Disputing Unauthorized Credit Card Transactions in the Philippines

Last updated for Philippine law and common bank/network practice as of mid-2024. Always check your card issuer’s latest terms, network rules (Visa/Mastercard/JCB/Amex/UnionPay), and Bangko Sentral ng Pilipinas (BSP) issuances for any updates.

Executive summary

If you spot a charge you didn’t make, act immediately: secure your account, report the transaction to your issuer, file a written dispute, and cooperate with the issuer’s investigation and any network chargeback. Philippine law—especially the Access Devices Regulation Act (R.A. 8484), the Philippine Credit Card Industry Regulation Law (R.A. 10870), and the Financial Consumer Protection Act (R.A. 11765)—together with BSP regulations and card-network rules, provide the backbone for getting your money back and limiting your liability when you are not at fault.

What counts as an “unauthorized” credit card transaction?

An entry on your account where you did not permit the charge, including:

Lost/stolen card transactions (card-present).
Card-not-present (CNP) transactions (online, mail/phone) made without your authorization, including account takeover.
Counterfeit/skimmed card transactions.
Contactless “tap” charges beyond your control.
Merchant errors (duplicate charge, wrong amount) and friendly fraud (someone you know used your card without consent).
Post-cancellation charges (e.g., subscription kept billing after cancellation).
Charge after rescinded consent in recurring payments.

Transactions you or an authorized user made but later regret are not “unauthorized.” Nor are valid charges where goods/services were received but you’re dissatisfied (that’s a quality dispute, handled differently).

Legal framework (Philippine context)

R.A. 8484 (Access Devices Regulation Act) Penalizes credit card fraud; obliges cardholders to promptly notify issuers of loss/theft and cooperate; issuers must investigate. Liability generally shifts after notice unless there is fraud or gross negligence by the cardholder.
R.A. 10870 (Philippine Credit Card Industry Regulation Law) Regulates issuers’ disclosure, billing, collection, error-resolution, and complaint-handling; aligns industry practice with consumer protection norms.
R.A. 11765 (Financial Consumer Protection Act) Requires BSP-supervised financial institutions (BSFIs) to maintain consumer assistance mechanisms, fair and timely resolution of complaints, transparent processes, and enables regulators to order restitution and enforce compliance.
R.A. 10173 (Data Privacy Act) Governs handling of your personal data during investigations and requires secure processing and (where applicable) breach notification.
R.A. 8792 (E-Commerce Act) Recognizes electronic documents/signatures; supports paperless dispute communications and digital evidence.
R.A. 11127 (National Payment Systems Act) Establishes oversight of payment systems; relevant where unauthorized transactions involve payment rails and acquirers.
BSP regulations & circulars Provide detailed standards on disclosures, billing statements, interest/fees, complaint handling, and market conduct. Issuers must keep a Consumer Assistance/Protection unit and follow documented timelines.
Card-network rules (Visa/Mastercard/JCB/Amex/UnionPay) Define chargeback rights, evidence standards, and time limits between issuers and acquirers. Cardholders don’t file with the network directly; your issuer does.

Key idea: In practice, your rights flow from Philippine statutes and BSP rules plus the global network chargeback system. You invoke both by filing a dispute with your issuer.

Your immediate obligations (to protect rights and limit liability)

Secure the account Call the issuer’s hotline on the card, mobile app, or website: request an immediate block and card replacement. Change app logins/PINs and email passwords; enable stronger authentication.
Give notice quickly Report as soon as you discover the transaction(s). Earlier notice typically reduces your exposure and improves recovery chances. (Issuers often set short statement-level deadlines—commonly within 30 days from statement date—for contesting entries. Don’t wait.)
File a written dispute Submit the issuer’s dispute form or a letter via email/branch/app. Keep proof of submission.
Cooperate Provide IDs, affidavits (e.g., Affidavit of Loss for lost/stolen), police blotter if requested, screenshots, travel proof, merchant communications—whatever the issuer needs under network rules.

