Quick answer

An unauthorized withdrawal from a joint bank account does not automatically make the bank liable or the withdrawing co-depositor criminally responsible. The result depends mainly on:

whether the account requires either depositor’s signature (“OR”) or all required signatures (“AND”);
the bank’s account-opening documents and terms;
who actually owned or contributed the money;
any agreement limiting how the funds could be used;
whether a signature, withdrawal slip, card, password, OTP, or electronic instruction was forged, stolen, or misused; and
whether the bank followed the account mandate and exercised the high degree of care required of banks.

For an “OR” account, either named depositor ordinarily has authority to withdraw as far as the bank is concerned. But that authority does not necessarily give the withdrawing depositor ownership of all the money or permission to use it for any purpose. A co-depositor who takes more than their share or violates the account’s agreed purpose may still have to return the money.

For an “AND” account, a withdrawal without every required authorization is generally inconsistent with the account mandate. The bank may be responsible if it paid despite a missing or forged signature, subject to the documents, evidence, and any negligence attributable to the depositors.

Report the transaction to the bank immediately. Ask it to secure the account, trace any electronic transfer, preserve records, and give you a written case reference number. Speed matters because transferred funds can be moved or withdrawn quickly.

First determine what “unauthorized” means

The word can describe several legally different situations:

A named co-depositor withdrew from an “OR” account. The transaction may have been authorized under the bank mandate, even though it violated an agreement between the co-depositors.
One depositor withdrew from an “AND” account without the other required signature. This may be an unauthorized payment by the bank.
A stranger, relative, employee, or representative withdrew without valid authority. This may involve bank negligence, forgery, fraud, or another offense.
Someone used stolen online credentials, a card, PIN, password, or OTP. Electronic-fraud procedures and the Anti-Financial Account Scamming Act may apply.
A genuine signature or login was obtained through deception, coercion, or abuse of authority. The bank’s records may show an apparently authorized transaction, but the underlying consent or use of the money may still be disputed.

These situations require different remedies. Do not assume that describing a transaction as unauthorized is enough; identify precisely whose authority was missing and what document or agreement imposed that requirement.

“OR” and “AND” accounts have different withdrawal rules

Joint “OR” accounts

An “OR” designation generally allows either co-depositor to transact independently. The bank normally does not need the other depositor’s separate consent for every withdrawal if the account documents say either signature is sufficient.

That rule governs the bank’s authority to pay. It does not conclusively determine who beneficially owns the funds.

In Apique v. Fahnenstich, the Supreme Court recognized that a depositor in a joint “OR” account could withdraw without presenting the co-depositor’s authorization to the bank. Nevertheless, the withdrawing depositor’s rights as against the other depositor remained limited by the purpose for which the account had been opened. The Court required the return of funds that the evidence showed the withdrawing party was not entitled to keep. See Apique v. Fahnenstich, G.R. No. 205705, August 5, 2015.

Accordingly, a bank that properly honors a withdrawal by a named “OR” depositor may have complied with its mandate even if that depositor later becomes liable to the other for restitution, accounting, or damages.

Joint “AND” accounts

An “AND” account ordinarily requires the signatures or authorization of all persons specified in the account mandate. A payment made without a required authorization may constitute a breach of the deposit agreement and of the bank’s duty to safeguard the account.

The exact rule still depends on the signature card, account-opening form, digital-banking enrollment, board or partnership resolutions if applicable, and any later written amendments. Labels on a passbook or statement should be checked against the complete bank records.

“AND/OR” and specially worded accounts

Some accounts use “AND/OR,” survivorship clauses, tiered signing limits, or special operating instructions. Their effect cannot safely be determined from the account name alone. Obtain the complete account agreement and identify:

who may withdraw;
how many signatures are required;
whether online or ATM access was individually assigned;
whether transaction limits apply;
whether a representative or attorney-in-fact was enrolled; and
whether the mandate changed before the disputed withdrawal.

Who owns the money in a joint account?

The names on the account and authority to withdraw are important, but they may not provide the final answer on ownership.

Article 485 of the Civil Code presumes that co-owners’ shares are equal unless the contrary is proved. The Supreme Court has applied this principle to joint bank accounts. See In the Matter of the Intestate Estate of Delgado, G.R. No. 230404, January 31, 2018.

