An unfamiliar withdrawal, fund transfer, card charge, or online banking payment can empty an account in minutes. The most important response is to act immediately: secure the account, report the transaction through the bank’s official fraud channel, request a trace and temporary hold of the funds, preserve evidence, and submit a written dispute. Philippine law gives financial consumers important rights, but recovery often depends on how quickly and thoroughly the incident is reported.

What Counts as an Unauthorized Bank Account Transaction?

An unauthorized transaction is a withdrawal, transfer, payment, or charge made without the account holder’s knowledge or valid consent. Common examples include:

Online transfers made after a criminal takes over a banking account
ATM withdrawals using a stolen or cloned card
Debit card purchases the cardholder did not make
Transfers resulting from a SIM-swap attack
Transactions made using stolen passwords, one-time passwords, or device credentials
Payments initiated after malware or remote-access software compromises a phone
Transfers made by a family member, employee, or other person who had no authority to use the account

A transaction can still be disputed even when the banking system records that the correct PIN, password, biometrics, or one-time password was used. Authentication records are evidence, but they do not automatically prove that the account holder knowingly and voluntarily authorized the transaction. BSP rules require the bank to examine the conduct of both the customer and the financial institution, including security controls, alerts, system logs, employee actions, and compliance with fraud-prevention procedures.

Unauthorized transactions versus scam-induced transfers

Banks often distinguish between a transaction technically initiated by a criminal and one personally approved by the account holder after being deceived.

Situation	Typical classification	Can it be disputed?
Hacker transfers money without the customer logging in	Unauthorized transaction	Yes
Stolen card is used at an ATM or merchant	Unauthorized transaction	Yes
Customer enters an OTP on a fake bank website	Account takeover or social-engineering incident	Yes
Customer transfers money to a fake seller or investment	Scam-induced transfer	Yes, although reimbursement may be more difficult
Customer accidentally sends money to the wrong account	Erroneous transfer	Yes, but the recipient’s consent or a legal process may be needed
Authorized family member spends more than expected	Authority or consent dispute	Depends on the scope of permission

The Anti-Financial Account Scamming Act treats transactions facilitated by social engineering—fraudulent methods used to obtain account information or control—as disputed transactions that may trigger tracing, temporary holding, and coordinated verification procedures. This is important when the customer was tricked into clicking a link, installing an app, disclosing an OTP, or approving a transfer. The fact that the customer performed one step does not necessarily end the inquiry. (Lawphil)

Your Rights Under Philippine Banking Law

Several laws and BSP regulations apply to unauthorized bank account transactions.

Financial Products and Services Consumer Protection Act

Republic Act No. 11765, or the Financial Products and Services Consumer Protection Act of 2022, requires banks and other covered financial service providers to maintain a free and accessible Financial Consumer Protection Assistance Mechanism.

When a customer disputes an unauthorized transaction, the institution must investigate the complaint fairly. While the investigation is pending, it must suspend applicable interest, fees, and charges on the disputed amount or provide a comparable reasonable accommodation. Consumers who remain dissatisfied may elevate their complaint to the appropriate financial regulator.

The law also prevents financial institutions from using contract terms to make consumers waive fundamental rights, including the right to receive information, have complaints addressed, protect non-public data, and bring a legal action. Claims under the law generally prescribe five years from the transaction or from the discovery of fraud or deceit, although waiting is rarely practical in a fraud case. See the official Financial Products and Services Consumer Protection Act.

BSP rules on unauthorized electronic fund transfers

Under BSP Circular No. 1160, BSP-supervised institutions must maintain an active, free, and accessible 24-hour channel for reporting fraud and unauthorized transactions.

For an unauthorized fund transfer, the complaint should first be filed with the Originating Financial Institution, meaning the bank or e-wallet from which the money left. That institution has primary responsibility for receiving the complaint and coordinating with the receiving and subsequent financial institutions.