The issuer’s obligations

Acknowledge and explain the process, required documents, and expected milestones.
Block/replace your card to prevent further loss.
Conduct a fair investigation and, where appropriate, initiate chargeback to the merchant’s bank within network time limits.
Update you on status and outcome; give reasoned decisions if denying the claim.
Respect due process in collections: no harassment, accurate billing, and suspension/adjustment of disputed amounts where warranted.
Maintain a Consumer Assistance mechanism and an escalation path up to the BSP if you remain unsatisfied.

Step-by-step: How to dispute

1) Lock down & document

Block the card (hotline/app) and request replacement.
Take dated screenshots of the transaction, alerts, and your available balance/limits.
Write a short timeline (when you noticed, where you were, device used, any OTP received).

2) Report & file

Call the issuer; obtain the reference number.
Submit the dispute form (online/branch/email) and attach:
- Government ID
- Affidavit of Loss (if card lost/stolen)
- Police blotter (often requested for physical card loss)
- Screenshots of SMS/email alerts, app logs, OTP messages
- Travel/geo evidence (boarding pass, passport stamp) if relevant
- Merchant cancellation proof for recurring/subscription charges

3) Keep paying the undisputed portion

Pay your bill excluding the disputed items. Ask the issuer in writing to suspend interest/fees on the disputed amount pending resolution.

4) Issuer investigation & chargeback

The issuer may give provisional credit (not guaranteed by law) while it investigates, or hold the amount in dispute.
The issuer files chargeback to the acquirer/merchant under the applicable reason code (e.g., fraud, no cardholder authorization, processing error).
The merchant can represent (re-presentment) with evidence (e.g., 3-D Secure authentication, signed receipt). The issuer can rebut. This can move through pre-arbitration phases under network rules.

5) Resolution

Successful: the charge is reversed permanently; related interest/fees are adjusted. Obtain a corrected statement.
Denied: you receive an explanation and evidence relied upon (e.g., EMV-chip present transaction with valid PIN; strong authentication; delivery proof to your address).

6) Escalation (if needed)

Issuer escalation: Request supervisor review or a formal complaint ticket under their consumer assistance mechanism.
Regulatory escalation: File with the BSP (for banks/quasi-banks) under the Financial Consumer Protection framework. Provide your complete file (timeline, dispute form, issuer responses).
Law enforcement: For fraud, report to PNP Anti-Cybercrime Group or NBI Cybercrime Division; cite R.A. 8484 (access device fraud) and, where applicable, R.A. 10175 (computer-related fraud).
Civil remedies: If you suffer loss due to issuer/merchant fault and cannot resolve administratively, seek counsel on civil action or consider small claims (thresholds and rules apply).

Time limits (practical guide)

Report immediately once discovered.
Issuer filing windows: Many issuers require disputes within ~30 days of the statement date for that transaction.
Network chargeback clocks: Often up to 120 calendar days from the transaction posting/date of discovery (varies by reason code and network).
Recurring billing: Different counting rules may apply (e.g., from last billing date after cancellation). Because these windows vary by network and reason code, earliness is your friend.

Evidence: what helps your case

Proof the card was not in your possession (e.g., you were abroad while a domestic chip transaction occurred; or vice versa).
Device/OTP evidence: You did not receive or did not share any OTP; screenshots of suspicious OTPs.
Merchant logs: IP address/device fingerprint (issuer/acquirer can request through network processes).
Delivery proof issues: Address mismatch, courier POD anomalies, charge to virtual card that you closed, etc.
Cancellation records: Emails, tickets, chat transcripts for subscriptions.

Liability rules in practice

After you notify the issuer of loss/theft/compromise, you generally should not be liable for subsequent unauthorized transactions absent your fraud or gross negligence (R.A. 8484 principles; also reflected in many issuer contracts and “zero liability” network policies for qualifying transactions).
Before notice, liability depends on facts:
- Card-present EMV + PIN: Issuers may argue you (or an authorized person) made it; you’ll need contrary proof (impossibility, cloning evidence, etc.).
- CNP transactions: Liability often shifts if strong customer authentication (e.g., 3-D Secure) did not succeed or was bypassed; if SCA succeeded, merchants may defend with authentication logs.
Network “Zero Liability” policies (Visa/Mastercard/Amex/JCB) commonly protect cardholders who promptly report and are not negligent, but exclusions exist (e.g., PIN-based cash advances, gross negligence, commercial cards). Treat these as policy protections, not statutory guarantees; issuers implement them with conditions.

