I. Introduction

An unauthorized ATM withdrawal occurs when a person withdraws money from another person’s bank account without the account holder’s permission. This may happen in many ways: by using a stolen ATM card, using a card that was entrusted for a limited purpose, guessing or obtaining the personal identification number, keeping and using a found card, coercing the account holder to reveal the PIN, or transferring funds after gaining access to online or mobile banking credentials connected to the ATM account.

In the Philippine setting, unauthorized ATM withdrawals may give rise to both criminal liability and civil liability. The exact offense depends on the facts: how the ATM card or credentials were obtained, whether there was consent, whether there was deceit, whether force or intimidation was used, whether the offender is a stranger, relative, employee, agent, caregiver, partner, or bank employee, and whether the transaction involved electronic systems.

There is no single offense called simply “ATM withdrawal without permission.” The conduct may fall under several laws, including the Revised Penal Code, the Access Devices Regulation Act, the Cybercrime Prevention Act, banking laws and regulations, and civil law principles on damages and restitution.

This article discusses the possible legal consequences of withdrawing money from another person’s ATM account without authority in the Philippines.

II. Basic Legal Character of Unauthorized ATM Withdrawal

An ATM card is commonly treated as an access device that allows a person to obtain money, goods, services, or funds from a bank account. The money in the account belongs to the depositor, although technically the bank-depositor relationship is generally treated as creditor-debtor in banking law. For criminal law purposes, however, unauthorized taking or withdrawal of funds may still be treated as a punishable deprivation of another person’s money or property.

The central question is usually authority. Did the account holder authorize the person to use the card and withdraw the amount? If yes, was the withdrawal within the scope of that authority? A person may be allowed to withdraw ₱5,000 for groceries but not ₱50,000 for personal use. A person may be allowed to hold the card for safekeeping but not to use it. A person may know the PIN because of trust or past permission, but that does not automatically mean unlimited authority to withdraw.

Unauthorized ATM withdrawal may involve any of the following legal theories:

Theft, where there is taking of personal property without consent and with intent to gain.
Qualified theft, where the offender committed theft with grave abuse of confidence or under circumstances that qualify the offense.
Estafa, where the offender received the card, money, or access through trust, agency, administration, or deceit, and later misappropriated the funds.
Robbery or extortion, where force, violence, or intimidation was used.
Access device fraud, where an ATM card, account number, PIN, or similar device was used without authority.
Cybercrime-related liability, where the unauthorized transaction involved computer systems, online banking, electronic credentials, phishing, hacking, identity theft, or computer-related fraud.
Civil liability, including restitution, damages, attorney’s fees, and interest.

III. Theft Under the Revised Penal Code

A. Elements of Theft

Under Philippine criminal law, theft generally requires:

There is taking of personal property;
The property belongs to another;
The taking is done with intent to gain;
The taking is done without the owner’s consent; and
The taking is accomplished without violence against or intimidation of persons and without force upon things.

Money is personal property. A bank deposit, when accessed and withdrawn through an ATM, results in the offender obtaining cash or causing funds to be debited from another person’s account. If the withdrawal is without permission and with intent to gain, theft may be considered.

B. Intent to Gain

Intent to gain does not always require permanent enrichment. It may be inferred from the unauthorized use, possession, or benefit derived from the money. Even temporary use may support intent to gain if the offender appropriated the funds for personal purposes.

For example, if a person uses another’s ATM card and PIN to withdraw ₱20,000 and spends it, intent to gain is obvious. If the offender claims that they intended to return the money, that does not automatically erase criminal liability. Repayment may affect civil liability, mitigation, settlement, or the complainant’s willingness to pursue the case, but it does not necessarily extinguish criminal liability once the offense has been committed.

C. Lack of Consent

Consent is often the most important factual issue. The accused may argue that the account holder allowed them to use the card. The complainant may argue that the authority was limited or nonexistent.

Consent may be express or implied, but courts generally examine the totality of circumstances. Prior permission to withdraw money once does not automatically authorize future withdrawals. Knowledge of the PIN does not automatically prove consent. Possession of the ATM card does not automatically prove ownership or authority.

