Unauthorized deductions—sometimes called “unauthorized transactions,” “unrecognized charges,” or “fraudulent debits”—happen when money leaves your bank account, credit/debit card, or e-wallet without your valid consent. In the Philippines this can arise from outright fraud (stolen credentials, SIM-swap, phishing), merchant error, or “negative-option” billing where a service renews or bills you without proper authorization.

This article explains your rights under Philippine law and regulation, the duties of banks and e-money issuers, and the step-by-step remedies you can take.

1. What Counts as an Unauthorized Deduction?

An unauthorized deduction is any transfer, payment, or debit that you did not approve or that was processed without complying with required security and consent rules. Examples:

Unknown merchant charge on a debit/credit card.
E-wallet cash-out or transfer you never initiated.
Bill payment or online purchase made using stolen OTPs, passwords, or biometrics.
Subscription renewals or in-app purchases billed without clear consent.
ATM withdrawals after card cloning or PIN compromise.
“Floating” or duplicate transactions (you get debited once or more but the merchant doesn’t receive payment).
Account takeover caused by phishing links, fake customer support, malware, or SIM-swap.

Key idea: If you didn’t knowingly and validly authorize it, treat it as unauthorized—even if the system shows it came from your account.

2. The Philippine Legal and Regulatory Framework

Unauthorized deductions are addressed through a mix of statutes and financial-sector regulations.

2.1 Consumer and Financial Protection Rules

Philippine financial consumer protection is built on these principles:

Fair treatment and transparency
Security of funds
Efficiency in dispute resolution
Accountability for system failures
Proportionate allocation of risk

Banks and e-money issuers must maintain complaint channels, investigate, and provide timely resolution.

2.2 Banking and E-Money Oversight

Banks operate under BSP (Bangko Sentral ng Pilipinas) supervision.
E-wallets / e-money issuers (EMIs) are also regulated by BSP and must follow strict rules on safeguarding, dispute handling, and cybersecurity.

2.3 Data Privacy and Cybercrime Laws

Unauthorized deductions often involve illegal access or identity theft. Relevant laws include:

Data Privacy Act of 2012 (RA 10173) Requires personal information controllers (including banks/EMIs) to keep your data secure, notify about breaches where required, and apply reasonable organizational/technical safeguards.
Cybercrime Prevention Act of 2012 (RA 10175) Covers hacking, illegal access, identity theft, phishing, online fraud, and computer-related forgery.
Access Devices Regulation Act (RA 8484) Penalizes credit card fraud, possession of counterfeit access devices, and unauthorized use.
Electronic Commerce Act (RA 8792) Recognizes electronic transactions and signatures; emphasizes validity of consent and accountability for e-transactions.

2.4 Civil Code Obligations

If money was taken without authorization, you can demand restitution under:

Solutio indebiti (payment by mistake must be returned).
Unjust enrichment (no one should benefit at another’s expense).
Damages if negligence or bad faith is proven.

3. Who Is Responsible: You or the Provider?

Liability depends on cause, security controls, and your own conduct.

3.1 When Banks/EMIs Are Usually Liable

Providers may be accountable when:

System or processing error (duplicate debit, floating without reversal, unauthorized internal posting).
Weak security or failure to follow required controls (e.g., OTP not actually delivered to you, failed fraud detection, poor authentication).
Merchant chargeback cases where you clearly didn’t transact.
Delayed or improper handling of disputes.

3.2 When Liability Can Shift to You

Providers may deny reimbursement if they prove:

You authorized it (even inadvertently).
Gross negligence on your part, e.g.:
- You shared OTPs/PINs/passwords.
- You clicked phishing links and entered credentials.
- You left your phone unlocked or gave it to someone.
- You installed suspicious apps that captured your login.
You delayed reporting beyond policy timelines and this delay enabled loss escalation.

Important: “Negligence” must be proven, not assumed. Providers can’t reflexively blame you without investigation.

4. Immediate Actions: The First 30–60 Minutes Matter

As soon as you notice an unauthorized debit:

Step 1: Secure Your Account

Freeze/lock your card or wallet if the app allows.
Change passwords/PINs immediately.
Log out all sessions if there’s a setting.
Disable biometrics temporarily and reset device lock.
If SIM-swap is suspected (signal loss, no OTP arriving), contact your telco to block/recover your number.

Step 2: Gather Evidence

Take screenshots / save records of:

Transaction reference numbers
Amount, date/time, merchant name
SMS/email alerts
Your app’s transaction history
Any suspicious messages or links you received

Step 3: Report to the Provider Right Away

Use official channels:

In-app help center
Official hotline
Official email or chat
Branch (for banks)

Ask for:

Case/ticket number
Temporary account restriction
Formal dispute/chargeback filing
Timeline for investigation

5. Formal Dispute Process (Banks and E-Wallets)

5.1 Write a Clear Dispute Statement

Include:

Your full name, account number, registered mobile/email
Transaction details (amount, date/time, ref no.)
Statement that you did not authorize it
Circumstances (e.g., phone in your possession, no OTP received, no login)
Request for reversal/refund and investigation
Attach evidence screenshots

Keep it factual and direct.

