When a bank account is debited because of a scam, the first few hours matter. The money may pass through several bank accounts or e-wallets quickly, so your immediate goal is not only to “complain,” but to secure your account, trigger the bank’s fraud process, ask for temporary holding or tracing of the funds, and preserve evidence for a bank investigation, BSP complaint, and possible cybercrime case. This guide explains what to do if your bank account was debited due to a scam in the Philippines, what rights you have under current Philippine law, and what documents you should prepare.

First, identify what kind of debit happened

Banks, e-wallets, the BSP, police, prosecutors, and courts will usually look at the facts differently depending on how the money left your account.

Situation	Common example	Why it matters
Unauthorized transaction	Your account was accessed without your consent; money was transferred while you were asleep; your SIM or app was compromised	The bank’s security controls, authentication process, fraud monitoring, and response time become very important
Social engineering scam	A fake bank officer, fake buyer, fake investment agent, or phishing link tricked you into giving an OTP, password, card details, or account access	This may fall under the Anti-Financial Account Scamming Act and cybercrime laws, but your own actions may still be reviewed
Authorized but scam-induced transfer	You personally sent money to a scammer because of a fake job, fake online seller, romance scam, crypto scam, or investment scam	Recovery is harder if the receiving account already withdrew or moved the funds, but you should still report immediately
Erroneous transfer	You mistyped the account number or amount	This is usually treated differently from scam or unauthorized debit; the receiving account holder’s consent or bank process may be needed

This distinction matters because a “scam debit” is not always automatically refunded. The key questions are: Was the transaction authorized? Was your account taken over? Did the bank comply with BSP rules? Did the bank act quickly after notice? Were the funds still traceable or intact?

Legal basis: your rights and the bank’s obligations

Anti-Financial Account Scamming Act: RA 12010

The most important law for scam-related bank and e-wallet debits is the Anti-Financial Account Scamming Act, or Republic Act No. 12010, approved in 2024. It covers financial accounts such as bank deposit accounts, transaction accounts, credit card accounts, e-wallets, and other financial accounts used to access financial products or services. (Lawphil)

RA 12010 penalizes two scam patterns that ordinary victims often encounter:

Money muling, such as selling, lending, renting, buying, borrowing, or allowing the use of a financial account to receive or move criminal proceeds.
Social engineering schemes, where a person uses deception, false representation, phone calls, SMS, email, social media messages, or other electronic communications to obtain sensitive identifying information that leads to unauthorized access or control of a financial account. (Lawphil)

This is why the “recipient account” matters. The person named in the receiving bank or e-wallet may be the actual scammer, a recruited money mule, a person whose identity was misused, or another victim. Give the bank the full receiving account details, but avoid public shaming unless law enforcement confirms the person’s role.

Temporary holding of disputed funds

RA 12010 allows financial institutions to temporarily hold funds that are the subject of a disputed transaction, within the period prescribed by the BSP, not exceeding 30 calendar days, unless extended by a court. (Lawphil)

BSP Circular No. 1215, Series of 2025, gives the working rules for this process. It applies to electronic transfers from one financial account to another financial account, but not to ordinary erroneous transactions, and generally not to credit card transactions except when the card is used to perform electronic fund transfers through an automated clearing house.

Under the BSP rules, an initial holding may be for not more than 5 calendar days, and it may be extended by not more than 25 calendar days, for a total holding period of not more than 30 calendar days unless a court extends it. Once the disputed funds are held, the equivalent amount is treated as credited but cannot be withdrawn during the holding period.

Coordinated verification between banks and e-wallets

RA 12010 also requires involved institutions and account owners to begin a coordinated verification process after a complaint, information from another institution, or fraud-monitoring detection. This process can continue even if the money has already moved out of the first receiving account. (Lawphil)

In practical terms, this is why your first report should be specific. Do not just say “I was scammed.” Say:

“I am reporting a disputed transaction caused by a scam. Please immediately block further access to my account, initiate fraud investigation, request temporary holding of the disputed funds under RA 12010 and BSP Circular No. 1215 if applicable, and coordinate with the receiving financial institution.”