D. Theft by a Relative, Partner, or Household Member

Unauthorized ATM withdrawal may occur within families or relationships. A spouse, live-in partner, sibling, child, parent, caregiver, helper, or relative may have access to the ATM card and PIN. The existence of a relationship does not automatically make the act legal. However, the relationship may affect the evidence, the applicable offense, the credibility of consent, and possible defenses.

Certain crimes against property under the Revised Penal Code have rules on absolutory causes or exemptions in limited family situations. These rules are technical and fact-dependent. They do not apply to all relatives, all property crimes, or all circumstances. They also generally do not erase civil liability. Therefore, even within a family, unauthorized ATM withdrawal should not be assumed to be free from legal consequences.

IV. Qualified Theft

A. When Theft May Become Qualified

Theft may become qualified when committed under circumstances such as grave abuse of confidence or by a person who had special access or trust. In ATM-related cases, qualified theft may be considered where the offender was entrusted with the ATM card, PIN, account access, or control over the victim’s financial affairs, and used that trust to withdraw funds without authority.

Examples may include:

An employee entrusted with payroll or company funds using an ATM card without authority;
A caregiver withdrawing money from an elderly person’s account beyond what was authorized;
A household helper using an employer’s ATM card and PIN after being trusted with access;
A relative managing the finances of a senior citizen and secretly withdrawing funds for personal use;
A company officer or finance staff withdrawing corporate funds for personal benefit.

B. Grave Abuse of Confidence

Grave abuse of confidence requires more than ordinary opportunity. It usually involves a relationship of trust that gave the offender access to the property or account. The prosecution must prove that the offender used that confidence to facilitate the taking.

The distinction between simple theft and qualified theft can be important because qualified theft carries heavier penalties. The value of the amount withdrawn also affects the penalty.

V. Estafa and Misappropriation

A. Estafa Distinguished from Theft

Estafa may apply where the offender lawfully received money, property, or access under an obligation to return, deliver, administer, or use it for a specific purpose, and later misappropriated or converted it.

The key distinction is often this:

In theft, the taking is unlawful from the beginning.
In estafa, possession or access may have been lawful at first, but the offender later abused it and misappropriated the funds.

In ATM withdrawal cases, estafa may be considered where the account holder voluntarily entrusted the ATM card and PIN to the offender for a limited purpose, and the offender exceeded that authority and converted the funds.

B. Examples of Possible Estafa

Estafa may be argued in situations such as:

A person is given an ATM card to withdraw ₱10,000 for the owner but withdraws ₱50,000 and keeps the excess;
An employee is instructed to withdraw funds for company expenses but uses part of the amount personally;
A relative is authorized to withdraw pension money for the account holder’s needs but diverts the money;
A person receives the card to hold or safeguard but uses it to withdraw funds;
A collector, cashier, bookkeeper, or administrator withdraws funds entrusted to them and fails to account.

C. Demand and Failure to Account

In estafa cases involving misappropriation, a demand to return or account for the money is often relevant as evidence. Demand is not always an element in every form of estafa, but it can help prove conversion or misappropriation. If the accused cannot account for the money after demand, this may support the complainant’s case.

VI. Robbery, Extortion, and Coerced Withdrawals

If the offender uses violence, intimidation, or threats to force a person to withdraw money from an ATM, the case may no longer be simple theft or estafa. It may involve robbery, extortion, grave coercion, threats, or other offenses depending on the facts.

Common examples include:

Forcing the victim at knifepoint to withdraw cash from an ATM;
Threatening harm unless the victim gives the ATM card and PIN;
Detaining the victim and compelling several withdrawals;
Threatening to expose private information unless the victim transfers or withdraws funds;
Using intimidation against an elderly or vulnerable person to obtain their ATM pension.

Where force or intimidation is present, the legal analysis changes significantly. The ATM withdrawal becomes part of a broader criminal act involving coercion or violence.

VII. Access Devices Regulation Act

A. ATM Cards as Access Devices

The Access Devices Regulation Act of 1998, or Republic Act No. 8484, as amended, regulates and penalizes fraudulent acts involving access devices. An access device may include cards, account numbers, electronic serial numbers, personal identification numbers, or other means of account access that can be used to obtain money, goods, services, or anything of value.

An ATM card and PIN can fall within this general concept. Unauthorized possession, use, production, trafficking, or fraudulent use of access devices may lead to criminal liability.

