The criminal case that most directly applies to an unauthorized ATM withdrawal is usually access device fraud under Republic Act No. 8484, or the Access Devices Regulation Act of 1998, as amended by Republic Act No. 11449 of 2019. The law specifically penalizes fraudulent access to an ATM or debit-card account, whether the offender had no authority at all or initially had limited authority but used the account fraudulently. Depending on how the withdrawal was carried out, the offender may also face theft, qualified theft, cybercrime, estafa, financial-account scamming, or money-laundering charges.

Unauthorized ATM Withdrawal as Access Device Fraud

An ATM card, debit card, account number, and personal identification number or PIN are considered access devices because they allow a person to obtain money or initiate a fund transfer.

Section 9(s) of RA 8484, as amended by RA 11449, prohibits:

Accessing, with or without authority, any application, online banking account, credit card account, ATM account, or debit card account in a fraudulent manner, regardless of whether monetary loss results.

This provision is broad enough to cover common situations such as:

Using a stolen ATM card and PIN to withdraw cash;
Secretly using a relative’s, employer’s, or client’s card;
Withdrawing more than the amount authorized by the cardholder;
Accessing an ATM account through cloned card information;
Using credentials obtained through phishing or deception;
Making test transactions even if no cash is successfully withdrawn; and
Fraudulently accessing an account that temporarily has no funds.

A first offense under Section 9(s) is generally punishable by six to ten years’ imprisonment and a fine of ₱500,000 or twice the value obtained, whichever is higher, without prejudice to civil liability. The same law separately penalizes card skimming, possession of skimming equipment or malware, hacking, use of counterfeit cards, and possession of another person’s access device without authority. (Supreme Court E-Library)

The full amendments can be reviewed in the Supreme Court E-Library copy of Republic Act No. 11449.

Other Criminal Cases That May Apply

The prosecutor is not limited to the label “unauthorized ATM withdrawal.” The appropriate charge depends on how the offender obtained the card or PIN, whether the victim voluntarily handed over anything, whether an employee abused a trusted position, and where the withdrawn funds went.

Situation	Possible criminal case	Why it may apply
Someone secretly uses another person’s ATM card or account	Access device fraud under RA 8484	The ATM or debit account was accessed fraudulently
A person physically takes and keeps cash withdrawn without consent	Theft under Article 308 of the Revised Penal Code	Property was taken without consent, violence, or intimidation
A trusted employee, caregiver, cashier, or bank officer abuses a position of confidence	Qualified theft under Article 310	The taking may have involved grave abuse of confidence
The victim gives the card or PIN because of a lie or false promise	Estafa under Article 315	The victim may have voluntarily parted with access or property because of deceit
A cloned card or skimming device is used	Access device fraud, including Sections 9(q), 9(r), and 9(s)	The law expressly penalizes skimming, copying, equipment possession, and fraudulent account access
The offender hacks an account or uses digital systems to commit the offense	RA 8484 in relation to RA 10175	Crimes committed through information and communications technology may be covered by the Cybercrime Prevention Act
Credentials were obtained through phishing, fake bank calls, or deceptive messages	Social engineering under RA 12010	The Anti-Financial Account Scamming Act penalizes obtaining sensitive account information through deception
Another person knowingly receives or withdraws scam proceeds for the principal offender	Money muling under RA 12010	Knowingly using an account to receive, transfer, or withdraw criminal proceeds is punishable
The proceeds are transferred through other accounts to conceal their origin	Money laundering under RA 9160, as amended	Moving criminal proceeds may create a separate money-laundering offense

Theft or qualified theft

Under Article 308 of the Revised Penal Code, theft involves taking another person’s personal property, with intent to gain, without the owner’s consent and without violence, intimidation, or force upon things.

Theft becomes qualified theft when a qualifying circumstance exists, such as grave abuse of confidence. However, being an employee, household worker, or acquaintance does not automatically establish grave abuse of confidence. The prosecution must show that the offender used a relationship of special trust that materially facilitated the taking.

