Quick answer

If you discover an unauthorized credit card transaction, contact the card issuer immediately through its official hotline, mobile app, website, email, or branch. Ask it to block the card, secure the account, dispute each unauthorized charge, and issue a case or reference number.

Send a written dispute as soon as possible. Under the Philippine Credit Card Industry Regulation Law, the issuer must give you up to 30 calendar days from the statement date to report a billing error or discrepancy and must act on the notice within 10 business days. Do not wait for the thirtieth day: rapid reporting can prevent additional transactions and preserve records.

If someone deliberately used your card or account details, you may separately report the crime to the Philippine National Police Anti-Cybercrime Group (PNP-ACG) or the National Bureau of Investigation (NBI). Escalate an unresolved complaint against a bank or other BSP-supervised issuer to the Bangko Sentral ng Pilipinas (BSP).

A bank dispute, a BSP complaint, and a criminal complaint serve different purposes. Filing one does not automatically file the others, and neither a police report nor a fraud allegation guarantees an immediate refund.

What counts as credit card fraud?

Credit card fraud generally involves the unauthorized or fraudulent use of a physical card, card number, account, or related credentials. Common examples include:

Purchases or cash advances you did not make or authorize
Transactions made after a card was lost or stolen
Online purchases using stolen card details
A counterfeit, altered, or fraudulently obtained card
Account takeover after phishing, malware, SIM-related fraud, or stolen login credentials
A transaction whose amount or other information was altered without authority
Charges made by someone who obtained card details through deception

The fraudulent use of a credit card may constitute access-device fraud under the Access Devices Regulation Act of 1998, as amended by Republic Act No. 11449. Conduct involving phishing, illegal access, identity misuse, or electronic communications may also fall under the Cybercrime Prevention Act of 2012 or the Anti-Financial Account Scamming Act, depending on the evidence.

A merchant dispute is not necessarily fraud. Non-delivery, defective goods, duplicate billing, an incorrect amount, or a cancelled subscription that continued to be charged may instead be a billing or merchant dispute. Report it promptly, but describe the facts accurately rather than labeling every disputed transaction as criminal fraud.

Step 1: Secure the card and related accounts

Use only contact details found on the back of the card, the issuer’s official app or website, or an official statement. Do not call a number supplied in a suspicious text message, email, advertisement, or social-media account.

Ask the issuer to:

Block or freeze the affected card immediately.
Disable relevant online, international, contactless, cash-advance, or recurring-payment functions.
Check for pending as well as posted transactions.
Replace the card and card number if necessary.
End active sessions and secure the online account.
Record the date and time you first reported the incident.
Give you a complaint or case-reference number.
Explain its fraud-dispute procedure and documentary requirements.

Change the password for the issuer’s app or website. If the same password was used elsewhere, change it there too. Secure the email account and mobile number linked to the card, enable stronger authentication, and contact the mobile provider if you suddenly lost cellular service or suspect an unauthorized SIM replacement.

Never give anyone your one-time password, CVV, PIN, full password, or remote access to your phone. A genuine investigator may need transaction details but should not require your secret credentials to “reverse” a charge.

Step 2: File a written dispute with the issuer

A telephone report is important, but a written complaint creates a clearer record. Follow the issuer’s required channel and retain proof of submission.

Your dispute should contain:

Your full name and current contact details
The issuer and the last four digits of the card only
The date you detected and first reported the problem
Each disputed transaction’s date, merchant descriptor, amount, and currency
Whether the card remained in your possession
A clear statement that you did not make, authorize, or benefit from the transaction
Any suspicious call, message, link, login alert, or OTP activity connected with the incident
The action requested, such as reversal, correction of the statement, suspension of related charges, and replacement of the card
The hotline report or case-reference number
A list of supporting documents

Do not send your full card number or security code through an unsecured channel. Redact unrelated balances and transactions unless the issuer or investigator reasonably requires them.

Under Section 18 of Republic Act No. 10870, a card issuer must allow up to 30 calendar days from the statement date for reporting a billing error or discrepancy and must take action within 10 business days after receiving the notice. Contractual chargeback or card-network rules may impose additional procedural requirements, so comply promptly with the issuer’s forms and requests.

