What to Do After Unauthorized Bank Withdrawals in the Philippines

A practical, law-grounded guide for consumers

Disclaimer: This is general information, not legal advice. If the amount is significant or the case is complex, consult a Philippine lawyer familiar with banking, cybercrime, and financial-consumer disputes.

1) The first 24–48 hours: do this immediately

Lock down your money

Call your bank’s hotline (or use the app/online banking) to: (a) freeze or block the affected card/account; (b) change your PIN and online credentials; (c) disable online transfers and international/overseas use, if available.
If you suspect a SIM swap or phone takeover, call your telco to suspend the SIM and re-issue it. Change your email passwords as well.

Record everything

Take screenshots of the debits, SMS/email alerts, and your balances before/after.
List a timeline (date/time, channel used, device, location).
Keep the reference or case number from every bank/telco call.

Report and dispute—immediately and in writing

File a formal dispute with your bank (email/branch form/in-app). Ask for a written acknowledgment and case number.
For card transactions (credit/debit), ask the bank to raise a retrieval request/chargeback under the card network rules.
File a police blotter (nearest station) and/or report to PNP Anti-Cybercrime Group or NBI Cybercrime Division—these help your bank’s investigation and are often required.

Preserve devices & footage

Don’t wipe phones/computers used for the transaction—these can be forensically reviewed.
If an ATM was involved, request the branch (in writing) to preserve CCTV and machine logs.

2) What counts as an “unauthorized withdrawal”?

ATM/over-the-counter withdrawals you did not make.
Online banking transfers you didn’t authorize (insta-pay/peso-net, e-wallet top-ups, wire transfers).
Card-not-present charges (ecommerce, wallet linkage) or card-present cash advances you didn’t perform.
SIM-swap/OTP interception leading to account drain.
Insider or account-takeover fraud (phishing, malware/remote access, social engineering).

3) Your legal toolkit (Philippine framework)

Financial Consumer Protection Act (FCPA, R.A. 11765). Gives you rights to fair treatment, transparency, privacy, and redress. Banks and other BSP-supervised financial institutions (BSFIs) must maintain an effective Consumer Assistance Mechanism and handle complaints promptly and fairly. The Bangko Sentral ng Pilipinas (BSP) can sanction BSFIs that violate consumer-protection rules.
Access Devices Regulation Act (R.A. 8484). Penalizes fraud involving ATM/credit/debit cards and similar “access devices” (skimming, cloning, stolen/lost card misuse, etc.). Often cited in criminal complaints alongside estafa/theft provisions in the Revised Penal Code.
Cybercrime Prevention Act (R.A. 10175). Covers illegal access, computer-related fraud, identity-related offenses, and cyber-theft, commonly used for online-banking takeovers.
Data Privacy Act (R.A. 10173). If a breach of your personal data contributed to the loss, the bank (as personal information controller) has duties of security and breach notification; you may complain to the National Privacy Commission (NPC).
Credit Card Industry Regulation Law (R.A. 10870). Relevant to credit card disputes and issuer obligations (billing error handling, disclosures, fair collection). (Debit cards fall primarily under BSP rules for deposit accounts.)
Electronic Commerce Act (R.A. 8792). Recognizes electronic documents and digital signatures—useful when presenting screenshots, logs, and emails.
Civil Code & jurisprudence (bank’s fiduciary duty). Banks must exercise the highest degree of diligence in handling deposits and payments. Failures in authentication, monitoring, or security can be a breach of contract (actionable for damages). Actions on a written contract generally prescribe in 10 years; actions based on quasi-delict in 4 years (time limits matter—don’t delay).

Important: PDIC insurance does not cover unauthorized withdrawals; it pays only if a bank is closed by the regulator.

4) Who bears the loss?

Allocation depends on facts and evidence:

Bank/system fault (e.g., control failure, ATM malfunction, security lapses) → Bank should bear loss.
Merchant/card-network fraud with timely dispute → often chargeback to merchant/acquirer.
Customer negligence (e.g., wrote PIN on card, shared OTP knowingly) → may weigh against reimbursement.
Phishing/social engineering: not automatically negligence. Banks must show robust authentication and risk controls; mere OTP entry under deception doesn’t absolve all liability.
SIM swap: if telco failure allowed takeover, there can be shared liability (potential separate telco complaint).

