When you see withdrawals, transfers, card charges, e-wallet movements, or account changes you did not authorize, the most important thing is speed. In the Philippines, reporting unauthorized bank account use is not just a customer-service issue. It may involve financial consumer protection rules, cybercrime, access-device fraud, money muling, social engineering, and the temporary holding of suspicious funds. This guide explains what counts as unauthorized or suspicious account use, where to report it, what documents to prepare, and what Philippine laws protect you.

What Counts as Unauthorized Bank Account Use?

Unauthorized bank account use happens when someone accesses, controls, or uses your bank account, credit card, debit card, online banking, e-wallet, payment account, or other financial account without your real consent.

Common examples include:

Money transferred from your account through online banking without your permission
Unauthorized InstaPay, PESONet, QR, or e-wallet transfers
ATM withdrawals you did not make
Credit card or debit card transactions you did not authorize
Someone using your account as a “receiving account” for scam proceeds
A scammer tricking you into giving an OTP, password, PIN, or login code
SIM swap, phishing, fake bank calls, fake links, malware, or remote-access app scams
A person “borrowing,” renting, or buying your bank account to receive money

Under Republic Act No. 12010, or the Anti-Financial Account Scamming Act (AFASA), a “financial account” includes deposit accounts, trust accounts, investment accounts, credit card accounts, e-wallets, and other transaction accounts. The law also covers sensitive identifying information such as usernames, passwords, bank account details, card details, e-wallet information, electronic credentials, and other confidential personal information. (Supreme Court E-Library)

In everyday terms, the law recognizes that many scams no longer look like traditional robbery. Often, the victim is manipulated into clicking a link, giving an OTP, downloading an app, answering a fake bank call, or allowing an account to be used by another person.

Report Immediately: The First 30 Minutes Matter

Many bank and e-wallet transfers move almost instantly. Under BSP rules for account-to-account electronic fund transfers, near-real-time electronic transfers may credit the beneficiary within seconds after the receiving financial institution receives the clearing advice. That is why fast reporting can make the difference between a possible fund hold and money being withdrawn or moved again.

Do these steps as soon as you notice the suspicious transaction:

Stop using the possibly compromised device. If you clicked a suspicious link, installed a remote-access app, or suspect malware, do not continue logging in from the same phone or computer. Use a clean device if possible.
Call the bank or e-wallet’s official fraud hotline. Use the number on the official website, the back of your card, the official app, or your bank documents. Do not call numbers sent by the suspicious text, email, or caller.
Ask for immediate blocking or freezing. Request temporary blocking of online banking, card, e-wallet access, outgoing transfers, or the affected account if needed. Ask whether the bank can place a hold on the disputed transaction or coordinate with the receiving financial institution.
Get a reference number. Ask for the ticket number, date, time, name or ID of the representative if available, and the exact action taken.
Change credentials from a safe device. Change passwords, remove trusted devices, log out all sessions, disable biometrics if compromised, and update email and mobile number only through official channels.
Preserve evidence before deleting anything. Take screenshots of transaction details, SMS messages, emails, app notifications, fake websites, caller IDs, chat messages, QR codes, receipts, and bank alerts. Save the transaction reference number, amount, date, time, recipient name, recipient account number, bank name, e-wallet number, or merchant name.
Do not talk to the scammer again. Scammers often call back pretending to “help reverse” the transaction. Real banks will not ask for your password, OTP, PIN, full card number with CVV, or screen-sharing access.

Your Rights Under Philippine Banking and Consumer Protection Rules

Philippine banking rules recognize that unauthorized transactions are urgent complaints.

Under BSP Circular No. 1160, BSP-supervised financial institutions must have reporting channels that are free, active, and available 24/7, which may include phone, mobile, online portal, email, chatbot, or messaging channels. The institution must give immediate written acknowledgment through the same channel used by the consumer. Fraud-related concerns must be given utmost priority and resolved within a reasonable time depending on complexity.

For unauthorized transaction disputes, BSP rules place primary responsibility on the Originating Financial Institution (OFI). This is the bank or e-wallet where the money came from. The OFI must assist the customer, inform the receiving financial institution, and take appropriate protective actions while the case is being investigated. These may include suspension of interest or fees, holding disputed funds intact, provisional accommodations, or temporary holds when applicable.