Under the Financial Products and Services Consumer Protection Act, while a final investigation into an alleged disputed amount or unauthorized transaction is pending, the financial service provider must suspend the imposition of interest, fees, and charges on that amount or provide a similar reasonable accommodation. Request this protection expressly and in writing.

Continue addressing any legitimate, undisputed balance. Do not assume that disputing one charge automatically suspends the entire account or every payment obligation.

Step 3: Preserve evidence

Keep original electronic files whenever possible. Screenshots help, but they may omit metadata or context.

Preserve:

Statements showing the disputed charges
Transaction alerts, emails, and app notifications
Complete SMS or messaging threads
Suspicious email headers and the original email
URLs, account names, phone numbers, and social-media profiles used by the suspected offender
Call logs and a contemporaneous note of what each caller said
Login, password-change, device-enrollment, and OTP notices
Receipts or records showing where the physical card was kept
Correspondence with the merchant and issuer
Complaint forms, acknowledgments, reference numbers, and written decisions
Police reports, affidavits, or blotter entries
A chronological incident log

Do not edit original files, delete suspicious messages, factory-reset the device, or publicly expose the suspect’s personal information before investigators advise you. If malware or remote-access software may be involved, disconnect the device from sensitive accounts and have it examined without destroying potential evidence.

Step 4: Report the crime when appropriate

Report promptly to the PNP-ACG or NBI when there was deliberate unauthorized use, identity theft, account takeover, phishing, counterfeit-card activity, repeated fraud, threats, or an identifiable suspect.

You can start by consulting:

Online or email reporting may begin the referral process, but investigators can require personal appearance, identity verification, original evidence, and a sworn complaint or affidavit. Use the agencies’ current official pages to confirm the proper office, address, and contact details before submitting sensitive documents.

Bring or prepare:

A government-issued ID
A concise chronological narrative
Copies of the disputed statements and issuer correspondence
The issuer’s complaint-reference number
The physical card, if investigators request it
The original device or electronic evidence, if relevant
Information identifying the suspected person, merchant, account, device, or communication channel
A clear explanation of how you know the transaction was unauthorized

State only facts you honestly know. Do not identify a person as the offender merely because a name appeared in a merchant descriptor, delivery record, or recipient account. Those details may belong to an intermediary, compromised account holder, or unrelated business and must be investigated.

A criminal complaint seeks investigation and possible prosecution. It does not by itself compel the issuer to reverse the charge. Continue the issuer’s dispute process separately.

Step 5: Escalate the issuer complaint to the BSP

The issuer’s Financial Consumer Protection Assistance Mechanism is the required first-level recourse. If the issuer does not resolve the matter satisfactorily, fails to respond properly, or closes the dispute without adequately addressing your evidence, elevate it to the BSP Consumer Assistance Mechanism.

The BSP accepts complaints through its consumer-assistance channels and BSP Online Buddy. Complaints may also be submitted through the official email, postal, telephone, or in-person channels listed on that page.

Include:

A clear summary of the dispute
The outcome you are requesting
Your daytime telephone number and email address
A copy of the complaint sent to the issuer
The issuer’s response or final decision, if any
Supporting statements, transaction records, and correspondence
All relevant issuer reference numbers

BSP Online Buddy issues a case-reference number when a complaint is processed. For complaints submitted by email or postal mail, BSP states that a consumer specialist will evaluate and, when necessary, respond or refer the concern to the supervised institution within seven banking days of receipt. This is an evaluation or referral period, not a guarantee that the underlying fraud dispute will be finally decided within seven days.

For a purely civil financial claim seeking only payment or reimbursement, the BSP has statutory adjudicatory authority up to ₱10 million, subject to its applicable rules and procedures. Escalation through consumer assistance does not automatically commence formal adjudication.

When a privacy complaint may also be appropriate

Consider a separate complaint to the National Privacy Commission (NPC) if facts indicate that an organization unlawfully disclosed, misused, inadequately protected, or refused to correct your personal data. An unauthorized transaction alone does not prove that the issuer or merchant committed a privacy violation.

The NPC requires a formal complaint in the prescribed format. Its current guidance calls for a completed and notarized complaint or verified pleading, supporting evidence, and submission through an authorized channel. Consult the NPC complaint-filing page for the current form, fees, and filing instructions.

The NPC process addresses personal-data rights and organizational compliance. It is not a substitute for immediately blocking the card, disputing the transaction, or reporting a crime.

