Quick answer

Report the transaction immediately through your bank or card issuer’s official 24/7 fraud channel. Ask it to block further use, open a formal dispute, trace any transferred funds, place available disputed funds on temporary hold, and suspend interest, fees, or charges on the disputed amount. Get a written acknowledgment and reference number.

For a credit-card billing error, report within 30 calendar days from the statement date. For unauthorized withdrawals, debit-card transactions, online transfers, or e-wallet payments, report at once: delay may allow the money to be withdrawn or transferred again.

A refund is not automatic. The institution must investigate fairly, considering both the account holder’s conduct and any security, system, employee, agent, or regulatory failure on its side. If dissatisfied after using the institution’s complaint mechanism, escalate the matter to the Bangko Sentral ng Pilipinas (BSP).

What counts as an unauthorized transaction?

An unauthorized transaction is generally one initiated without the account owner’s actual or legally attributable knowledge and consent. Common examples include:

Card purchases or cash advances you did not make or approve;
ATM withdrawals made with a cloned or compromised card;
Transfers made after someone took control of your online-banking or e-wallet account;
Transactions performed through stolen credentials, phishing, malware, SIM-related compromise, or social engineering; and
Transactions processed after you had already reported a card or account as compromised.

Not every disputed payment is technically “unauthorized”:

If you personally sent money after being deceived by a scammer, the institution may classify it as a scam-induced but authenticated transaction.
If you entered the wrong account number or amount, it is an erroneous transaction.
If you approved a purchase but the merchant failed to deliver, charged the wrong amount, or refused a promised refund, it is normally a merchant or billing dispute.

Report all of these immediately, but describe exactly what happened. The classification can affect the investigation, temporary-hold process, card-network remedies, and prospects of recovery.

What to do immediately

1. Secure the card, account, phone, and email

Using the institution’s official app, website, hotline, or the number printed on the card:

Lock or block the affected card;
Disable online, international, cash-advance, or fund-transfer functions if available;
Ask the institution to secure the account and revoke unrecognized devices or sessions;
Change the online-banking password and any compromised email password;
Replace passwords reused on other accounts;
Remove unknown beneficiaries, devices, and contact details; and
Ask whether the card, account number, PIN, or digital credentials must be replaced.

Do not use a phone number or link contained in a suspicious text, email, or chat message. Never give an OTP, PIN, CVV, password, or recovery code to someone claiming to investigate the fraud.

2. Report to the institution where the money originated

For a fund transfer, complain to the originating financial institution—the bank, e-wallet, or payment provider holding the source account. It is primarily responsible for assisting its customer and coordinating with the receiving institution.

You may also alert the receiving institution if its official fraud channel is known, but do not let either institution simply send you back and forth. BSP rules require the originating institution to initiate the necessary coordination.

Ask for:

Immediate blocking or restriction of further transactions;
A formal unauthorized-transaction or fraud case;
The case or ticket number and written acknowledgment;
Tracing of the full transaction chain;
Temporary holding of any disputed funds still available;
Suspension of interest, finance charges, late fees, or similar charges on the disputed amount;
The institution’s investigation deadline and required documents; and
Written confirmation of what has been blocked, held, credited, or referred to another institution.

BSP-supervised institutions must maintain free complaint channels and closely monitored fraud-reporting channels available on a 24/7 basis. A consumer contacting the fraud channel should receive an immediate written acknowledgment. These requirements appear in BSP Circular No. 1160.

3. Identify every disputed transaction precisely

Provide, as available:

Account or card involved, showing only the last four digits in ordinary email correspondence;
Transaction date and exact or approximate time;
Amount and currency;
Merchant, ATM location, recipient, or destination institution;
Transaction or reference number;
Date and time you discovered and reported it;
Whether the card and phone remained in your possession;
Whether you received an OTP or transaction alert;
Whether anyone contacted you, impersonated the institution, or induced you to install an app, click a link, share information, or send money; and
The specific outcome requested, such as reversal, restitution, removal of related charges, correction of records, or restoration of account access.