BSP Circular No. 1195 also defines an unauthorized electronic fund transfer as one initiated without the sender’s actual or imputed knowledge and consent. It confirms that the OFI has primary responsibility for communicating status updates, investigation results, and resolution of unauthorized or erroneous transactions.

This means you should usually report first to your own bank or e-wallet, not only to the receiving bank. The receiving bank may help preserve funds, but your own institution is normally the one responsible for taking your complaint, verifying your account, and coordinating the dispute process.

AFASA: The Law on Financial Account Scams, Money Mules, and Social Engineering

Republic Act No. 12010, approved in 2024, specifically targets financial account scams. It was enacted to protect the public from cybercriminals and criminal syndicates that target financial accounts or lure account owners into fraudulent activities. (Supreme Court E-Library)

Money Muling

AFASA penalizes money muling, which includes using, borrowing, allowing the use of, buying, renting, selling, lending, or recruiting another person to open or use a financial account for fraudulent activity. (Supreme Court E-Library)

This matters because some people are approached with offers like:

“Pahiram muna ng bank account, may papasok lang na pera.”
“Rent your GCash or bank account for commission.”
“Receive funds, withdraw them, and send them to another person.”
“Open an account for our online job and we’ll pay you per transaction.”

Even if the account owner did not personally scam the victim, allowing an account to be used this way can create serious criminal exposure.

Social Engineering

AFASA also penalizes social engineering, which means obtaining sensitive identifying information through deception or fraud that results in unauthorized access or control over a financial account. This includes impersonating a bank, financial institution, or trusted person through electronic communications. (Supreme Court E-Library)

Examples include fake bank texts, spoofed calls, phishing links, fake refund pages, fake delivery notices, fake investment platforms, and “verification” scams asking for OTPs.

Temporary Holding of Disputed Funds

AFASA allows financial institutions to temporarily hold funds subject to a disputed transaction for a BSP-prescribed period, not exceeding 30 calendar days, unless extended by a court. The law applies to transactions that are unusual, have no clear economic purpose, involve suspected unlawful activity, or may involve social engineering. (Supreme Court E-Library)

AFASA also requires coordinated verification of disputed transactions once a complaint, report, or detection occurs, even if the disputed funds are no longer within the banking system. During this coordinated verification, bank secrecy and data privacy rules do not prevent the verification process required by law. (Supreme Court E-Library)

Other Philippine Laws That May Apply

Unauthorized bank account use may involve several laws, depending on the facts.

Situation	Possible Legal Basis	What It Means in Practice
Fake bank call, phishing link, stolen OTP, account takeover	RA 12010, AFASA	May be treated as social engineering or financial account scamming
Account rented or used to receive scam proceeds	RA 12010, AFASA	May be money muling
Hacking, illegal access, malware, identity theft	RA 10175, Cybercrime Prevention Act of 2012	May involve illegal access, computer-related fraud, or identity theft
Card skimming, unauthorized online banking/card access	RA 8484 as amended by RA 11449	Covers access-device fraud, online banking fraud, skimming, and related acts
Deception causing the victim to transfer money	Revised Penal Code, Article 315 on estafa	May apply when fraud or deceit caused financial loss
Bank negligence or failure to follow proper procedures	Civil Code and banking jurisprudence	May support civil liability depending on facts

RA 10175 covers illegal access, computer-related fraud, and computer-related identity theft. It also recognizes that computers include devices such as mobile phones and smartphones. (Supreme Court E-Library)

RA 11449 strengthened the Access Devices Regulation Act by covering acts such as skimming, hacking, and fraudulent access to online banking accounts, credit card accounts, ATM accounts, and debit card accounts, regardless of whether monetary loss has already occurred. (Supreme Court E-Library)

Article 315 of the Revised Penal Code on estafa may apply when the offender defrauds another person through deceit, false pretenses, fraudulent acts, or misappropriation of money or property. (Lawphil)

Banks Have a High Duty of Diligence

Philippine jurisprudence consistently treats banking as a business affected with public interest. The Supreme Court has held that banks must exercise the highest degree of diligence in handling depositors’ accounts because of the fiduciary nature of banking.

