If someone withdrew money from your ATM card without your permission, the usual criminal case is access device fraud under Republic Act No. 8484, as amended by Republic Act No. 11449, often filed together with theft, qualified theft, estafa, or cybercrime, depending on how the money was taken. The right case depends on the facts: Was the ATM card stolen? Did you lend the card but not authorize the withdrawal? Was your PIN obtained through phishing? Was the money transferred to a mule account? Was the bank negligent? This article explains the possible cases, where to file, what evidence to prepare, and what to do immediately to protect your money.

The Most Common Case: Access Device Fraud

An ATM card is not just a plastic card. Under Philippine law, it is an access device because it allows a person to access an account, withdraw cash, or initiate fund transfers. Republic Act No. 8484, the Access Devices Regulation Act of 1998, defines an access device broadly to include a card, account number, PIN, code, or other means of account access that can be used to obtain money or initiate a transfer of funds. (Lawphil)

This means that if someone uses your ATM card, debit card, PIN, online banking credentials, or account access details without authority, the case may fall under access device fraud.

Republic Act No. 11449, approved in 2019, strengthened RA 8484 by expressly covering modern banking fraud, including ATM accounts, debit cards, payment cards, online banking, card skimming, hacking, and fraudulent access to applications. It specifically penalizes fraudulent access to an ATM account or debit card account, even if no monetary loss ultimately occurs. (Supreme Court E-Library)

In simple terms, if the person used your ATM card or ATM details to withdraw money without permission, access device fraud is usually the first case to consider.

Other Possible Criminal Cases

Several crimes may arise from the same unauthorized ATM withdrawal. Prosecutors often evaluate the entire set of facts and may charge one or more offenses.

Situation	Possible case to file	Why it may apply
Someone stole your ATM card and withdrew money	Access device fraud; theft	The person used an unauthorized access device and took money without consent.
A relative or friend borrowed your card for one purpose but withdrew more than allowed	Access device fraud; theft or estafa	The issue is whether the card or money was merely used without consent, or was entrusted and later misappropriated.
A household helper, caregiver, employee, or trusted person used your card and PIN	Access device fraud; qualified theft	Qualified theft may apply when the taking is committed with grave abuse of confidence or by a domestic servant.
Your ATM details were obtained through phishing, fake bank calls, fake SMS, or fake links	Access device fraud; cybercrime; Anti-Financial Account Scamming Act violation	The fraud involved electronic communications, sensitive identifying information, or financial account scamming.
Your account was accessed through an online banking app or hacked device	Access device fraud; cybercrime	Unauthorized access to an online banking account or computer system may be involved.
The bank allowed suspicious withdrawals despite obvious red flags	Bank complaint; BSP complaint; possible civil action for damages	Banks have a high duty of diligence in protecting depositors’ accounts.

Legal Basis Under Philippine Law

Republic Act No. 8484, as amended by Republic Act No. 11449

RA 8484 punishes fraudulent acts involving access devices. A person may be liable for access device fraud if he or she uses, possesses, traffics, copies, skims, hacks, or fraudulently accesses an access device.

RA 11449 added clearer coverage for ATM and online banking fraud. It includes:

Card skimming or copying information from a credit card, payment card, or debit card;
Possession or use of skimming devices, malware, software, or hardware used to commit access device fraud;
Fraudulent access to any application, online banking account, credit card account, ATM account, or debit card account;
Hacking involving unauthorized access to a computer or information system. (Supreme Court E-Library)

The penalties can be heavy. For many access device fraud offenses, RA 11449 provides imprisonment of six to ten years and a fine of ₱500,000 or twice the value obtained, whichever is higher, without prejudice to civil liability. Larger-scale offenses, hacking of bank systems, or skimming affecting many cards may carry much higher penalties, including life imprisonment in economic sabotage situations. (Supreme Court E-Library)

Theft Under Article 308 of the Revised Penal Code

Theft applies when a person takes personal property belonging to another, with intent to gain, without the owner’s consent, and without violence or intimidation.

In an ATM withdrawal case, the “property” taken is the money withdrawn from the account. Theft may be considered when the offender simply took your card or used your card details and withdrew your money without any valid authority.

Theft is often considered when:

Your wallet or ATM card was stolen;
Someone secretly took your card from your bag, drawer, or room;
A person saw or guessed your PIN and withdrew money;
A person used your card while you were asleep, hospitalized, abroad, or otherwise unaware.