Be accurate. Do not describe a transaction as entirely unknown if you actually approved part of it or communicated with the recipient. A knowingly false report that maliciously causes funds to be held can create criminal exposure under the Anti-Financial Account Scamming Act.

4. Follow the verbal report with a written dispute

Even if the hotline accepts the report, send a written complaint through the institution’s official Financial Consumer Protection Assistance Mechanism, or FCPAM. Attach its required dispute form, affidavit, or supporting documents promptly.

A useful written request should state:

I dispute the transactions listed below because I did not initiate or authorize them. Please secure the account, trace and temporarily hold any available disputed funds, suspend interest and charges on the disputed amount, investigate the authentication and transaction trail, and provide the results and reasons in writing. Please preserve all relevant system, device, communication, authorization, fraud-monitoring, and transaction records.

Do not email passwords, PINs, CVVs, or full OTPs. If an OTP is relevant, state when it arrived and whether it was entered or disclosed, without exposing current credentials.

Special deadlines and procedures

Credit-card transactions

Under the Philippine Credit Card Industry Regulation Law and its BSP implementing rules:

A cardholder must be given up to 30 calendar days from the statement date to report an error or discrepancy.
Notice may be made verbally, in writing, or through another documented means.
The issuer must take action within 10 business days after receiving the notice and relevant records.
Within 90 days after receiving the notice, the issuer must conduct a thorough investigation, make appropriate corrections, and send a written explanation or clarification before collecting the contested amount.
The issuer may continue collecting amounts that were not disputed.

These rules are in Republic Act No. 10870 and BSP Circular No. 1003.

If a physical card was lost or stolen, transactions made before the loss was reported are generally for the cardholder’s account. However, BSP Circular No. 1003 expressly preserves the right to dispute those transactions. If the investigation finds them unauthorized or fraudulent, the issuer must reverse them together with related finance charges and fees.

Report even if the 30-day period has passed. A late report may affect the special billing-dispute procedure, but it does not justify concealing or ignoring fraud, and other contractual or legal remedies may still depend on the facts.

Do not simply stop paying the whole bill. Pay the undisputed portion when due and obtain written instructions on how the issuer will treat the disputed amount. Under the Financial Products and Services Consumer Protection Act, interest, fees, and charges on an alleged unauthorized or disputed amount must be suspended pending the final investigation, or the institution must provide a similar reasonable accommodation.

Unauthorized transfers and payments

Under BSP Circular No. 1215, covered disputed funds may be temporarily held while institutions conduct coordinated verification:

The initial holding period is up to five calendar days.
It may be extended by up to 25 additional calendar days when reasonable grounds and the need for further verification exist.
The total administrative holding period cannot exceed 30 calendar days, unless extended by a competent court.
The source account owner may be required to submit a sworn complaint, affidavit, police report, or other supporting document within the initial holding period, subject to the applicable industry protocol.
If no funds were successfully held, coordinated verification should generally be completed within 30 calendar days. For meritorious reasons, the originating institution may extend that process, but the total may not exceed 60 calendar days.

A temporary hold is not a guaranteed refund. It can protect only funds that can still be identified and held. The institutions must verify the transaction before deciding whether the money should be released to the source or beneficiary account owner.

This is why reporting within minutes or hours—not after waiting for a statement—is critical.

Erroneous transfers

If you entered the wrong recipient or amount, tell the originating institution immediately and provide your identity and contact details, source account, beneficiary details, amount, date, and time. BSP rules require the originating and receiving institutions to make reasonable recovery efforts, but recovery is not guaranteed, particularly if the recipient has already moved or spent the money.

Do not falsely label an accidental transfer as account hacking.

What the institution must investigate

Under Republic Act No. 11765 and BSP Circular No. 1160, a BSP-supervised institution must evaluate the claim fairly and reasonably and explain the process and outcome transparently.

