An unfamiliar debit from a foreign merchant can be alarming, especially when the merchant name is unclear, the amount is in another currency, or the bank says the transaction was authenticated. The most important steps are to secure the account immediately, report the transaction through the bank’s official fraud channel, submit a written dispute using the correct reason, and preserve evidence. Philippine banking rules require banks to investigate alleged unauthorized transactions fairly, provide accessible reporting channels, and inform customers of the investigation result.

First, identify what kind of transaction appeared

Not every unfamiliar bank entry is the same. The correct dispute process depends on how the money was taken.

Transaction shown on the account	What it may be	Appropriate action
Pending card authorization	A temporary hold that has not yet been finally posted	Report it immediately, lock the card, and ask whether the bank can stop or monitor the authorization
Posted debit-card purchase	A completed card payment to a merchant	File an unauthorized transaction or card purchase dispute
Recurring or subscription debit	A merchant used previously stored card details	Cancel with the merchant and dispute later charges under the correct recurring-payment category
Direct debit from the deposit account	A debit arrangement based on an account mandate	Ask the bank for the mandate, enrollment records, and transaction instructions
Electronic account-to-account transfer	Money was transferred to another financial account	Report it as an unauthorized fund transfer and ask whether the Anti-Financial Account Scamming Act procedures apply
Duplicate, inflated, or incorrectly converted charge	The purchase was authorized, but the amount is wrong	Dispute the amount, duplication, currency conversion, or processing error—not the entire transaction as fraud
Merchant refund not received	The merchant claims to have reversed the payment	Request the refund reference or acquiring-bank trace number and file a credit-not-processed dispute

A foreign-looking description does not always mean the seller is based in that country. The statement may show the name or location of a payment processor, marketplace, subscription platform, or merchant acquiring bank rather than the brand the customer recognizes.

Before declaring the transaction fraudulent, check:

Recent online purchases and free trials
App Store, Google Play, gaming, streaming, travel, and cloud subscriptions
Purchases made by authorized supplementary cardholders or family members
Digital wallets where the card was previously saved
Merchants that bill under a parent company or payment facilitator
Purchases converted from another currency
Delayed charges from hotels, transportation companies, or rental services

Do not delay reporting while investigating privately. A customer can tell the bank that the transaction is unfamiliar and that confirmation is still being obtained.

Your rights under Philippine banking law

Financial consumer protection rights

The principal law is Republic Act No. 11765, or the Financial Products and Services Consumer Protection Act of 2022. It applies to financial products and services such as deposit accounts, payment services, debit cards, credit cards, electronic banking, and digital financial transactions.

The law recognizes a financial consumer’s rights to:

Fair and equitable treatment
Disclosure and transparency
Protection of financial assets against fraud and misuse
Protection of personal and financial information
Timely handling and redress of complaints

Every regulated financial service provider must maintain a Financial Consumer Protection Assistance Mechanism, commonly called an FCPAM. This is the bank’s internal process for receiving, investigating, and resolving complaints without charging the consumer a complaint-handling fee.

For an alleged unauthorized transaction, the law directs the provider to suspend applicable interest, fees, and charges while the dispute is under final investigation or to provide another reasonable accommodation. This does not automatically require an immediately withdrawable provisional credit in every case, but it gives the customer a legal basis to request protection from accumulating charges while the bank investigates.

A bank’s account terms cannot validly require a consumer to waive fundamental rights such as the right to receive information, have a complaint addressed, protect personal data, or pursue an available legal remedy.

BSP rules for unauthorized transactions

BSP Circular No. 1160, Series of 2022 implements the financial consumer protection framework for BSP-supervised institutions.

For fraud and unauthorized transaction complaints, a bank must:

Maintain free and active reporting channels available 24 hours a day, seven days a week
Immediately provide written acknowledgment of a report
Assist the customer and provide relevant information about the transaction
Explain the actions the customer and the bank should take
Evaluate the claim fairly and reasonably
Give priority to fraud-related concerns
Take reasonable measures to protect the customer’s account and remaining funds

The complaint should generally be filed with the originating financial institution—for example, the Philippine bank that issued the debit card or maintained the account. Under BSP rules, that institution is primarily responsible for handling the customer’s dispute, even when the merchant or acquiring bank is abroad.