Qualified Theft Under Article 310 of the Revised Penal Code

Qualified theft is a more serious form of theft. It may apply when theft is committed by a domestic servant, or with grave abuse of confidence.

This can matter in real-life ATM cases involving:

A house helper who was allowed to handle errands but secretly used the ATM card;
A caregiver who knew the senior citizen’s PIN and made unauthorized withdrawals;
An employee who had access to company ATM cards, payroll cards, or account credentials;
A trusted relative or assistant who abused a position of confidence.

However, not every relationship automatically creates qualified theft. Prosecutors usually look for proof that the offender enjoyed a special position of trust and used that trust to commit the taking.

Estafa Under Article 315 of the Revised Penal Code

Estafa is fraud or swindling. It usually involves deceit or abuse of confidence that causes damage to another person.

Estafa may be considered if the ATM card, PIN, or money was entrusted to the person for a specific purpose, and the person later misappropriated it.

Examples:

You gave your ATM card to someone only to withdraw ₱5,000 for you, but the person withdrew ₱50,000 and kept the rest.
You entrusted your payroll ATM card to a person to pay bills, but that person used the funds for personal expenses.
A person tricked you into revealing your PIN by pretending to help you, then withdrew money.

The difference between theft and estafa can be subtle. A practical distinction is this: theft usually involves taking without consent from the start, while estafa often involves money, property, or access initially received with trust or consent, then abused or converted.

Cybercrime Under Republic Act No. 10175

If the unauthorized ATM withdrawal involved hacking, phishing, malware, fake bank websites, fake text messages, online banking access, or electronic manipulation of data, the case may also involve the Cybercrime Prevention Act of 2012, Republic Act No. 10175.

RA 10175 covers computer-related fraud, identity theft, illegal access, and other cyber offenses. It is especially relevant when the ATM withdrawal is only the final step of a broader digital scam, such as:

A fake bank SMS asking you to “verify” your account;
A phishing link that captured your username, password, OTP, or PIN;
A compromised phone or SIM;
Unauthorized access to your mobile banking app;
Malware that captured your banking credentials.

Anti-Financial Account Scamming Act, Republic Act No. 12010

Republic Act No. 12010, the Anti-Financial Account Scamming Act, was approved in 2024. It addresses financial account scams involving banks, e-wallets, payment service providers, money mule accounts, and social engineering schemes. It defines “financial account” to include deposit accounts, credit card accounts, transaction accounts, and e-wallets. (Supreme Court E-Library)

RA 12010 is important when the unauthorized withdrawal is connected to:

Social engineering, such as fake bank calls, fake support agents, fake SMS, or deceptive messages used to obtain account credentials;
Money mule accounts, where another person’s bank or e-wallet account is used to receive, transfer, or withdraw scam proceeds;
Organized scams targeting several victims;
Fraudulent use of sensitive identifying information such as passwords, bank details, card details, e-wallet information, or other electronic credentials. (Supreme Court E-Library)

The law also allows institutions to temporarily hold funds involved in disputed transactions, subject to BSP rules and time limits, and recognizes that banks and financial institutions may be liable for restitution if they fail to use adequate risk management systems or fail to exercise the required diligence. (Supreme Court E-Library)

What You Should Do Immediately

Time matters in unauthorized ATM withdrawal cases. The first few hours can affect whether the bank can block the card, trace the withdrawal, preserve CCTV, or hold suspicious funds.

Call the bank immediately. Report the unauthorized withdrawal and ask the bank to block the ATM card, freeze online access if necessary, and issue a reference number.
Change all related credentials. Change online banking passwords, app PINs, email passwords, and device passcodes. If your SIM or phone may be compromised, contact your telecom provider.
Request transaction details. Ask for the date, time, amount, ATM terminal location, transaction reference number, and whether the withdrawal was on-us, interbank, overseas, or through another network.
Preserve evidence. Take screenshots of SMS alerts, mobile app records, email notifications, account history, and bank complaint acknowledgments.
Write a timeline while events are fresh. Include when you last had the card, who had access to it, when you noticed the missing money, and what the bank told you.
Report to law enforcement. For ordinary theft or known suspects, report to the local police. For phishing, hacking, online banking, card skimming, or unknown cyber suspects, report to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DOJ Office of Cybercrime.
File a complaint with the prosecutor. A criminal case formally begins through a complaint-affidavit and supporting evidence filed with the Office of the City or Provincial Prosecutor, unless the case is directly filed in court under special circumstances.