B. Unauthorized Use of Another Person’s ATM Card

A person who knowingly uses another person’s ATM card or access credentials without authority to obtain money may face liability under access device laws. This may be charged independently or alongside other offenses, depending on prosecutorial evaluation and the specific facts.

Possible access-device-related acts include:

Using a stolen ATM card;
Using a found ATM card;
Using a card entrusted for one purpose but used for another;
Using another person’s PIN without authority;
Possessing multiple cards or credentials under suspicious circumstances;
Obtaining account access through false pretenses;
Using skimming devices or cloned cards;
Selling, transferring, or trafficking ATM cards or account access information.

C. Relation to Theft or Estafa

Unauthorized ATM withdrawal can potentially be framed both as a property crime and as access device fraud. The government must avoid improper duplication of charges where the same act is punished twice in a legally impermissible manner, but a single course of conduct may sometimes violate more than one law. Prosecutors determine the appropriate charge based on the evidence.

VIII. Cybercrime Issues

A. When the Cybercrime Prevention Act May Apply

The Cybercrime Prevention Act of 2012, Republic Act No. 10175, may become relevant when the unauthorized withdrawal or transfer involves computer systems, electronic credentials, online banking, mobile banking, phishing, hacking, malware, identity theft, or computer-related fraud.

Although a conventional ATM machine is an electronic banking channel, the cybercrime dimension becomes clearer when the offender obtains or uses credentials through electronic means or manipulates a computer system.

B. Possible Cybercrime Offenses

Depending on the facts, the following cybercrime-related offenses may be considered:

Illegal access, where a person accesses a computer system or account without right;
Computer-related fraud, where computer data or systems are used to cause damage or obtain benefit;
Computer-related identity theft, where identifying information is acquired, used, misused, transferred, possessed, altered, or deleted without right;
Phishing-related conduct, where credentials are obtained through deceptive electronic communications;
System interference or data interference, in more technical cases involving manipulation of systems or data.

C. Online Transfer Followed by ATM Withdrawal

Some cases involve a combination of online and physical acts. For example, a person may obtain the victim’s online banking credentials, transfer funds to another account, and then withdraw through an ATM. In that case, the liability may include cybercrime, access device fraud, theft, estafa, money mule activity, or other offenses depending on the role of each participant.

IX. Bank Employee, Company Employee, or Agent Involvement

A. Bank Employee Cases

If a bank employee participates in unauthorized withdrawal, account manipulation, issuance of cards, disclosure of confidential information, or facilitation of fraudulent access, additional liability may arise. Apart from ordinary criminal liability, banking regulations, internal bank rules, data privacy obligations, and administrative sanctions may apply.

Bank employees owe duties of confidentiality and integrity. Unauthorized disclosure or misuse of account information may implicate data privacy and bank secrecy concerns, depending on the circumstances.

B. Company Funds and Corporate ATM Cards

Many companies use ATM cards for payroll, petty cash, benefits, reimbursements, or operational funds. Unauthorized withdrawal from a corporate account may involve theft, qualified theft, estafa, falsification, or violation of company policies.

If an employee is entrusted with a corporate card and misuses it, the employer may file a criminal complaint and may also pursue labor remedies, disciplinary action, termination for just cause, and civil recovery.

C. Agents, Caregivers, and Persons Managing Another’s Finances

Unauthorized withdrawal is especially common in situations where one person manages the funds of another: elderly parents, overseas Filipino workers, persons with disabilities, hospitalized persons, pensioners, and minors. Authority must be clear. The person managing the funds should keep receipts, records, written instructions, and accounting to avoid disputes.

X. Pension ATM Cards and Senior Citizens

A recurring Philippine issue involves pension ATM cards, especially for retirees, senior citizens, and beneficiaries of government or private pensions. Sometimes a pensioner gives a card to a child, caregiver, or relative to withdraw monthly benefits. Abuse may occur when the entrusted person withdraws more than authorized, refuses to return the card, keeps the pension, or continues withdrawing after the pensioner becomes incapacitated or dies.

Possible legal issues include:

Theft or qualified theft;
Estafa through misappropriation;
Falsification or fraud if documents were used;
Abuse, neglect, or exploitation of elderly persons;
Civil recovery of misappropriated pension money;
Bank reporting and account freezing issues;
Estate-related issues if withdrawals were made after death.

