How to Dispute Unauthorized Bank Transactions in the Philippines After an OTP Scam

This is general information for the Philippines. It’s not legal advice. If large sums or complicated facts are involved, consult a Philippine lawyer experienced in banking/cybercrime.

TL;DR (Action Plan)

Secure everything now: change passwords/PINs, revoke app sessions, enable stronger authentication, and report a possible SIM swap to your telco if signals/OTP behavior looked odd.
Call your bank’s fraud hotline immediately, then file a written dispute (keep reference numbers).
Freeze/trace funds: ask your bank to coordinate with the destination bank and the payment network (InstaPay/PESONet/3-D Secure/card network).
Prepare evidence: screenshots of phishing texts/links, OTP logs, bank alerts, device/IP data, and a timeline.
File a police report (PNP-ACG) or NBI Cybercrime and secure an incident number; this often unlocks deeper bank/network investigations.
If you used a credit card, request a chargeback; if debit/e-wallet, push a fraud dispute and recovery request.
Escalate if denied or delayed: take it to the BSP consumer protection channel (banks/e-money are BSP-regulated). Consider NPC (privacy breach) and civil/criminal remedies if needed.

What an “OTP Scam” Usually Looks Like

Smishing/Phishing: fake bank/telco/parcel messages or sites capturing your credentials and OTP.
Vishing/Agent Impersonation: caller tricks you into reading an OTP “to stop a transfer.”
Remote Access/Screen Share: scammer sees and uses your OTP in real time.
SIM Swap/Port-Out: your mobile line is silently moved; OTPs go to a new SIM.
Malware on phone/PC: intercepts or forwards OTPs.

Whether you shared the OTP (after being deceived) or it was intercepted, the key legal issue is authorization: you did not intend those transactions.

Legal Foundations (Philippine Context)

Financial Products and Services Consumer Protection Act (RA 11765). Sets duties on banks/e-money issuers to treat you fairly, protect your data, detect fraud, keep a robust complaints process, and provide redress where appropriate. It empowers the BSP to order corrective action and impose penalties on regulated institutions.
BSP Consumer Protection / E-channels Regulations. BSP requires clear, accessible complaint handling, risk-based fraud controls, and transparency around decisions. Banks must record and investigate disputes and keep you updated.
Access Devices Regulation Act (RA 8484). Covers credit/debit card fraud and imposes liabilities for unauthorized use of access devices.
Cybercrime Prevention Act (RA 10175) & Revised Penal Code (estafa). Criminal bases for going after the fraudsters (identity theft, computer-related fraud).
Data Privacy Act (RA 10173). If your personal data/OTP data handling contributed to the incident, you may involve the National Privacy Commission (NPC).
SIM Registration Act (RA 11934). Helps in tracing numbers in SIM-swap/phishing incidents (usually via law enforcement requests).

You do not need to cite these laws when you first call your bank—but knowing them helps you frame your rights.

First 24 Hours: Containment Checklist

Lock down access
- Change online/mobile banking and email passwords; revoke active sessions/devices in your bank app and email.
- Turn on stronger factors (app-based authenticators/biometrics).
- If you suspect SIM swap, contact your telco to freeze/restore your number.
Notify your bank’s fraud team
- Call the hotline, then submit a written dispute via branch, email, or in-app chat. Ask for:
  - A case/reference number and a copy of your complaint.
  - Immediate blocking of cards, online access, and suspicious payees.
  - Tracing/hold request to the destination bank(s) and networks.
Preserve evidence
- Screenshots of SMS/links, caller IDs, OTP timestamps, bank alerts, device logs, and your location at the time.
- Keep your device as-is (don’t wipe it) until advised; it may contain vital artifacts.
File a report
- PNP Anti-Cybercrime Group or NBI Cybercrime Division: obtain an Incident/Investigation Report number. Banks and networks often request this to proceed with deeper traces.

