Quick answer

Report the transaction to your bank or card issuer immediately through its official fraud channel. Block the card or activate the account’s kill switch, ask the institution to register a formal unauthorized-transaction dispute, and obtain a case or reference number. Follow the call with a written complaint listing every disputed transaction and attach supporting evidence.

Speed matters. For an unauthorized electronic fund transfer, an immediate report may allow the institutions involved to trace and temporarily hold funds that remain in the financial system. For a credit-card billing error or unauthorized charge, report it no later than 30 calendar days from the statement date. Reporting does not guarantee an automatic refund: responsibility depends on the evidence, the account holder’s conduct, the institution’s security controls and compliance, and the transaction’s particular circumstances.

Do not contact the recipient or suspected scammer instead of the bank, and never give anyone your PIN, password, one-time password (OTP), card verification value (CVV), or remote access to your device.

What to do immediately

1. Secure the card, account, and connected services

Use only the bank’s official mobile app, website, branch, or the number printed on the card or published on the bank’s official website.

Lock or block the affected card.
Use the account’s kill switch, if available, to suspend access and outgoing transactions.
Ask the bank to disable compromised online-banking access and issue a replacement card or account credentials where necessary.
Change the online-banking password, email password, and any reused passwords from a clean, trusted device.
Remove unfamiliar devices, payees, digital wallets, and recurring-payment arrangements.
If your SIM stopped working unexpectedly, contact your mobile provider immediately and ask whether a SIM replacement or account change occurred.
Check all accounts with the same institution, including savings, current, credit-card, loan, and e-wallet accounts.

BSP rules now require digital platforms facilitating retail interbank transfers and other high-risk transactions to offer a self-service facility capable of suspending the account and blocking outgoing transactions. They also require stronger fraud monitoring, transaction notifications, and security controls. See BSP Circular No. 1213.

2. File the dispute with the institution from which the money or credit came

For a bank transfer, ATM withdrawal, debit-card transaction, or alleged unauthorized transaction, file with the originating financial institution—normally the bank or financial institution where your affected account is maintained. That institution is primarily responsible for assisting you and coordinating with the receiving institution.

State clearly:

“I did not make, approve, or authorize these transactions. Please register this as an unauthorized-transaction complaint, preserve all relevant records, initiate tracing and coordinated verification, and provide my case reference number.”

Give the institution:

Your name and contact information;
The affected account, identified only as the institution requires through its secure channel;
The amount, date, time, merchant or recipient, and reference number of each transaction;
When and how you discovered it;
Whether the card or phone was lost, stolen, retained by an ATM, or still in your possession;
Whether you received or disclosed an OTP, PIN, password, or other credential;
Whether you clicked a link, installed an app, shared your screen, or allowed remote access;
Any unusual login, device-registration, profile-change, or SIM-replacement alert; and
The exact relief requested, such as reversal, removal of related fees, temporary account protection, or provisional credit.

Be accurate. Do not omit an embarrassing fact or label a transaction unauthorized if you actually approved it. A false report made maliciously or in bad faith that causes funds to be held may result in liability under the Anti-Financial Account Scamming Act.

3. Obtain written proof of the report

Ask for:

A complaint or case reference number;
Written acknowledgment showing the date and time of reporting;
Confirmation that the card or account access was blocked;
The list of documents still required;
The investigation timetable;
Whether any funds were successfully held;
Whether provisional credit or another temporary accommodation is available; and
The date when you should follow up.

BSP rules call for free, active, closely monitored fraud-reporting channels, immediate written acknowledgment, and fair and transparent claim handling. Fraud concerns must receive priority, although the time needed may depend on the case’s complexity. See BSP Circular No. 1160 and BSP Memorandum No. M-2024-030.

Special rules for electronic fund transfers

The Anti-Financial Account Scamming Act and its implementing BSP regulations establish a temporary-holding and coordinated-verification process for disputed electronic transfers from one financial account to another. This can cover transfers within the same institution or through systems such as InstaPay or PESONet when the transaction meets the regulatory definition of a disputed transaction.