Depending on the facts, the bank may be required to:

Block or restrict the compromised account
Hold funds that remain intact
Coordinate with the receiving institution
Suspend interest, fees, or charges relating to the disputed transaction
Consider provisional credit or another temporary accommodation
Correct or reverse the transaction if the investigation establishes that it was unauthorized or fraudulent
Give the customer a written investigation result within three banking days after the investigation concludes

A provisional credit is a temporary amount credited to the customer while the dispute is being investigated. It is not automatically required in every case and may initially be non-withdrawable.

Anti-Financial Account Scamming Act

Republic Act No. 12010, or the Anti-Financial Account Scamming Act of 2024, criminalizes activities such as money muling and social engineering involving financial accounts. A money mule is a person who receives, transfers, withdraws, or otherwise moves fraud proceeds, whether knowingly or under circumstances covered by the law. (Lawphil)

Under the Act and BSP Circular No. 1215, financial institutions may temporarily hold disputed funds while conducting a coordinated verification:

An initial hold may last up to five calendar days.
The hold may be extended for up to 25 additional calendar days.
A hold beyond the total 30-day period generally requires a court order.
The account holder may need to submit a sworn complaint, affidavit, police report, or other supporting evidence during the initial holding period.
If verification establishes social engineering, money muling, or another covered suspicious circumstance, funds that remain available may be returned to the source account.
If the transaction is found legitimate, the hold must be lifted.

A financial institution that fails to impose a required temporary hold may be liable for resulting loss or damage, including restitution, under applicable rules. Knowingly making a false or malicious fraud report can also have criminal consequences. (Bangko Sentral ng Pilipinas)

Banks must exercise a high degree of diligence

Section 2 of Republic Act No. 8791, the General Banking Law of 2000, recognizes the fiduciary nature of banking and requires high standards of integrity and performance. Civil Code Articles 1170 to 1173 also make a party liable for damages caused by fraud, negligence, delay, or violation of contractual obligations. (Lawphil)

The Supreme Court has repeatedly held that banks must exercise extraordinary or the highest degree of diligence in handling customer accounts. In Premiere Development Bank v. Manalo, the Court required a bank to restore money lost through an unauthorized withdrawal caused by its negligence. In Banco de Oro Universal Bank v. Seastres, the Court emphasized that a bank may be liable when it fails to follow its own safeguards and operating procedures. (Supreme Court E-Library)

These doctrines do not create an automatic refund for every reported transaction. The outcome still depends on the evidence, the bank’s security failures, the customer’s actions, and whether the loss could have been prevented or reduced.

What to Do Immediately After Discovering the Transaction

1. Secure the account and all connected devices

Use only the bank’s official application, website, hotline, or branch. Do not call a telephone number contained in a suspicious text message or email.

Ask the bank to:

Block online and mobile banking access
Freeze or replace the debit or ATM card
Log out all active devices
Remove unrecognized enrolled devices
Disable fund transfers if necessary
Change registered contact details only after identity verification
Place an alert on the account

Then secure the systems connected to the account:

Change the passwords for online banking and the registered email account.
Use a clean device if the original phone or computer may be compromised.
Contact the mobile provider if the SIM suddenly lost service.
Remove unknown remote-access or screen-sharing applications.
Check whether email-forwarding rules or recovery details were altered.
Do not factory-reset the device until important evidence has been preserved.

2. Report the dispute to the bank where the money originated

Report the incident immediately through the originating bank’s 24/7 fraud channel. A report made within minutes or hours gives the receiving bank a better chance of locating and holding the money before it is withdrawn or transferred again.

Provide:

Your name and masked account number
Transaction date and time
Amount
Transaction or reference number
Recipient account or merchant, if visible
A clear statement that you dispute the transaction
A brief description of what happened
The date and time you first discovered the transaction

Ask for:

A complaint or case reference number
Written acknowledgment
Immediate coordination with the receiving institution
Temporary holding of any remaining funds
Copies of the bank’s dispute form and documentary requirements
A written final investigation result

For a bank-to-bank or bank-to-e-wallet transfer, do not rely only on contacting the receiving institution. The originating institution has primary responsibility for initiating the coordinated process under BSP rules.

3. Send a written dispute on the same day

A phone call is useful for stopping further loss, but a written complaint creates a clearer record.