How to File the Bank Dispute (and What to Include)

Where to file: Your bank’s Consumer Protection / Dispute team (branch, official email, in-app, or website form).

What to attach:

Government ID, account/card number (masked), mobile number and email tied to the account.
Timeline (minute-by-minute if possible): when you received the phishing message/call, when you changed SIM/phone behavior, when you saw debit alerts, when you called the bank.
Transaction list you dispute (date, time, amount, merchant/payee, channel).
Screenshots of OTP messages/alerts, phishing pages, caller logs, app notifications.
Police/NBI blotter or incident number (if already filed).
A sworn Affidavit of Fraud/Unauthorized Use if your bank requests it (many do).

What to ask for explicitly:

Reversal/chargeback of unauthorized transactions (credit card) or recredit/recovery (debit/e-wallet).
Forensics & logs: request (in writing) a copy or summary of the bank’s findings—IP/device fingerprints, login geolocation, velocity checks, 3-D Secure results, changes to device or payee lists, and whether alerts were triggered/ignored.
Network coordination: ask the bank to raise chargebacks (card purchases) or interbank recovery (InstaPay/PESONet) and to contact the destination bank to freeze any remnants.

Special Tracks by Product Type

1) Credit Cards (Card-Not-Present / Online)

Dispute and chargeback: You normally dispute within the timeframe stated in your card T&Cs (commonly within days of statement or transaction). Sooner is always better.
Merchants/acquirers must respond, and the card network rules apply. If 3-D Secure was frictionless (no OTP prompt) or was compromised, the issuer can still pursue fraud chargebacks depending on network liability rules.
If the issuer denies your claim due to “OTP was entered,” emphasize lack of intent/authorization and social-engineering circumstances. Provide proof of abnormal device/IP/location, suspicious merchant patterns, or simultaneous OTP spam.

2) Debit/ATM Accounts

Money often moves via InstaPay/PESONet or to e-wallets. Request urgent recall and freeze coordination through your bank’s operations team. Recovery chances drop quickly, so escalate early and attach the police report.

3) E-Wallets (e.g., EMI accounts)

These are BSP-regulated. Use the in-app dispute channel, ask for account-takeover investigation, device logs, and inter-wallet/bank traces. If your linked bank card was charged, dispute on both sides (wallet and bank).

4) SIM Swap Suspected

Ask telco for a SIM activity log (SIM replacement/port-out timestamps). Provide these to the bank and police. If your number was hijacked, push the argument that you never received nor controlled the OTPs.

Building a Strong Case (What Banks Look For)

Authorization vs. authentication: Entering an OTP doesn’t equal consent if it was obtained through deception or interception.
Behavioral red flags: unusual device, new IP/geolocation, midnight velocity, first-time payee, high-risk merchant MCCs, rapid payee creation then transfer, multiple failed logins before success.
Control of the factor: If SIM-swapped, you couldn’t receive OTPs; if malware/remote app was active, OTPs may have been auto-forwarded.
Bank controls: Whether risk-based authentication, transaction limits, and anomaly detection were applied reasonably given your history.
Notification effectiveness: Were alerts timely and clear? Did the bank give a reasonable window to stop/confirm unusual transactions?

If the Bank Says “No” (or Won’t Update You)

Ask for the final written outcome explaining the basis and the evidence.
Escalate internally (Consumer Protection Officer/Unit, then higher management).
Take it to the BSP (Bangko Sentral ng Pilipinas) consumer assistance channel.
- Provide your complaint file, bank response, evidence, and the police/NBI incident number.
- RA 11765 empowers BSP to require corrective action and penalize regulated institutions.
Consider the NPC if your personal data handling appears deficient (privacy breach).
Civil remedies: For amounts within the small claims threshold (check current limit), you may sue for recovery without a lawyer; larger or complex claims go to regular courts (you can include damages).
Criminal route: Continue with PNP-ACG/NBI for estafa, identity theft, or computer-related fraud. Banks often cooperate more when there’s an active case.