The process generally works as follows:

The account owner reports through the originating institution’s 24/7 fraud channel.
The originating institution verifies the complaint and identifies the transaction chain.
Funds that remain in participating institutions may initially be held for up to five calendar days.
The initial hold may be extended by up to 25 additional calendar days when there are reasonable grounds to believe the held money is disputed and more time is needed.
The institutions conduct coordinated tracing and verification even if the money has already left their systems.

To support an extended hold, the source-account owner generally must provide a sworn complaint, affidavit, police report, or other supporting document within the initial holding period, subject to the applicable industry protocol. Ask the bank immediately which document it requires and where to submit it.

If funds were successfully held, coordinated verification must ordinarily be completed within the 30-calendar-day temporary-holding period, unless a competent court extends the hold. If no funds were held, verification must ordinarily be completed within 30 calendar days, but may extend to a total of 60 calendar days for meritorious reasons.

A temporary hold is not yet a final refund. Funds may ultimately be returned to the source account when the beneficiary waives them or the verification reasonably concludes that they are connected with money muling, unlawful activity, social engineering, or comparable grounds. Otherwise, the hold normally must be lifted when its lawful period expires. These procedures, scope limits, and release rules appear in BSP Circular No. 1215

Quick answer

Report the transaction to your bank or card issuer immediately through its official fraud hotline, app, website, or branch. Block the card or activate the account’s kill switch, ask the institution to open a formal unauthorized-transaction dispute, and obtain a case number and written acknowledgment.

Speed matters. For electronic transfers, an immediate report may allow the institutions involved to trace and temporarily hold funds that remain in the financial system. For a credit-card billing error, report it no later than 30 calendar days from the statement date. Reporting does not guarantee reimbursement: liability depends on the evidence, the account holder’s conduct, the institution’s security controls and actions, and the applicable rules.

What counts as an unauthorized transaction?

A transaction is generally unauthorized when it was completed without the account holder’s knowledge, consent, or valid instruction. Examples include:

Purchases made with a stolen or compromised card;
ATM withdrawals you did not make;
Online banking or e-wallet transfers made after an account takeover;
Transactions completed using credentials obtained through phishing, impersonation, SIM-related fraud, malware, or another social-engineering scheme; and
Charges made after you reported a card lost or stolen.

This is different from:

An erroneous transfer: You authorized the transfer but entered the wrong account number, recipient, or amount.
A merchant dispute: You made the purchase but the goods were not delivered, were defective, or were misrepresented.
A recurring charge: You originally authorized a subscription but believe later charges should have stopped.
A family or supplementary-card dispute: Someone with permitted access used the account beyond what you privately agreed.

Tell the institution exactly which situation occurred. Different investigation and recovery rules may apply.

What to do immediately

1. Secure the card and account

Use only the contact details printed on the card, shown in the official app, or published on the institution’s official website.

Lock or block the affected card.
Use the kill switch, if available, to suspend the account and outgoing transactions.
Ask the institution to disable online banking, cash advances, fund transfers, newly enrolled devices, and other exposed functions as appropriate.
If your phone or SIM may be compromised, contact your telecommunications provider and secure the mobile number.
Change online-banking, email, and related passwords from a trusted device. Do not reuse an old password.
Review other accounts for linked cards, unfamiliar recipients, new devices, changed contact details, or additional unauthorized transactions.

Blocking a card is not the same as closing the dispute. Complete both steps.

2. Report the transaction as fraud or unauthorized

Contact the institution from which the money or credit originated. In BSP terminology, this is ordinarily the originating financial institution, which is primarily responsible for assisting its customer.

Provide:

Your name and the affected account or card, using only the masked number where possible;
Transaction amount, date, time, recipient or merchant, and reference number;
The time you discovered and reported the transaction;
A clear statement that you did not make, approve, or benefit from it;
Whether the physical card, phone, or SIM remained with you;
Whether you received or disclosed an OTP, PIN, password, verification code, or other credential—and the exact circumstances;
Any suspicious call, message, link, device enrollment, password reset, or change to your registered contact information; and
The action requested, such as blocking the account, tracing and holding transferred funds, reversing the charge, and suspending related interest or fees.