A person who possesses a pensioner’s ATM card should not assume that family relationship equals unlimited authority. Written authorization and proper accounting are important.

XI. Use of a Found or Lost ATM Card

A person who finds an ATM card has no right to use it. Even if the PIN is written on the card, kept in the wallet, or easily guessed, withdrawing money is unauthorized. The finder should return the card to the owner, bank, police, or proper authority.

Using a found ATM card may support charges for theft, access device fraud, or related offenses. The fact that the card was “found” does not justify withdrawal. Keeping and using property known to belong to another may show intent to gain.

XII. Use of a Stolen ATM Card

Where the card itself is stolen and then used to withdraw funds, the offender may be liable for the theft of the card, the unauthorized withdrawal, access device fraud, and other related acts. If the card was taken through violence or intimidation, robbery may be involved.

If the offender steals a bag or wallet containing an ATM card and later uses the card to withdraw money, the acts may be treated as part of one criminal episode or as separate punishable acts, depending on the facts and charging decision.

XIII. Skimming, Cloning, and ATM Fraud Schemes

ATM fraud may involve technical methods such as skimming, card cloning, hidden cameras, fake keypads, shoulder surfing, card trapping, or malware. These schemes may involve organized criminal activity.

Possible liabilities may include:

Access device fraud;
Cybercrime offenses;
Theft;
Estafa;
Identity theft;
Possession or use of fraudulent devices;
Conspiracy or accomplice liability;
Money laundering concerns if proceeds are routed through multiple accounts.

Victims should promptly notify the bank, preserve transaction records, request CCTV preservation, file a police report, and coordinate with the bank’s fraud department.

XIV. Liability of Accomplices, Conspirators, and Money Mules

Unauthorized ATM withdrawals may involve more than one person. One person may obtain the card, another may learn the PIN, another may withdraw the cash, another may receive the money, and another may provide a bank account or e-wallet account to move the proceeds.

Under criminal law principles, persons who conspire in the commission of an offense may all be liable as principals if conspiracy is proven. A person who cooperates by indispensable acts may also be treated as a principal. Others may be liable as accomplices or accessories depending on their participation.

A “money mule” who allows their account to receive or move stolen funds may be exposed to criminal investigation. Even if the mule did not personally withdraw from the ATM, participation in receiving or transferring proceeds may create liability if knowledge or participation is shown.

XV. Civil Liability

A. Restitution

A person who withdraws money without authority may be ordered to return the amount withdrawn. Restitution is usually the basic civil consequence.

B. Damages

The victim may also claim damages, including:

Actual damages, such as the withdrawn amount and related expenses;
Moral damages, in proper cases involving anxiety, humiliation, or suffering;
Exemplary damages, where the conduct is wanton, fraudulent, or oppressive;
Attorney’s fees and litigation expenses, when legally justified;
Interest, where appropriate.

C. Civil Action Deemed Instituted

In Philippine criminal procedure, the civil action for recovery of civil liability arising from the offense is generally deemed instituted with the criminal action, unless waived, reserved, or separately filed. This means that a criminal complaint may also address recovery of the amount, subject to procedural rules.

D. Independent Civil Action

In some cases, a victim may pursue civil remedies separately, especially where the main objective is recovery. However, the choice between criminal, civil, or both remedies should be evaluated carefully because of procedural consequences.

XVI. Evidence in Unauthorized ATM Withdrawal Cases

Evidence is often the deciding factor. The complainant must prove unauthorized withdrawal and the accused’s participation.

Important evidence may include:

Bank statements showing date, time, location, and amount of withdrawal;
ATM transaction receipts, if available;
CCTV footage from the ATM site, bank branch, mall, store, or nearby area;
Bank certification identifying the account, transaction history, and disputed withdrawals;
ATM card records, including card number and issuance details;
SMS or email alerts from the bank;
Messages or admissions from the accused;
Witness testimony showing who possessed the card or knew the PIN;
Demand letters asking the accused to return or account for the money;
Police blotter or incident report;
Affidavits of the complainant and witnesses;
Screenshots of online banking, mobile banking, or electronic communications;
Device records in cyber-related cases;
Receipts or proof of how the money was used;
Employment records or authorization documents in company cases;
Written instructions or limits given to the accused.