A practical dispute statement may read:

I dispute the transaction dated [date and time] in the amount of ₱[amount], with reference number [number]. I did not knowingly or voluntarily authorize this transaction. Please block further access, initiate tracing and coordinated verification, temporarily hold any available funds, suspend charges relating to the disputed amount, and provide written acknowledgment and investigation results.

Describe the incident truthfully. If you clicked a phishing link, disclosed an OTP, installed an application, or spoke with a person pretending to be a bank employee, include that fact. Do not simply state “I did not share anything” if the bank’s logs or later evidence may show otherwise. An inconsistent account can damage credibility more than an honest explanation of how the deception occurred.

4. Preserve all available evidence

Save the evidence before messages disappear, accounts are deleted, or devices are reset.

Useful evidence includes:

Bank transaction history and account statements
SMS and email alerts
Screenshots of the fraudulent website, social media profile, advertisement, or conversation
Sender names, phone numbers, email addresses, usernames, and URLs
Call logs and recordings, when lawfully available
Transaction reference numbers
Proof of your location when the transaction occurred
Device security alerts and login notifications
SIM-replacement or service-interruption records
Receipts and communications with the legitimate merchant
Copies of every report made to the bank, police, NBI, or other agency

Keep original electronic files when possible. Screenshots are useful, but original emails, message exports, and files may contain metadata that helps identify when and how the fraud occurred.

5. Submit supporting documents within the initial holding period

Under the AFASA implementing rules, the source account owner may be required to provide a sworn complaint, affidavit, police report, or similar proof within the initial five-calendar-day holding period. Missing this window can make it harder to justify extending the hold, particularly when the bank is still trying to prevent the recipient from moving the money. (Bangko Sentral ng Pilipinas)

Do not wait for every document to become available before sending the initial report. Submit what you already have, identify documents that will follow, and ask the bank to confirm its deadline in writing.

6. File a law-enforcement report when fraud or account takeover is involved

A bank dispute and a criminal complaint serve different purposes. The bank dispute seeks account protection, tracing, and possible reimbursement. A criminal complaint seeks investigation and prosecution.

Depending on the facts, the conduct may violate:

Republic Act No. 12010, the Anti-Financial Account Scamming Act
Republic Act No. 8484, the Access Devices Regulation Act
Republic Act No. 10175, the Cybercrime Prevention Act
Article 315 of the Revised Penal Code on estafa
Republic Act No. 10173, the Data Privacy Act, when personal data was unlawfully obtained or exposed

Complaints may be reported to the Philippine National Police, the National Bureau of Investigation, or the Cybercrime Investigation and Coordinating Center. The NBI online complaint portal is available for submitting initial information, although investigators may later require personal appearance and original evidence. BSP’s official consumer guidance also identifies these agencies as possible reporting channels for fraud and scams. (National Bureau of Investigation)

Documents to Prepare for the Bank Dispute

Document or evidence	Why it matters
Government-issued identification	Confirms the complainant’s identity
Account statement or transaction history	Shows the disputed amount, date, recipient, and reference number
Bank dispute form	Starts the institution’s formal complaint process
Written narrative or chronology	Explains events in a consistent sequence
Screenshots and original messages	Shows phishing, impersonation, or fraudulent instructions
Affidavit of unauthorized transaction	Provides a sworn factual statement
Police, NBI, or cybercrime report	Supports the claim that a crime occurred
SIM replacement or telco report	Useful in SIM-swap cases
Travel, work, or location records	May show the customer could not have made an ATM or in-person transaction
Device and login records	May identify an unknown device, IP address, or enrollment
Prior bank correspondence	Proves timely reporting and follow-up
Special power of attorney	Needed when a representative handles formal proceedings

An affidavit should normally state:

The account holder’s identifying information
The relevant account, using only the digits needed by the receiving institution
The disputed transactions
The date and manner of discovery
Whether the card, phone, SIM, password, PIN, or OTP was lost, shared, intercepted, or compromised
Actions taken to report and secure the account
A declaration that the facts are true

The bank may accept an electronically submitted affidavit initially but later require a notarized original. Requirements vary depending on the institution, the amount, and the stage of the complaint.