Ask for:

A case or ticket number;
Immediate written acknowledgment;
The institution’s dispute form and evidence requirements;
Confirmation that the receiving institution has been notified, if money was transferred;
Confirmation whether any funds were successfully held;
The investigation timetable; and
Written notice of the result.

BSP rules require supervised institutions to provide free, active fraud-reporting channels, generally on a 24/7 basis, and to give an immediate written acknowledgment when a consumer uses the reporting channel. See BSP Circular No. 1160 and BSP Memorandum No. M-2024-030.

3. Follow up in writing

Even if the first report was by telephone, send a written complaint through the institution’s official email, secure message center, or branch. State:

I dispute the identified transaction as unauthorized. I did not initiate, approve, or benefit from it. Please preserve all relevant records, investigate the transaction, trace and hold any remaining funds where applicable, suspend related interest and fees, and provide the result and supporting explanation in writing.

List each disputed transaction separately. Do not merely say that the “account was hacked.”

Special rules for electronic fund transfers

The Anti-Financial Account Scamming Act and its implementing BSP rules created a coordinated process for disputed electronic transfers between financial accounts.

Under BSP Circular No. 1215:

A complaint through the originating institution’s 24/7 fraud channel can trigger tracing, temporary holding, and coordinated verification.
The initial holding period is not more than five calendar days.
It may be extended by not more than 25 additional calendar days when there are reasonable grounds to believe the held funds are disputed and more time is needed.
Supporting documents—such as a sworn complaint, affidavit, police report, or similar evidence—should be submitted within the initial holding period, subject to the applicable industry protocol.
If funds were successfully held, coordinated verification should be completed within the total 30-calendar-day holding period, unless a court extends the hold.
If no funds were held, verification should generally be completed within 30 calendar days and may, for meritorious reasons, be extended to a total of no more than 60 calendar days.

These rules apply to electronic transfers from one financial account to another. They do not ordinarily apply to credit-card purchase transactions or to transfers that you knowingly sent to the wrong recipient. A credit card is covered only when it was used to perform an electronic fund transfer through an Automated Clearing House.

A temporary hold is not an automatic refund. The receiving account holder may challenge the hold and prove that the transaction was legitimate. Depending on the verification result, held funds may be returned to the source account or released to the beneficiary.

If the transferred money has already been withdrawn, moved outside the covered system, spent, or converted into another asset, there may be nothing available to hold. The institutions must still participate in coordinated verification even when the funds no longer remain in their systems.

Special rules for credit-card charges

Report any error or discrepancy in a credit-card billing statement within 30 calendar days from the statement date. Under Republic Act No. 10870 and BSP Circular No. 1003:

The report may be written, verbal, or otherwise documented.
The issuer must take action within 10 business days after receiving the notice and relevant records.
Within 90 days after receiving the notice, the issuer must conduct a thorough investigation, make appropriate corrections, and send a written explanation or clarification before taking action to collect the contested amount.
The issuer may continue collecting amounts that were not identified as disputed.

Continue paying undisputed amounts on time. Ask the issuer in writing how to treat the disputed charge, minimum amount due, installment obligations, and any interest while the investigation is pending. Do not simply ignore the entire statement.

If an investigation finds that a transaction was unauthorized or fraudulent, the issuer should reverse it together with related finance charges and fees.

Lost or stolen credit cards

Report a lost or stolen card immediately. BSP regulations state that transactions made before the loss was reported are initially for the cardholder’s account, but the cardholder may still dispute them. If the transactions are found unauthorized or fraudulent, they must be corrected or reversed with related charges.

For transactions occurring after prompt notice, the Supreme Court has rejected contract terms that would make a cardholder remain liable while the issuer delays cancelling the card or notifying merchants. See Cruz v. Court of Appeals, G.R. No. 135149, July 25, 2006.

Will the bank have to refund the money?

Not automatically. A password, PIN, OTP, biometric record, or registered-device log may be important evidence, but no single item necessarily decides every case.

Under BSP consumer-protection rules, relevant considerations include:

The account holder’s actions before, during, and after the transaction;
Acts or omissions of the institution, its employees, agents, outsourced entities, or service providers; and
Whether the institution and those acting for it complied with applicable consumer-protection and security requirements.

