Here’s a practical, everything-you-need-to-know legal guide—Philippine context—on getting a refund for an unauthorized bank or e-wallet transaction. I’ll cover the legal framework, who’s liable (and when), what to do step-by-step, evidence you’ll need, timelines you can expect, escalation paths, and even a dispute-letter template. This is general information, not legal advice.

What counts as an “unauthorized transaction”?

You didn’t do it and you didn’t consent to it (no instruction, no benefit to you).
Common scenarios: account takeover (phishing/smishing/vishing), SIM-swap/OTP interception, stolen card used online, cloned/skimmed card at POS/ATM, merchant error (double charge), misdirected fund transfer, and insider fraud.

Legal & regulatory framework (Philippines)

Financial Consumer Protection Act (FCPA, R.A. 11765) – core statute protecting customers of banks, e-money issuers (EMIs), e-wallets, remittance and payment systems. Gives regulators (Bangko Sentral, SEC, IC) supervision, complaint handling, restitution and penalty powers. Establishes duties to treat customers fairly, keep systems secure, and resolve complaints promptly.
BSP regulations (applying to banks, EMIs, payment system operators):
- Consumer protection standards (fair treatment, disclosure, suitability, effective recourse).
- Risk management & fraud/operational resilience (including incident response, transaction monitoring, and strong customer authentication).
- E-money and digital payments rules (covering GCash, Maya, bank apps, InstaPay/PESONet).
- Complaint handling & redress requirements (acknowledge, investigate, decide, and document).
Access Devices Regulation Act (R.A. 8484) – criminalizes credit/debit card fraud and access device offenses.
Cybercrime Prevention Act (R.A. 10175) – penalizes computer-related fraud and illegal access; authorizes preservation of electronic evidence.
Electronic Commerce Act (R.A. 8792) – recognizes electronic documents & signatures; relevant for evidence.
Anti-Money Laundering Act (R.A. 9160, as amended) – supports tracing/recovery of proceeds; banks must report suspicious transactions.
SIM Registration Act (R.A. 11934) – aids attribution in SIM-swap/OTP-theft cases.
Civil Code – bases for damages (negligence, quasi-delict) and unjust enrichment.
Reversal vs. insurance: PDIC insurance covers bank failure, not unauthorized transactions.

Liability: who bears the loss?

Think in three buckets:

Bank/EMI liability (common cases)

The institution is typically responsible when security controls fail (e.g., card skimming due to poor POS controls, account accessed without valid, bank-accepted authentication, or a system/operational error).
If the bank can’t show the transaction was properly authenticated under its rules (right credentials, device binding, 2FA, risk checks), the presumption leans toward refund/reversal.

Consumer liability (exceptions)

Gross negligence or fraud by the customer can shift or share loss: e.g., voluntarily giving OTP/PIN to a scammer, writing the PIN on the card, publicly posting credentials, jailbreaking devices used to bank, ignoring explicit security warnings.
Even then, institutions must prove the negligence caused the loss and that their own controls were adequate.

Shared liability/merchant error

For card-not-present transactions (online), schemes (Visa/Mastercard/JCB/Amex) have chargeback rules; liability can shift between merchant/acquirer and issuer depending on authentication (e.g., 3-D Secure) and evidence.
For fund transfers (InstaPay/PESONet/e-wallet), rules allow trace, freeze, and return if funds remain; if already withdrawn and the recipient is a fraudster, recovery may require law-enforcement and civil/criminal action.

What you must do immediately (the “golden hours”)

Freeze access
- Call your bank/e-wallet hotline; report unauthorized activity; request immediate blocking of the card/account credentials and app access; ask for a password reset and device de-registration.
Dispute the transaction(s)
- Get a case/reference number. Request the bank’s Dispute/Chargeback Form (cards) or Unauthorized EFT Form (transfers).
Preserve evidence
- Screenshots of SMS/email alerts, app logs, transaction details, suspicious links, caller numbers, device info, and your location at the time (if available).
File a police/NBI report (especially for phishing/SIM-swap or large losses).
- PNP Anti-Cybercrime Group (ACG) or NBI-CCD; keep the blotter/complaint copy.
Tell your telco (for SIM-swap/OTP issues) and NTC if your number was compromised.
Check recipient details
- If you see the recipient account/e-wallet, ask the bank to initiate a trace/hold request via the receiving institution.