Pending investigation, the bank should suspend applicable interest, fees, and charges, hold disputed funds that remain intact when legally and operationally possible, or provide another reasonable accommodation. BSP Circular No. 1160 mentions accommodations such as a non-withdrawable provisional credit or temporary hold, but the exact measure depends on the transaction and investigation.

After the investigation is concluded, the bank must formally notify the customer of the result within three banking days. If the transaction is confirmed to be fraudulent or unauthorized, the bank should correct or reverse the transaction and related charges or make the appropriate provisional credit permanent. The three-banking-day rule runs from the conclusion of the investigation; it is not a universal deadline requiring every investigation to finish within three days.

Banks must exercise a high degree of diligence

Philippine Supreme Court decisions repeatedly recognize that banks must exercise the highest or extraordinary degree of diligence because banking is affected with public interest.

In Banco de Oro Universal Bank, Inc. v. Seastres and Benaje, G.R. No. 257151, February 13, 2023, the Supreme Court held a bank liable after finding that it failed to follow its own safeguards and contractual procedures. The decision did not involve an ordinary cross-border debit-card purchase, but it reinforces an important principle: a bank cannot rely only on general denials when its own controls, records, or procedures may have failed. Read the Supreme Court decision. (Supreme Court E-Library)

In Spouses Ermitaño v. Court of Appeals and BPI Express Card Corporation, G.R. No. 127246, April 21, 1999, the Court rejected an excessively one-sided card provision and emphasized the significance of prompt notice after the loss of a card. Although the case involved a credit card under older rules, it remains useful in understanding why immediate reporting and fair contract terms matter. Read the Supreme Court decision. (Supreme Court E-Library)

What to do immediately after discovering the debit

1. Secure the card, account, and connected devices

Use the bank’s official mobile application, website, hotline, or branch to:

Temporarily lock or permanently block the debit card
Disable online, international, contactless, and cash-withdrawal functions when available
Request a replacement card with a new number
Ask the bank to revoke merchant tokens linked to the old card
Change the online banking password
Change the password of the email account connected to the bank
Sign out of unknown devices and remove unfamiliar digital wallets
Reset the PIN if compromise is suspected

Do not call a telephone number contained in an unexpected text message or email. Obtain the hotline from the back of the physical card, the bank’s official application, or its official website.

Blocking the physical card may not always remove a merchant’s stored payment token. Specifically ask whether the bank can disable card-on-file credentials, recurring payment tokens, and mobile-wallet tokens associated with the compromised card.

2. Report the transaction through the bank’s fraud channel

Report the debit immediately, even if it is still pending.

Obtain and save:

Complaint or case reference number
Date and exact time of the report
Name or employee number of the representative
Channel used
Instructions provided by the bank
Date by which the bank expects documents

Ask for written acknowledgment by email, secure message, or text. BSP rules require active 24/7 reporting channels and immediate written acknowledgment of fraud or unauthorized transaction reports.

3. Ask for the transaction’s technical details

The description on the statement may not be enough to identify the transaction. Ask the bank for information it can lawfully disclose, including:

Full merchant descriptor
Merchant’s registered or acquiring location
Date and time of authorization
Date the transaction was posted
Original transaction currency
Original amount and Philippine peso amount
Exchange rate and foreign transaction fees
Merchant category code
Authorization or retrieval reference number
Whether it was card-present or card-not-present
Whether a chip, magnetic stripe, contactless tap, PIN, OTP, or 3-D Secure process was used
Whether the transaction was marked recurring
Whether a digital-wallet or network token was used
Whether the merchant submitted proof of delivery, login, or device information

The bank may not release confidential information belonging to another person, but it should provide enough information for the customer to understand and respond to the disputed debit.

4. File a written dispute using the correct reason

The dispute category must match what actually happened.

Use unauthorized transaction or fraud when:

You did not make or approve the purchase
You did not give the card details, PIN, OTP, or banking credentials to another person
You did not receive or benefit from the goods or services
No authorized user made the purchase

Use canceled recurring transaction when:

You previously authorized the merchant
You later canceled the subscription or payment authority
The merchant charged the card again after cancellation

Use goods or services not received when:

You made the purchase
The merchant failed to deliver

Use not as described, duplicate processing, incorrect amount, or credit not processed when those descriptions are accurate.

