An unauthorized credit card transaction can quickly become more expensive if additional charges, interest, foreign-exchange fees, or penalties continue to appear while the dispute is unresolved. Report the transaction to your card issuer immediately, block the card, preserve your evidence, and submit a formal written dispute—not just a phone call. Philippine financial consumer protection rules require issuers to maintain accessible fraud-reporting channels, investigate disputed transactions fairly, and explain what action they have taken.

What Counts as an Unauthorized Credit Card Transaction?

A transaction is generally unauthorized when it was made without the cardholder’s knowledge or consent. Common examples include:

Purchases made using stolen card details
Online transactions you did not make
Charges after your physical card was lost or stolen
Cash advances made without your permission
Transactions resulting from card skimming or cloning
Charges made after a phishing, smishing, or fake-bank-call incident
Purchases made through a compromised digital wallet linked to your card
Recurring charges that continued after a valid cancellation

Do not confuse an unauthorized transaction with an ordinary merchant dispute.

Situation	Usual type of dispute
You never made or approved the purchase	Unauthorized transaction or fraud
The merchant charged you twice	Duplicate billing
The amount charged was higher than agreed	Incorrect amount
You paid but never received the goods	Non-delivery or merchant dispute
A cancelled subscription continued billing	Recurring-payment dispute
You received defective goods	Quality or merchant dispute
You recognize the merchant but not the billing name	Possible merchant-descriptor issue

This distinction matters because the issuer may use a different card-network dispute or “chargeback” reason. A chargeback is the process through which the issuing bank contests a transaction with the merchant’s acquiring bank. It can help recover funds, but it is not an automatic guarantee of reimbursement.

Before reporting a merchant name as fraudulent, search your email receipts, subscriptions, app-store purchases, hotel deposits, transport bookings, and purchases made by supplementary cardholders. Merchant descriptors on statements sometimes differ from the store or website name.

Your Rights Under Philippine Law

Financial consumer protection under Republic Act No. 11765

Republic Act No. 11765, or the Financial Products and Services Consumer Protection Act of 2022, protects financial consumers’ rights to:

Equitable and fair treatment
Clear disclosure and transparency
Protection of consumer assets against fraud and misuse
Data privacy and protection
Timely handling and redress of complaints

The law gives financial regulators, including the Bangko Sentral ng Pilipinas (BSP), authority to supervise complaint handling, conduct mediation, and adjudicate qualifying financial consumer claims. The BSP may adjudicate purely monetary claims against BSP-supervised institutions up to ₱10 million, excluding legal interest, attorney’s fees, and litigation costs. (Lawphil)

Credit card regulation under Republic Act No. 10870

Republic Act No. 10870, or the Philippine Credit Card Industry Regulation Law of 2016, places bank and non-bank credit card issuers under BSP regulation. It governs matters such as credit card issuance, disclosure, billing, collection practices, and cardholder protection. (Lawphil)

BSP rules for unauthorized transactions

Under BSP Circular No. 1160, financial institutions must provide free and active reporting channels for fraud concerns. These may include hotlines, mobile numbers, email, online portals, chatbots, or instant messaging, and fraud-reporting channels should be available 24 hours a day. A consumer who reports through the channel should receive an immediate written acknowledgment.

While the matter is being investigated, the institution should take appropriate protective measures, which may include:

Suspending interest, fees, or charges on the disputed amount
Providing provisional credit where appropriate
Blocking the card or account
Preventing additional transactions
Preserving or holding funds where the applicable rules allow it

If the investigation confirms that the transaction was unauthorized or fraudulent, the institution should reverse or correct the transaction, including related interest, fees, and charges, or make any provisional credit permanent.

Liability is not decided solely by whether an OTP, PIN, or password was used. BSP rules allow the issuer to consider:

The cardholder’s actions before, during, and after the transaction
The conduct or omissions of the issuer and its service providers
Whether the issuer complied with applicable security and consumer protection requirements

This means disclosure of an OTP or delayed reporting can seriously weaken a claim, but the issuer should still conduct a fair investigation instead of rejecting the complaint automatically.

Access-device and cybercrime laws

Credit card fraud may also constitute a criminal offense under:

Republic Act No. 8484, the Access Devices Regulation Act of 1998
Republic Act No. 11449 of 2019, which expanded the law to cover skimming, fraudulent access to credit card accounts, hacking, and possession of devices or software used for access-device fraud
Republic Act No. 10175, the Cybercrime Prevention Act of 2012
Republic Act No. 12010, the Anti-Financial Account Scamming Act or AFASA, which penalizes money-muling and social-engineering schemes involving financial accounts (Lawphil)

An important limitation applies: the special temporary-hold and coordinated-verification procedure under BSP Circular No. 1215 generally does not apply to ordinary credit card purchases. It applies to credit cards only when the card is used to perform an electronic fund transfer through an Automated Clearing House. Ordinary unauthorized card purchases remain governed primarily by the BSP’s general financial consumer protection rules and the issuer’s card-dispute procedures.