Banks may have retention periods for CCTV and electronic records, so prompt action is important.

XVII. Role of the Bank

A. Immediate Reporting

A victim should immediately report unauthorized withdrawal to the bank. Delay can affect investigation, recovery, and the bank’s assessment of liability. The account holder should request card blocking, PIN reset, account monitoring, and written acknowledgment of the dispute.

B. Bank Investigation

The bank may investigate whether the transaction was PIN-authenticated, card-present, chip-based, magnetic stripe-based, online, mobile, or otherwise. However, the fact that a correct PIN was used does not always prove that the account holder authorized the withdrawal. It may show that the offender had access to the PIN, but authority remains a separate question.

C. Bank Liability

Bank liability depends on the facts. A bank may resist reimbursement where the transaction appears valid and PIN-authenticated. However, if the loss was caused by bank negligence, system failure, failure to act on timely notice, unauthorized disclosure, or defective security procedures, the bank may face civil, regulatory, or administrative issues.

Victims may elevate unresolved disputes to appropriate regulatory channels, depending on the nature of the bank and transaction.

XVIII. Data Privacy Considerations

ATM fraud may involve personal data such as names, account numbers, card details, PINs, mobile numbers, one-time passwords, identification documents, and biometric or device information. Unauthorized collection, processing, disclosure, or use of personal data may raise issues under the Data Privacy Act of 2012.

If a bank employee, company employee, or third party misused personal information to facilitate withdrawals, data privacy complaints may be considered. However, not every ATM withdrawal case is automatically a data privacy case. There must be unauthorized or improper processing of personal information within the scope of the law.

XIX. Common Defenses

An accused person may raise several defenses, including:

A. Consent or Authority

The accused may claim that the account holder allowed the withdrawal. This is common where the accused is a relative, partner, employee, or caregiver.

B. Ownership or Right to the Money

The accused may argue that the money was partly theirs, represented payment of a debt, salary, reimbursement, family support, or shared funds. This defense depends heavily on proof.

C. Lack of Intent to Gain

The accused may claim that the withdrawal was for the account holder’s benefit, for emergency use, or with intent to return the money. This may or may not be persuasive depending on circumstances.

D. Mistake of Fact

The accused may argue that they honestly believed they had authority to withdraw. The belief must be credible and supported by facts.

E. Payment or Settlement

Return of the money may reduce conflict but does not automatically erase criminal liability. Settlement may affect the complainant’s participation, civil liability, or possible compromise in certain cases, but criminal offenses are generally prosecuted in the name of the People of the Philippines.

F. Lack of Identification

The accused may deny being the person who withdrew the money. CCTV, location data, witness testimony, and possession of the card become important.

G. Frame-Up or Fabrication

The accused may claim that the complaint is retaliatory or fabricated, especially in family, employment, or relationship disputes. Documentation and objective bank records are crucial.

XX. Complaint Procedure

A. Immediate Steps for the Victim

A victim should generally consider the following steps:

Contact the bank immediately and block the ATM card;
Change PINs and online banking credentials;
Request a transaction history and dispute form;
Ask the bank to preserve CCTV and electronic logs;
Gather SMS alerts, receipts, screenshots, and communications;
Prepare a written narration of events;
Send a demand letter if the suspect is known and the case involves misappropriation;
File a police blotter or complaint with law enforcement;
Execute affidavits;
File a complaint before the prosecutor’s office, where appropriate.

B. Filing with the Prosecutor

Most criminal complaints begin with affidavits and supporting documents submitted to the Office of the City or Provincial Prosecutor. The prosecutor conducts preliminary investigation or inquest proceedings, depending on whether the accused was arrested without warrant and whether the offense requires preliminary investigation.

The complainant must present enough evidence to establish probable cause. The prosecutor determines whether to file an information in court.

C. Barangay Conciliation

If the parties live in the same city or municipality and the offense is within the scope of the Katarungang Pambarangay system, barangay conciliation may be required before court action. However, many criminal offenses, especially those carrying penalties above certain thresholds or involving public offenses beyond barangay authority, may not be subject to barangay settlement. The need for barangay proceedings depends on the offense, penalty, parties, residence, and procedural rules.