Where to File the Complaint

Office or agency	When to go there	What they can usually do
Your bank	Immediately after discovering the withdrawal	Block the card, investigate, issue transaction details, coordinate with other banks, preserve internal records.
Local police station	If there is a known suspect or physical theft of the card	Make a blotter, assist in investigation, endorse evidence.
PNP Anti-Cybercrime Group	If phishing, hacking, skimming, online banking, or cyber access is involved	Cybercrime investigation, digital evidence handling, coordination with prosecutors.
NBI Cybercrime Division	If the case involves cyber fraud, organized scams, or unknown online offenders	Investigation, digital forensics, coordination with banks and prosecutors.
Office of the City or Provincial Prosecutor	When you are ready to file the criminal complaint	Conduct preliminary investigation and determine probable cause.
BSP Consumer Assistance Mechanism	If the issue involves the bank’s handling, refusal to act, or reimbursement dispute	Facilitate consumer complaint process against BSP-supervised institutions.

The Department of Justice lists the usual requirements for filing a complaint for preliminary investigation, including an investigation data form, complaint-affidavit or sworn statement, and supporting documents. (Department of Justice)

Documents and Evidence to Prepare

A strong complaint is built on documents. The prosecutor does not need you to prove the entire case at the filing stage, but your complaint should show enough facts and evidence to support probable cause.

Document or evidence	Why it matters
Valid government ID	Identifies you as complainant and account holder.
Complaint-affidavit	Your sworn written narration of what happened.
Bank statement or transaction history	Shows the unauthorized withdrawal and amount lost.
ATM withdrawal details	Helps identify the ATM terminal, time, and location.
SMS or email alerts	Shows when the transaction occurred and when you learned of it.
Bank complaint ticket or reference number	Shows prompt reporting to the bank.
Card blocking confirmation	Helps prove you acted quickly after discovery.
Police blotter or incident report	Supports the fact that the incident was reported.
Screenshots of phishing messages, fake links, calls, or chats	Important for cybercrime, social engineering, and RA 12010 cases.
Names of possible suspects and witnesses	Helps investigators determine who had access or opportunity.
CCTV request details	ATM CCTV is usually controlled by the bank or ATM owner and may require law enforcement or prosecutor assistance.

Your complaint-affidavit should be notarized. If you are abroad, you may need to sign before a Philippine Embassy or Consulate, or have the document notarized abroad and apostilled if required for Philippine use.

How to File the Criminal Case Step by Step

1. Get the bank’s transaction details

Ask the bank for a written record of the disputed transaction. At minimum, try to obtain:

Account name and account number, with sensitive numbers masked when appropriate;
Date and time of withdrawal;
Amount withdrawn;
ATM terminal ID;
ATM location;
Reference number;
Whether the transaction was made using your physical card, card number, online banking, or interbank network.

Banks may not immediately release CCTV or internal logs directly to you because of privacy, security, and bank secrecy concerns. Law enforcement or the prosecutor may need to request them formally.

2. Prepare a clear complaint-affidavit

Your complaint-affidavit should answer:

Who owns the account?
When did you discover the unauthorized withdrawal?
Where were you when the withdrawal happened?
Did you have the ATM card with you?
Did anyone else know your PIN?
Was the card lost, stolen, borrowed, or entrusted?
Did you receive phishing messages, suspicious calls, or OTP requests?
What did the bank say when you reported it?
How much money was lost?
Who do you suspect, if anyone, and why?

Avoid exaggeration. Stick to facts, dates, amounts, messages, and documents.

3. File with the proper law enforcement office

If the suspect is known and the act is straightforward, such as a helper or relative using your card, the local police may assist. If the facts involve cyber methods, unknown online actors, phishing, hacking, skimming, or mule accounts, go to the PNP Anti-Cybercrime Group or NBI Cybercrime Division.

Under RA 11449, banks and other access device issuers must conduct an initial investigation on reported access device fraud and furnish real-time reports to the NBI and PNP Anti-Cybercrime Group. The report should contain a narration of the fraud and identify the perpetrator if feasible. (Supreme Court E-Library)

4. File the complaint with the prosecutor

The prosecutor evaluates whether there is probable cause, meaning enough basis to believe that a crime was committed and that the respondent probably committed it.