How to Report Unauthorized Credit Card Transactions

1. Lock or block the card immediately

Use the issuer’s mobile app, online banking platform, or emergency hotline to lock the card. Ask the issuer to:

Permanently block the compromised card
Issue a replacement card with a new card number
Remove the card from digital wallets if necessary
Stop recurring card-token transactions where possible
Review recent pending and posted transactions

Blocking the physical card may not automatically invalidate every stored merchant token. Ask specifically whether the issuer will update or terminate tokenized and recurring-payment arrangements.

Record the exact date and time of the report, the name or identification number of the representative, and the reference number.

2. Secure your other accounts

If the incident involved phishing, a fake bank website, remote-access software, malware, or a compromised email account:

Change your online banking and email passwords using a clean device.
Log out all active sessions.
Remove unknown devices from your accounts.
Change reused passwords on other services.
Contact your mobile provider if you suspect a SIM swap.
Scan affected devices for malicious applications.
Do not delete suspicious messages, links, or apps until you have preserved evidence.

Never give anyone an OTP, CVV, PIN, password, or full card number during the reporting process. Legitimate BSP complaint handling does not require these credentials.

3. Identify every disputed transaction

Prepare a complete list showing:

Transaction date and time
Posting date
Merchant name or statement descriptor
Amount and currency
Whether the transaction is posted or pending
Whether you received an OTP or transaction alert
Why you believe the transaction was unauthorized

Do not report only the largest charge. Fraudsters sometimes make a small “test” transaction before attempting larger purchases.

4. Submit a formal written dispute to the issuer

A hotline report protects the account, but it may not complete the issuer’s formal dispute process. Submit the issuer’s dispute form or send a written complaint through its official email, app, branch, or consumer assistance channel.

Your complaint should state clearly:

I dispute the transactions listed below because I did not make, authorize, participate in, or benefit from them.

Include the date of your first fraud report and the case number. Request:

Investigation of each disputed transaction
Suspension of interest, finance charges, late fees, and collection activity relating to the disputed amount
Provisional credit where appropriate
Confirmation that the card has been permanently blocked
A written explanation of the investigation result
Copies or details of the evidence relied upon if the claim is denied

BSP rules require the issuer’s Financial Consumer Protection Assistance Mechanism, or FCPAM, to receive, record, evaluate, investigate, and resolve consumer complaints through accessible channels.

5. Submit supporting documents promptly

Requirements vary by issuer and transaction type, but the following documents are commonly useful:

Document	Purpose
Completed dispute form	Identifies each contested transaction
Copy of statement or transaction history	Shows the amount, date, and descriptor
Screenshot of transaction alerts	Establishes when you learned of the charge
Hotline or complaint reference number	Proves prompt reporting
Valid identification	Confirms the account holder’s identity
Affidavit of unauthorized transaction	Provides a sworn factual account if requested
Police or cybercrime report	Supports cases involving theft, phishing, or identity fraud
Card-possession evidence	Helps show that the card remained with you
Travel records	Relevant when a card-present transaction occurred elsewhere
Cancellation email or merchant correspondence	Supports recurring-payment disputes
Device or account-security screenshots	Helps document account takeover or unknown logins

Redact unrelated transactions and sensitive credentials where possible. Never send your PIN, CVV, online banking password, or full card number by ordinary email.

A police report is not stated in BSP rules as a universal prerequisite for every card dispute. The issuer may reasonably request one in fraud or identity-theft cases, but you should not delay the initial bank report while waiting for it.

6. Pay the undisputed portion of the bill

Do not simply ignore the entire statement. Pay the purchases, cash advances, installments, and fees that you do not dispute.

At the same time, ask the issuer in writing to suspend:

Interest on the disputed transaction
Late-payment penalties caused by the dispute
Collection activity involving the disputed amount
Adverse credit reporting related to the unresolved transaction

BSP rules contemplate suspension of interest, fees, or charges where applicable while an unauthorized-transaction claim is under investigation. Keeping the undisputed portion current also prevents the dispute from becoming mixed with a legitimate payment-default issue.

