized complaint-affidavit.

8. Prepare a Complaint-Affidavit if You Want a Formal Case

For a criminal complaint, the usual starting document is a complaint-affidavit. This is your sworn statement explaining what happened.

A good complaint-affidavit should include:

your full name, address, contact details, and ID;
the app name and company or agent name used;
the date you downloaded the app or started communicating;
the promised loan amount;
the exact reason they gave for the deposit;
the amount you paid;
where you sent the money;
the reference numbers;
what happened after payment;
threats, harassment, or further demands;
screenshots and receipts as annexes;
names of witnesses, if any.

In the Philippines, affidavits usually need notarization. If you are abroad, you may need consular notarization through a Philippine Embassy or Consulate, or an apostille/authentication route depending on where the document was executed and where it will be used.

Documents and Evidence to Prepare

Evidence	Why it matters
Government ID	Proves your identity as complainant.
Screenshots of app and chats	Shows the false promise, demand for deposit, and threats.
Payment receipts and reference numbers	Connects your loss to a specific transaction.
Recipient account name and number	Helps banks, e-wallets, and investigators trace funds.
App permissions screenshots	Useful for privacy complaints.
Call logs and SMS	Shows contact history and pressure tactics.
Links to website or app store page	Helps authorities identify the platform.
Names of contacted relatives or friends	Supports harassment or privacy claims.
Bank or e-wallet complaint ticket	Shows you acted promptly.
Complaint-affidavit	Needed for many formal investigations.

If You Already Paid the Deposit

If you already paid, do not blame yourself. These scams are designed to look urgent and official.

Do this within the first few hours:

Report the transaction to your e-wallet or bank.
Ask if the recipient account can be flagged or frozen.
Save the complaint ticket number.
Report the scam to cybercrime authorities.
Do not negotiate further with the scammer.
Do not pay a “refund processing fee.”
Tell your family or employer only what is necessary to prevent harassment or impersonation.

After 24 to 72 hours, the chance of recovering money may become lower because scam funds are often moved through several accounts. Still, reporting is useful because it creates a paper trail and may help authorities connect your case with other victims.

Common Scenarios

“They said I entered the wrong bank account number.”

This is one of the most common tricks. The app will claim your funds are frozen because of a wrong digit in your bank details, then ask you to pay a “correction fee.” A legitimate lender should verify bank details before disbursement. A wrong account number does not justify endless deposit demands.

“They said the deposit is refundable.”

A refundable deposit can still be fraudulent if it is used to deceive you into paying money for a loan that never existed. Focus on the conduct: Was there a real lender? Was there SEC authority? Was there a proper contract? Were charges disclosed? Was the loan ever released?

“They are threatening to sue me even though I never received the loan.”

If no loan proceeds were released to you, there may be no actual loan for you to repay. Save proof that you never received funds. Do not admit a debt in writing just because an agent pressures you.

“They are threatening to message my contacts.”

This may raise privacy and harassment issues. Preserve screenshots of threats. If they contacted people who were not guarantors, include this in your complaint to the SEC and NPC.

“I am an OFW or foreigner outside the Philippines.”

You can still report, but document execution may require extra steps. Keep digital evidence, file online reports where available, and prepare a sworn statement. If a Philippine authority requires a notarized affidavit, you may need consular notarization or an apostilled document depending on the country and the receiving office’s requirements.

“The app used the name of a real SEC-registered company.”

Scammers sometimes impersonate legitimate companies. Verify through official channels. Check the company’s official website, customer service email, and SEC records. Do not rely on a screenshot of an SEC certificate sent by the agent.

Can You Recover the Money?

Recovery depends on how fast you report, whether the receiving account can be identified, whether funds remain in the account, and whether the persons behind the scam can be traced.

Possible routes include:

e-wallet or bank dispute handling;
cybercrime investigation;
criminal complaint for estafa or related offenses;
SEC complaint if a lending or financing company is involved;
NPC complaint for privacy violations;
civil action for recovery of money;
small claims case if the defendant is identifiable and the claim is within the small claims threshold.

Under the current Rules on Expedited Procedures in first-level courts, small claims may cover purely civil money claims not exceeding ₱1,000,000, exclusive of interest and costs. This is usually practical only if you know the real identity and address of the person or entity you are suing. If all you have is a fake username and mule account, law enforcement tracing may be needed first.