Financial consumer protection: RA 11765 and BSP rules

The Financial Products and Services Consumer Protection Act, or RA 11765, applies to financial products and services such as deposits, payments, remittances, investments, insurance, and other similar services. It gives financial regulators such as the BSP authority over market conduct and consumer protection. (Supreme Court E-Library)

BSP Circular No. 1160 implements financial consumer protection rules. It recognizes several consumer rights, including the right to protection of consumer assets against fraud and misuse and the right to timely handling and redress of complaints.

Banks and BSP-supervised institutions must maintain a Financial Consumer Protection Assistance Mechanism, or FCPAM, which is the bank’s first-level complaint channel. The bank must provide free complaint assistance, accessible reporting channels, complaint tracking, status updates, and procedures for investigation, resolution, and possible restitution.

Civil Code and Supreme Court principles on bank diligence

A bank deposit is legally treated as a simple loan under Article 1980 of the Civil Code, so the bank generally becomes the debtor and the depositor becomes the creditor. But Philippine law and jurisprudence impose a higher standard on banks because banking is imbued with public interest.

In Simex International (Manila), Inc. v. Court of Appeals and later cases, the Supreme Court emphasized that banks must treat depositors’ accounts with meticulous care. In Consolidated Bank and Trust Corporation v. Court of Appeals, the Court explained that the fiduciary nature of banking requires a degree of diligence higher than that of a good father of a family, consistent with the General Banking Law’s recognition of the fiduciary nature of banking. (Supreme Court E-Library)

In BDO Unibank, Inc. v. Seastres, the Supreme Court again held a bank liable for unauthorized withdrawals after finding that the bank failed to exercise the required diligence in handling the depositor’s accounts. (Supreme Court of the Philippines)

For scam debits, this does not mean the bank is always liable. But it does mean the bank’s systems, warnings, authentication process, fraud alerts, unusual transaction monitoring, customer verification, and response after notice may be examined.

What to do immediately after discovering the scam debit

1. Lock down your account first

Before arguing about liability, stop further loss.

Do these immediately:

Call the bank’s official fraud hotline using the number on the bank’s official website, app, ATM card, or statement.
Ask to freeze online banking access or temporarily block transfers if the account may be compromised.
Change your password and PIN using only the official app or website.
Disable biometric login if your phone may be compromised.
Remove unknown devices from your banking app if the app allows device management.
Call your telco if your SIM lost signal, because SIM swap or unauthorized SIM replacement may be involved.
Do not uninstall the app yet if it contains transaction history or device records that may be useful as evidence.

If you clicked a phishing link, downloaded an APK, installed remote-access software, shared screen access, or gave an OTP, tell the bank exactly what happened. Hiding embarrassing facts usually hurts the investigation later.

2. Report the disputed transaction to the bank in writing

A phone call is important, but written proof is stronger. Use the bank’s in-app report, email, branch complaint form, or FCPAM channel.

Include:

Your full name and account number, but avoid sending passwords, PINs, full card CVV, or OTPs.
Date and exact time you discovered the debit.
Date and exact time of the transaction.
Amount debited.
Transaction reference number.
Receiving bank or e-wallet.
Receiving account name, account number, mobile number, or merchant details, if shown.
Screenshots of SMS, email, app alerts, transfer receipts, scam chats, phishing links, and call logs.
A clear request for investigation, temporary holding, coordinated verification, and written updates.

Ask for a ticket number or reference number. Write down the date, time, name of the agent, and summary of what was promised.

3. Request temporary holding and tracing of funds

Use direct language. Many victims lose time because they only ask, “Can I get my money back?” Instead, ask the bank to take specific action:

“Please determine whether this is a disputed transaction under RA 12010.”
“Please coordinate with the receiving financial institution.”
“Please request temporary holding of the disputed funds if still available.”
“Please trace subsequent transfers if the funds moved to another account.”
“Please give me written confirmation of the action taken.”

Under BSP Circular No. 1215, involved financial institutions must keep logs of when triggers are received and must coordinate verification. The rules also require updates to the source account owner on whether disputed funds were successfully held and whether the coordinated verification process has commenced.

4. Preserve evidence properly

Do not rely on memory. Prepare an evidence folder.

Save:

Bank statement showing the debit.
Transfer receipt or transaction confirmation.
SMS and email alerts.
Screenshots of the scammer’s profile, account name, username, mobile number, email address, marketplace listing, website, QR code, or payment instructions.
Full chat thread, not only selected messages.
Call logs.
URLs of phishing sites.
Screenshots showing the date and time on your device.
Any courier receipt, invoice, fake ID, business permit, investment presentation, or job offer used in the scam.
Bank complaint ticket number and written replies.