Relevant matters may include:

How the transaction was authenticated;
Device, login, IP-address, session, and geolocation records, where available;
Enrollment of new devices or beneficiaries;
Changes to registered phone numbers, email addresses, limits, or security settings;
OTP generation, delivery, and use;
Transaction alerts and whether they were delivered;
Fraud-monitoring warnings, unusual transaction patterns, or bypassed controls;
ATM, merchant, card-network, and receiving-institution records;
The consumer’s actions before, during, and after the incident; and
Acts or omissions of the institution, its employees, agents, service providers, or outsourced entities.

An OTP or successful technical authentication is relevant evidence, but the institution should still investigate the complete circumstances. Request the factual and contractual basis if a denial merely states that the transaction was “OTP-verified,” “authenticated,” or made from a registered device.

Within three banking days after concluding its investigation, the institution must formally inform the customer of the result. If it finds the transaction unauthorized or fraudulent, it should immediately reverse or correct it, including related interest, fees, and charges, or make a provisional credit permanent.

The Anti-Financial Account Scamming Act also provides that institutions may be required to make restitution when loss from covered financial-account scamming offenses resulted from inadequate risk-management systems or controls, or failure to exercise the required high degree of diligence. This does not make an institution automatically liable for every scam; causation, compliance, and the evidence still matter. See Republic Act No. 12010.

Evidence to preserve

Keep original, unedited copies of:

Account statements and transaction histories;
Screenshots showing balances, disputed transactions, alerts, and device activity;
SMS messages, emails, chats, caller numbers, usernames, and social-media profiles;
Full email headers and suspicious website addresses;
Receipts, merchant communications, cancellation requests, and refund promises;
Hotline call dates, times, agent names, recordings lawfully in your possession, and reference numbers;
The card or SIM packaging and device details, if relevant;
Police or NBI reports and affidavits;
The institution’s complaint forms, acknowledgments, responses, and final investigation result; and
Proof of when the card or account was blocked.

Prepare a simple chronology. Do not factory-reset or dispose of an affected device before preserving evidence or obtaining technical advice, especially if malware or unauthorized access is suspected.

If the institution denies or ignores the dispute

First, send a written reconsideration or escalation through its FCPAM. Ask the institution to:

Identify each disputed transaction addressed;
State the evidence and account terms relied upon;
Explain the authentication and fraud-monitoring results;
Address any unusual activity, changed credentials, failed alerts, or security-control issues;
Explain how your conduct and the institution’s conduct were weighed;
Remove interest and fees improperly imposed during the investigation; and
Issue its final position in writing.

Point out specific factual errors. Do not rely only on statements such as “I have always been a good customer.”

Escalating to the BSP

You must ordinarily complain to the institution’s FCPAM first. If its response is unsatisfactory or it fails to act within a reasonable period, escalate through the BSP Consumer Assistance Mechanism, or BSP-CAM.

The BSP currently directs consumers to:

File through the BSP Online Buddy (BOB) on the BSP website or BSP’s official Facebook page; or
If BOB is inaccessible, complete the BSP Complaint/Inquiry/Reply form and email it, with proof of the complaint to the institution, to consumeraffairs@bsp.gov.ph.

Follow the current instructions on the BSP Consumer Assistance Channels page.

BSP-CAM is primarily facilitative and is a required step before BSP mediation or adjudication. Under BSP Circular No. 1169:

Mediation is voluntary.
BSP adjudication may cover purely civil claims seeking payment or reimbursement of money not exceeding ₱10 million, excluding legal interest, attorney’s fees, and litigation costs.
Claims above that amount may require waiver of the excess or filing in the proper court.
BSP adjudication does not cover every kind of damages or request for provisional court remedies.

Claims under Republic Act No. 11765 generally prescribe five years after the transaction, or five years after discovery of deceit or material nondisclosure, subject to an ultimate ten-year limit from the violation. These longer periods are not reasons to delay a fraud report or disregard the credit-card deadline.

