Here’s a practitioner-style explainer on the Credit Card Phishing Scam Dispute Process (Philippine context)—what to do in the first hour, what banks and card networks actually require, how the Financial Consumer Protection Act (RA 11765) and other laws help you, what outcomes to expect, and ready-to-use dispute templates. This is general information, not legal advice for your exact facts.

1) What counts as a “phishing scam” for card disputes?

Any trick that impersonates a bank/merchant/courier/government to make you divulge credentials (card number, CVV, OTP, 3-D Secure code, app login), click a malicious link, install malware, or authorize a “one-time verification” that is actually a payment or card-on-file enrollment. Variants:

SMS/email link to a fake site (card details + OTP harvested).
Voice phishing (“vishing”): caller pretends to be the bank and walks you through OTP entry.
Account takeover: your banking/app credentials are stolen; card added to Apple/Google Pay or to a merchant wallet.
SIM-swap: attacker ports your number, intercepts OTP, adds your card to a wallet, spends.
QR/CNP push: “pay ₱1 verification” but it’s a high-value transaction or recurring mandate.

2) Legal & regulatory backbone (why your bank must take you seriously)

RA 11765 – Financial Consumer Protection Act (FCPA): requires banks/card issuers to keep a formal, trackable dispute process, give clear outcomes, and protect consumers against fraud and unfair practices.
RA 10175 – Cybercrime Prevention Act: criminalizes computer-related fraud; basis for police/NBI action.
RA 8484 – Access Devices Law: penalizes unauthorized card use and card data fraud.
Data Privacy Act (RA 10173): governs handling of your personal and card data; breaches can be reportable.
SIM Registration Act (RA 11934): helps stop/trace SIM-based OTP interception (SIM-swap).

Bottom line: you have a right to dispute and to a reasoned resolution. Banks cannot dismiss you with “you gave the OTP—case closed” without a proper, documented evaluation.

3) What to do in the first 60 minutes (triage)

Kill the card: Call the issuer (back-of-card hotline/in-app) → block the card and all card-on-file tokens (Apple/Google Pay, e-commerce vaults). Ask for a new card number.
Lock the channels: Change mobile/email passwords, enable app-based 2FA (not SMS), log out of all sessions.
Telco (if any SIM-swap signs): Request immediate line suspension and SIM replacement; ask telco to flag SIM-swap fraud on your account.
Freeze the leak: If you used the card inside a wallet (GCash/Maya/Apple/Google Pay), remove the card and ask their fraud team to freeze suspicious merchant tokens.
Capture evidence: Save screenshots of the phishing message/site, call logs, OTP timestamps, device notifications, and your transaction timeline.

4) File the dispute—how the chargeback really works

Although issuers differ, the flow is broadly the same:

You submit a fraud/unauthorized transaction dispute with evidence.
Issuer blocks card, gives case/ticket #, files a chargeback to the acquiring bank under card-scheme rules (Visa/Mastercard/Amex/JCB).
Acquirer/Merchant may accept (refund) or represent (fight) with evidence (3-D Secure logs, IP/device data, delivery proof).
If unresolved, the case can go to scheme arbitration. Final liability follows the network’s rules.

Time is critical. File immediately; don’t wait for the statement. Aim to submit within 24–48 hours of discovery. (Schemes commonly set issuer deadlines measured in days to a few weeks from posting—earlier reporting = stronger odds.)

5) What banks look for (and how to frame your case)

Stronger dispute when you can show:

No card-present (CNP) transaction you did not authorize;
No Strong Customer Authentication by you (no 3-D Secure challenge you performed); or
Compromised channel (SIM-swap, account takeover, malware) beyond your control.

Weaker if the bank shows:

You completed a 3-D Secure challenge (correct OTP/app approve) on a genuine bank page;
Clear customer approval for wallet tokenization/merchant mandate; or
Gross negligence (e.g., handing OTP to a cold caller after warnings).

Even then, stress social-engineering fraud, issuer’s duty of care, and the bank’s ability to detect risk signals (sudden high-value cross-border spend, new device/token, velocity). Many issuers resolve via goodwill refund or partial credit when the facts show a sophisticated scam.

6) Evidence checklist (attach with your dispute)

Dispute letter (concise facts, not legalese) + valid ID.
Transaction list marking what’s unauthorized (date/time/amount/merchant/order ID).
Screenshots of phishing SMS/email/website, caller IDs, chat logs, false “verification” pages.
Phone logs showing OTP bursts; SIM-swap proof if any (telco ticket).
Device details (your device vs. merchant’s device fingerprint if issuer shares it).
Police/NBI blotter (strengthens freezes with recipients and supports escalation).
If delivery of goods is claimed: you never received; attach proof of your location (e.g., work logs, flight, CCTV, toll/transit records) if helpful.

7) Your rights under RA 11765 (FCPA) while disputing

Acknowledgment of your complaint and a ticket number.
A clear timeline for resolution and status updates.
A reasoned written outcome (approve/deny, with basis).
Appeal/escalation within the bank; then to the BSP Consumer Assistance Mechanism if unresolved or unfair.

If a bank closes your case with a template line (“customer shared OTP”) but ignores your evidence (SIM-swap, spoof site, wallet tokenization), appeal in writing and escalate under FCPA.

8) Special scenarios & tactics

A) 3-D Secure “frictionless” approvals

Some transactions pass without an OTP prompt. Argue issuer risk assessment failure (no step-up despite red flags)—strong ground for issuer liability.

B) Account takeover / wallet tokenization

If your card was added to Apple/Google Pay or a merchant wallet you didn’t authorize, ask for the token creation timestamp, device model, IP, and geolocation. Mismatch with your devices bolsters your case.