7. Follow up and request the investigation evidence

Depending on the transaction, ask whether the issuer reviewed:

EMV chip or magnetic-stripe data
Contactless-payment records
Signed sales slips
Merchant location and terminal details
Three-Domain Secure or 3-D Secure authentication
OTP generation and delivery logs
Device, browser, IP-address, or login records
Digital-wallet enrollment records
Proof of delivery
Merchant refund or cancellation records
ATM logs and CCTV for cash advances
The merchant-acquirer’s response to the chargeback

An issuer may not release every internal security record, but it should provide enough information to explain why the transaction was treated as authorized or unauthorized.

There is no single fixed investigation period that applies identically to every credit card fraud claim. BSP rules require fraud concerns to receive priority and be resolved within a reasonable period proportionate to their complexity. After the investigation concludes, the institution must formally communicate the result within three banking days.

Overseas transactions, merchant-document retrieval, card-network proceedings, and multiple acquiring banks can extend the investigation.

8. Escalate an unresolved complaint to the BSP

The card issuer’s FCPAM is the required first-level complaint channel. If the issuer does not act within a reasonable time, gives an unsupported denial, continues charging interest on the disputed amount, or otherwise fails to resolve the issue properly, escalate the matter through the BSP Consumer Assistance Mechanism, or BSP-CAM. BSP-CAM is a second-level process and must generally be completed before BSP mediation or adjudication.

You may file through:

The BSP Online Buddy or BOB chatbot on the BSP website
The messaging facility on the BSP’s official Facebook page
A completed Complaint/Inquiry/Reply form sent to consumeraffairs@bsp.gov.ph
A BSP regional office or branch
Postal mail, courier, or personal filing

Attach proof that you first complained to the issuer, including the bank’s acknowledgment, reference number, response, dispute form, and relevant statements. Do not send the BSP your PIN, password, CVV, or complete card number.

Under the BSP-CAM procedure, the issuer must submit an answer directly to the consumer within 15 days after receiving the BSP’s directive. The consumer may reply within 30 days, and the issuer may be directed to submit a rejoinder within 10 days.

If BSP-CAM does not resolve the dispute, the consumer may be offered mediation. A qualifying claim for reimbursement of up to ₱10 million may proceed to BSP adjudication. BSP states that adjudication commonly takes about six to eight months, carries no filing fee, and requires a verified formal complaint, a certification against forum shopping, and supporting evidence.

When to Report the Fraud to the Police, NBI, or CICC

A bank dispute seeks reversal or reimbursement. A criminal complaint seeks investigation and prosecution of the offender. These are separate processes, and you may pursue both.

Report the incident to law enforcement when it involves:

Phishing, smishing, or fake bank calls
Identity theft
Card skimming or cloning
Stolen cards or devices
Unauthorized access to your banking or email account
Fraudulent digital-wallet enrollment
Organized or repeated transactions
A known suspect
Threats, extortion, or remote-access scams

Possible reporting channels include:

PNP Anti-Cybercrime Group: acg@pnp.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph
Cybercrime Investigation and Coordinating Center: report@cicc.gov.ph or hotline 1326

The BSP itself recommends reporting criminal fraud to the PNP, NBI, or CICC because these agencies have authority to commence a criminal investigation and pursue the perpetrators.

Bring or preserve:

A chronological account of the incident
Copies of statements and transaction records
Screenshots of texts, emails, websites, and chat messages
Phone numbers, email addresses, usernames, and URLs used by the scammer
Email headers where available
Bank complaint and reference numbers
Proof that the card was in your possession
Device and login alerts
Copies of IDs requested by the investigating agency

A police blotter merely records that an incident was reported. A formal criminal case may require a sworn complaint-affidavit, supporting affidavits, documentary evidence, and referral to the appropriate prosecutor.

You do not need to undergo barangay conciliation before reporting credit card cyberfraud to the bank, BSP, PNP, NBI, or CICC.

Common Problems That Cause Credit Card Disputes to Fail

Reporting too late

Delay allows additional transactions and makes it harder to preserve merchant, CCTV, device, and authentication records. It may also expose the cardholder to contractual liability for transactions made before the card was reported lost or compromised.

Relying only on a telephone call

A phone call may block the card but leave no complete record of the disputed transactions. Always obtain a reference number and follow up in writing.

Saying only, “I was scammed”

Explain exactly what happened. State whether you clicked a link, installed an app, disclosed an OTP, entered card details on a fake page, lost the card, or noticed an unknown digital-wallet enrollment. Inaccurate or incomplete facts can damage credibility later.

Deleting messages or resetting the phone too early

Preserve screenshots, URLs, messages, call logs, app names, device alerts, and email headers before deleting apps or performing a factory reset.

Refusing to pay the entire statement

Nonpayment of legitimate purchases can create separate interest, collection, and credit-reporting problems. Pay the undisputed balance and contest the fraudulent amount in writing.