How banks/e-wallets investigate (what they look for)

Authentication: Was the login or payment authenticated per their standard (device binding, biometrics/OTP, 3-D Secure for cards)? Was there impossible travel or unusual device/IP?
Telemetry: New device? New location? Multiple failed attempts?
Customer conduct: Any sign the customer disclosed OTP/PIN/passcode? (They may review call/SMS/email transcripts you provide.)
Merchant/acquirer logs (cards) or receiving bank data (transfers): AVS/CVV/3-DS results, timestamps, IPs, delivery addresses.
System defects: Outages or control gaps at the time.

Timelines: what to realistically expect

Acknowledge quickly (often same day to a few business days) and provide a case ID.
Provisional credit: Some institutions grant it for card disputes while investigating; others wait for merchant/acquirer response.
Resolution: Straightforward cases can close in ~10–15 business days; cross-bank traces/chargebacks and complex fraud can take up to several billing cycles (cards) or weeks (fund transfers), especially if funds moved across multiple wallets/accounts.
You’re entitled to status updates and a written final response explaining the decision and your appeal options.

Tip: Ask your bank to confirm in writing whether it accepts that the transaction was “properly authenticated.” If they can’t, that supports your refund claim.

How to maximize your chances of refund

Act fast (report immediately). Delay can be cited as contributory negligence.
Be precise: Identify each disputed item (date/time, amount, merchant/recipient, reference no.).
Provide a timeline: What you were doing, devices you used, and when you noticed alerts.
Show your hygiene: Proof you didn’t share OTP/PIN, you use unique passwords, you enabled biometrics, etc.
Preserve devices: Don’t factory-reset before you’ve captured screenshots/logs.
Escalate politely but firmly when deadlines slip.

Special situations

Phishing/smishing/vishing (OTP theft): If you typed an OTP after being deceived, banks may argue customer negligence. Counter with: social-engineering sophistication, lack of adequate real-time warnings, or unusual-pattern detection that should’ve blocked the transaction.
SIM-swap: Provide telco records (SIM change time). If the swap preceded the transactions, it supports your claim.
Card-present skimming: Typically bank liability; emphasize EMV use, your card custody, and merchant location.
Misdirected transfer (typo in account no.): If you initiated it, refund is not guaranteed; still request a recall. If a platform auto-filled a wrong recipient due to its error, push for reversal.
Inside-job fraud (merchant/agent): File criminal complaint; seek bank cooperation and AML tracing.

Escalation paths if the bank denies or delays

Internal appeal within the bank (ask for a written final response).
Bangko Sentral ng Pilipinas (BSP) – file a complaint with the BSP’s financial consumer protection channel. Under the FCPA, BSP can require corrective action or restitution and impose penalties.
Card network (for credit/debit card disputes) – ensure your bank actually raised a chargeback within network time limits.
Law enforcement – PNP-ACG or NBI-CCD for criminal pursuit; attach bank’s denial and evidence.
Civil action – claim damages under the Civil Code (plus attorney’s fees, interests).
Other regulators – If it’s non-bank lending or securities, you may need SEC; for insurance-linked instruments, the Insurance Commission. (Most retail banking/e-wallet issues fall under BSP.)

Evidence checklist (attach copies, keep originals)

Dispute form + your sworn statement/affidavit
ID, account/card details (masked)
App/online banking screenshots and alerts
SMS/email headers or full thread (with timestamps)
Device info (model, OS version) and whether rooted/jailbroken (ideally not)
Location history (if enabled)
Police/NBI report and telco ticket (for SIM-swap)
Any merchant correspondence (refund emails, delivery proof)
Reference numbers from bank hotlines and receiving bank trace tickets

Practical step-by-step playbook

Day 0 (discovery): Call hotline → freeze/replace credentials → get Case ID → request dispute form → compile screenshots.
Day 0–1: File written dispute (email/branch/app), ask for provisional credit (if card), ask for expected timelines and named case handler.
Within the first week: File police/NBI complaint (if fraud), telco report (SIM-swap), request transaction logs and authentication proof from bank.
Week 2–6: Follow up weekly in writing; if cross-bank, ask whether a recall/hold was sent to the receiving institution and when they responded.
If denied or overdue: Request a final response letter, then escalate to BSP with full documentation.