The usual flow is:

You file the complaint-affidavit and supporting evidence.
The prosecutor reviews whether the complaint is sufficient in form and substance.
The respondent may be required to submit a counter-affidavit.
You may be allowed to submit a reply-affidavit.
The prosecutor issues a resolution.
If probable cause is found, an Information is filed in court.

Timelines vary widely. A simple case with a known suspect may move faster. Cybercrime and bank fraud cases often take longer because investigators may need bank certifications, CCTV, IP logs, device information, account ownership details, and coordination between institutions.

Can You Get the Money Back?

A criminal complaint punishes the offender, but recovery of money may require several parallel steps.

Bank reimbursement or restitution

Report immediately to the bank and ask for reversal or restitution. RA 8484 states that in case of loss of an access device, the holder must notify the issuer upon knowledge of the loss, and full compliance with the procedure can absolve the holder of financial liability from fraudulent use from the time the loss or theft is reported. (Lawphil)

Under RA 12010, institutions must protect access to clients’ financial accounts through adequate risk management systems and controls, such as multi-factor authentication and fraud management systems. The law also states that conviction is not a prerequisite to restitution when the institution is liable for failure to employ adequate controls or exercise the required diligence. (Supreme Court E-Library)

BSP complaint against the bank

If the bank does not act properly, you may escalate to the Bangko Sentral ng Pilipinas Consumer Assistance Mechanism. BSP says consumers should first report the concern to the bank’s Financial Consumer Protection Assistance Mechanism or customer service channel. If unsatisfied, they may escalate to BSP through the BSP Online Buddy chatbot or other BSP channels.

This is not the same as filing a criminal case against the thief. A BSP complaint focuses on the bank’s handling of your complaint, its consumer protection duties, and possible reimbursement or corrective action.

Civil action for damages

If the bank was negligent, or if the offender is identified but refuses to return the money, a civil claim may be pursued. In Philippine jurisprudence, banks are repeatedly held to a high standard of diligence because their business is affected with public interest and their relationship with depositors is fiduciary in nature.

In Banco De Oro Universal Bank, Inc. v. Seastres, the Supreme Court affirmed that a bank must exercise extraordinary diligence in handling depositor accounts and may be liable for unauthorized withdrawals when it fails to follow proper safeguards. (Supreme Court of the Philippines)

In Far East Bank & Trust Co. v. Chante, the Supreme Court rejected a bank’s attempt to hold a depositor liable for allegedly fraudulent ATM withdrawals where the bank failed to sufficiently prove that the depositor personally made or caused the withdrawals. The Court emphasized that the bank had the duty to ensure the safety of funds held in trust for depositors, especially where a system bug facilitated the withdrawals. (Supreme Court E-Library)

Common Mistakes That Can Hurt Your Case

Waiting too long before reporting

Delay gives the offender time to withdraw remaining funds, delete messages, dispose of the card, or move money through mule accounts. It also makes it harder to preserve ATM CCTV, system logs, and bank records.

Deleting scam messages

Do not delete SMS, emails, call logs, chat messages, fake bank links, OTP requests, or screenshots. These may prove phishing, social engineering, identity theft, or cybercrime.

Admitting you shared your PIN without explaining context

If you voluntarily gave your PIN to someone, the bank or respondent may argue that you were negligent. That does not always defeat your case, but it changes the analysis. Be precise: why was the PIN shared, for what limited purpose, when, and what withdrawal was unauthorized?

Filing only a barangay complaint

Unauthorized ATM withdrawals usually involve offenses with penalties beyond barangay conciliation thresholds. Barangay proceedings may help if the suspect is a neighbor or relative and the issue is settlement, but serious criminal cases such as access device fraud, theft, qualified theft, cybercrime, or financial account scamming should be brought to law enforcement and the prosecutor.

Suing the wrong person too early

In cyber fraud cases, the name on the receiving account may be a mule, not the mastermind. Still, mule account holders can be important respondents or witnesses. Let investigators trace where the money went before assuming the first visible account is the only culprit.

Special Situations

The suspect is a family member

You can still report the incident. Being related does not automatically make the withdrawal lawful. The key questions are whether the person had permission, what the permission covered, and whether the withdrawal exceeded that authority.

For example, if you allowed a sibling to withdraw ₱3,000 but the sibling withdrew ₱30,000, the excess withdrawal may still be criminal.

