Legal Steps After an Unauthorized ATM Withdrawal in the Philippines (Updated to June 2025)
1. What Counts as an “Unauthorized ATM Withdrawal”?
An ATM withdrawal is unauthorized when money is taken from your account without your knowledge or consent, including situations caused by:
| Scenario | Typical Legal Classification |
|---|---|
| Card-skimming, shimming or card-trapping | Access Devices Regulation Act (RA 8484) fraud; possible Qualified Theft under the Revised Penal Code (RPC) |
| PIN “shoulder surfing,” lost or stolen card | RA 8484 fraud and/or Estafa (Art. 315 RPC) |
| Phishing / account takeover via mobile or online banking | Computer-related Fraud (sec. 6(i), Cybercrime Prevention Act RA 10175) |
| Inside-job withdrawals by bank staff | Qualified Theft (Art. 310 RPC) plus administrative sanctions against the bank |
Key point: Banks will deny liability if they can show you were grossly negligent (e.g., you shared your PIN). Always keep your ATM PIN confidential and change it periodically.
2. Immediate Actions (Within the First 24 Hours)
Lock the Card / Account Immediately Call your bank’s 24-hour hotline (found on the card or the bank’s website) and request a freeze on the card or the whole deposit account.
Document Everything
- Screenshots of SMS alerts or online-banking logs
- ATM receipts (if any)
- The exact time you discovered the loss
- Running balance before and after the disputed withdrawal
File a Written Dispute With the Bank Banks require a dispute form or a sworn statement. Submit it in writing (e-mail or branch) so the statutory investigation period starts to run (see Section 4). Attach your evidence.
Make a Police Blotter Go to the nearest police station and request a blotter entry. If cyber elements are involved, you may also proceed to:
- PNP Anti-Cybercrime Group (ACG) in Camp Crame, or
- NBI Cybercrime Division in Taft Avenue, Manila.
A police blotter is not legally required by the bank, but it:
- (a) corroborates the timeline, and
- (b) is indispensable if you later pursue criminal or civil action.
3. Bank Investigation & BSP-Mandated Timeline
| Step | BSP Consumer Protection Framework (Circular 1048 s. 2019 & Circular 1168 s. 2023)* |
|---|---|
| Acknowledgment | Bank must confirm receipt within 2 banking days. |
| Resolution (simple cases) | 20 banking days to issue a written decision and credit back if meritorious. |
| Complex/Third-party cases | May extend to 40 days (domestic) or 90 days (international) but the bank must send interim updates every 20 days. |
| Provisional Credit | For electronic fund transfer (EFT) disputes ≤ PHP 10,000, Circular 1168 requires a provisional credit within 5 days after validation of basic facts. |
* While Circular numbers occasionally change, banks uniformly incorporate these service standards in their General Terms & Conditions; you can cite them back to the bank.
4. If the Bank Denies or Delays Your Claim
Elevate to the BSP Consumer Assistance Management System (CAMS)
- File online at https://www.bsp.gov.ph/consumercomplaints or walk-in at BSP head office.
- Attach the denial letter (or proof of inaction beyond the timeline) plus all evidence.
Small Claims or Regular Civil Action
- Small Claims Court (Rule [SC] of the 2022 Rules): monetary claims up to PHP 1 million; filing is simplified, no lawyer required.
- Beyond PHP 1 million or if you will also claim moral/exemplary damages, file an ordinary civil action under the Civil Code (Arts. 1170–1173 on breach of contractual diligence, Art. 2176 on quasi-delict).
Criminal Complaint
Unknown offender → PNP-ACG or NBI-Cybercrime for investigation.
Known offender (e.g., relative or bank employee) → Execute a Sinumpaang Salaysay and file with the Office of the City/Provincial Prosecutor for:
- Qualified Theft (Art. 310 RPC), or
- Violation of RA 8484 (imprisonment up to 20 years), and/or
- Computer-related Fraud under RA 10175.
5. Evidence & Burden of Proof
| Evidence Type | Who Holds It | How to Obtain |
|---|---|---|
| ATM camera footage | Acquiring bank / ATM owner | Formally request in writing; cite Data Privacy Act (DPA RA 10173) right to access personal data. Preserve within 30 days before CCTV auto-overwrites. |
| Transaction journal logs | Issuing bank | Included in dispute process; ask for redacted extract. |
| Mobile or SMS alerts | Consumer | Screenshot + affidavit of authenticity. |
| Expert forensic report (if skimming/phishing) | Third-party forensics | May be required in court; cost borne by complainant unless awarded as litigation expense. |
Tip: Even if the perpetrator is unidentified, you can win a civil case against the bank if you prove that the loss was more probably caused by a security or systems failure than by your negligence (see Land Bank v. CA, G.R. No. 145970, July 21 2021).
