Quick answer

Report the unauthorized transactions to your credit card issuer immediately, have the card blocked or replaced, and submit a formal transaction-by-transaction dispute. Do not wait for your employer, HR, or the coworker to investigate first.

Under Philippine credit card rules, a cardholder must generally be allowed up to 30 calendar days from the statement date to report a billing error or discrepancy. After receiving the notice and relevant documents, the issuer must take action within 10 business days and complete a thorough investigation, correct its records when warranted, and provide a written explanation within 90 days. Undisputed amounts may still be collected while the disputed transactions are being investigated.

Using another person’s credit card, card details, account number, PIN, or other access credentials without authority may violate the Access Devices Regulation Act, as amended. Depending on how the card was used, an online or app-based transaction may also involve the Cybercrime Prevention Act. Criminal liability is not established merely by accusation: investigators and prosecutors must still prove who made the transactions, the absence or limits of authority, fraudulent intent where required, and the other elements of the applicable offense. (Lawphil)

What to do immediately

1. Block the card and secure every related account

Use only the issuer’s official mobile app, website, hotline, or the number printed on the card to:

Lock or block the card.
Request a replacement card and new card number.
Disable cash advances, online transactions, recurring transactions, supplementary cards, or linked virtual cards when appropriate.
Change the passwords for the card app, online banking, email account, and any digital wallet connected to the card.
Change the PIN if the coworker may know it.
Ask your mobile provider about securing or replacing your SIM if OTP messages may have been viewed, forwarded, or intercepted.

Tell the issuer whether the physical card was taken, merely handled, photographed, returned, or never left your possession. Also disclose whether the coworker may have seen an OTP, PIN, CVV, saved card profile, billing statement, identification document, or unlocked phone.

Under Republic Act No. 8484, a cardholder who loses an access device must notify the issuer. Compliance with the issuer’s reporting requirements generally protects the cardholder from financial liability for fraudulent use occurring from the time of reporting. Transactions made before notice may still be disputed and investigated, but immediate reporting is critical. (Lawphil)

2. File a formal dispute with the issuer

Do not rely only on a telephone conversation. Ask for a case or reference number and send a written dispute through the issuer’s official channel.

Identify each disputed transaction separately:

Transaction date and posting date
Merchant or recipient
Amount
Whether the card was present
Whether you received an OTP or app approval request
Whether you still had the physical card
When and how you discovered the transaction
Why you believe the coworker was responsible
Whether you had ever given that person any limited authority to use the card

Attach copies rather than surrendering your only originals. Ask for written acknowledgment and confirmation that the card has been blocked.

A billing-error report may be made in writing, verbally, or through another documented method accepted by the issuer. The issuer must allow up to 30 calendar days from the statement date for reporting, act within 10 business days after receiving the notice and relevant documents, and complete the investigation and written response within 90 days.

While the dispute is pending, continue paying amounts that are not disputed. Obtain the issuer’s written instructions concerning the contested amount. Do not assume that disputing one transaction suspends the entire bill, minimum payment, or unrelated interest.

Depending on the circumstances, the issuer may temporarily suspend interest or fees on the disputed amount, place a hold, block the affected account, or grant provisional credit. These interim measures are not automatic in every case. If the investigation determines that the transaction was unauthorized or fraudulent, the issuer should promptly reverse or correct it, including related interest, charges, and fees.

3. Ask the employer to preserve workplace evidence

Make a dated written report to HR, security, compliance, or management when workplace access may have enabled the misuse. State the facts without exaggeration and request immediate preservation of relevant evidence, such as:

CCTV recordings
Office entry and exit logs
Computer or Wi-Fi access logs
Desk, locker, or cabinet access records
Company-issued device records
Delivery-reception logs
Internal emails and chat messages
Witness accounts
Work schedules showing who was present

Evidence may be overwritten under ordinary retention practices, so request preservation promptly. Keep a copy of your report and proof that it was received.