C) SIM-swap fraud

Provide telco suspension/SIM change timestamps, which often coincide with the first fraudulent OTP. Ask issuer to treat this as high-risk fraud and to reverse.

D) Recurring/merchant-initiated payments

Request immediate cancellation of the merchant mandate and block future tokens, not just the plastic.

E) Cross-border/casino/crypto merchants

These often rely on CNP rails. Emphasize merchant due-diligence failure and request scheme-level blocking of the merchant IDs linked to your case.

9) Outcomes you can realistically expect

Provisional credit while investigation proceeds (issuer-specific; ask for it).
Full reversal of the unauthorized amount(s) + fees/interest accrued thereon.
Partial relief or goodwill credit (esp. mixed cases with some customer action).
Denial (appealable) if issuer proves strong cardholder authentication and/or merchant performance.

If denied, ask for the complete rationale and evidence relied upon (e.g., 3-D Secure logs). You may still pursue criminal complaints and, where warranted, civil damages.

10) Parallel tracks (do these in tandem)

Police/NBI/PNP-ACG complaint (get case number; attach to bank dispute).
Telco: SIM-swap block; request call/SMS logs around the incident.
NPC (privacy regulator) if a bank/merchant leak or data mishandling is suspected.
Merchant platform (e.g., marketplace/app store): file unauthorized purchase report—some issue ex-gratia refunds fast.

11) Clean-up & hardening (post-incident)

Replace card (new PAN), rotate all passwords, enable app-based 2FA, remove old recovery numbers, review forwarding rules in email, and check bank alerts are active.
Consider moving OTP delivery to in-app approvals where available.
Audit auto-debits and subscriptions; re-enroll only what you trust.
Keep a fraud dossier (PDF: dispute, evidence, tickets, police report).

12) Practical templates you can copy

A) Dispute letter to card issuer (fraud/unauthorized)

Subject: URGENT – Fraud Dispute & Chargeback Request (Card ending ****1234) I am disputing the following unauthorized transactions on my credit card: | Date/Time | Merchant | Amount | Ref/Order ID | |—|—|—|—| | [mm/dd hh:mm] | [Name] | ₱[ ] | [ ] | Total: ₱[ ] I did not authorize these charges. I was targeted by a phishing scam on [date] via [SMS/email/call]. I immediately blocked my card and filed a police/NBI report (attached). Evidence attached: phishing screenshots, OTP logs, SIM-swap/telco ticket (if any), timeline, ID. Please: (1) reverse the transactions (chargeback), (2) block all tokens/recurring mandates, (3) issue provisional credit, and (4) provide the case number and resolution timeline under RA 11765. Name / Mobile / Email / Billing Address Signature & ID

B) Appeal (if initially denied)

Subject: APPEAL – Fraud Dispute Denial (Case #[ ]) I respectfully appeal your [date] denial. Your letter states [“OTP shared”/“authorized”], but my evidence shows [SIM-swap timestamp; spoof site; different device/IP; frictionless 3-DS]. Under RA 11765, please reassess and provide the authentication logs used to deny (3-D Secure challenge/issuer app approve, device/IP, tokenization details). I request reconsideration and reversal, or a reasoned final response for escalation.

C) Police/NBI narration (short form)

On [date/time], I received [SMS/email/call] from [name/number] posing as [bank/courier]. I clicked [link] / followed instructions. Subsequently, [#] unauthorized transactions posted on my card ending ****[ ]. I blocked my card at [time] and filed a dispute with [issuer] (Ticket #[ ]). I request investigation for computer-related fraud/illegal access.

13) FAQs

Q: I read “if you gave the OTP, it’s your fault.” True? Not categorically. Banks still owe duty of care (risk scoring, step-up, merchant due diligence). Social-engineering frauds with clear risk signals often end in bank-side or scheme-side relief, especially with SIM-swap or account takeover.

Q: Do I have to pay while the case is pending? Pay the uncontested part. For the disputed amount, ask for provisional credit or at least that interest/finance charges be suspended pending resolution.

Q: Will a dispute hurt my credit score? The dispute itself shouldn’t. Late payment of undisputed balances might. Keep the issuer informed and in writing.

Q: Can I get my money back from the merchant directly? Try in parallel (some platforms refund quickly), but always file with the issuer—only your issuer can run the network chargeback.

Q: How long does it take? Weeks to a few months, depending on the scheme stage and merchant response. Keep tickets and timelines; escalate under RA 11765 if the bank goes silent or issues a non-reasoned denial.

14) One-page action checklist

✅ Block card + all tokens; request new PAN
✅ Change passwords; move 2FA from SMS → app
✅ Telco: stop SIM-swap; replace SIM if needed
✅ Dispute with issuer (letter + evidence) → ticket #
✅ Police/NBI report; attach to dispute
✅ Merchant/wallet: report unauthorized use; cancel mandates
✅ Follow-up for provisional credit; ask for logs if denied
✅ Appeal → BSP Consumer Assistance if unresolved
✅ Harden accounts; audit subscriptions; keep a fraud dossier

Bottom line

Move fast, document everything, and use the right labels: this is fraud/unauthorized use, not “buyer’s remorse.” Under RA 11765, your bank must give you a proper investigation and reasoned outcome—and the card-network chargeback system exists to unwind phishing-driven transactions. Even if an OTP was entered, strong social-engineering evidence, SIM-swap, or frictionless approvals can swing liability back to the issuer or merchant. If stonewalled, appeal crisply and escalate through the BSP; in parallel, pursue police/NBI action and lock down your digital life.

If you want, share (a) dates/amounts/merchants, (b) how the phishing happened, and (c) what you’ve already done—I can tailor the dispute letter and appeal to your exact timeline.