Card-network chargeback rules distinguish among these situations. A bank may reject a dispute that is filed under the wrong category even when the customer has a valid complaint under another category. Mastercard’s current chargeback guide, for example, uses different requirements and evidence for different dispute reasons. (Mastercard)

Never sign an affidavit saying the transaction was wholly unauthorized when you actually entered the card information, approved an OTP, accepted a free trial, or previously authorized recurring billing. Explain the facts accurately and let the bank determine the applicable dispute category.

5. Ask for account protection while the case is pending

In the written complaint, request:

Suspension of fees, penalties, and interest connected with the disputed amount
Reversal or suspension of related overdraft or insufficient-funds charges
Provisional credit, when appropriate
Confirmation that the disputed amount will not negatively affect the account’s standing
Written notice before any provisional credit is withdrawn
Continued blocking of further transactions from the merchant

The bank may offer a temporary credit that cannot yet be withdrawn or may impose another protective arrangement while verification is ongoing. The remedy depends on the bank’s investigation and the type of transaction.

6. Contact the merchant when safe and useful

Contacting the merchant can help when:

The descriptor is merely unfamiliar
The debit arose from a subscription or free trial
The amount was duplicated or incorrect
The merchant promised a refund
The bank requests proof that the issue was first raised with the merchant

Use email or another written channel. Save the merchant’s reply, cancellation confirmation, refund reference, and screenshots.

Do not give the merchant another OTP, full card number, PIN, CVV, online banking password, or remote access to a device. A legitimate merchant does not need those credentials to process a refund.

When the card is clearly compromised or the merchant appears fraudulent, contacting the merchant should not delay the bank report.

7. Preserve evidence

Keep the following in one folder:

Bank statement or transaction screenshot
Written bank complaint and acknowledgment
Complaint reference number
Merchant emails and chat records
Order history
Subscription cancellation confirmation
Refund receipt or reference number
Screenshots of the merchant’s website and terms
Travel records showing where you were
Device security alerts
Login history and unusual IP or device notices
Text messages and emails containing OTPs or alerts
Police or NBI report, if obtained
Chronological account of events

Screenshots should show the date, time, website address, and relevant account information where possible. Preserve the original electronic files rather than relying only on cropped images.

Suggested wording for a bank dispute

A written dispute can be brief but specific:

I dispute the debit of PHP [amount], originally charged as [foreign amount and currency], posted on [date] under the merchant descriptor “[descriptor].” I did not make, authorize, participate in, or benefit from this transaction. My card was in my possession, and I did not provide my PIN, OTP, CVV, password, or banking credentials to any person in connection with this transaction.

I reported the transaction on [date and time] under reference number [number]. Please block further transactions, replace the compromised card, investigate the authentication and merchant records, suspend charges related to the disputed amount, and provide the written investigation result and basis for the decision.

Modify the statement when the facts involve a canceled subscription, undelivered purchase, duplicate debit, or merchant refund. Accuracy is more important than using forceful language.

Documents the bank may request

Document	Why it may be needed
Signed dispute form	Provides the formal transaction details and dispute reason
Government-issued ID	Verifies the account holder
Bank statement or transaction screenshot	Identifies the exact debit
Written narrative or affidavit	Records the customer’s account under oath when required
Card possession declaration	Helps show that the physical card was not lost
Cancellation proof	Supports a recurring-payment dispute
Merchant correspondence	Shows attempts to clarify, cancel, or obtain a refund
Order, shipping, or service records	Helps determine whether the customer received a benefit
Police or NBI report	Supports serious fraud cases but is not automatically required for every dispute
Proof of location or travel	May help when the transaction was supposedly made elsewhere
Authorization for a representative	Allows another person to handle the complaint

Do not write the PIN, CVV, password, or complete OTP in the complaint. When showing an OTP message, redact the actual code unless the bank provides a secure method and specifically explains why it is needed.

An affidavit is not automatically necessary in every case, but some banks require one for significant claims or particular dispute categories. Ask whether notarization is required before paying for it.