In BDO Unibank, Inc. v. Seastres, the Supreme Court held a bank liable for unauthorized withdrawals where the bank failed to follow its own verification procedures. The Court emphasized that banks must treat depositor accounts with high care and integrity. (Supreme Court of the Philippines)

This does not mean every disputed transaction is automatically refunded. Each case depends on evidence: how the transaction occurred, what security controls were used, whether the customer was deceived, whether the bank followed its own procedures, whether the fraud was promptly reported, and whether the institution acted with the diligence required by law and regulation.

Step-by-Step Guide to Report Unauthorized Bank Account Use

1. Report to Your Bank or E-Wallet First

Contact the bank or e-wallet where the funds came from. This is usually the Originating Financial Institution.

Give the following details:

Your full name and account identifier
Date and time you discovered the transaction
Date and time of the unauthorized transaction
Amount
Transaction reference number
Receiving account number, bank, e-wallet number, merchant, or QR details
Whether you clicked a link, gave an OTP, received a suspicious call, lost a phone, experienced SIM issues, or installed an app
What action you want: account block, card block, investigation, fund hold, reversal request, written acknowledgment, and coordination with the receiving institution

Use direct language:

“I am reporting an unauthorized transaction. I did not authorize this transfer. Please block further access, create a fraud case, coordinate with the receiving financial institution, and preserve or hold the disputed funds if still possible.”

2. Ask for Written Acknowledgment

BSP rules require immediate written acknowledgment through the same channel used by the consumer. Save the email, SMS, chat transcript, in-app ticket, or case reference.

Write down:

Complaint or ticket number
Date and time of report
Name of bank representative, if given
Summary of what the bank said it would do
Any required forms or deadlines

3. Submit the Bank’s Dispute Form or Written Complaint

Most banks and e-wallets will require a dispute form, customer information sheet, or sworn statement. Some may ask for a notarized affidavit, especially for large losses, identity theft, card disputes, or law-enforcement coordination.

Your written complaint should clearly state:

“I did not authorize the transaction.”
“I did not receive the benefit of the transaction.”
“I reported the matter as soon as I discovered it.”
“I request investigation, preservation of records, coordinated verification, and recovery or reversal if available.”
“Please provide the basis of any denial in writing.”

Attach evidence in a clean order. Avoid sending passwords, OTPs, PINs, CVV codes, or full screenshots that expose unrelated account details.

4. Ask the Bank to Coordinate With the Receiving Financial Institution

If the money was transferred to another bank or e-wallet, ask your bank to notify the receiving institution immediately. Under BSP rules, the OFI is primarily responsible for customer assistance and coordination.

Ask whether the receiving institution can:

Identify whether funds remain in the receiving account
Temporarily hold the disputed funds if legally allowed
Flag the account for suspicious activity
Preserve transaction logs
Participate in coordinated verification under AFASA

Do not expect the receiving bank to disclose private account information directly to you. Banks are still bound by privacy and confidentiality rules except through lawful reporting, regulatory, or law-enforcement channels.

5. Escalate to the Bank’s Financial Consumer Protection Assistance Mechanism

All BSP-supervised financial institutions are required to have a Financial Consumer Protection Assistance Mechanism (FCPAM) as the first-level recourse for consumer complaints. This is the bank or e-wallet’s internal complaint-handling process.

Escalate internally when:

The hotline only gives generic answers
No written acknowledgment is issued
The bank refuses to provide a case number
No meaningful update is given
The bank closes the case without explaining the basis
You need written confirmation for BSP, NBI, PNP, or court use

6. Escalate to the BSP Consumer Assistance Mechanism

If you are dissatisfied with the bank’s response or there is inaction after using the bank’s FCPAM, you may escalate to the Bangko Sentral ng Pilipinas Consumer Assistance Mechanism (BSP-CAM). BSP-CAM is a second-level recourse for financial consumers dealing with BSP-supervised institutions.

BSP allows escalation through its BOB chatbot on the BSP website or official BSP Facebook page. If the consumer cannot access BOB, BSP’s published process allows submission of a Consumer Information Report form by email to BSP’s consumer affairs channel, with proof that the complaint was first raised with the financial institution.

For BSP escalation, prepare:

Your bank complaint reference number
Copies of your written complaint and bank replies
Transaction records and screenshots
Timeline of events
Proof that you used the bank’s FCPAM
Your desired resolution, such as investigation, written explanation, correction, reversal, or other appropriate relief

BSP complaints should generally be filed by the real party in interest, such as the account owner, depositor, cardholder, sender, transaction recipient, or a duly authorized representative.