In Lingad v. People, the Supreme Court upheld findings involving unauthorized withdrawals and transfers processed by a bank employee who had access to client accounts and the bank’s computer system. The employee’s user and teller identification records, transaction documents, authority over accounts, and movement of funds were important pieces of evidence. (Supreme Court E-Library)

Estafa

Estafa is more likely when the victim voluntarily gives possession, authority, or money because of deceit or abuse of confidence.

For example, a person may tell an elderly cardholder, “I will withdraw only ₱2,000 for your medicine,” but intentionally withdraw ₱20,000 and keep the difference. Depending on the evidence, the conduct may support access device fraud, estafa, theft, or a combination of legally distinct charges.

The basic distinction is:

In theft, the offender takes property without the victim voluntarily delivering it.
In estafa, the victim ordinarily parts with property or access because of deception or an obligation that the offender later misappropriates.

Cybercrime charges

Under Section 6 of the Cybercrime Prevention Act of 2012, RA 10175, offenses under the Revised Penal Code or special laws that are committed through information and communications technology may be subject to the relevant cybercrime provisions and a higher penalty.

This becomes particularly important when the withdrawal involved:

Hacking an online or ATM account;
Malware or remote-access software;
Stolen electronic credentials;
Manipulation of banking systems;
Digital communications used to obtain the PIN; or
Coordinated transfers across several electronic accounts.

The Supreme Court has recognized fraudulent access to an ATM account under Section 9(s) of RA 8484 as an offense for which cybercrime warrants and disclosure procedures may become relevant. Investigators may need a court-authorized warrant to obtain protected computer data, subscriber information, transaction logs, or account-linking evidence. (Supreme Court E-Library)

Social engineering and money mules under AFASA

The Anti-Financial Account Scamming Act, RA 12010 of 2024, applies when criminals obtain sensitive financial information through deception, such as by pretending to represent a bank or sending phishing messages.

Social engineering under AFASA is generally punishable by ten to twelve years’ imprisonment or a substantial fine, or both. A higher penalty may apply when the victim is a senior citizen. Knowingly acting as a money mule may be punished by six to eight years’ imprisonment, a fine, or both. Economic sabotage may carry life imprisonment when the statutory circumstances are present. (Supreme Court E-Library)

AFASA does not replace RA 8484. Section 19 expressly allows prosecution under other laws, including the Revised Penal Code, RA 8484, the Anti-Money Laundering Act, and RA 10175.

What Must Be Proven in an Unauthorized ATM Withdrawal Case?

A bank statement showing an unauthorized debit proves that a transaction occurred, but it does not automatically prove who committed the crime.

For access device fraud involving an ATM withdrawal, the prosecution will normally need evidence showing that:

The account or access device belonged to another person;
The accused accessed or used it;
The access was fraudulent or outside the authority given;
The accused intended to defraud, gain, or obtain something of value; and
The offense occurred within the proper territorial jurisdiction.

Evidence connecting the suspect to the withdrawal may include:

ATM CCTV footage;
The terminal identification number and location;
Exact transaction dates and timestamps;
ATM journal and switch records;
Card, chip, or magnetic-stripe transaction data;
The suspect’s possession of the card;
Messages containing admissions or instructions;
Witness testimony;
Location, travel, work, or telephone records;
Transfers to accounts connected to the suspect; and
Recovery of cash, cloned cards, skimming devices, or written PINs.

In Far East Bank and Trust Company v. Chan, a civil case involving disputed ATM withdrawals, the Supreme Court held that the cardholder’s physical possession of the ATM card did not, by itself, prove that he personally made or caused the withdrawals, especially where a system defect was involved. In a criminal case, the prosecution carries the even heavier burden of proving guilt beyond reasonable doubt. (Supreme Court E-Library)

What to Do Immediately After Discovering an Unauthorized Withdrawal

1. Block the card and account access

Contact the bank through its official hotline, app, branch, or fraud-reporting channel. Ask the bank to:

Block or permanently deactivate the ATM card;
Reset online-banking access;
Change or revoke the PIN and passwords;
Sign out active devices;
Check for other pending transactions; and
Issue a written complaint or incident-reference number.