For screenshots, capture the full screen where possible. If you later file with the NBI, PNP, prosecutor, or court, you may be asked to execute an affidavit explaining how you obtained and preserved the electronic evidence. RA 8792, the Electronic Commerce Act, recognizes electronic documents for evidentiary purposes, but authenticity and completeness still matter. (Bangko Sentral ng Pilipinas)

5. File a police, PNP-ACG, or NBI cybercrime report

For serious scam debits, do not rely only on the bank complaint. File with law enforcement, especially if the amount is significant, there are multiple victims, or the scammer’s identity or receiving account is known.

The NBI Cybercrime Division accepts requests for investigative assistance from the general public. Its Citizen’s Charter describes a process where complainants proceed to the Cybercrime Division, undergo interview and initial investigation, execute sworn statements or submit affidavits, and provide supporting documents. (National Bureau of Investigation)

Possible legal bases include:

RA 12010 for financial account scamming, money muling, and social engineering.
RA 10175, the Cybercrime Prevention Act of 2012, for cyber-related offenses and computer-related fraud. (Lawphil)
RA 8484, the Access Devices Regulation Act, as amended by RA 11449, for fraudulent acts involving access devices such as cards, account numbers, codes, PINs, and other means of account access. (Lawphil)
Article 315 of the Revised Penal Code for estafa or swindling, when deceit caused the victim to part with money.
RA 9160, the Anti-Money Laundering Act, if the facts show laundering of criminal proceeds. (Lawphil)

After the investigation, the case may be referred for inquest or preliminary investigation before the prosecutor, depending on whether suspects are arrested and what evidence is available.

Escalating to BSP if the bank does not act properly

The BSP is usually not the first place to file. For BSP-supervised institutions, the first step is the bank’s or e-wallet’s FCPAM. BSP-CAM is a second-level recourse after you reported to the institution and you are not satisfied with the handling or the institution failed to act within a reasonable period.

You can file through the BSP Online Buddy (BOB) or, if you cannot access BOB, by submitting the BSP form and supporting documents by email. BSP’s own guidance says new complaints should first be reported to the BSI’s FCPAM or customer service channel; if unsatisfied, the consumer may escalate to BSP-CAM through BOB and obtain a reference number.

When escalating to BSP, attach:

Your complaint to the bank.
The bank’s reply, if any.
Ticket numbers.
Transaction screenshots.
A timeline of events.
Your specific requested resolution.
Proof that you asked for temporary holding, tracing, blocking, or coordinated verification.

If BSP-CAM does not resolve the dispute, BSP procedures may allow mediation and, for certain purely civil financial consumer complaints, adjudication. BSP Circular No. 1169 provides that adjudication may cover claims for payment or reimbursement of money not exceeding ₱10,000,000, exclusive of legal interest, damages, attorney’s fees, and costs.

Documents you should prepare

Document	Purpose	Practical notes
Government ID	Identity verification for bank, BSP, police, NBI, or prosecutor	Foreigners may use passport, ACR I-Card, or other accepted ID
Bank statement or transaction history	Proves the debit	Download the official PDF if available
Transaction receipt/reference number	Helps trace the transfer	Include InstaPay, PESONet, QR, or e-wallet reference details
Screenshots of scam messages	Shows deception or social engineering	Capture sender details, dates, times, URLs, and phone numbers
Written bank complaint	Shows timely notice	Keep email headers, ticket number, and chat transcript
Bank reply or case update	Needed for BSP escalation	Ask for written confirmation, not only verbal statements
Affidavit or sworn statement	Needed for NBI, PNP, prosecutor, or formal proceedings	Usually notarized if executed in the Philippines
Police blotter or cybercrime report	Supports extended holding or criminal investigation	Helpful but does not guarantee refund
Special Power of Attorney	Needed if someone else will represent you	If signed abroad, notarization, consular acknowledgment, or apostille issues may arise