Reporting possible crime

A bank dispute and a criminal complaint serve different purposes. The bank investigates liability and possible reversal; law enforcement investigates the offender.

Consider reporting promptly to the National Bureau of Investigation’s Cybercrime Division or another competent law-enforcement office when there is account takeover, phishing, identity theft, malware, impersonation, organized scamming, or a substantial or continuing loss. The NBI provides information on investigative assistance for computer-crime victims and an online complaint page.

Give law enforcement the bank reference numbers, transaction trail, communications, recipient details, and preserved electronic evidence. Filing a police or NBI report does not replace the immediate report to the financial institution.

Common mistakes to avoid

Waiting for the monthly statement before reporting an online transfer;
Contacting only the receiving bank and not the source institution;
Failing to obtain a case number or written acknowledgment;
Deleting scam messages, emails, call logs, or transaction alerts;
Resetting the affected phone before preserving evidence;
Giving another OTP or password to a supposed investigator;
Assuming that provisional credit is already a final refund;
Ignoring requests for an affidavit or supporting documents during the five-day initial holding period;
Treating a mistaken or scam-induced payment as if you never participated in it;
Refusing to pay undisputed credit-card charges;
Filing with the BSP before first using the institution’s FCPAM; and
Posting complete account numbers, IDs, or evidence publicly on social media.

When legal help is urgent

Consult a Philippine lawyer promptly if:

The disputed amount is substantial or exceeds the BSP’s ₱10-million adjudication limit;
A court order may be needed to extend a temporary hold beyond 30 days;
The institution threatens collection, account offset, foreclosure, or litigation despite a documented dispute;
The account is for payroll, business operations, trust funds, or several affected customers;
An employee, agent, or insider may be involved;
The institution refuses to preserve or disclose essential records;
Your identity or several financial accounts have been compromised;
You are being accused of authorizing, benefiting from, or participating in the transaction; or
Immediate provisional relief from a court may be necessary.

Frequently asked questions

Will the bank automatically refund an unauthorized transaction?

No. It must investigate, and the outcome depends on the evidence, applicable account terms, consumer conduct, security controls, and any act or omission by the institution or its service providers. Confirmed unauthorized or fraudulent transactions should be reversed with related charges.

What if the scammer used a valid OTP?

Disclose honestly how the OTP was obtained and used. A valid OTP is important evidence, but liability remains fact-dependent. Social engineering, unauthorized account control, the institution’s security measures, and both parties’ conduct may still require examination.

Can I dispute an unauthorized e-wallet transaction?

Yes, if the provider is a BSP-supervised institution. Report first through the provider’s official fraud and consumer-assistance channels, then escalate an unresolved complaint to the BSP.

Should I pay a disputed credit-card charge?

Ask the issuer in writing to suspend interest and charges on the disputed amount. Continue paying undisputed amounts when due unless the issuer gives different written instructions. Do not assume that filing a dispute permits nonpayment of the entire bill.

What if the card was still with me?

State that fact. Card details may be compromised without the physical card being stolen. The institution should investigate how the card information or digital token was used.

Can money be recovered after it reaches another bank?

Possibly, especially if it is reported quickly and the funds remain traceable and intact. Temporary holding and coordinated verification can help, but neither guarantees recovery if the funds have already been withdrawn, dissipated, or transferred outside the traceable chain.

Does a police or NBI report guarantee a refund?

No. It supports the factual record and may be required for continued temporary holding, but the financial institution must still investigate and determine the proper disposition of the transaction.

What if I reported after the credit-card 30-day period?

Report anyway and explain when and how you discovered the charge. The special billing-error procedure may be affected, but other remedies may remain depending on the documents, account agreement, fraud circumstances, and applicable law.

This article provides general Philippine legal information, not legal advice for a particular dispute. Rights and outcomes depend on the transaction, account agreement, evidence, institution, and procedural history. Official sources and procedures were checked as of August 1, 2026.