Assuming an OTP proves consent

An OTP can be relevant evidence, but it is not necessarily the whole case. The investigation should consider how the OTP was obtained, whether the transaction pattern was unusual, whether security controls worked properly, and whether the issuer responded appropriately to risk signals. BSP rules require consideration of both the consumer’s actions and the institution’s conduct.

Filing with the BSP before complaining to the bank

BSP-CAM is generally a second-level remedy. A complaint filed without proof that the issuer’s FCPAM was used first may be delayed or rejected.

For OFWs, Foreigners, and Cardholders Outside the Philippines

A Filipino or foreign national abroad may still dispute transactions involving a credit card issued by a Philippine bank or BSP-supervised issuer. Use the issuer’s international collect hotline, secure app, online banking channel, or official fraud email.

Keep evidence of your location, such as immigration stamps, airline records, employment attendance, or overseas purchase receipts, when the disputed transaction was supposedly made physically in the Philippines or another country.

BSP-CAM permits a cardholder to act through a representative who has written and signed authority to handle and settle the complaint. Formal BSP adjudication requires a Special Power of Attorney when a representative will appear, sign pleadings, or bind the cardholder.

Where a notarized SPA or affidavit is executed abroad, the receiving institution may require either:

Notarization before a Philippine embassy or consulate; or
Local notarization followed by an apostille in a country that is a party to the Apostille Convention

Requirements can differ by country and by the issuer’s document-verification policies, so confirm the required format before paying for notarization or authentication. (Philippine Embassy in New Delhi)

Frequently Asked Questions

How long do I have to dispute an unauthorized credit card transaction?

Report it immediately. Philippine BSP rules do not provide one universal card-dispute deadline that overrides every issuer’s terms and card-network rules. Many issuers impose contractual reporting periods counted from the statement date, but prompt reporting is important even when the transaction is older.

Will the bank automatically refund an unauthorized transaction?

No. The bank will investigate the transaction and assess the evidence and the conduct of both the cardholder and the institution. If the transaction is found unauthorized or fraudulent, BSP rules provide for reversal or correction, including related interest, charges, and fees.

Can the bank reject my claim because an OTP was used?

The use of an OTP is important evidence, but it should not automatically end the investigation. The bank may consider how the OTP was obtained, whether the transaction matched your normal activity, the effectiveness of its security controls, and whether you reported promptly.

Should I pay the disputed transaction while the investigation is pending?

Pay the undisputed portion of your bill. Ask the issuer in writing to suspend interest, penalties, and collection activity on the disputed amount and to provide provisional credit where appropriate.

Is a police report required before the bank investigates?

Not in every case. BSP regulations do not make a police report a universal condition for starting an unauthorized-transaction investigation. An issuer may request one depending on the circumstances, especially for theft, identity fraud, phishing, or large transactions.

Can I report pending credit card transactions?

Yes. Report them immediately even if they have not yet posted. The bank may be unable to initiate a formal chargeback until posting, but it can block the card, document the report, and prevent additional transactions.

Can I complain directly to the BSP?

You must generally complain to the card issuer’s FCPAM first. You may escalate to BSP-CAM when the bank’s response is unsatisfactory or the complaint has not been acted upon within a reasonable time.

Can the BSP order the bank to reimburse me?

The BSP may facilitate the complaint through BSP-CAM and mediation. Through formal adjudication, it may decide qualifying monetary claims against BSP-supervised institutions up to ₱10 million, subject to the requirements of Republic Act No. 11765 and BSP Circular No. 1169. (Lawphil)

What if the unauthorized transaction damaged my credit record?

Ask the issuer in writing to correct any adverse credit information caused by the disputed charge, including falsely reported delinquency. After resolution, obtain your credit report and dispute any remaining inaccurate entry with the issuer and the relevant credit-information provider.

Can I recover moral or exemplary damages through BSP adjudication?

BSP adjudication is principally for payment or reimbursement of money up to the jurisdictional limit, together with allowable legal interest, attorney’s fees, and costs. Other forms of damages are generally outside that adjudicatory remedy and may require an appropriate court action.

Key Takeaways

Block the compromised credit card and report every unauthorized transaction immediately.
Follow the hotline report with a formal written dispute and keep the reference number.
Pay the undisputed portion of the statement while requesting suspension of charges on the disputed amount.
Preserve screenshots, messages, statements, OTP alerts, login records, and merchant information.
The issuer must investigate fairly and formally communicate the result after the investigation concludes.
Escalate unresolved complaints to BSP-CAM only after using the issuer’s FCPAM.
Report phishing, skimming, identity theft, or account takeover separately to the PNP, NBI, or CICC.
OFWs and cardholders abroad may report remotely and appoint a representative when properly authorized.