Institutions must investigate fairly, transparently, and within a reasonable period proportionate to the case’s complexity. They may provide accommodations such as a non-withdrawable provisional credit, but provisional credit is not guaranteed in every case.

Within three banking days after concluding the investigation, the institution must formally communicate the result. If it finds that the transaction was unauthorized or fraudulent, it should immediately reverse or correct the transaction, including related interest, charges, and fees, or make any provisional credit permanent.

An institution’s internal terms do not override statutory consumer rights. The Financial Products and Services Consumer Protection Act protects consumers’ rights to fair treatment, protection of assets against fraud and misuse, and timely complaint handling. Contractual provisions that waive the right to sue, receive information, or have complaints addressed are unenforceable.

Courts decide liability from the evidence. For example, the Supreme Court held a bank responsible where an ATM system defect enabled purported withdrawals inconsistent with the account balance and withdrawal limits. See Far East Bank & Trust Co. v. Chante, G.R. No. 170598, October 9, 2013. That result does not mean every ATM or online-banking dispute will be resolved against the bank.

Evidence to preserve

Keep the original files where possible, not only edited screenshots.

Account and card statements;
Transaction notifications and reference numbers;
Screenshots showing balances, recipients, registered devices, login alerts, and profile changes;
Fraud reports, emails, chat transcripts, branch acknowledgments, and ticket numbers;
Telephone call logs and the exact time the institution was notified;
Suspicious SMS, emails, social-media messages, usernames, profile links, phone numbers, and website addresses;
Email headers and original electronic attachments;
Proof that the card, phone, or SIM was in your possession;
SIM-replacement or service-interruption records;
Device security alerts, malware findings, and login histories;
Proof of your location when the transaction occurred;
Police, NBI, PNP, or CICC reports;
Affidavits from witnesses; and
Relevant receipts, CCTV availability, or merchant correspondence.

Do not delete messages, reset a possibly compromised phone, or surrender original evidence without retaining a copy unless a qualified investigator instructs you otherwise. Do not publish full account numbers, card numbers, IDs, or credentials on social media.

How to escalate an unresolved complaint

Escalate inside the institution

Address the complaint to the institution’s Financial Consumer Protection Assistance Mechanism or consumer-assistance unit. Ask for its final written response and the records or reasons supporting its conclusion.

Challenge factual errors specifically. For example:

The cited device was not yours;
The notification was sent after the transaction;
Your registered mobile number had been changed;
The transaction exceeded normal patterns;
The bank did not act promptly after your report; or
The response relied only on successful authentication without addressing how the credentials or account were compromised.

Escalate to the BSP

For a BSP-supervised bank, card issuer, e-wallet, or payment service provider, the institution’s complaint process is the required first-level remedy. If its response is unsatisfactory—or it does not act within a reasonable period—file through the BSP Consumer Assistance Mechanism.

The BSP’s current filing guidance allows escalation through:

The BSP Online Buddy or BOB chatbot on the BSP website or BSP’s official Facebook page; or
A completed Complaint/Inquiry/Reply form emailed to consumeraffairs@bsp.gov.ph, with proof that you first complained to the institution.

Follow the BSP’s official complaint instructions. Do not send your PIN, password, complete account or card number, passbook, passport, or full identification documents unless a secure and legally appropriate process specifically requires them.

Under BSP Circular No. 1169, the institution must answer the consumer within 15 calendar days after receiving the BSP’s directive. The consumer may reply within 30 calendar days after receiving that answer. BSP-CAM is facilitative; qualifying disputes may proceed to mediation or BSP adjudication. BSP adjudication generally covers purely civil claims seeking payment or reimbursement of no more than ₱10 million, excluding legal interest, attorney’s fees, and litigation costs.

When to report to law enforcement

A bank dispute seeks financial redress; it does not replace a criminal complaint. Consider promptly reporting to the PNP, NBI, or CICC when the incident involves phishing, impersonation, account takeover, identity theft, a stolen phone or SIM, money mules, threats, organized fraud, or substantial or continuing losses.

The BSP itself encourages scam and fraud victims to approach these agencies because they can commence a formal investigation. The NBI provides an online complaint page and publishes information for computer-crime victims.