7. File a Criminal Complaint With NBI or PNP Cybercrime Units

If the incident involves phishing, hacking, identity theft, fake bank calls, malware, account takeover, social engineering, card fraud, or mule accounts, consider reporting to law enforcement.

The NBI Cybercrime Division Citizen’s Charter describes the intake process: the complainant files a complaint or request for investigation, is assisted in completing a complaint sheet, undergoes preliminary interview or initial investigation, and may execute sworn statements or submit prepared affidavits and device evidence. The charter lists no filing fee for this intake process. (National Bureau of Investigation)

Bring or prepare:

Government ID or passport
Bank statements and transaction records
Screenshots of SMS, email, websites, chats, QR codes, and calls
Device used during the incident, if relevant
SIM card information and telco records, if relevant
Bank complaint number
Affidavit or written narrative
Names, phone numbers, account numbers, URLs, or social media profiles used by the suspect

Under RA 10175, law-enforcement authorities such as the NBI and PNP handle cybercrime investigations, and computer data preservation rules may be important. Traffic and subscriber data are preserved for at least six months from the transaction, and content data may be preserved by order. (Supreme Court E-Library)

8. Preserve Data Privacy and Breach Evidence

If the incident appears connected to leaked personal data, stolen IDs, compromised login credentials, or a security breach, preserve all notices from the bank, e-wallet, merchant, telco, or platform.

Under National Privacy Commission rules, a personal information controller must notify the NPC and affected data subjects within 72 hours when a notifiable personal data breach involves sensitive personal information or information that may enable identity fraud, there is unauthorized acquisition, and there is a real risk of serious harm. (National Privacy Commission)

For ordinary consumers, this means you should keep breach notices, emails, SMS alerts, and identity-theft evidence because they may support your complaint, bank dispute, or law-enforcement report.

Where Should You Report?

Problem	Report First To	Why It Matters
Money left your bank or e-wallet without authorization	Your own bank or e-wallet	The OFI is primarily responsible for assisting you and coordinating the dispute
The receiving account is known	Your bank, then law enforcement if fraud is suspected	Your bank can coordinate with the receiving institution; law enforcement may investigate the account user
Bank or e-wallet ignores your complaint	BSP-CAM after using FCPAM	BSP handles second-level consumer assistance for BSP-supervised institutions
Phishing, hacking, malware, identity theft, fake bank calls	NBI Cybercrime Division or PNP cybercrime unit	These may be criminal offenses under cybercrime, AFASA, access-device, or estafa laws
Personal data leak or identity fraud risk	Institution’s Data Protection Officer; NPC process may apply	Breach notification and data-protection duties may be involved
Someone wants to rent, borrow, or buy your account	Do not allow it; report suspicious activity to your bank if needed	Money muling is penalized under AFASA

Documents and Evidence Checklist

Prepare a simple folder, digital or printed, with the following:

Document or Evidence	Why It Helps
Valid ID, passport, or account-opening ID	Proves your identity and account ownership
Bank statement or transaction history	Shows the disputed transaction clearly
Transaction reference number	Helps banks trace the transfer
Screenshots of bank alerts, SMS, emails, and app notifications	Shows timing and content of the fraud
Screenshot of fake website, link, QR code, or sender number	Helps prove phishing or social engineering
Call logs and phone numbers	Useful for fake bank call or vishing complaints
Chat messages with scammer or fake seller	Shows deception and instructions
Affidavit or written narrative	Organizes the facts for the bank, BSP, NBI, PNP, or court
Police or NBI report, if already obtained	Supports fraud classification and further investigation
Special Power of Attorney, if a representative will act for you	Needed when someone else will file or follow up on your behalf

For OFWs and foreigners outside the Philippines, banks and agencies may require a notarized or consularized document, depending on the purpose. Philippine embassies and consulates commonly provide notarization or acknowledgment services for affidavits, special powers of attorney, and similar documents for use in the Philippines, subject to the specific post’s requirements. (Philippine Consulate LA)

Common Mistakes That Can Hurt Your Report

Waiting Too Long

Delays make recovery harder. Once funds are withdrawn, transferred again, converted to crypto, or sent through multiple mule accounts, tracing and recovery become more difficult.