5) Step-by-step process (with practical timelines)

File the bank dispute (Day 0).
- Submit a dispute letter and supporting evidence (see template below).
- Ask specifically for: (i) temporary freeze; (ii) investigation, (iii) reversal/provisional credit where applicable, (iv) chargeback for card transactions, and (v) written findings.
Law-enforcement report (Day 0–2).
- Police blotter + PNP-ACG or NBI Cybercrime report. Keep the case number and investigator contact.
Follow the bank’s investigation (usually days to weeks).
- Respond quickly to requests (affidavit of loss, ID, device info, travel proof, etc.).
- Ask for CCTV/terminal logs for ATM cases and transaction authentication logs (IP, device ID, 3-DSecure/OTP, geo-location) for online/card disputes.
Escalate if needed.
- If you receive an adverse or no resolution, escalate in writing to the bank’s Consumer Assistance/Complainthandling Head.
- Still unresolved? Elevate to the BSP (consumer assistance/complaint portal). The BSP can compel banks to rectify violations and impose sanctions; courts decide damages.
Consider civil action.
- For amounts up to ₱1,000,000, you may use Small Claims (no lawyers required in hearings; rules updated in recent years).
- Larger or complex claims → regular civil action (breach of contract/damages).
- You can pursue criminal cases against the perpetrators in parallel (R.A. 8484, R.A. 10175, estafa/theft).
Parallel tracks (if applicable).
- NPC complaint (if personal data was compromised).
- Telco complaint/NTC if SIM-swap or number porting enabled the fraud.
- Merchant dispute where the merchant relationship is relevant.

6) What your bank should do (and what to ask for)

Acknowledge your complaint and give a case number.
Freeze/restrict the account promptly.
Investigate using system logs: device fingerprint, IP addresses, geolocation, 3-D Secure/OTP logs, EMV/ATM switch data, CCTV, merchant responses.
Explain their findings in writing (not just “transactions were OTP-verified”).
Cooperate with BSP/law enforcement and provide documents needed for chargeback or prosecution.
Fair outcome: reversal or restitution when evidence shows lack of authorization and no consumer fault, or shared remedies if liability is mixed.

7) Typical bank arguments—and how to respond

“An OTP was used, therefore you authorized it.” → OTP entry under phishing or SIM-swap can occur without genuine consent. Ask for end-to-end authentication logs, SIM change timestamps, device binding data, and risk-scoring flags.
“Transaction occurred on your usual device/IP.” → Malware/remote-access tools can hijack sessions. Request session logs, browser fingerprints, and behavioral-biometrics flags.
“ATM dispensed cash, so it’s valid.” → Skimming/shimming and cash-out mule patterns exist. Seek ATM terminal health logs, EMV fallback records, and CCTV.
“You delayed reporting.” → Report times should be viewed reasonably; once you learned of the loss, you promptly filed. Provide alert timestamps and explain any no-signal/overseas context.

8) Evidence checklist

Bank statements and transaction history (CSV/PDF).
Screenshots of SMS/email alerts; for emails, save .eml files with headers.
Copies of dispute forms, affidavits, and acknowledgments (with dates).
Police/NBI/PNP-ACG reports.
Travel records (boarding passes, passport stamps), work logs, CCTV if available.
Device details (IMEI, OS version), antivirus reports, and any SIM change records from your telco.

9) Special scenarios

ATM skimming/cash-out within minutes: Commonly involves cloned magstripe abroad or card-info theft domestically with later overseas cash-out. Push for EMV data and CCTV preservation.
SIM-swap: Sudden loss of signal + flood of OTPs/notifications. Immediately block the SIM, get a written telco confirmation of the swap time, and align it with the bank’s OTP logs.
E-wallet bridges: Fraudsters often hop funds through multiple wallets. Ask your bank to trace beneficiary accounts and issue freeze requests through relevant institutions.
Joint accounts: Clarify mandate (“AND” vs “OR”). Unauthorized withdrawals by one joint holder may still be actionable depending on mandate and circumstances.
Overseas withdrawals: If you were in the Philippines, provide location proofs; ask for acquirer country, ATM ID, and network data.