Section 15 of RA 8484 requires the holder to notify the issuer upon learning that an access device was lost. Compliance protects the holder from financial liability for fraudulent use occurring from the time the loss or theft is reported. (Lawphil)

2. File a written dispute with the bank

Do not rely only on a telephone call. Send a written complaint identifying:

The disputed amount;
Date and time of each withdrawal;
Account and card involved;
Why the transaction was unauthorized;
Whether the card remained in your possession;
Whether anyone knew or was given the PIN;
Your location when the transaction occurred; and
The date and time you reported the incident.

Ask the bank to preserve—not merely review—the relevant CCTV footage, ATM journal, switch logs, authentication data, transaction records, and internal investigation results.

CCTV and technical records may not be kept indefinitely. The bank may also decline to release some information directly because of privacy, bank-secrecy, or security restrictions. Police officers, prosecutors, or courts can use subpoenas, disclosure orders, and cybercrime warrants where legally necessary.

3. Preserve your own evidence

Keep the original phone, SIM card, ATM card, messages, emails, and banking notifications. Do not crop or edit screenshots in a way that removes dates, sender details, or surrounding context.

Save:

Full screenshots and screen recordings;
Exported chat histories;
Original SMS and email messages;
Bank statements before and after the withdrawal;
ATM receipts;
Call logs;
Location history;
Travel tickets or attendance records; and
Messages in which the suspect admits, explains, or offers to repay the withdrawal.

Back up the evidence, but retain the original device whenever possible.

4. Report the incident to law enforcement

A complaint may be reported to:

The local police station;
The PNP Anti-Cybercrime Group;
The NBI Cybercrime Division; or
The Cybercrime Investigation and Coordinating Center for appropriate referral.

Cybercrime units are particularly useful when the case involves skimming, phishing, unknown offenders, several banks, digital transfers, or accounts registered in different locations.

The BSP’s current consumer guide likewise directs fraud victims to report possible criminal activity to the PNP, NBI, or CICC.

5. Prepare a complaint-affidavit

A criminal complaint normally requires a detailed, sworn complaint-affidavit stating:

Who owns the account;
When the unauthorized withdrawal was discovered;
Each disputed transaction;
Why the withdrawal was unauthorized;
How the suspect is connected to the card, PIN, account, or ATM location;
What the bank and police investigation revealed;
What documents and witnesses support the accusation; and
The amount of loss and restitution requested.

Under Rule 112 of the Rules of Criminal Procedure, the complaint must be supported by the complainant’s and witnesses’ affidavits and other evidence establishing probable cause. The affidavits are generally sworn before a prosecutor or authorized government officer, or before a notary public when the authorized officials are unavailable. (Lawphil)

6. File in the proper place

Criminal venue is jurisdictional. The ATM’s location is often an important starting point because that is where the cash was dispensed, but another location may be relevant when the fraudulent access, hacking, deception, or transfer occurred elsewhere.

For transactions involving several cities, online access, foreign actors, or multiple recipient accounts, allow investigators and the prosecutor to determine where the legally material elements occurred. Filing in the wrong city or province can delay the case or create a jurisdictional challenge.

7. Continue the separate bank-reimbursement process

The bank dispute and the criminal case serve different purposes:

The criminal case determines whether an offender should be prosecuted and punished.
The bank complaint addresses account blocking, investigation, restitution, or reimbursement.
A civil claim seeks recovery of the loss and other legally recoverable damages.

Under AFASA, a covered institution may be liable for restitution when it failed to employ adequate risk controls or failed to exercise the required degree of diligence in preventing losses arising from offenses under the law. A criminal conviction is not always a prerequisite to restitution under that provision. (Lawphil)

A consumer must ordinarily report the complaint first through the bank’s Financial Consumer Protection Assistance Mechanism. An unresolved complaint may then be elevated to the BSP Consumer Assistance Mechanism through the official BSP channels.