D. Police and Cybercrime Units

Where the case involves phishing, hacking, online banking, mobile banking, identity theft, or organized fraud, the victim may seek assistance from police cybercrime units or the National Bureau of Investigation cybercrime division. Technical evidence should be preserved quickly.

XXI. Prescription of Offenses

Criminal offenses prescribe after a certain period, depending on the offense and penalty. The prescriptive period for theft, estafa, access device fraud, or cybercrime-related offenses may differ. The amount involved can affect the penalty and thus affect prescription.

Victims should not delay. Even if prescription has not yet run, delay can weaken evidence, cause CCTV loss, make records harder to retrieve, and affect witness memory.

XXII. Penalties

The penalty depends on the specific offense charged, the amount involved, and qualifying circumstances. In property crimes, the value of the money withdrawn is often important. A larger amount generally results in heavier penalties. Qualified theft may carry heavier consequences than simple theft. Cybercrime or access device offenses may carry separate or enhanced penalties.

Because penalties under Philippine law can be technical and may be affected by amendments, value thresholds, modifying circumstances, and special laws, the exact penalty should be computed based on the facts and the current applicable law at the time of prosecution.

XXIII. Effect of Returning the Money

Returning the money is important but not always decisive.

It may:

Reduce or satisfy civil liability;
Show remorse;
Support settlement discussions;
Affect the complainant’s willingness to proceed;
Be considered in plea bargaining or sentencing where legally available.

It usually does not automatically:

Erase the fact that an offense may have been committed;
Require dismissal of a criminal case;
Prevent prosecution by the State;
Convert a criminal act into a purely private debt.

If the withdrawal was truly authorized or based on a legitimate debt or agreement, that is a different issue. But if the withdrawal was criminal at the time it was made, later repayment does not automatically remove criminal liability.

XXIV. Unauthorized Withdrawal Versus Debt Collection

A common misconception is that a person may withdraw from another’s ATM account because the account holder owes them money. This is risky and generally unlawful unless there is clear authority.

For example, if A owes B ₱20,000, B cannot simply take A’s ATM card and withdraw ₱20,000 without permission. A debt does not automatically authorize self-help seizure of bank funds. The proper remedy is collection, demand, civil action, settlement, or other lawful process.

Even where the accused claims the money was payment of a debt, the unauthorized manner of taking may still create criminal exposure.

XXV. Unauthorized Withdrawal by Spouse or Partner

Marriage, cohabitation, or romantic relationship does not automatically authorize one person to use the other’s ATM card. However, factual issues may be complicated by shared expenses, common funds, household arrangements, implied consent, and marital property regimes.

Questions may include:

Was the account personal or joint?
Did the account holder share the PIN?
Was there a history of authorized withdrawals?
Was the withdrawal for household expenses?
Was the amount excessive or secret?
Was the relationship already separated or hostile?
Was there intimidation, manipulation, or abuse?
Was the money paraphernal, conjugal, community, salary, pension, or business-related?

A spouse or partner should not assume that access equals authority.

XXVI. Unauthorized Withdrawal from a Deceased Person’s Account

Withdrawing from a deceased person’s ATM account raises serious legal issues. Authority to use an ATM card generally does not continue indefinitely after death. Funds may become part of the estate, subject to succession, taxes, claims, and estate settlement rules.

A person who withdraws after the account holder’s death may face civil claims from heirs or the estate, and possibly criminal liability if the withdrawal is fraudulent or unauthorized. Even if the withdrawer is an heir, heirship does not automatically authorize unilateral withdrawal of estate funds.

Expenses for funeral, medical bills, or estate needs should be properly documented and handled through lawful processes.

XXVII. Unauthorized Withdrawal Involving Minors or Incapacitated Persons

Where the account holder is a minor, elderly person, person with disability, mentally incapacitated person, hospitalized person, or otherwise vulnerable person, the law may scrutinize the transaction closely. A guardian, parent, child, caregiver, or representative must act for the benefit of the account holder and within legal authority.

Using the person’s ATM card for the representative’s personal benefit may result in criminal, civil, administrative, or protective proceedings.

XXVIII. Corporate, Cooperative, and Association Accounts

Unauthorized ATM withdrawals from organizations may involve officers, treasurers, collectors, bookkeepers, or employees. The relevant documents may include board resolutions, bylaws, bank mandates, employment contracts, cash advance policies, liquidation rules, and authorization letters.