How Long Does the Investigation Take?

The following periods apply under BSP rules, although complex cases may take longer when funds pass through several institutions or when the bank needs law-enforcement records.

Stage	Typical regulatory period
Fraud report and acknowledgment	Immediate or as soon as practicable through the 24/7 channel
Initial temporary hold	Up to 5 calendar days
Extended temporary hold	Up to 25 additional calendar days
Total hold without a court order	Up to 30 calendar days
Coordinated verification when funds are held	Generally within 30 calendar days
Verification when no funds were held	Generally within 30 days, extendable for meritorious reasons up to 60 days
Written notice after the investigation concludes	Within 3 banking days

The customer may request information such as transaction reference numbers, the institutions involved, and relevant dates and times. However, the bank may withhold information protected by bank-secrecy, data-privacy, anti-money-laundering, or law-enforcement restrictions. (Bangko Sentral ng Pilipinas)

A 30-day investigation period does not mean the customer should wait 30 days before following up. Confirm that the bank received the evidence, ask whether a hold was successfully placed, and document every response.

How Banks Determine Who Bears the Loss

The bank should not decide the case solely by saying that its records show a successful OTP, PIN, biometric, or password authentication. A proper investigation should consider the complete sequence of events.

Relevant questions include:

What did the customer do?

Was the loss reported promptly?
Was the card or phone physically secured?
Was an OTP, password, PIN, or verification code disclosed?
Was remote-access software installed?
Did the customer ignore an obvious security warning?
Did the customer continue communicating with the fraudster after discovering the problem?
Were the customer’s statements accurate and consistent?

What did the bank do?

Did the bank detect an unusual device, location, or transaction pattern?
Was a new device or beneficiary enrolled immediately before the transfer?
Were required alerts sent?
Did the bank enforce transaction limits and cooling-off safeguards?
Did it follow its own authentication and callback procedures?
Did it respond promptly to the fraud report?
Did it coordinate with the receiving institution?
Were known high-risk or mule accounts involved?
Did an employee or outsourced service provider fail to follow procedure?

Useful records to request or ask the bank to preserve include:

Device and IP-address logs
Login and authentication history
New-device and beneficiary-enrollment records
OTP generation and delivery records
Fraud-monitoring alerts
Call recordings
Branch surveillance footage
ATM terminal records and footage
Internal case notes
Communications between the originating and receiving institutions

The bank may not release every internal or third-party record directly to the customer, but a written preservation request can become important if the dispute later proceeds to BSP adjudication or court.

Common Mistakes That Weaken a Dispute

Reporting only to the receiving bank

The originating institution should receive the formal complaint because it is responsible for starting the coordinated verification process.

Accepting a verbal rejection

Ask for the final result in writing, including the factual basis, security records relied upon, and applicable bank policy. A statement such as “the transaction was authenticated” does not explain whether the bank investigated social engineering, account takeover, unusual behavior, or weaknesses in its controls.

Delaying the affidavit or police report

The first five calendar days can be crucial when a temporary hold is being considered. Submit available evidence early.

Deleting messages or resetting the device

This can erase links, malware traces, timestamps, account names, and other evidence. Preserve the data before cleaning the device.

Giving the bank inaccurate information

Do not conceal that an OTP was shared or that an application was installed. Explain how the deception happened and why the transaction did not reflect informed, voluntary consent.

Treating a provisional credit as a final refund

A temporary credit can be reversed if the bank later decides against the dispute. Ask whether the amount is provisional, withdrawable, and subject to reversal.

Paying a supposed “recovery fee”

Banks, regulators, and legitimate law-enforcement agencies do not require payment to an unknown personal account or cryptocurrency wallet to release frozen fraud proceeds. Fraud victims are frequently targeted a second time by fake recovery agents.

What to Do If the Bank Rejects or Delays the Dispute

1. Escalate through the bank’s consumer assistance mechanism

Send a written follow-up quoting the original case number. Ask for:

The current investigation status
Confirmation of whether funds were held
The date the receiving institution was notified
Any missing documents
The expected completion date
The written basis for any denial

Keep proof that the complaint passed through the bank’s Financial Consumer Protection Assistance Mechanism. This is normally required before BSP will process the matter as a second-level complaint.