Documents Commonly Needed

Document or evidence	Purpose
Government-issued identification	Establishes the complainant’s identity
Proof of account ownership	Shows the complainant’s connection to the affected account
Complete bank statement	Identifies the unauthorized debits and remaining balance
Bank complaint and reference number	Proves timely reporting and creates a written record
Bank’s written response	Shows findings, denial, reimbursement, or unresolved issues
SMS, email, and app notifications	Establishes transaction timing and possible account compromise
ATM receipt or transaction details	Identifies the terminal, amount, and time
Police or cybercrime incident report	Documents the report to law enforcement
Witness affidavits	Supports lack of consent, identity, possession, or admissions
Travel, attendance, or location records	May show the cardholder was elsewhere
Messages with the suspect	May prove possession, authority limits, admissions, or intent
Special power of attorney	Allows a representative to handle certain steps for a person abroad

Do not hand over the only copy of an original document without receiving an acknowledgment or evidence-receipt record.

Preliminary Investigation and Court Process

Because access device fraud under Section 9(s) carries a penalty reaching ten years, the complaint generally undergoes preliminary investigation before an Information is filed in court.

The usual sequence is:

The complaint-affidavit and evidence are filed with the prosecutor’s office.
The investigating prosecutor evaluates whether the complaint has sufficient basis.
If the case proceeds, the respondent receives a subpoena and copies of the supporting evidence.
The respondent is generally given ten days from receipt to submit a counter-affidavit.
The prosecutor may ask clarificatory questions or require additional evidence.
The prosecutor decides whether probable cause exists.
If probable cause is found, an Information is filed in the proper Regional Trial Court.
The court independently determines whether a warrant of arrest should issue.
The accused is arraigned, after which pretrial and trial follow.

Rule 112 provides short periods for some preliminary-investigation steps, including the issuance of a subpoena and submission of a counter-affidavit. Actual completion can take longer because of difficulties serving the respondent, requests for additional evidence, review proceedings, technical bank-record requests, and prosecutor caseloads. (Supreme Court E-Library)

Barangay conciliation is generally not required before filing an RA 8484 complaint. The Local Government Code excludes offenses punishable by imprisonment exceeding one year or a fine exceeding ₱5,000, while access device fraud carries penalties far above those limits. (Lawphil)

Common Situations and Legal Complications

The cardholder gave the suspect the ATM card

Giving someone the card does not necessarily authorize every transaction.

A person instructed to withdraw ₱5,000 may act fraudulently by withdrawing ₱30,000, repeatedly using the card later, checking the balance for personal purposes, or refusing to return the card. Section 9(s) expressly covers fraudulent access with or without authority, which is important when the offender originally had limited permission.

The complaint should clearly state:

What exact amount was authorized;
The authorized date or purpose;
Whether repeated use was prohibited;
When the authority ended; and
How the actual transactions exceeded the permission given.

A spouse or relative made the withdrawal

Article 332 of the Revised Penal Code creates an exemption from criminal liability for theft, swindling, and malicious mischief committed between certain relatives, including spouses, subject to the article’s conditions. Civil liability may remain.

However, the Supreme Court has emphasized that Article 332 applies only to the specific Revised Penal Code offenses listed in it. It does not automatically erase possible liability under a distinct special law such as RA 8484. The relationship, ownership of the funds, authority over the account, property regime, and exact charge must therefore be examined carefully. (Lawphil)

The card never left the owner’s possession

This may indicate:

Card skimming or cloning;
Compromised card information;
ATM tampering;
An insider transaction;
A replacement card obtained by fraud;
Account takeover; or
A banking-system or processing error.

State clearly in the bank complaint that the original card remained with you. Ask whether the transaction used the chip, magnetic stripe, fallback processing, cardless withdrawal, or another authentication method.

The ATM debited the account but dispensed no cash

A cash-not-dispensed or partial-dispense incident is not automatically a criminal withdrawal. It may be a failed transaction, ATM balancing issue, or network error.