An internal investigation does not replace a bank dispute, police or NBI investigation, or prosecutor’s proceeding. Your employer also does not determine whether the coworker is criminally guilty.

4. Consider reporting the incident to law enforcement

Report promptly when there is a substantial loss, repeated use, cash withdrawal, identity theft, use of an online account, threats, evidence tampering, or a risk that the coworker will continue using the information.

You may seek assistance from:

The National Bureau of Investigation, including its Cybercrime Division for digitally facilitated transactions
The Philippine National Police or PNP Anti-Cybercrime Group
The city or provincial prosecutor’s office with jurisdiction over the incident

Bring a clear chronology, government identification, bank statements, dispute correspondence, transaction alerts, electronic records, witness information, and any workplace incident report. Investigators or the prosecutor may require a sworn complaint-affidavit and additional supporting documents.

Republic Act No. 11449 also requires access-device issuers and their partner merchants to conduct an initial investigation of reported access-device fraud and furnish real-time reports to the NBI and the PNP Anti-Cybercrime Group. Such a report may serve as a complaint for further investigation and prosecution. This does not prevent the victim from making a separate direct report. (Supreme Court E-Library)

What Philippine criminal laws may apply

Access-device fraud

Republic Act No. 8484 treats a credit card, account number, PIN, code, and similar means of obtaining money, goods, services, or other value as an “access device.” An unauthorized access device can include one that was lost, stolen, revoked, canceled, suspended, or obtained with intent to defraud. (Lawphil)

Prohibited conduct includes, among other acts:

Using an unauthorized access device with intent to defraud
Obtaining money, goods, services, or another thing of value through an access device with intent to defraud or gain
Disclosing card or account information without the cardholder’s permission
Fraudulently accessing a credit card account, with or without authority, regardless of whether a monetary loss ultimately occurs
Using skimming, hacking, malware, or similar methods to obtain or exploit access-device information

The coworker’s mere opportunity to access the card is not enough by itself. The prosecution must connect the person to the transactions through admissible evidence and prove the elements of the specific offense charged. (Lawphil)

For fraudulent use of a credit card, Republic Act No. 11449 provides imprisonment of four to six years and a fine equal to twice the value of the credit obtained fraudulently. Different or more severe penalties may apply when the conduct falls under another access-device offense, involves multiple cards or accounts, constitutes economic sabotage, or includes other legally significant circumstances. The prosecutor and court—not the cardholder, employer, or bank—determine the proper charge and penalty. (Supreme Court E-Library)

Online or digitally facilitated use

When the underlying offense is committed by, through, or with the use of information and communications technology, Section 6 of the Cybercrime Prevention Act may be considered. That provision generally imposes a penalty one degree higher than the penalty under the underlying law. Whether it applies depends on the exact manner of commission and the charge supported by the evidence. (Supreme Court E-Library)

Other offenses under the Revised Penal Code or special laws may sometimes be considered—for example, when the incident involves theft of the physical card, falsified documents, identity information, threats, or unlawful access to a computer system. Their application is fact-dependent and should not be assumed without reviewing the evidence.

Will the bank automatically refund the charges?

No. Reporting a transaction as unauthorized begins an investigation; it does not by itself guarantee reimbursement.

The issuer may examine:

Whether and when the card was reported lost or compromised
Whether the transaction used the physical chip, magnetic stripe, contactless function, PIN, OTP, CVV, or app approval
Whether the cardholder shared credentials or left them exposed
Whether the merchant followed identification and authorization procedures
Device, location, authentication, and transaction records
The cardholder’s previous dealings with the coworker
Whether the issuer and its service providers complied with security and consumer-protection duties

Philippine regulations allow liability to be assessed in light of both the account holder’s conduct and the acts, omissions, safeguards, and regulatory compliance of the financial institution and its agents. A transaction found to be unauthorized or fraudulent should be reversed or corrected, together with related interest, charges, and fees.

The fact that the issuer says a transaction was “OTP-authenticated,” “chip verified,” or made through a recognized device does not necessarily end the inquiry. Explain specifically how the coworker may have obtained access and ask the issuer to identify the records and contractual provisions supporting its decision.