2. File a complaint with the Bangko Sentral ng Pilipinas

If the bank does not act or its response is unsatisfactory, elevate the matter through the BSP Consumer Assistance Mechanism.

The BSP recommends using BSP Online Buddy, or BOB, through the official BSP website or verified BSP Facebook Messenger account. A complaint may also be submitted using the BSP Complaint, Inquiry, or Reply form together with proof that the matter was first reported to the bank.

Include:

Your contact information
Name of the bank or financial institution
Bank complaint reference number
Chronology of events
Disputed transactions
The relief requested
Copies of the bank’s responses
Supporting evidence

Do not send passwords, PINs, complete card numbers, or one-time passwords. The official BSP guide on filing a financial consumer complaint explains the available channels and documentary requirements.

3. Consider BSP mediation or adjudication

BSP Consumer Assistance is generally the required first regulatory step before mediation or adjudication.

Under BSP Circular No. 1169:

Mediation allows the consumer and financial institution to attempt a voluntary settlement with the assistance of a BSP mediator.
Adjudication allows BSP to decide a purely civil claim for payment or reimbursement involving a financial product or service.
BSP adjudication generally covers claims up to ₱10 million, excluding legal interest, attorney’s fees, and costs.
A claimant seeking more than ₱10 million may have to waive the excess to remain within BSP jurisdiction or pursue the claim in court.
Claims already pending before or decided by a court or another competent adjudicatory body may be excluded.

Formal proceedings may require a verified complaint, supporting documents, and a certification against forum shopping—a sworn declaration that the same case has not been filed elsewhere.

4. Evaluate a civil case

A civil action may be appropriate when the amount is substantial, the bank is alleged to have acted negligently, important evidence requires compulsory disclosure, or relief beyond reimbursement is sought.

Possible legal grounds may include:

Breach of the deposit or banking contract
Negligence under Civil Code Articles 1170 to 1173
Violation of statutory consumer-protection duties
Damages caused by failure to follow security or fraud-response procedures

The proper court depends on the amount and nature of the claim, the parties’ locations, and applicable jurisdictional rules. Court action should also account for arbitration clauses, BSP proceedings, prescription periods, and the prohibition against pursuing the same claim simultaneously in multiple forums.

Special Situations

The customer shared the OTP

Sharing an OTP can make recovery more difficult, but it does not automatically establish that the customer intended the final transaction. The bank should still investigate whether the OTP was obtained through social engineering, whether the payee or device was newly enrolled, whether the transaction was highly unusual, and whether bank safeguards operated properly.

The funds were already withdrawn

A temporary hold is only effective against money still present in the receiving or subsequent accounts. If the funds have been withdrawn, converted, or transferred through several accounts, recovery becomes more difficult. The bank must still complete the investigation, and law enforcement may trace the proceeds, identify mule accounts, seek preservation orders, or pursue criminal charges.

The transaction involves a debit card purchase

Report the transaction to the issuing bank, not only to the merchant. Ask whether the transaction was card-present, contactless, online, recurring, or processed through a digital wallet. Request the merchant name, transaction location, authorization method, and available chargeback or card-network dispute procedure.

The transaction is an ATM withdrawal

Ask the bank to preserve:

ATM surveillance footage
Terminal identification
Electronic journal records
Card-reading and PIN-validation logs
Time synchronization records
Records of other fraud complaints involving the same ATM

Footage may be overwritten after a retention period, making prompt preservation important.

The transfer was sent to the wrong account

An erroneous transfer is not always fraud. The bank usually cannot simply debit the recipient’s account based only on the sender’s request, especially when ownership is disputed. The bank may contact the recipient, restrict funds when legally justified, or require consent, an indemnity, or a court order.

A family member or employee used the account

The dispute may turn on whether the person had actual or apparent authority. Sharing a card, PIN, password, signed withdrawal slip, or device can complicate the case. Clearly describe what authority, if any, was given and how the disputed transaction exceeded it.