6. Criminal, Civil, and Administrative Liability Matrix
| Potential Defendant | Criminal Statute | Civil Liability | Administrative / Regulatory |
|---|---|---|---|
| Perpetrator | RA 8484, RA 10175, RPC Art. 310 | Restitution & damages | None |
| Bank employee | Same as perpetrator, plus RPC Art. 315 (Estafa) | Solidary liability with bank if in the course of employment | BSP sanctions, SEC if publicly listed |
| Bank / financial institution | None (corporate entities can’t be imprisoned) | Actual, moral, exemplary damages; attorney’s fees | Fines/suspension under BSP Circular 1324 s. 2024 and Consumer Act (RA 7394) |
7. Role of the Data Privacy Act (DPA RA 10173)
- Right to Access – You may demand copies of CCTV or system logs containing your personal data.
- Security Principle – Banks must implement “appropriate organizational, technical and physical measures”. A proven breach may trigger separate penalties from the National Privacy Commission (NPC), ranging from PHP 500 k to PHP 5 m per act.
8. Deposit Insurance & Recovery of Funds
- The Philippine Deposit Insurance Corporation (PDIC) covers bank closures, not unauthorized withdrawals.
- Recovery hinges on your dispute’s success. If the bank voluntarily credits the full amount, interest is computed from the date of loss at the bank’s savings-deposit rate, unless a court awards legal interest (currently 6 % per annum, per Nacar v. Gallery Frames, G.R. No. 189871, Aug 13 2013).
9. Cross-Border or Inter-Bank Cases
Where the ATM is abroad or the acquirer is a foreign bank:
- File the dispute with your issuing Philippine bank first.
- The bank will lodge a VISA/Mastercard/EFT switch network chargeback.
- Expect a 45–90 day network adjudication timeline. Provisional credit rules still apply under BSP Circular 1168 but may be reversed if the network rules favor the acquirer.
10. When to Hire a Lawyer
- Claims > PHP 1 million or with complex evidence (forensic experts, cross-border subpoenas).
- When you seek moral/exemplary damages (requires proof of bad faith or gross negligence).
- If the bank countersues for “contributory negligence”.
11. Preventive Measures & Best Practices
- Chip-based (EMV) cards only – all Philippine banks migrated in 2018, but disable mag-stripe where possible.
- Set daily ATM withdrawal limits (e.g., PHP 10 k) via mobile banking.
- Enable real-time SMS/email alerts for every withdrawal.
- Cover the keypad and inspect for skimmers before inserting your card.
- Use bank-owned ATMs inside branches rather than standalone kiosks.
12. Quick-Reference Checklist
| Timeline | Action | Statutory Basis |
|---|---|---|
| Day 0 | Lock card & account; collect digital proof | Bank T&Cs; prudent practice |
| Day 0-1 | File written dispute, police blotter | BSP Circular 1048 |
| Day 2 | Bank must acknowledge | BSP Circular 1048 |
| Day 5 | Provisional credit (EFT ≤ PHP 10 k) | BSP Circular 1168 |
| Day 20/40/90 | Bank must resolve | BSP Circular 1048 |
| After denial | File complaint with BSP CAMS (no fee) | BSP Charter RA 7653 §4 |
| Within 4 years | File civil suit (quasi-delict) | Civil Code Art. 1146 |
13. Sample Demand Letter (Essential Elements)
Date Bank Legal Department Re: Unauthorized ATM Withdrawal of PHP __ on __
Dear Sir/Madam:
- I am the depositor of Savings Account No. _____________.
- On [date/time] I discovered an unauthorized withdrawal of PHP ____ at ATM ID ____ located at ____. I was in possession of my card and never disclosed my PIN.
- Pursuant to BSP Circular 1048, I demand the immediate provisional credit and full reimbursement within 20 banking days, plus legal interest.
- Attached are my sworn statement, SMS alerts, and police blotter.
Kindly act within the prescribed period; otherwise I shall file a complaint with the BSP and initiate legal action to protect my rights.
Sincerely, [Name & Signature]
Conclusion
Navigating an unauthorized ATM withdrawal involves three simultaneous tracks: (1) the bank dispute governed by BSP rules, (2) possible criminal prosecution of the perpetrator, and (3) a civil or administrative claim to compel the bank to indemnify you. Acting swiftly, preserving documentary evidence, and understanding the statutory timelines are crucial. With the updated consumer-protection measures of 2023-2025, the odds of recovering your funds—and holding negligent parties accountable—are better than ever, provided you assert your rights methodically.