What if you previously allowed the coworker to use the card?

Limited permission for one transaction does not necessarily authorize later transactions, larger amounts, cash advances, recurring charges, or use after permission was withdrawn.

However, prior consent can make the case more fact-sensitive. Preserve communications showing:

The precise purchase or purpose authorized
The maximum amount permitted
The date or time limit
Whether the card details were to be saved
Whether additional transactions were prohibited
When consent was withdrawn
Any admission that the coworker exceeded the permission

Be candid with the issuer and investigators. A misleading denial of all prior permission can damage credibility if messages or transaction records later show otherwise.

Sharing a PIN, OTP, password, or full card credentials may also affect the issuer’s assessment under the card agreement and consumer-protection rules. It does not automatically make every later transaction lawful, but it can complicate proof and the allocation of financial responsibility.

Evidence to preserve

Create one secure folder containing the following:

Account records: statements, transaction histories, pending-transaction screenshots, merchant names, reference numbers, and amounts.
Alerts: original SMS, email, and app notifications.
Issuer communications: call dates, agent names, case numbers, emails, letters, chat transcripts, and dispute forms.
Physical evidence: the card, envelope, receipts, delivery labels, or documents handled by the coworker.
Communications with the coworker: messages, emails, admissions, repayment offers, apologies, threats, or explanations.
Workplace records: HR reports, CCTV-preservation requests, access logs, witness names, schedules, and security reports.
Device information: the phone or computer that received OTPs or approvals, security alerts, login-history notices, and evidence of unauthorized access.
Law-enforcement records: complaint acknowledgment, referral, affidavit, and documents submitted.
A chronology: when the card was last safely held, when access may have occurred, each transaction, discovery, reporting, and subsequent communication.

Electronic documents may be used as evidence, but their authenticity and integrity can become important. Keep the original message, file, account, or device where possible. Export complete conversations, preserve dates and sender information, retain unedited copies, and make secure backups. Avoid relying exclusively on cropped screenshots. (Lawphil)

Do not secretly enter the coworker’s phone, email, online account, locker, or computer to obtain evidence. Give investigators the information you lawfully possess and let them use proper legal processes for records you cannot access.

When and how to escalate a bank complaint

The issuer’s own Financial Consumer Protection Assistance Mechanism is the first level of recourse. Give the issuer a reasonable opportunity to investigate and retain proof that you complained.

You may escalate the matter to the Bangko Sentral ng Pilipinas Consumer Assistance Mechanism when:

The issuer does not acknowledge or act on the complaint
Applicable response or investigation periods have passed
The issuer closes the complaint without adequately addressing the evidence
Unauthorized charges, related fees, or collection activity remain unresolved
You believe the issuer failed to follow applicable consumer-protection rules

Submit your complaint to the BSP with a copy of the complaint sent to the issuer, the issuer’s reply if any, and supporting records. BSP-CAM is a second-level remedy and is generally a required step before BSP mediation or adjudication.

BSP proceedings address the conduct of a BSP-supervised financial institution. They do not determine the coworker’s criminal guilt or impose criminal punishment. Criminal allegations must be handled through law enforcement, prosecution, and the courts.

Common mistakes to avoid

Waiting for HR before contacting the issuer

An employer’s inquiry can take time, while unauthorized transactions may continue and bank-reporting periods may run. Block and dispute first.

Reporting only by telephone

A telephone report is useful for immediate blocking, but preserve a written record, transaction list, acknowledgment, and case number.

Disputing the bill but ignoring undisputed amounts

Continue complying with written payment instructions for legitimate charges. Failure to pay unrelated amounts can create avoidable fees or collection issues.

Deleting embarrassing or unfavorable messages

Preserve the complete conversation, including messages showing any prior consent. Selectively deleting records can undermine credibility and context.