What determines whether the charge will be reversed?

The outcome depends on the records and circumstances, including:

Whether the transaction was actually authorized
When the cardholder discovered and reported it
Whether the physical card, PIN, OTP, password, or enrolled device was used
How those credentials were obtained
The issuer’s authentication and fraud-monitoring records
Device, IP, location, merchant, and delivery information
Whether the merchant can produce valid proof of the transaction
The card agreement and applicable card-network rules
Whether the cardholder complied with reasonable security and reporting duties
Whether the issuer complied with its legal and regulatory obligations

Use of an OTP, PIN, or familiar device can be relevant evidence, but it should not be treated as an automatic answer without examining how the credential or device was obtained and whether the transaction was genuinely authorized. Conversely, a cardholder’s denial alone does not automatically establish fraud.

Ask the issuer for a reasoned written decision. Where appropriate, request the transaction’s authentication method, date and time, merchant information, and the material basis for denying the dispute, subject to lawful confidentiality and security limitations.

Common mistakes to avoid

Waiting for the monthly statement before blocking a compromised card
Reporting only by telephone and keeping no written record
Missing the 30-calendar-day billing-dispute period
Disputing legitimate charges merely because the merchant name looks unfamiliar
Paying a supposed “recovery agent” who asks for an advance fee
Giving an OTP or installing a screen-sharing app to receive a “refund”
Sending full card credentials through ordinary email or chat
Deleting messages or resetting a device before preserving evidence
Assuming a police report automatically produces a refund
Assuming a bank dispute automatically starts a criminal investigation
Ignoring legitimate portions of the statement
Making unsupported accusations on social media
Filing inconsistent narratives with the issuer, BSP, and investigators

When help is urgent

Act immediately if unauthorized transactions are still occurring, the card or phone is missing, the account email or mobile number has changed, you have lost cellular service unexpectedly, or another financial account may also be compromised.

Promptly consult a Philippine lawyer if:

The disputed amount is substantial
The issuer is demanding payment or threatening legal action despite a documented dispute
Your credit record may be affected
The suspected offender is known to you
You are being accused of participating in the fraud
Investigators want access to devices containing privileged or highly sensitive information
You received a subpoena, prosecutor’s notice, summons, demand letter, or court document
A filing or review deadline is approaching
The facts involve a business card, supplementary cardholder, employee, deceased cardholder, or disputed authority

Frequently asked questions

Must I go to the police before disputing the transaction?

No. Notify the issuer first and immediately secure the account. A police or NBI report may later be required or helpful, particularly for deliberate fraud, identity theft, or account takeover.

Can I dispute a pending transaction?

Report it immediately even if it is still pending. The issuer may have to wait until it posts before processing a formal reversal, but early notice can help secure the account and document the timing.

Should I pay the disputed amount while the investigation is pending?

Ask the issuer in writing to suspend interest, fees, and charges on the alleged unauthorized amount or provide the reasonable accommodation required by Republic Act No. 11765. Pay legitimate undisputed amounts according to the issuer’s instructions. Obtain written clarification on how payments will be applied.

What if I reported more than 30 days after the statement date?

Report it anyway and explain the delay. The statutory billing-error period may affect the available process, but late reporting does not make fraudulent conduct lawful or prevent you from asking the issuer and authorities to investigate. Your contractual rights and other remedies will depend on the facts.

Is an OTP-authenticated transaction automatically my responsibility?

Not necessarily. Authentication records are important, but authorization remains a fact-dependent question. Explain whether you received, disclosed, entered, or never saw the OTP, and preserve all related messages and device records.

Can the BSP arrest the fraudster?

No. The BSP supervises financial institutions and provides consumer-redress and adjudicatory mechanisms within its authority. Criminal investigation is handled by law-enforcement agencies such as the PNP and NBI, with prosecution governed by the applicable criminal procedure.

Can I recover money from the suspected offender?

Possible civil restitution, damages, or recovery will depend on identification of the responsible party, available evidence, the criminal or civil proceedings pursued, and collectability. A lawyer can assess the proper remedy and forum.

Official legal and government references

This article provides general legal information, not legal advice or a prediction of any case’s outcome. Rights and procedures may depend on the card agreement, transaction records, and specific facts. Official sources were checked as of September 3, 2026.