Overseas Filipinos and Foreign Account Holders

A customer does not lose Philippine financial consumer rights merely because the customer is abroad or is not a Filipino citizen. The key question is whether the account or financial service is provided by an institution supervised under Philippine law.

An overseas customer should:

Report through the bank’s official international hotline or online fraud channel.
State the current country and time zone.
Preserve travel, immigration, employment, or location records.
Ask whether electronic copies of affidavits are temporarily acceptable.
Use a representative in the Philippines when personal appearance is impractical.

A representative may need a special power of attorney, or SPA, expressly authorizing the person to file complaints, submit documents, receive communications, attend mediation, or enter into a settlement.

A document notarized abroad may need an apostille when executed in a country participating in the Apostille Convention. Documents from non-participating countries may require authentication or legalization through the relevant Philippine diplomatic or consular post. The exact requirement should be confirmed with the bank, BSP, court, or agency where the document will be used. (Philippine Embassy in Ottawa)

Frequently Asked Questions

How soon should I report an unauthorized bank transaction?

Report it immediately—preferably within minutes or hours of discovery. Philippine rules allow an initial temporary hold of up to five calendar days, but funds can disappear long before that if the fraudster transfers or withdraws them.

Is the bank automatically required to refund me?

No. The bank must investigate, but reimbursement depends on the evidence, the type of transaction, the customer’s conduct, and whether the bank or its service providers failed to exercise required diligence. A refund is stronger when the transaction was clearly unauthorized or bank controls failed.

Can I dispute a transaction even if an OTP was used?

Yes. Explain exactly how the OTP was obtained or used. The bank should consider social engineering, device takeover, SIM swapping, abnormal transaction behavior, and its own security controls—not merely the existence of a valid OTP.

Can the bank freeze the recipient’s account?

The receiving institution may temporarily hold disputed funds under applicable BSP and AFASA procedures. A hold is not the same as permanently confiscating the money. The institution must verify the transaction, and a court order is generally needed to extend a hold beyond the regulatory period.

How long should the bank investigation take?

When funds are held, coordinated verification should generally be completed within 30 calendar days. When no funds were held, the process generally takes 30 days and may be extended for meritorious reasons up to 60 days. The bank should communicate the final result in writing within three banking days after completing its investigation. (Bangko Sentral ng Pilipinas)

Do I need a police report before the bank investigates?

Not necessarily for the initial report. The bank should accept and act on the fraud notification immediately. However, a police, NBI, or cybercrime report may be required as supporting evidence, particularly during the initial holding period or for a substantial claim.

Can BSP order the bank to return my money?

Through its adjudication process, BSP may decide qualifying civil claims for payment or reimbursement within its jurisdiction. Consumers ordinarily must first complete the bank’s complaint process and BSP Consumer Assistance stage.

What if the bank says the transaction was valid because it came from my phone?

Ask the bank to examine whether the device was compromised, whether a new device or beneficiary was enrolled, whether remote-access software was used, and whether the transaction pattern triggered fraud alerts. Device recognition is relevant evidence, but it is not necessarily conclusive.

Can I recover money after it has passed through several accounts?

Recovery is possible but becomes more difficult with each transfer. Prompt reporting allows institutions to trace and hold funds in receiving or subsequent accounts. Criminal investigators may also seek records and court orders to trace the proceeds.

Key Takeaways

Report the transaction immediately through the originating bank’s official 24/7 fraud channel.
Secure the bank account, card, phone, SIM, and registered email account.
Ask for a case number, fund trace, temporary hold, and written acknowledgment.
Submit screenshots, transaction records, an affidavit, and any police or cybercrime report as early as possible.
Do not assume that use of an OTP, PIN, or registered device automatically defeats the dispute.
Banks must examine both customer conduct and their own security controls and procedures.
Temporary holds can generally last up to 30 calendar days without a court order.
Escalate an unresolved complaint through BSP Consumer Assistance, followed when appropriate by mediation, adjudication, or court proceedings.
Preserve evidence and insist on a written investigation result rather than relying on verbal explanations.