Practical Timeline

Time from incident	What to do
First 1 hour	Stop paying, screenshot everything, report to bank or e-wallet.
Same day	Change passwords, revoke app permissions, warn close contacts.
Within 24 hours	File reports with SEC, PNP ACG or NBI, and the payment provider.
Within a few days	Prepare a complaint-affidavit with attachments.
If data was misused	File or prepare an NPC complaint using the required format.
If suspect is identified	Consider criminal complaint and/or civil recovery.

What Not to Do

Avoid these common mistakes:

Do not send more money to “recover” the first payment.
Do not delete chats before saving evidence.
Do not send your OTP or banking password.
Do not post your full complaint online with your ID, account number, or private details visible.
Do not threaten the scammer in a way that could be used against you.
Do not rely on barangay settlement if the matter is clearly an online scam involving unknown persons.
Do not assume an app is legitimate just because it appears in an app store.
Do not ignore privacy risks after uninstalling the app.

Frequently Asked Questions

Is it normal for a loan app to ask for a deposit before I can withdraw my loan?

No. A demand for an advance deposit to unlock a loan withdrawal is a major red flag. Legitimate lenders should clearly disclose charges and provide proper loan documents. Endless “unlock” fees are typical of advance-fee scams.

Can a lending app charge processing fees in the Philippines?

A legitimate lender may charge lawful and disclosed fees, but they should be clearly stated before you accept the loan. The issue becomes suspicious when the fee is demanded through unofficial accounts, after a supposed approval, with no proper disclosure statement, and without actual release of funds.

What if the app says my loan is frozen because of AML rules?

Be very careful. Scammers often misuse “AML” or anti-money laundering language to sound official. If there is a real compliance issue, a legitimate financial institution will not usually ask you to send random deposits to a personal account to “clear” it.

I paid through GCash or Maya. Can I get my money back?

Possibly, but it is not guaranteed. Report immediately to the e-wallet provider with screenshots and transaction reference numbers. The sooner you report, the better the chance that the account can be flagged or investigated before the funds are moved.

Can I be arrested for not paying a loan I never received?

If you never received loan proceeds, the app should not treat you as having an actual released loan. Debt alone is generally not a reason for automatic arrest. Threats of immediate arrest, NBI action, or public shaming are common pressure tactics. Preserve proof that no funds were disbursed.

Where should I report an abusive online loan app?

For lending-related misconduct, report to the SEC through its iMessage platform. For online scams or threats, report to the PNP Anti-Cybercrime Group or NBI Cybercrime Division. For misuse of contacts, photos, or personal data, prepare a complaint with the National Privacy Commission.

What if they contacted my family, employer, or friends?

Save screenshots and names of people contacted. Online lending platforms should not freely use your contact list for harassment or collection. This may support complaints with the SEC and NPC, especially if the contacted persons were not guarantors.

Should I uninstall the app immediately?

First preserve evidence: screenshots, app page, permissions, chats, and payment instructions. After saving evidence, revoke permissions and uninstall. Also change passwords for important accounts.

Can foreigners complain in the Philippines?

Yes. A foreigner who was scammed in a Philippine-related transaction may report to Philippine authorities. If documents are executed abroad, notarization, consular acknowledgment, or apostille requirements may apply depending on the document and receiving office.

Is this a civil case or a criminal case?

It can be both. Recovery of money is civil in nature, while deception to obtain money may be criminal, such as estafa. Cybercrime, financial account scamming, and data privacy issues may also arise depending on how the scam was carried out.

Key Takeaways

Do not pay an advance deposit to unlock a supposed online loan withdrawal.
A legitimate lender should be verifiable, properly authorized, and transparent about charges.
Preserve evidence before deleting the app or blocking the agent.
Report quickly to your bank or e-wallet because scam funds move fast.
File complaints with the SEC for lending-related misconduct, PNP or NBI for cybercrime, and NPC for privacy violations.
If you never received loan proceeds, do not let threats pressure you into admitting or paying a fake debt.
For OFWs and foreigners, digital evidence is still useful, but sworn documents may need consular notarization or apostille depending on where they are executed.