The equal-share presumption can be overcome by credible evidence, such as:

deposit slips and transfer records identifying the source of funds;
payroll, remittance, sale, loan, or business records;
a written agreement stating the contributors’ shares;
messages explaining why the account was opened;
proof that the funds belonged to a business, estate, trust, or particular project;
marriage-property documents; or
evidence of a donation or other valid transfer.

Contribution is important but not always conclusive. A person may place money in a joint account as a gift, for convenience, as an agent, or for a limited purpose. Conversely, being named on an account for convenience does not necessarily establish ownership of half—or all—of the balance.

For married depositors, the applicable property regime and the source and timing of the funds may also matter. The account label alone does not decide whether money is community, conjugal, or exclusive property.

When the bank may be liable

Banks must treat depositors’ accounts with a high degree of care. The Supreme Court has repeatedly held that banks must ensure that funds are released only to the depositor or a properly authorized representative.

Potential bank liability is strongest when evidence shows that the bank:

honored a withdrawal from an “AND” account without every required signature;
accepted a forged or materially irregular signature;
paid a person who was neither a depositor nor a validly authorized representative;
disregarded a revoked or expired authority already communicated to it;
allowed employees to exceed their authority;
failed to follow its own material verification procedures; or
cannot produce the withdrawal or authorization documents that should support the payment.

In Philippine Savings Bank v. Chowking Food Corporation, the Supreme Court emphasized the meticulous care expected of banks and found liability where the bank failed to establish authority for a substantial withdrawal. See G.R. No. 214567, April 4, 2016.

Liability is not automatic merely because one co-depositor objects after the transaction. If the bank followed a valid “OR” mandate and authenticated the withdrawing co-depositor in accordance with the account agreement and applicable rules, the primary dispute may be between the co-depositors.

The depositor’s own conduct can also affect the result—for example, sharing an OTP, leaving signed blank withdrawal slips, entrusting credentials to another person, or failing to examine statements despite clear warnings. Such conduct does not excuse every bank failure, but it may affect causation, allocation of loss, or damages.

Immediate steps after discovering a withdrawal

1. Contact the bank through its official fraud channel

Use the number in the bank’s official app, website, card, or statement—not a number supplied through a message. For suspected fraud, BSP rules require covered institutions to maintain an active 24/7 reporting channel.

Ask the bank to:

block or restrict affected cards and electronic access;
reset online credentials and revoke unrecognized devices;
preserve CCTV footage, system logs, call recordings, withdrawal slips, checks, signature-verification records, and teller records;
trace any electronic transfer and request a temporary hold on identifiable disputed funds;
note formally that future withdrawals are disputed;
investigate whether the transaction complied with the joint-account mandate; and
issue a case or complaint reference number.

A unilateral request may not permanently freeze a valid joint account, particularly where another “OR” depositor has contractual withdrawal authority. The bank may require consent, a revised mandate, or a court order. Still, prompt written notice creates an important record and may prevent further loss.

2. Submit a detailed written complaint

State:

the account name and masked account number;
the transaction date, time, amount, channel, and reference number;
when and how you discovered it;
why it was unauthorized;
the account’s signing rule;
whether any card, phone, passbook, checkbook, ID, password, or OTP was compromised;
the action you want the bank to take; and
the records you want preserved and provided.

Do not send passwords, PINs, or full card security codes. Keep proof of submission and every response.

3. Preserve evidence

Save original or unaltered copies of:

account-opening forms, signature cards, terms, and special instructions;
statements, passbooks, deposit slips, checks, and withdrawal slips;
electronic-transfer confirmations and reference numbers;
SMS messages, emails, chat logs, call logs, and device alerts;
screenshots showing the full date, time, sender, and URL;
records proving the source and intended use of the money;
prior agreements between the co-depositors;
demands for return and the recipient’s response;
police, barangay, NBI, or bank reports; and
a chronological account written while events are fresh.

Avoid editing original files. Export messages where possible and retain the device on which they were received.

4. Secure your other accounts

Change compromised credentials from a trusted device. Use unique passwords, activate multi-factor authentication, remove unknown devices, and review linked accounts and beneficiaries. If identity documents were exposed, notify other affected institutions.