10) Templates you can adapt

A) Bank dispute letter (deposit/ATM/online)

Subject: URGENT – Dispute of Unauthorized Withdrawals | [Account No.]

To: [Bank Name] Consumer Assistance / Complaints Handling

I am disputing the following unauthorized transactions on my [type of account/card]:
Account/Card No.: [XXXX-XXXX]
Transaction(s): [Date/Time, Amount, Channel/ATM/Payee/Location, Reference No.]

Facts:
• I did not authorize these transactions and did not receive/approve any legitimate request.
• Upon discovery on [date/time], I immediately [called hotline / blocked card / changed PIN].
• Attached are screenshots/statements/police blotter and my valid ID.

Demands/Requests:
1) Immediate freeze on my account/card to prevent further loss.
2) Full investigation and written findings, including authentication/terminal logs, IP/device data, and ATM CCTV (if applicable).
3) Reversal/restoration of the debited amount(s) and fees; for card transactions, file retrieval/chargeback.
4) Confirmation of this complaint’s case number and expected next steps.

This complaint is made under my rights as a financial consumer pursuant to R.A. 11765 and applicable BSP consumer-protection rules.

Sincerely,
[Name, Address, Contact Nos., Email]
[Signature over Printed Name]
[Date]

B) Demand letter (if the bank denies)

Subject: DEMAND – Resolution of Unauthorized Withdrawal Case No. [____]

I refer to my complaint dated [____] and the bank’s reply dated [____]. The reply fails to establish that I authorized the disputed transactions or that adequate authentication and risk controls were in place. OTP usage, by itself, is not proof of consent where phishing/SIM-swap/remote access is evident.

Unless the bank restores the debited amounts of ₱[____] within [7] days and furnishes complete investigation logs, I will file/continue escalation to the BSP and pursue civil and criminal remedies (R.A. 11765, R.A. 8484, R.A. 10175, Civil Code damages), including costs.

Very truly yours,
[Name]

C) Police/NBI incident narrative (guide)

What happened (chronology).
When you discovered it.
Actions taken (bank call, SIM block).
Evidence available (screenshots, emails, CCTV).
Suspected method (phishing, SIM-swap, skimming, malware).
Amounts and beneficiaries (if any).

11) Remedies and venues (at a glance)

Administrative: Complaint to BSP (for banks, e-money issuers, remittance/banksupervised entities). BSP can direct corrective actions and sanction institutions.
Criminal: R.A. 8484 / R.A. 10175 / estafa/theft—filed with PNP-ACG/NBI then Prosecutor’s Office.
Civil:
- Small Claims (generally up to ₱1,000,000): speedy recovery of sums; no counterclaims for damages beyond liquidated amounts.
- Regular civil action: breach of contract/damages; can include moral, exemplary, and attorney’s fees where warranted.
Data privacy: NPC complaint for security lapses or breach of personal data.
Telco/NTC: For SIM-swap enabling fraud.

12) Practical prevention going forward

Use separate accounts for savings and day-to-day spending; keep minimal balances on cards linked to ATMs/e-wallets.
Disable high-risk features (international usage, card-not-present) when not needed.
Turn on real-time alerts; act on any SIM “no signal” events.
Keep devices updated, avoid installing untrusted apps, and don’t approve remote-control prompts.
Treat all links/calls as suspect—call the bank back using the official hotline.
Store PINs only in your head; never share OTPs, CVV, or mobile banking passwords—banks never ask for these.

13) Frequently asked questions

Will PDIC reimburse me? No. PDIC covers deposits if a bank is closed, not individual fraud losses.
Do I need a lawyer? Not always for small claims; but legal counsel is helpful for large or contested cases.
Can I still recover after months? Report ASAP. Card-network chargeback windows are strict (often 30–60 days); civil actions have longer prescriptive periods, but delay weakens evidence.
The bank says my case is closed. You can still escalate to BSP and pursue civil/criminal remedies. Ask for the complete record of the investigation.

Bottom line

Act fast, document thoroughly, and insist—politely but firmly—on your rights under R.A. 11765 and related laws. Unauthorized withdrawals are a solvable mix of forensics, procedure, and persistence: lock down, dispute in writing, involve law enforcement, and escalate when needed.