Reporting Only to the Receiving Bank

Victims often try to contact only the bank or e-wallet that received the money. That can help, but your first formal complaint should usually be with your own bank or e-wallet because it is the OFI and has primary responsibility for assisting you under BSP rules.

Deleting Messages or Resetting the Phone

Do not delete suspicious SMS, emails, chat messages, apps, call logs, or browser history before preserving evidence. If malware is suspected, stop using the device for banking, but keep it available for possible technical review.

Giving More OTPs After the Incident

Scammers may call again pretending to be from the “fraud department.” They may say they need another OTP to reverse the transaction. Do not give any OTP, PIN, password, CVV, or screen-sharing permission.

Filing an Exaggerated or False Report

AFASA penalizes malicious false reports. A person who knowingly files a false or malicious report may face imprisonment or fine under the law. (Supreme Court E-Library)

Allowing Your Account to Be Used by Others

Many people get pulled into scams through “easy money” offers. Letting another person use your account to receive or move funds can be treated as money muling under AFASA. (Supreme Court E-Library)

What If You Were Tricked Into Giving the OTP?

Many victims feel embarrassed because they clicked a link or gave an OTP after a convincing fake bank call. Report anyway.

Under AFASA, social engineering covers deception or fraud used to obtain sensitive identifying information that results in unauthorized access or control over a financial account. (Supreme Court E-Library)

The bank will still investigate the facts. Important questions include:

Was the message spoofed to look like an official bank message?
Did the caller impersonate the bank?
Did the bank’s system detect unusual activity?
Were there multiple suspicious transactions?
Did the bank send adequate warnings?
Did the bank follow its own procedures?
How fast did you report?
Were funds still traceable or holdable?

A victim’s mistake does not automatically end the inquiry. At the same time, banks will examine whether the customer disclosed credentials, ignored warnings, or authorized steps that appeared valid in the system. The outcome depends on evidence and applicable rules.

Can the Bank Freeze the Receiving Account?

A bank or e-wallet may be able to place a hold on disputed funds when allowed by law and regulation. AFASA specifically provides for temporary holding of funds subject to disputed transactions for a period prescribed by BSP, not exceeding 30 calendar days unless extended by a court. (Supreme Court E-Library)

However, the bank may not be able to tell you the receiving account holder’s private information directly. Information may be shared through coordinated verification, BSP processes, law-enforcement channels, or court processes.

What If the Bank Denies the Claim?

If the bank denies the claim, ask for the denial in writing and request the specific factual and legal basis. A useful denial letter should state more than “OTP was used” or “transaction was successful.”

Ask for:

The reason the transaction was considered authorized
The security controls relied upon
Whether unusual activity alerts were triggered
Whether the receiving institution was notified
Whether funds were still available when you reported
Whether the case was reviewed under fraud, consumer protection, and AFASA-related procedures
The internal appeal or reconsideration process

If the explanation is incomplete or unsatisfactory, escalate through the bank’s FCPAM, then BSP-CAM with your evidence and complaint history.

Typical Timelines and Practical Expectations

Stage	Practical Timing
Initial hotline or app report	Should be done immediately; ask for written acknowledgment
Blocking card, online banking, or e-wallet	Often immediate once identity is verified
Bank fraud investigation	Varies depending on complexity, receiving institution coordination, and evidence
Temporary hold under AFASA	May not exceed 30 calendar days unless extended by court
Failed, rejected, timed-out, or multiple-debit EFT returns	BSP has separate timelines, but these do not automatically apply to unauthorized or erroneous transfers
BSP-CAM escalation	Available after using the financial institution’s complaint mechanism
NBI or PNP cybercrime investigation	Intake may be quick, but investigation, subpoenas, forensic review, and prosecution can take longer

BSP Circular No. 1195 has specific return-of-funds standards for failed, rejected, timed-out, or multiple-debit electronic fund transfers, but it expressly treats unauthorized and erroneous transactions differently. Unauthorized fraud disputes usually require investigation rather than automatic return under those operational timelines.

Special Notes for OFWs, Expats, and Foreigners

If you are outside the Philippines but your Philippine bank account, e-wallet, card, or mobile number is involved, report through official digital or hotline channels immediately. Time zone differences should not delay reporting because many financial institutions maintain 24/7 fraud channels under BSP rules.