The victim is a senior citizen

If the ATM owner is elderly, bedridden, or dependent on a caregiver, investigators should closely examine whether there was abuse of confidence, undue influence, or exploitation. RA 12010 also imposes higher penalties for certain social engineering schemes when the target or victim is a senior citizen. (Supreme Court E-Library)

The victim is abroad

OFWs and foreigners often discover unauthorized withdrawals while outside the Philippines. You can still act by:

Calling the bank’s international hotline;
Blocking the card through online banking;
Sending a written dispute by email;
Executing a Special Power of Attorney for a trusted representative in the Philippines;
Signing a complaint-affidavit before the Philippine Embassy or Consulate, or using notarization and apostille procedures where appropriate.

The ATM withdrawal happened overseas

If the card was used abroad, ask the bank for the network involved and the foreign ATM location. The case may still be reported in the Philippines if the account, bank, victim, offender, or relevant acts connect to the Philippines. Evidence gathering may take longer because the bank may need to coordinate with international card networks or foreign ATM operators.

Frequently Asked Questions

What case should I file if someone used my ATM card without permission?

The most common case is access device fraud under RA 8484, as amended by RA 11449. Depending on the facts, you may also file theft, qualified theft, estafa, cybercrime, or a complaint under RA 12010.

Is unauthorized ATM withdrawal theft or estafa?

It can be either, depending on how the person got the card, PIN, or money. If the person took and used the card without consent from the start, theft is more likely. If you entrusted the card or money for a limited purpose and the person abused that trust, estafa may be considered.

Can I file a case if I gave my ATM card but not permission to withdraw that amount?

Yes. Permission to hold or use the card for one purpose is not permission to withdraw any amount. Your complaint should clearly explain the exact authority given and how the person exceeded it.

What if the person is my spouse, sibling, child, or parent?

A family relationship does not automatically authorize ATM withdrawals. The issue is consent. However, family cases may involve practical issues such as proof of permission, shared finances, settlement pressure, and witness cooperation.

Do I need CCTV from the ATM before filing?

Not always. You can file based on your affidavit, bank records, transaction alerts, and other documents. However, CCTV can be very useful. If the bank will not release it directly, law enforcement or the prosecutor may request it.

Can the bank be forced to return my money?

Possibly, especially if the bank failed to follow security procedures, ignored red flags, failed to act on a timely report, or lacked adequate risk controls. The proper route may include a bank dispute, BSP escalation, and if necessary, a civil action.

Should I go to the barangay first?

Usually, serious ATM fraud cases should be reported to the police, NBI, PNP Anti-Cybercrime Group, and prosecutor. Barangay conciliation is generally not the proper main remedy for serious offenses like access device fraud, qualified theft, cybercrime, or financial account scamming.

What if I do not know who withdrew the money?

You can still report the incident. Many ATM and cyber fraud cases begin with an unknown suspect. Investigators can use bank records, ATM terminal details, CCTV, receiving account information, device logs, and cybercrime tools to trace the offender.

Can I file both a criminal case and a BSP complaint?

Yes. The criminal case is against the offender. The BSP complaint concerns the bank’s handling of your dispute and its duties as a financial institution. These remedies can proceed separately.

How long does an unauthorized ATM withdrawal case take?

A bank investigation may take days to weeks, depending on the complexity. A prosecutor’s preliminary investigation may take months. If the case reaches court, it can take much longer. Cybercrime cases often take more time because digital evidence and bank coordination are needed.

Key Takeaways

The main case for unauthorized ATM withdrawal is usually access device fraud under RA 8484, as amended by RA 11449.
Other possible cases include theft, qualified theft, estafa, cybercrime under RA 10175, and financial account scamming under RA 12010.
Report to the bank immediately, block the card, preserve evidence, and get a complaint reference number.
File with the police, PNP Anti-Cybercrime Group, NBI Cybercrime Division, or the prosecutor depending on whether the case is physical theft, known-suspect fraud, or cyber-enabled fraud.
Prepare a strong complaint-affidavit supported by bank records, SMS alerts, screenshots, transaction details, and witness statements.
A criminal case punishes the offender, while bank reimbursement may require a separate bank dispute, BSP complaint, or civil action.
Do not rely only on barangay proceedings for serious ATM fraud cases.
Act quickly because ATM CCTV, digital logs, and recoverable funds may disappear if you delay.