How the bank investigates an unauthorized debit

The investigation may examine:

Whether the transaction used the physical card, chip, PIN, contactless function, or magnetic stripe
Whether an OTP or 3-D Secure authentication was completed
Device identifiers, login history, IP addresses, and geolocation
Whether the card was stored in a digital wallet
Whether the merchant had a previous relationship with the customer
Subscription and recurring-payment indicators
Shipping address, recipient, email, or account used for the purchase
Timing of the customer’s report
Security alerts sent by the bank
The customer’s actions before and after the transaction
Whether the bank, its personnel, agents, or service providers followed required controls
Whether the bank’s fraud detection systems identified unusual activity

BSP rules allow liability to be assessed in light of the consumer’s conduct, the conduct of the bank and its service providers, and any failure by the bank to comply with applicable requirements. Liability is therefore evidence-based and cannot always be decided solely from the transaction description.

Does an OTP automatically defeat the dispute?

No single authentication record should replace a full investigation.

An OTP may support the bank’s position that the transaction passed an authentication step, but further questions remain:

Was the OTP sent to the correct registered number?
Was a SIM replacement or account takeover involved?
Did malware or remote-access software compromise the device?
Was the OTP entered by the customer after deception?
Did the bank’s fraud systems detect an unusual merchant, country, amount, or device?
Did the transaction use a stored token rather than a newly entered OTP?
Did the bank follow its own security and notification procedures?

If the customer personally entered an OTP after being deceived by a scammer, the bank may argue that the transaction was customer-authorized or enabled through social engineering. That does not eliminate the bank’s duty to investigate, but it can materially affect liability.

Card dispute, chargeback, and criminal complaint are different processes

A chargeback is a card-network procedure. The Philippine issuing bank submits the dispute through the card network to the merchant’s acquiring bank. The merchant may respond with transaction records, after which the dispute is decided under applicable network rules.

A chargeback is not the same as:

A merchant refund
A court case
A BSP complaint
A police or NBI criminal investigation

These processes can proceed separately. Filing a police report does not automatically return the money, and a card dispute does not prosecute the offender.

Network deadlines vary according to the transaction type, dispute reason, and date of discovery. Do not assume that every case has the same 60-, 90-, or 120-day period. Some network procedures may continue for months, but the customer should notify the issuing bank immediately because the bank may need time to satisfy earlier internal and network deadlines. (Mastercard)

When the Anti-Financial Account Scamming Act may apply

Republic Act No. 12010, or the Anti-Financial Account Scamming Act of 2024, strengthened protections against money muling, social engineering, and fraudulent financial account activity. It requires institutions to maintain fraud management systems, appropriate controls, and mechanisms such as multi-factor authentication. An institution may be required to make restitution when its failure to employ adequate systems or the required degree of diligence caused the loss; a criminal conviction is not always a prerequisite to restitution. (Lawphil)

The law also permits temporary holding of disputed funds for up to 30 days under qualifying circumstances.

However, the implementing framework under BSP Circular No. 1215, Series of 2025 is primarily directed at electronic transfers from one financial account to another. Ordinary card purchases may instead be handled mainly through the card-dispute and chargeback process. A customer should ask the bank whether the transaction was routed as a merchant card purchase, an automated clearing house transfer, or another form of electronic fund transfer before relying on the temporary-hold provisions.

What to do if the bank denies the dispute

A denial should not be the end of the inquiry. Request a written final response stating:

The exact reason for denial
The dispute category used
The authentication method relied upon
Whether the merchant submitted evidence
Whether the transaction was recurring or tokenized
Whether the bank filed a card-network chargeback
The chargeback reason code, when disclosure is allowed
Which account terms or rules were applied
Whether reconsideration is available
The date the investigation was concluded

Respond point by point. For example:

If the bank says an OTP was used, explain whether you received or entered it.
If the merchant submitted proof of delivery, identify why the recipient, address, device, or email is not yours.
If the bank says the transaction was recurring, submit the cancellation confirmation.
If the merchant claims a prior relationship, distinguish earlier legitimate purchases from the disputed charge.
If the bank says the complaint was late, provide the date you first discovered the debit and explain why it was not reasonably discoverable earlier.

Do not rely only on repeated hotline calls. Submit the reconsideration in writing and retain proof of delivery.

How to escalate the complaint to the Bangko Sentral ng Pilipinas

The customer must generally first use the bank’s FCPAM. If the bank does not respond adequately, rejects the dispute without satisfactory explanation, or fails to act, the complaint may be escalated through the BSP Consumer Assistance Mechanism, or BSP-CAM.