5. Send a formal demand when appropriate

If a co-depositor or representative took money they were not entitled to keep, a written demand should identify the transaction, explain your ownership or agreed limitation, request an accounting and return, and set a reasonable response date.

A demand can clarify the dispute and may be legally significant in certain civil or criminal theories. Have counsel review it where the amount is substantial, the ownership arrangement is complicated, or litigation is likely.

Electronic transfers and the AFASA process

Republic Act No. 12010, the Anti-Financial Account Scamming Act (AFASA), and its BSP implementing rules created procedures for temporarily holding disputed funds and coordinating verification among financial institutions.

For covered electronic fund transfers, the originating institution may initiate the process based on a complaint through its 24/7 fraud-reporting channel. The rules provide for an initial hold of up to five calendar days and allow extensions within an overall maximum of 30 calendar days, unless a competent court extends the period. A hold preserves identifiable funds; it does not itself finally decide ownership.

Report immediately and provide the transaction reference, source and beneficiary accounts, amount, date, time, channel, and reasons for the dispute. Cooperate promptly with requests for documents.

This process does not cover every joint-account disagreement. In particular, an electronic transfer initiated by a co-depositor who was genuinely authorized under an “OR” mandate may present an ownership or misuse dispute rather than an unauthorized electronic transaction. Cash withdrawals, erroneous transfers, and certain card transactions are also treated differently under the implementing rules.

Knowingly filing a malicious or completely unwarranted report that causes funds to be held can itself create liability. See Republic Act No. 12010 and the BSP AFASA rules and statutory booklet.

Escalating an unresolved bank complaint

The bank’s Financial Consumer Protection Assistance Mechanism is the first-level remedy. If the bank’s action is unsatisfactory, escalate the complaint to the Bangko Sentral ng Pilipinas through the BSP Consumer Assistance Mechanism or BSP Online Buddy.

Include the bank’s complaint reference number, your written complaint, the bank’s final response or evidence of delay, transaction records, and the specific resolution sought. BSP assistance does not prevent a court from deciding ownership, damages, or criminal liability.

Republic Act No. 11765 protects financial consumers’ rights to fair treatment, protection of assets against fraud and misuse, and timely complaint handling. It also gives financial regulators consumer-redress and adjudicatory authority within the limits of the law. See the Financial Products and Services Consumer Protection Act and the BSP Consumer Assistance channels.

Possible civil and criminal remedies

Depending on the evidence, civil remedies may include:

return or restitution of money;
an accounting of deposits and withdrawals;
collection of a proven debt;
enforcement of the co-depositors’ agreement;
damages for breach of contract or negligence; and
a court order preserving funds or preventing further disposition when the legal requirements for provisional relief are met.

The correct defendant may be the withdrawing person, the bank, a recipient of the funds, or a combination of them. The appropriate claim depends on who authorized the transaction, who received the money, and what duty each party breached.

A criminal complaint may be appropriate where evidence supports theft, estafa, falsification, unauthorized access, computer-related fraud, identity misuse, money-muling, or another defined offense. Not every breach of a joint-account agreement is a crime. Criminal liability requires proof of every statutory element, and co-ownership can complicate offenses involving the taking of property belonging to another.

Do not use a criminal complaint merely as leverage in a genuine accounting or ownership dispute. Present the complete facts and documents to a Philippine lawyer, the police, the NBI Cybercrime Division, or the appropriate prosecutor for assessment.

Special situations

A co-depositor has died

Death does not automatically transfer the entire account to the survivor. Ownership, succession, the account agreement, and tax rules must be considered.

Under the current Section 97 of the National Internal Revenue Code, as amended by the TRAIN Law, withdrawals from a deceased person’s sole or joint bank deposit are subject to the prescribed estate-tax procedure, including a six-percent final withholding tax in the circumstances stated by law. Where the deposit was included in the estate and the estate tax was paid, the applicable BIR documentation may permit withdrawal without that withholding. See Republic Act No. 10963, Section 27 and BIR Revenue Regulations No. 12-2018.

Do not conceal a co-depositor’s death or sign a sworn declaration that all depositors are living when that is untrue.