Special scenarios

Online fraud with OTP/3-D Secure If a one-time password was used, issuers may claim cardholder presence. Rebut with SIM-swap indicators, malware evidence, or proof the OTP wasn’t received or was phished (provide phishing emails/SMS).
Contactless “tap” transactions Small transactions may be approved without PIN/OTP. If the card was lost/stolen, quick notice and proof you were elsewhere are crucial.
Recurring/subscription charges Provide cancellation proof and request a chargeback reason code for recurring billing canceled. Ask the issuer to block future debits from that merchant ID.
Dynamic Currency Conversion (DCC) If a merchant processed in a foreign currency you didn’t choose (or vice versa), dispute as processing error (wrong currency/amount).
Installments If the base transaction is unauthorized, all related installment charges should be reversed once the dispute is upheld.

Practical protections (to prevent a repeat)

Enable real-time spend alerts by SMS/app/email; review statements monthly.
Use virtual cards or card-on-file controls for online merchants; set per-transaction/merchant limits where available.
Keep device OS/apps updated; run reputable anti-malware; avoid public Wi-Fi for transactions.
Never share OTP or full card details by chat/SMS/call; issuers never ask for your OTP/PIN.
Consider 3-D Secure-only settings for online purchases if your issuer offers it.
For travel, advise your issuer and carry a backup payment method.

Sample dispute letter (adapt to your issuer’s form)

Subject: Dispute of Unauthorized Credit Card Transaction(s) Cardholder: [Full Name], [Last 4 digits of card] Address/Contact: [Address / Email / Mobile] Reference No.: [If any]

I am disputing the following transaction(s) as unauthorized:

[Merchant], [Amount & Currency], [Date Posted / Date of Transaction], [Reference/ARN if shown]

[Add rows as needed]

Facts: On [date/time], I noticed the above charges. I did not authorize or benefit from these transactions. The card was [in my possession / lost or stolen on (date/time) — police blotter attached]. I immediately reported to [Issuer hotline] on [date/time], reference no. [xxx]. I request that you block the card, investigate, and reverse the disputed charges, including any interest and fees arising from them.

Attached are: [ID], [Affidavit of Loss], [Police blotter], [Screenshots of alerts/statement], [Travel proof], [Merchant cancellation emails], and other supporting documents.

Please keep me informed of progress and provide your findings, including any evidence relied upon if the claim is denied. Kindly suspend collections on the disputed amounts pending resolution.

Sincerely, [Signature / Full Name] [Date]

Frequently asked questions

Do I have to pay while the dispute is pending? Pay the undisputed portion to keep your account current. Ask the issuer in writing to suspend interest/late fees on the disputed amount.

Will my credit standing be affected? Non-payment can lead to adverse reporting. Keep paying undisputed amounts and secure written confirmation that the disputed sum is on hold.

Is a police blotter required? Often requested for lost/stolen physical card cases; less common for purely online fraud. Provide it if asked—it helps establish your diligence.

How long will it take? Investigations can span weeks to a few months, depending on merchant/acquirer cooperation and network timelines. Early, complete documentation shortens this.

What if the issuer denies my dispute? Request the evidence (e.g., signed slip, EMV/PIN logs, 3-D Secure data). If you still disagree, escalate within the bank, then to the BSP under the Financial Consumer Protection framework, and consider law enforcement for fraud.

Practical checklist

Block card & request replacement
Save screenshots and draft a timeline
File dispute form + supporting documents
Pay undisputed balance; request fee/interest suspension on disputed items
Track reference numbers and follow-ups
Escalate if not resolved; consider BSP and law enforcement

Final notes

Read your cardholder agreement—some issuers embed shorter notice periods and documentary requirements.
In fraud cases, speed, documentation, and persistence materially increase the odds of recovery.
If significant sums are involved or you face a complex denial, consult a Philippine lawyer experienced in payments/consumer protection to assess civil remedies and guide regulatory escalation.