Current BSP channels include:

BSP Online Buddy, or BOB
Consumer complaint email: consumeraffairs@bsp.gov.ph
BSP consumer assistance direct line: (02) 5306-2584
Postal or walk-in submission using the BSP Consumer Information and Request Form

The complaint should include:

A concise chronology
The disputed amount and transaction details
The resolution requested
The bank complaint reference
A copy of the complaint filed with the bank
The bank’s final response, if any
Supporting documents
Current contact information

The BSP maintains a directory of consumer assistance channels of BSP-supervised institutions, updated as of March 10, 2026. (Bangko Sentral ng Pilipinas)

Typical BSP timelines

Stage	Indicative procedure or timeline
Bank-level complaint	No single fixed duration applies to every investigation; the result must be sent within three banking days after the investigation concludes
Initial BSP-CAM process	Commonly approximately 55–65 days
Bank’s answer in BSP-CAM	Generally 15 days
Consumer reply	Generally within 30 days
Bank rejoinder	Generally within 10 days
Further consumer reply	Generally within 10 days
BSP mediation	Often approximately 50–60 days overall; the formal mediation period is generally 30 days unless extended by agreement
BSP adjudication	Commonly approximately 180–240 days, or six to eight months

These are procedural estimates, not guaranteed completion dates. Delays may result from incomplete documents, requests for transaction records from an overseas acquiring bank, card-network deadlines, merchant responses, technical verification, or settlement discussions.

BSP adjudication for monetary claims

If conciliation or mediation does not resolve the complaint, BSP adjudication may be available for a claim that is:

Purely civil in nature
Directed against a BSP-supervised financial institution
Solely for payment or reimbursement of money
Not more than ₱10 million, excluding damages and attorney’s fees

The customer does not always need a lawyer, although legal assistance may be useful in a complex or high-value case. BSP’s adjudication process commonly takes six to eight months.

Special issues when the merchant is abroad

Currency conversion losses

A successful reversal may not exactly match the peso amount originally debited. The original purchase and the reversal may be converted on different dates and at different exchange rates.

Ask the bank to explain:

The original exchange rate
The reversal exchange rate
Foreign transaction fees
Whether the dispute includes related fees
Whether any exchange-rate difference can be adjusted

Merchant location and legal identity

A statement may identify only a processor or payment facilitator. Ask for the merchant descriptor and acquiring-country information before attempting to locate the business.

When the merchant operates through a marketplace, file the complaint with both:

The marketplace or payment platform
The Philippine issuing bank

The platform’s buyer-protection deadline may be shorter than the bank’s process.

Documents in another language

A bank may initially accept screenshots or correspondence in the original language with an informal English explanation. For mediation, adjudication, or court use, a certified translation may later be required, especially when the meaning is disputed.

Customers living outside the Philippines

A Filipino account holder abroad or a foreign customer of a Philippine bank can normally submit the bank complaint and BSP-CAM documents electronically. A lawyer is not required merely to begin BSP-CAM. A representative may act with written authorization, while formal mediation or adjudication may require a special power of attorney.

When a special power of attorney is signed abroad, the receiving bank or agency may require it to be notarized and apostilled in the country where it was executed, or acknowledged before a Philippine consular officer, depending on the country and intended use. Confirm the required form before execution because an incorrectly authenticated document can delay the case.

When to report the matter to law enforcement

Consider filing a report with the Philippine National Police Anti-Cybercrime Group or the National Bureau of Investigation Cybercrime Division when:

Multiple accounts were compromised
Identity theft occurred
A SIM swap or email takeover is suspected
The customer was deceived into installing remote-access software
The transaction involved phishing, social engineering, or a fake bank representative
A substantial amount was taken
The bank or BSP requests a police report
Personal information appears to be used repeatedly

Potentially relevant laws include:

Republic Act No. 8484, the Access Devices Regulation Act of 1998
Republic Act No. 10175, the Cybercrime Prevention Act of 2012
Republic Act No. 12010, the Anti-Financial Account Scamming Act of 2024
Relevant fraud provisions of the Revised Penal Code

A criminal complaint is directed against the offender. The bank dispute remains necessary to obtain reversal or reimbursement through the financial system.