Your rights under the FCPA (in plain language)

To be treated fairly and not blamed without basis.
To clear, full information about what happened and how the bank authenticated the transaction.
To effective recourse: a free, accessible complaints process, with written decisions and reasons.
To restitution when the institution (or its systems/agents) is at fault.
To data privacy and secure handling of your information.

Common bank defenses (and how to respond)

“OTP was used, so it’s authorized.” → Not automatically. Ask the bank to show how the login/payment was risk-scored, device-bound, and whether there were red flags (new device, location jump, multiple attempts).
“Our system shows successful 3-D Secure.” → Request the 3-DS data (challenge vs. frictionless, device/IP). If a mule used your number via SIM-swap, 3-DS success may still be account takeover, not consent.
“You delayed reporting.” → Provide your alert timeline; many victims only see statements later.
“You shared your OTP.” → If social engineering overcame ordinary caution, argue no gross negligence and point to the bank’s duty to implement contextual fraud controls and real-time warnings.

Criminal & civil actions (if needed)

Criminal: Estafa (Art. 315 RPC), access device fraud (R.A. 8484), computer-related offenses (R.A. 10175). These support restitution and asset freezes.
Civil: Claim actual, moral, and exemplary damages if the bank’s negligence or refusal to refund is proven; attorney’s fees and interest may be recoverable.

Template: Dispute / Refund Request (you can paste & customize)

[Date]

[Bank/EMI Name]
Attention: [Consumer Assistance / Dispute Resolution]
[Email/Address]

Re: Dispute of Unauthorized Transaction(s); Request for Refund
Account/Card/Wallet No.: [XXXX-XXXX-1234]
Case/Reference No.: [if any]

I am disputing the following transaction(s) as unauthorized:
• Date/Time: [YYYY-MM-DD HH:MM], Amount: [PHP], Reference: [#], Merchant/Recipient: [name]
• [repeat as needed]

Facts:
• I did not initiate, authorize, or benefit from these transactions.
• I discovered them on [date/time] via [app alert/SMS/email/statement].
• I immediately reported and requested blocking at [time], Case ID: [if any].
• My device(s): [model/OS]; I did not share my PIN/OTP/password. [If SIM-swap/phishing suspected, describe.]

Requests:
1) Immediate reversal/refund and, if applicable, **provisional credit** pending investigation.
2) Copies of authentication and transaction logs (device ID/IP, 3-D Secure/OTP records).
3) Status updates and a written final response per the Financial Consumer Protection Act.

Enclosures: ID, dispute form, screenshots, police/NBI report [if any], telco report [if any], other evidence.

Sincerely,
[Name]
[Contact details]

FAQs

Do I need a police report? Not strictly required to start a dispute, but very helpful for fraud cases and for escalation.

What if the recipient withdrew the funds already? Recovery becomes harder, but still push for chargeback/trace and pursue criminal complaints to pressure the receiving bank to identify the account holder and assist.

Does PDIC repay me? No. PDIC covers bank failure, not unauthorized transactions.

Are e-wallets covered? Yes—BSP-supervised EMIs are covered by the FCPA and BSP consumer-protection rules.

Can the bank refuse because I clicked a phishing link? Clicking a link isn’t, by itself, gross negligence. The question is whether the bank’s authentication and fraud controls should have flagged/blocked the transaction and whether you knowingly gave away secure credentials.

If you’d like, tell me your situation (bank/e-wallet, amounts, how it happened, what you’ve filed so far), and I’ll draft a tighter, evidence-based letter and escalation plan you can use right away.