The account belongs to a business, estate, or organization

Corporate resolutions, partnership rules, trust terms, estate authority, and account-specific signing limits may control. A person named as a signatory is not necessarily the beneficial owner of the funds. Obtain the governing resolutions and authority documents immediately.

The withdrawal was made under a power of attorney

Check its exact scope, effective date, conditions, and any revocation. Authority to manage an account does not necessarily authorize the agent to transfer the principal’s money to themselves. Death of the principal and other legal events may also affect the authority.

Domestic or financial abuse is involved

If a spouse, partner, caregiver, or family member is taking money through threats, coercion, isolation, or misuse of access, prioritize physical safety. Contact trusted support, law enforcement, or counsel before confronting the person. Tell the bank privately that coercion or abuse is alleged and ask what protective measures it can lawfully implement.

Common mistakes to avoid

Assuming an “OR” account means each person owns the entire balance.
Assuming proof that one person deposited the money automatically resolves ownership.
Waiting for the next statement before reporting an electronic transfer.
Reporting only by telephone and keeping no written record.
Giving the bank conclusions without transaction numbers, dates, and supporting documents.
Altering screenshots or discarding the original device.
Signing an affidavit without checking the account mandate and transaction records.
Making public accusations before the facts are verified.
Treating a bank complaint as a substitute for a court action where ownership is genuinely disputed.
Ignoring limitation periods. There is no single deadline for every joint-account case; the applicable period depends on the cause of action, document, offense, and procedural route.

When legal help is urgent

Consult a Philippine lawyer promptly if:

withdrawals are continuing or the remaining balance may disappear;
the amount is substantial;
a co-depositor denies your ownership or refuses an accounting;
the bank will not preserve records;
signatures or authority documents appear forged;
funds were transferred through several institutions or converted to cash or digital assets;
a depositor has died;
the account contains estate, corporate, trust, client, or public funds;
you need an injunction, attachment, subpoena, or other court process;
police or prosecutors have contacted you; or
a contractual, civil, administrative, or criminal deadline may be approaching.

Court orders preserving assets require specific facts and legal grounds. Seek advice before delay makes the money or evidence harder to recover.

Frequently asked questions

Can one person withdraw the entire balance from a joint “OR” account?

The bank mandate may allow either depositor to withdraw the balance. That does not necessarily mean the withdrawing person owns or may keep all of it. The other depositor can seek return of the portion proven to belong to them or used contrary to an agreement.

Is the bank automatically liable if it did not call the other depositor?

Usually not for a valid “OR” account unless the contract, a restriction already accepted by the bank, a fraud alert, or other circumstances required additional verification. For an “AND” account, missing authorization is much more significant.

Can the bank freeze the account after I complain?

The bank may secure electronic access or temporarily hold covered disputed transferred funds under applicable rules. It may not be able to impose a permanent freeze on an otherwise valid joint account solely because one co-depositor objects. A revised mandate, consent of the parties, legal authority, or court order may be necessary.

Does a joint account always mean equal ownership?

Equal shares are presumed under the Civil Code, but the presumption may be rebutted by evidence of contributions, donations, agency, an agreed purpose, or another ownership arrangement.

Can I obtain the withdrawal slip and CCTV footage?

Request them immediately and in writing. Disclosure may be subject to bank-secrecy, privacy, security, and evidence-preservation rules. Even when the bank cannot hand over a record directly, it should preserve relevant material for its investigation or lawful production through regulatory, prosecutorial, or court process.

Should I file a police report before complaining to the bank?

Do not postpone the bank report. Notify the bank first or simultaneously so it can secure access and attempt to trace funds. File with law enforcement promptly when forgery, account takeover, identity theft, deception, or another apparent crime is involved.

Will the BSP order the other co-depositor to return my money?

BSP processes can address the conduct of a supervised institution and facilitate or adjudicate matters within BSP authority. A private ownership dispute between co-depositors may ultimately require settlement or a court judgment.

How long do I have to sue?

It depends on whether the claim is based on a written contract, oral agreement, injury to rights, fraud, another civil obligation, or a criminal offense. Contractual notice provisions may also affect a claim against the bank. Obtain advice promptly rather than relying on a general limitation period.

Official legal sources

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Account documents and specific facts can materially change the analysis. Sources and procedures were checked as of September 4, 2026.