A police report or affidavit may also help support an extended hold of transferred funds, but filing with law enforcement does not by itself ensure recovery.

Common mistakes to avoid

Waiting for the monthly statement before reporting an alert you already received;
Contacting only the receiving bank instead of first reporting to the institution from which the money originated;
Blocking the card but failing to lodge a formal transaction dispute;
Reporting only by telephone and keeping no ticket number or written record;
Describing a transaction you personally made as “unauthorized” when the actual issue is a merchant dispute or erroneous transfer;
Omitting uncomfortable but relevant facts, such as entering credentials on a suspicious page;
Assuming that an OTP record automatically proves either side’s case;
Missing the 30-day credit-card billing-dispute period;
Failing to submit affidavits or other evidence during the initial five-day holding period for a disputed electronic transfer;
Paying nothing on a credit-card bill even though part of the balance is undisputed;
Sending complete credentials or IDs through unsecured email or social media; and
Filing knowingly false information. Malicious reporting that causes funds to be held can result in criminal liability under the Anti-Financial Account Scamming Act.

When legal help is urgent

Consult a Philippine lawyer promptly if:

The loss is substantial or affects business, payroll, trust, or joint-account funds;
The bank denies the claim despite evidence of a system or control failure;
The transaction involved a signed document, corporate authorization, supplementary card, or disputed agency relationship;
The institution threatens collection, offset, account closure, or adverse credit reporting while a charge remains contested;
A receiving account holder disputes the temporary hold;
You need a court order to extend a hold beyond the regulatory period;
You receive a subpoena, demand letter, collection case, or criminal complaint;
Several institutions or jurisdictions are involved; or
Evidence may soon be erased or unavailable.

Claims under the Financial Products and Services Consumer Protection Act generally prescribe five years after the transaction, or five years after discovery of deceit or material nondisclosure, subject to an absolute ten-year limit from the violation. Other laws, contracts, court rules, and causes of action may have different deadlines, so do not rely on that outer period before seeking advice.

Frequently asked questions

Is calling the hotline enough?

It can begin the report, but obtain a case number and follow up in writing. A clear written record helps establish what you reported, when you reported it, and what action you requested.

Can the bank refuse the claim because an OTP was used?

The bank may treat OTP use as important evidence, particularly if the customer disclosed it. However, liability should be assessed from all relevant facts, including how the account was accessed, whether security controls worked, whether the institution detected unusual activity, and how both sides acted before and after the transaction.

Can money sent through InstaPay or PESONet be reversed?

Possibly, but not automatically. Immediate reporting may allow funds that remain in a receiving account or subsequent account to be held and verified. Recovery becomes more difficult once the money is withdrawn or leaves the covered financial system.

What if I transferred the money after a scammer deceived me?

Explain precisely what happened. A transfer obtained through social engineering may qualify as a disputed transaction under the AFASA framework, particularly where deception produced unauthorized access or control. Whether a customer-authorized transfer falls within a particular remedy depends on the exact facts and the evidence.

What if I sent money to the wrong account?

Report it immediately as an erroneous transfer. The originating and receiving institutions should make reasonable recovery efforts, but the AFASA temporary-holding rules for disputed transactions do not ordinarily apply to a transfer you knowingly authorized but misdirected.

Can I ask for provisional credit?

Yes. BSP rules recognize non-withdrawable provisional credit as a possible reasonable accommodation. Whether it is granted, and on what conditions, depends on the institution’s assessment and policies.

Should I pay a disputed credit-card charge?

Identify the contested charge in writing and pay undisputed amounts on time. Ask the issuer to confirm how it will treat the disputed amount, minimum payment, interest, and fees during the investigation. The issuer must provide a written explanation before collecting the contested amount, subject to the investigation’s result.

Does filing with the BSP guarantee a refund?

No. BSP-CAM facilitates communication and may lead to mediation or adjudication, but the outcome depends on jurisdiction, evidence, applicable law, and the findings on authorization and liability.

This article provides general Philippine legal information, not legal advice for a particular transaction. Rights and outcomes depend on the account agreement, transaction records, security evidence, and other facts. Official sources and procedures were checked as of August 1, 2026.