Common mistakes that weaken a dispute

Waiting for the next statement before reporting
Reporting only by telephone and keeping no written record
Calling a fake hotline from a phishing message
Describing a canceled subscription as a completely unknown merchant
Claiming no OTP was involved without checking messages and device history
Deleting merchant emails, browser history, or security alerts
Sending the bank screenshots with no dates or context
Continuing to use the compromised card
Accepting a merchant’s promise of a refund without obtaining a reference number
Missing a bank deadline for the dispute form
Filing with BSP before giving the bank a reasonable opportunity to handle the complaint
Assuming that the merchant’s foreign location excuses the Philippine bank from investigating
Posting complete account or card details publicly on social media

Frequently Asked Questions

Can I dispute a foreign merchant charge through my Philippine bank?

Yes. File the dispute with the Philippine bank that issued the debit card or maintained the account. Under BSP rules, the originating financial institution is primarily responsible for handling the complaint, even when the merchant’s acquiring bank is abroad.

Must I contact the foreign merchant before filing a bank dispute?

Not when the transaction is clearly unauthorized. Report it to the bank immediately. For a subscription, duplicate charge, undelivered purchase, or missing refund, written merchant correspondence can strengthen the case, but it should not delay account protection.

Can the bank deny my claim because an OTP was used?

The bank may treat OTP use as important evidence, particularly when the OTP was entered by the customer. However, the bank should still investigate the surrounding facts, including account takeover, SIM compromise, device access, social engineering, transaction risk indicators, and whether its controls operated properly.

What if I previously bought from the merchant?

A prior legitimate purchase does not automatically authorize every later charge. Identify which earlier transactions were valid and explain why the disputed debit was not authorized. Check whether the merchant treated the charge as recurring or used a stored card token.

Can I dispute a charge after canceling a subscription?

Yes, when the charge occurred after a valid cancellation or outside the agreed subscription terms. Submit the cancellation confirmation, relevant terms, and merchant correspondence. Classify it as a canceled recurring transaction rather than claiming that you never knew the merchant.

How long does a bank dispute take?

There is no single investigation period for every card dispute. Cases involving a foreign merchant can require communication through the card network and overseas acquiring bank. BSP rules require the bank to notify the customer within three banking days after the investigation is concluded. A later BSP-CAM escalation commonly takes approximately 55–65 days, while adjudication may take six to eight months.

Is the bank required to refund the money immediately?

Not automatically. The bank must investigate and may provide reasonable accommodations, such as suspending related charges or providing a form of provisional credit. A final reversal generally depends on the evidence and investigation result.

Do I need a police report or notarized affidavit?

Not for every dispute. The bank may request an affidavit or police report depending on the amount, transaction type, or suspected criminal conduct. Ask for the requirement in writing before arranging notarization.

Can I complain to BSP while living abroad?

Yes. BSP-CAM complaints can be filed through online and email channels. A representative may also assist with written authority, although a special power of attorney may be required for formal stages such as mediation or adjudication. (Bangko Sentral ng Pilipinas)

Can I recover foreign transaction fees and other charges?

Request reversal of all charges directly connected with the unauthorized transaction, including foreign transaction fees, overdraft charges, and related penalties. Whether every amount is recoverable will depend on the investigation, account terms, exchange-rate treatment, and applicable rules.

Key Takeaways

Lock the card and secure the bank account, email, and connected devices immediately.
Report the debit through the Philippine issuing bank’s official fraud channel and obtain written acknowledgment.
Identify whether the transaction is fraud, recurring billing, a duplicate, an incorrect amount, undelivered goods, or a missing refund.
Submit a written dispute with precise facts and the correct dispute category.
Ask for transaction authentication details, merchant information, suspension of related charges, and appropriate provisional protection.
Preserve statements, messages, cancellation records, device alerts, merchant correspondence, and complaint reference numbers.
A foreign merchant’s location does not remove the Philippine bank’s duty to investigate fairly.
Request the bank’s written reasoning and evidence if the claim is denied.
Escalate an unresolved complaint through BSP-CAM after using the bank’s internal FCPAM process.
Act immediately because bank and card-network deadlines vary according to the transaction and dispute reason.