Common timelines and practical bottlenecks

Stage	Typical timing	Bottleneck
Calling bank fraud hotline	Same day, ideally within minutes	Hotline queue, identity verification, incomplete transaction details
Initial bank investigation	A few days to several weeks	Receiving institution response, whether funds are still intact
Initial holding under BSP Circular No. 1215	Up to 5 calendar days	The bank must have sufficient information to identify the disputed transaction
Extended holding	Additional period up to 25 calendar days	May require sworn complaint, affidavit, police report, or supporting documents
BSP-CAM escalation	After bank FCPAM report or unsatisfactory handling	Missing proof that you complained to the bank first
NBI/PNP cybercrime investigation	Varies widely	Anonymous accounts, fake IDs, money mules, cross-border platforms
Prosecutor preliminary investigation	Often months	Need to identify respondents and establish probable cause
Court case	Often longer	Locating accused, evidence authentication, witness availability

The most common bottleneck is that the funds are transferred or withdrawn before the report reaches the receiving institution. That is why the first report must be immediate, specific, and documented.

Will the bank refund the money?

A refund depends on the facts.

The bank’s liability may be stronger if:

The transaction was clearly unauthorized.
Your account was accessed despite proper care on your part.
The bank failed to send timely alerts.
The bank ignored obvious unusual activity.
The bank failed to act after prompt notice.
The bank failed to temporarily hold funds when required under RA 12010 and BSP rules.
The bank failed to exercise the highest degree of diligence required of banks.

The bank’s position may be stronger if:

You voluntarily transferred the money.
You shared your OTP, password, PIN, or remote screen access.
You ignored repeated security warnings.
You reported too late and funds were already withdrawn.
The bank can show compliance with adequate risk management systems, multi-factor authentication, fraud monitoring, and BSP rules.

RA 12010 is important because it states that institutions may be liable for restitution if they fail to employ adequate risk management systems and controls or fail to exercise the highest degree of diligence in preventing loss or damage arising from covered offenses; conviction of the scammer is not required before restitution. (Lawphil)

It also states that an institution that fails to temporarily hold funds subject of a disputed transaction, as required by law and BSP rules, may be liable for loss or damage arising from that failure, including restitution of the disputed funds. (Lawphil)

Special situations

If you are a Filipino abroad

Report through the bank’s official digital channels immediately. If a family member in the Philippines will file with the bank, NBI, PNP, or prosecutor on your behalf, prepare a Special Power of Attorney. Depending on where you sign it, the document may need consular acknowledgment at a Philippine Embassy or Consulate, or notarization and apostille if executed in a country where apostille is accepted. DFA apostille services generally apply to Philippine public documents for use abroad, while foreign-issued documents follow the authentication process of the issuing country. (Apostille Philippines)

If you are a foreigner with a Philippine bank account

You may still use the bank’s FCPAM and BSP-CAM if the institution is BSP-supervised and the transaction involves your Philippine financial account. For identity documents, prepare your passport, Philippine address records if any, ACR I-Card if applicable, account opening documents, and proof of your relationship to the account.

If you are outside the Philippines, coordinate with the bank on whether it accepts a remotely notarized affidavit, consularized affidavit, or apostilled document. Requirements vary depending on the receiving institution and forum.

If the scam involved GCash, Maya, or another e-wallet

E-wallets are also covered if they are BSP-supervised institutions or payment service providers. Report first through the e-wallet’s official help channel and request blocking, tracing, and temporary holding if applicable. Save the wallet number, account name, reference number, QR code, and conversation history.

If the scammer used a marketplace, social media page, or fake investment group

Report to the platform, but do not stop there. Platform reports may remove the account, but they do not automatically preserve bank records or initiate fund holding. File with your bank or e-wallet first, then law enforcement if the amount or pattern justifies it.

If your personal data was leaked or misused

If the scam involved mishandling of your personal data by an organization, a bank data breach, unauthorized disclosure, or unlawful access to personal information systems, the Data Privacy Act of 2012, or RA 10173, may be relevant. The National Privacy Commission handles privacy complaints, while banks and law enforcement handle the financial fraud and criminal aspects. (National Privacy Commission)

Mistakes that can weaken your case

Avoid these common errors:

Waiting several days before reporting because you feel embarrassed.
Calling a number given by the scammer instead of the bank’s official hotline.
Sending your OTP, PIN, password, CVV, or full account credentials in an email complaint.
Deleting chats or blocking the scammer before preserving screenshots.
Posting the alleged scammer’s full personal details online without verification.
Filing a vague complaint with no transaction reference number.
Refusing to cooperate with the bank’s verification requests.
Making a false or exaggerated report. RA 12010 penalizes malicious reporting that results in temporary holding of funds. (Lawphil)

Sample complaint wording to send to your bank

Use this as a practical structure:

I am reporting a disputed transaction caused by a scam or unauthorized access to my account.