Report the exact terminal, time, amount, and receipt message to the bank. Criminal investigation becomes more relevant if the records indicate that another person collected the cash, manipulated the machine, or used the account.

The victim is abroad

An overseas Filipino or foreign account holder may coordinate immediately with the bank and Philippine law enforcement electronically, but original affidavits, identification, and authority documents may later be required.

An affidavit or special power of attorney executed abroad may be:

Notarized at a Philippine embassy or consulate; or
Notarized locally and apostilled by the competent authority when executed in an Apostille Convention country.

Documents from a country where the Apostille Convention does not apply may require the appropriate consular authentication process. Apostilled foreign affidavits and private documents are recognized in the Philippines subject to evidentiary and procedural requirements. (Philippine Embassy)

Frequently Asked Questions

What case should I file if someone used my ATM card without permission?

The most direct case is usually access device fraud under Section 9 of RA 8484, as amended by RA 11449. Theft, qualified theft, estafa, or cybercrime charges may also apply depending on how the card and PIN were obtained and used.

Is unauthorized ATM withdrawal theft or estafa?

It is more likely theft when the money was taken without voluntary delivery. It may be estafa when the victim voluntarily provided the card, PIN, or money because of deceit or an obligation that the offender abused. Access device fraud may apply in either situation.

Can someone be charged even if no cash was successfully withdrawn?

Yes. Section 9(s) penalizes fraudulent access regardless of whether the account holder suffers monetary loss. Attempted access device fraud and possession of prohibited devices or account information may also be punishable.

What if I gave permission to withdraw a smaller amount?

Permission for one amount or one transaction does not automatically authorize a larger or later withdrawal. Document the exact limits of the authority and provide messages or witnesses showing those limits.

Does use of the correct PIN prove that I authorized the withdrawal?

Not necessarily. A PIN may be observed, disclosed through deception, recorded, stolen, or obtained together with the card. Correct PIN use is relevant evidence, but it does not by itself conclusively identify the person who made the withdrawal or establish the cardholder’s consent.

Do I have to go through the barangay first?

Generally, no. Access device fraud carries imprisonment and fines exceeding the limits for mandatory barangay conciliation.

Should I wait for the bank’s investigation before filing a police report?

No legal rule requires a victim to wait for the bank’s final decision before reporting suspected criminal activity. Filing promptly helps preserve CCTV footage, transaction records, account-linking information, and digital evidence.

Can the bank refuse to disclose the recipient or ATM records to me?

The bank may restrict direct disclosure because of privacy, bank-secrecy, and security rules. Investigators and prosecutors may obtain relevant evidence through lawful requests, subpoenas, disclosure orders, or cybercrime warrants.

Can I recover the withdrawn money through the criminal case?

Civil liability and restitution may be included with the criminal prosecution. Recovery may also come through the bank’s dispute process, an AFASA restitution proceeding where applicable, or a separate civil remedy. A criminal complaint does not guarantee immediate reimbursement.

Can a foreigner file the complaint?

Yes. Philippine criminal laws protect Filipino and foreign account holders. A foreigner abroad may need properly authenticated identification, affidavits, and a special power of attorney if a representative will handle permitted procedural steps in the Philippines.

Key Takeaways

Unauthorized ATM withdrawals are most directly prosecuted as access device fraud under RA 8484, as amended by RA 11449.
Fraudulent ATM-account access is punishable even when the offender initially had limited authority or no cash was successfully taken.
Theft, qualified theft, estafa, cybercrime, AFASA, and money-laundering charges may apply depending on the method used.
Immediately block the card, file a written bank dispute, request preservation of ATM and CCTV records, and report suspected criminal activity.
A bank debit alone does not identify the offender; CCTV, terminal records, messages, location evidence, and account links are often critical.
The bank-reimbursement process is separate from the criminal complaint and should be pursued at the same time.
Barangay conciliation is generally not required for access device fraud.
Victims abroad should prepare properly notarized, consularized, or apostilled affidavits and authority documents when required.