Publicly accusing the coworker

Avoid social-media posts, group-chat accusations, and statements presented as established guilt. Limit disclosures to the issuer, counsel, employer personnel with a legitimate role, investigators, and authorities.

Confronting the coworker alone

A confrontation may lead to threats, destruction of evidence, pressure to withdraw the complaint, or a disputed account of what was said. Prioritize safety and preserve communications.

Accepting an informal repayment too quickly

Repayment may reduce the financial loss but does not automatically resolve bank records, fees, identity risks, or potential criminal issues. Document any settlement carefully, avoid signing a waiver you do not understand, and do not make false statements to the bank or authorities.

Assuming a police blotter completes the case

An incident report or blotter is evidence that a report was made. Further investigation, affidavits, supporting documents, and prosecutor action may still be required.

When legal help is urgent

Consult a Philippine lawyer promptly when:

The amount is substantial or the transactions are repeated
Cash advances, fund transfers, identity documents, or several accounts are involved
The issuer denies the dispute based on an alleged OTP, PIN, chip, or app approval
Collection demands or adverse credit reporting continue despite a documented dispute
The coworker threatens, harasses, blackmails, or pressures you
The employer retaliates or discourages lawful reporting
CCTV, system logs, or other evidence may soon be erased
You previously shared the card, PIN, OTP, or account credentials
You are asked to sign an affidavit, settlement, quitclaim, or waiver
You receive a subpoena, prosecutor’s notice, counter-complaint, or court document
The incident involves several possible locations, making venue or jurisdiction uncertain

Bring the lawyer a complete timeline and unedited copies of the documents. The proper legal strategy may depend on the card agreement, authentication records, workplace evidence, transaction location, and the precise scope of any prior permission.

Frequently asked questions

Can the coworker still be charged after returning the card?

Potentially, yes. Returning the physical card does not erase transactions already made or attempted. Liability depends on proof of the prohibited act and the required criminal intent.

Do I have to report the coworker to HR first?

No. You may immediately contact the issuer and law enforcement. An HR report is useful when workplace records, safety, or company rules are involved, but it is not a prerequisite to a bank dispute or criminal complaint.

What if the physical card never left my possession?

Card details, saved credentials, photographs, OTP access, virtual cards, online accounts, or contactless transactions may still have been used. Tell the issuer that the card remained with you and request investigation of the authentication and device records.

What if I discover the charge after the 30-day dispute period?

Report it immediately anyway. The issuer should evaluate the complaint under the applicable law, regulations, card agreement, and circumstances. Missing the ordinary reporting period may affect available remedies, but you should not assume that it automatically defeats every claim.

Must the issuer remove the charge while investigating?

Not necessarily. Interim relief such as provisional credit, suspension of fees, or a temporary hold may be available but is not guaranteed in every case. The issuer may continue collecting undisputed amounts. If the transaction is found unauthorized or fraudulent, the issuer should reverse or correct the amount and related charges.

Can BSP order the coworker to repay me or send the coworker to jail?

No. BSP consumer mechanisms address complaints involving BSP-supervised financial institutions. Claims against the coworker and possible criminal responsibility belong in the appropriate law-enforcement, prosecutorial, and judicial processes.

Can I deduct the loss from the coworker’s salary or take the coworker’s property?

Do not use self-help measures. Salary deductions and taking another person’s property are subject to legal restrictions and can create a separate dispute. Use a properly documented voluntary settlement or the appropriate civil, labor, or criminal process.

Does repayment automatically end a criminal case?

Not necessarily. Repayment may affect the loss, the parties’ decisions, or other case considerations, but it does not automatically erase an offense that has already been committed. Obtain legal advice before signing a settlement, affidavit of desistance, release, or waiver.

Official sources

Disclaimer

This article provides general legal information, not legal advice or a prediction of any case’s outcome. Responsibility may depend on the cardholder agreement, timing of the report, transaction-authentication records, scope of any prior permission, issuer safeguards, workplace evidence, and other documents. Consult a qualified Philippine lawyer for advice on a specific incident.

Sources last checked: 20 July 2026.