Account name: [Name] Source account: [Last 4 digits only, unless bank requires full number through secure channel] Transaction date and time: [Date/time] Amount: [Amount] Reference number: [Reference] Receiving institution/account/e-wallet: [Details shown]

I request immediate blocking of further unauthorized access, fraud investigation, tracing of the funds, coordinated verification with the receiving financial institution, and temporary holding of the disputed funds if applicable under RA 12010 and BSP Circular No. 1215.

Please provide a complaint reference number and written confirmation of the action taken.

Frequently Asked Questions

Can I get my money back if I was scammed through a bank transfer?

Possibly, but it depends on how fast you report, whether the funds are still traceable or intact, whether the transaction was unauthorized or scam-induced, and whether the bank complied with BSP rules. Report immediately and ask for temporary holding and coordinated verification.

Should I report to the bank or BSP first?

Report to the bank or e-wallet first through its FCPAM or official customer service channel. BSP-CAM is generally the second-level remedy if the institution does not act properly, does not respond within a reasonable period, or gives an unsatisfactory response.

What if I gave my OTP to a fake bank employee?

That may be a social engineering scam under RA 12010 if deception was used to obtain sensitive identifying information and gain access to your financial account. Your sharing of the OTP will be reviewed, but the bank’s security controls, warnings, fraud detection, and response may also be relevant.

Can the bank freeze the scammer’s account?

A bank may temporarily hold disputed funds under RA 12010 and BSP rules if the legal and regulatory requirements are met. This is not the same as a permanent freeze or automatic return of money. Longer restraint may require court action or other lawful authority.

Is a police blotter enough to recover the money?

No. A blotter or police report helps document the incident, but it does not by itself force a refund. You still need to report to the bank, ask for tracing and temporary holding, and pursue BSP, NBI, PNP, prosecutor, or court remedies as applicable.

What if the receiving account has already withdrawn the money?

Recovery becomes harder, but you should still proceed. Under BSP Circular No. 1215, coordinated verification may involve tracing the disputed transaction chain even if the funds have moved to another institution or have been withdrawn.

Can I sue the bank?

You may have remedies if the evidence shows bank negligence, failure to follow BSP rules, failure to exercise the required diligence, or failure to act after timely notice. Depending on the amount and nature of the claim, possible routes include BSP mediation or adjudication, civil action, or other proceedings.

Can the scammer be charged even if I voluntarily sent the money?

Yes, if deceit, false pretenses, social engineering, money muling, access device fraud, cybercrime, or estafa can be proven. Voluntary transfer does not automatically make the scam lawful; it usually changes the evidence needed to prove deception and recovery.

Should I confront the account holder whose name appeared on the transfer receipt?

Be careful. The named account holder may be a money mule, identity-theft victim, or person whose account was rented or misused. Preserve the details and give them to the bank and law enforcement. Direct threats or public accusations can create separate legal problems.

How long should I keep my evidence?

Keep all records until the bank complaint, BSP process, criminal investigation, and any civil or criminal case are fully resolved. For serious losses, keep both digital and printed copies, including the original files with metadata where possible.

Key Takeaways

Report the scam debit to your bank or e-wallet immediately, preferably within minutes.
Ask specifically for account blocking, fraud investigation, tracing, temporary holding, and coordinated verification.
RA 12010 covers financial account scamming, money muling, social engineering, temporary holding of disputed funds, and possible restitution.
BSP rules require banks and BSP-supervised institutions to maintain consumer complaint mechanisms and assist with fraudulent or unauthorized transactions.
A refund is not automatic; liability depends on the evidence, your conduct, the bank’s systems, and the bank’s response.
Preserve screenshots, transaction references, call logs, bank tickets, and written replies.
Escalate to BSP-CAM if the bank’s FCPAM response is inadequate.
File with NBI, PNP cybercrime authorities, or the prosecutor when the facts support a criminal complaint.
For Filipinos abroad and foreigners, representation documents such as a Special Power of Attorney may need notarization, consular acknowledgment, or apostille depending on where they are executed.