Possible issues include:

Whether the accused had authority to withdraw;
Whether the withdrawal was properly approved;
Whether the funds were liquidated;
Whether receipts were falsified;
Whether the money was used for the organization;
Whether internal controls were bypassed;
Whether there was conspiracy among officers.

In organizations, failure to liquidate or account for withdrawals may support estafa, qualified theft, or civil claims, depending on the facts.

XXIX. Practical Risk Prevention

A. For Account Holders

Account holders should:

Never write the PIN on the card;
Avoid sharing PINs;
Change PINs after allowing temporary use;
Activate SMS or app alerts;
Use withdrawal limits;
Keep cards secure;
Regularly review bank statements;
Immediately report lost cards;
Avoid giving cards as informal collateral;
Use written authorization for entrusted withdrawals;
Require receipts and accounting from helpers, employees, or relatives;
Consider separate accounts for caregivers or household expenses.

B. For Persons Asked to Withdraw for Someone Else

A person withdrawing for another should:

Get clear written permission;
Withdraw only the authorized amount;
Keep receipts;
Turn over the money immediately;
Document expenses;
Avoid using the card for personal transactions;
Return the card promptly;
Never continue using the card after authority is revoked;
Never use the card after the account holder’s death unless legally authorized.

C. For Employers and Organizations

Employers and organizations should:

Avoid giving one person unchecked ATM access;
Use dual controls;
Require written approvals;
Set transaction limits;
Conduct regular audits;
Separate custody, withdrawal, recording, and approval functions;
Require liquidation within a fixed period;
Disable access immediately upon termination or reassignment.

XXX. Frequently Asked Questions

1. Is it theft if someone withdraws from my ATM without permission?

It may be theft if the withdrawal was without your consent and with intent to gain. Depending on the facts, it may also be qualified theft, estafa, access device fraud, or cybercrime.

2. What if I gave the person my ATM card before?

Prior possession does not automatically mean authority for every withdrawal. The issue is whether the specific withdrawal was authorized.

3. What if I gave the person my PIN?

Giving your PIN may make the evidence more complicated, but it does not necessarily authorize unlimited withdrawals. The scope of permission matters.

4. What if the person is my relative?

A family relationship does not automatically legalize unauthorized withdrawal. However, special rules and factual issues may apply depending on the relationship, offense, and circumstances.

5. What if the person returned the money?

Return of the money may reduce civil liability but does not automatically erase criminal liability.

6. What if the person says I owed them money?

A debt does not usually authorize a person to take money from your ATM account without permission. The proper remedy is lawful collection.

7. Can the bank reimburse me?

It depends on the bank’s investigation, the nature of the transaction, your promptness in reporting, whether your credentials were compromised, and whether the bank was negligent.

8. Is CCTV enough to prove the case?

CCTV is strong evidence if it clearly identifies the withdrawer, but it is usually best combined with bank records, account statements, witness testimony, and other proof.

9. Can I file both a bank dispute and a criminal complaint?

Yes, these are different remedies. A bank dispute seeks investigation or reimbursement from the bank, while a criminal complaint seeks prosecution of the offender.

10. What if the ATM withdrawal happened years ago?

Prescription and evidence issues may arise. The applicable prescriptive period depends on the offense and penalty. Delay may also make CCTV and records harder to obtain.

XXXI. Conclusion

Unauthorized ATM withdrawal in the Philippines is a serious matter. It may appear simple—someone used another person’s ATM card and withdrew cash—but legally it can involve several overlapping areas: theft, qualified theft, estafa, access device fraud, cybercrime, data privacy, banking regulation, civil liability, and family or employment law.

The most important factual questions are: Was there authority? What was the scope of that authority? How was the card or PIN obtained? Who benefited from the withdrawal? Was there deceit, abuse of confidence, violence, intimidation, hacking, or use of another person’s identity? What evidence exists to prove the transaction and identify the offender?

For victims, prompt reporting and preservation of evidence are essential. For persons entrusted with another’s ATM card, strict compliance with the owner’s instructions is necessary. Access to a card or PIN is not the same as ownership of the funds. In Philippine law, unauthorized withdrawal from another person’s account can expose the offender to criminal prosecution, civil liability, and long-term legal consequences.