5.2 Provider Investigation

The provider should:

Verify logs (device, IP, location, authentication method)
Validate OTP delivery or biometric use
Check merchant/acquirer records
Evaluate fraud indicators
Determine if system failure occurred
Issue provisional credit where appropriate under internal rules

5.3 Outcomes

Possible results:

Refund / reversal
Chargeback (card cases)
Denial with reasons
Partial refund if some charges are proven valid
Account remediation (new card, new wallet ID)

6. Escalation if the Provider Won’t Fix It

If you receive no action, an unreasonable delay, or a denial you believe is wrong:

6.1 Escalate Internally First

Ask for a supervisor review.
Re-submit evidence.
Cite your ticket number.
Request a written explanation.

6.2 File a Complaint with BSP (Financial Consumer Protection)

BSP handles complaints against:

Banks
E-money issuers / e-wallets
Other BSP-supervised financial institutions

Prepare:

Copies of your dispute
Provider’s response/denial
Screenshots and proof
Timeline of events

BSP can require the provider to respond and can mediate or enforce compliance with consumer protection rules.

6.3 National Privacy Commission (NPC)

If you suspect:

Data breach
Unauthorized disclosure
System weakness enabling fraud
Poor handling of your personal information

You may file with NPC, especially if the provider failed security obligations.

6.4 Law Enforcement / NBI Cybercrime Division / PNP Anti-Cybercrime Group

File a criminal complaint if:

There’s identity theft, hacking, phishing, SIM-swap, or large losses.
You have evidence of a specific perpetrator.
The provider’s logs help link a suspect.

Criminal cases can proceed alongside BSP/NPC actions.

6.5 Civil Action

If losses are big and denial seems negligent/bad faith:

Demand letter
Small claims (if within jurisdictional limits and mostly monetary)
Regular civil suit for restitution + damages

7. Special Cases and How They’re Treated

7.1 Card Transactions (Debit/Credit/Prepaid)

You usually file a chargeback dispute through your bank/issuer.
Provide proof of non-participation.
For online card-not-present fraud, issuers must examine authentication steps used.

7.2 Floating / Pending but Deducted

Often caused by network or merchant/acquirer delay.

Providers typically reverse automatically within their set window.
Still file a ticket to ensure tracking.

7.3 Subscription or Auto-Renewals

Key question: did you give valid consent?

If terms were hidden, misleading, or no clear opt-in, you can dispute as unauthorized or unfair billing.
Provide screenshot proof of non-consent or cancellation.

7.4 OTP-Based Transactions

OTP is strong evidence of authorization only if:

It was actually delivered to your registered number,
It was not coerced or intercepted,
Provider security was intact.

Phishing that tricks you into giving an OTP may be treated as user negligence, but not automatically—providers still must show they met security standards and warnings.

7.5 SIM-Swap / Number Takeover

If your SIM was hijacked and OTPs were intercepted:

Telco records + provider logs matter.
You can pursue telco complaint and cybercrime case.
Providers must verify unusual SIM changes and risk signals.

8. Practical Tips to Improve Your Chances of Refund

Report within hours, not days.
Never admit fault casually. Stick to facts.
Ask for written findings if denied.
Keep a single timeline document with dates and screenshots.
Follow up regularly and note names of agents.
Escalate early if you see stalling.
Don’t delete suspicious messages; save them.

9. Preventive Measures (Worth Doing Even After the Incident)

Enable transaction notifications for every channel.
Use strong, unique passwords and a password manager.
Turn on 2FA/biometric + device binding.
Never share OTPs—even with “support.”
Verify links and apps; avoid APKs outside official stores.
Set low transfer limits if possible.
Lock your SIM with a PIN; require ID for SIM replacement.
Keep phone OS updated; install reputable anti-malware.
Review account history weekly.

10. Template: Simple Unauthorized Transaction Dispute Letter

Subject: Unauthorized Transaction Dispute and Request for Reversal

Dear [Bank/EMI Name] Support,

I am reporting an unauthorized transaction from my account/wallet.

Account/Wallet: [number / registered mobile] Transaction Date/Time: [date/time] Amount: PHP [amount] Merchant/Recipient: [name shown] Reference No.: [ref]

I did not authorize, initiate, or consent to this transaction. My phone/card was in my possession at the time and I did not receive or provide any OTP/PIN for this payment.

I request that you investigate this incident and reverse/refund the amount. Attached are screenshots of the transaction record and related alerts.

Please provide a case number and advise the investigation timeline.

Sincerely, [Full Name] [Contact number/email]

11. Bottom Line

In the Philippines, unauthorized bank or e-wallet deductions are both a consumer protection issue and often a cybercrime issue. You have the right to prompt investigation, fair treatment, and refund where you did not validly consent. Providers must show that transactions were properly authenticated and that they maintained secure systems.

Act fast, document everything, use formal dispute channels, and escalate to BSP, NPC, or cybercrime authorities if needed.