If you need someone in the Philippines to follow up, the bank, BSP, or law-enforcement office may require a Special Power of Attorney (SPA) or written authorization. BSP rules on complaint escalation recognize that a duly authorized representative may act for the real party in interest.

Foreigners with Philippine accounts should keep copies of passports, ACR I-Card if applicable, account documents, local contact information, and transaction records. If documents are executed abroad, the bank or agency may require notarization, consular acknowledgment, apostille, or authentication depending on where the document was made and how it will be used.

AFASA also has extraterritorial reach in certain situations, including when elements are committed in the Philippines, damage occurs in the Philippines, the financial account is maintained in the Philippines, or computer systems located in the Philippines are used. (Supreme Court E-Library)

Frequently Asked Questions

What should I do first if money disappeared from my bank account?

Call your bank or e-wallet’s official fraud channel immediately. Ask them to block the account or card, create a fraud case, coordinate with the receiving financial institution, and issue written acknowledgment with a reference number. Then preserve all evidence.

Should I report to the bank or police first?

Report to the bank or e-wallet first if the transaction just happened because they are the only ones who can immediately block access, trace the transaction internally, or request a hold through financial-institution channels. Report to NBI or PNP cybercrime units if there is phishing, hacking, identity theft, social engineering, card fraud, or a suspected mule account.

Can an unauthorized InstaPay or PESONet transfer be reversed?

Possibly, but it depends on speed, whether the funds are still in the receiving account, the rules of the payment system, the receiving institution’s action, and the investigation result. Near-real-time transfers may move within seconds, so immediate reporting is critical.

What if I gave the OTP because I was tricked?

Report it as possible social engineering. AFASA recognizes deception used to obtain sensitive identifying information resulting in unauthorized access or control over a financial account. The bank will still examine what happened, what warnings were given, what controls were used, and how quickly you reported. (Supreme Court E-Library)

Do I need a police report before the bank investigates?

Usually, no. Banks and e-wallets should accept and acknowledge consumer complaints through their own reporting channels. A police, NBI, or cybercrime report may still help support the case, especially for identity theft, phishing, hacking, mule accounts, or large losses.

Can I report the receiving account used by the scammer?

Yes. Give the receiving account details to your bank and to law enforcement if a crime is suspected. Your bank can coordinate with the receiving institution, while law enforcement can investigate through proper legal channels. The receiving bank may not disclose the account holder’s private details directly to you.

Can my own account be frozen if someone used it for suspicious transactions?

Yes. If your account receives suspicious funds or appears connected to a scam, the bank may restrict, review, or report the account depending on the facts and applicable rules. If you knowingly allowed your account to be used by another person to receive or move scam proceeds, that may raise money-muling issues under AFASA. (Supreme Court E-Library)

What if I am an OFW and cannot go to the branch?

Use official hotline, app, email, or online complaint channels immediately. Ask for a case number and written instructions. If someone in the Philippines must act for you, prepare a written authorization or SPA that meets the bank’s requirements. If executed abroad, the document may need consular acknowledgment, notarization, apostille, or authentication depending on the situation.

Can I still recover the money if the scammer already withdrew it?

Recovery becomes harder once funds are withdrawn or moved through multiple accounts, but reporting is still important. The bank may preserve records, coordinate verification, flag accounts, and assist regulators or law enforcement. NBI or PNP investigation may also identify suspects, mule accounts, or linked transactions.

Key Takeaways

Report unauthorized bank account use immediately to your own bank or e-wallet, especially if the transfer just happened.
Ask for blocking, fraud investigation, written acknowledgment, transaction tracing, and coordination with the receiving financial institution.
Preserve screenshots, transaction numbers, SMS, emails, call logs, fake links, QR codes, and chat messages.
AFASA covers money muling, social engineering, disputed transaction verification, and temporary holding of suspicious funds.
BSP rules require financial institutions to maintain complaint channels, acknowledge reports, prioritize fraud concerns, and handle unauthorized transaction disputes properly.
Escalate to BSP-CAM if the bank or e-wallet fails to act properly after you use its complaint mechanism.
Report phishing, hacking, identity theft, fake bank calls, malware, card fraud, or mule accounts to NBI or PNP cybercrime authorities.
Never rent, lend, sell, or allow another person to use your bank or e-wallet account to receive or move money.