Evidence Pack: What to Gather

Government ID; account/card numbers (partially masked).
Complete timeline and transaction list.
Screenshots of phishing SMS/emails, fake pages, caller IDs, OTP messages (with timestamps).
Bank alerts and in-app notifications.
Device info: OS version, installed remote-access/screen-share apps, anti-virus results.
Telco logs (if SIM swap suspected).
Any merchant communications (confirmation emails, shipping notices).
Police/NBI report and any subpoenas or preservation letters.

Sample Dispute Letter (You Can Reuse)

Subject: Fraud Dispute – Unauthorized Transactions from OTP Scam To: [Bank/E-Money Issuer – Consumer Protection/Fraud Team]

I am disputing the following unauthorized transactions on my [account/card ending xxxx]: • [Date/Time – Channel – Amount – Merchant/Payee – Reference No.]

Summary of incident: On [date/time], I received [phishing SMS/call/notice]. I did not authorize any of the disputed transactions. The OTP was [intercepted via SIM swap / obtained by deception / pushed while my device was compromised].

Actions taken: I reported the incident by phone on [date/time; reference no.], changed credentials, and filed a police/NBI report [number].

Requests:

Immediate reversal/chargeback (credit card) / recredit & recovery (debit/e-wallet).

Tracing and freeze coordination with destination bank(s)/network(s).

A written summary of your forensic findings (login/device/IP logs, 3-D Secure results, alerts, risk checks).

Copies of my complaint records and your final decision when ready.

Attached are my ID and evidence pack (screenshots, transaction list, police report).

Thank you, [Full Name, contact details, signature]

Typical Timelines (What’s Reasonable)

Immediate: acknowledge receipt and block further transactions.
Short term: initial findings or requests for documents.
Following weeks: network/merchant/destination bank responses (chargeback/interbank recovery).
Final outcome: a written decision and, if approved, credit/reversal posting.

Exact timelines differ by institution and network; act early to avoid missing internal or network windows.

Criminal & Civil Paths (When Needed)

Criminal complaints (PNP-ACG/NBI): identity theft, computer-related fraud, estafa; helpful for subpoenas to telcos/merchants/banks.
Civil actions: recovery of sums + damages; small claims can be faster and cheaper for qualifying amounts.
Protection orders for data: through NPC processes if a privacy violation is involved.

Prevention (After You Recover)

Prefer app-based authenticators over SMS OTP where supported.
Add transaction limits, enable out-of-pattern alerts, and review payees regularly.
Keep devices clean: uninstall screen-sharing/unknown apps; update OS; use mobile security.
Treat urgent calls/messages as suspect—banks rarely ask for OTPs.
Keep a fraud kit ready: scanned ID, templated dispute letter, and a list of hotlines.

FAQs

Q: I read the OTP to a caller. Does that mean I “authorized” it? No. Consent must be informed and intentional. Social engineering undermines true authorization. Present clear evidence of deception and abnormal activity.

Q: The bank says the transaction was 3-D Secure “successful,” so I’m liable. 3DS success shows the system authenticated a device/flow—it does not, by itself, prove your intent. Ask for logs and highlight anomalies.

Q: Funds went to a mule account via InstaPay; can I still recover? Recovery declines with time, but early freezes/recalls sometimes retrieve partial amounts. Act fast and keep pushing interbank coordination (with your police report attached).

Q: Do I need a lawyer? Not for filing disputes or small claims, but legal counsel helps if the amount is high, there’s a denial, or multi-party liability (bank, telco, merchant) is at issue.

Final Notes

Keep everything in writing and calendar all follow-ups.
Be precise, unemotional, and evidence-driven.
If you hit a wall, escalate to BSP under RA 11765 with your full file.

If you want, I can turn this into a printable checklist pack (letter template + evidence checklist + timeline worksheet).