Quick answer

Unauthorized ATM withdrawals most commonly support a complaint for access device fraud under Republic Act No. 8484, as amended by Republic Act No. 11449. An ATM or debit card, account number, and personal identification number (PIN) are “access devices.” Fraudulently accessing an ATM or debit-card account is punishable even if no money is ultimately lost.

Depending on how the withdrawal happened, the same incident may also involve:

Theft under Article 308 of the Revised Penal Code, when another person’s money was taken without consent and with intent to gain;
Qualified theft under Article 310, but only when the taking involved a legally sufficient grave abuse of special trust or confidence;
Card skimming or use of a counterfeit access device under RA 8484, as amended;
Social engineering under the Anti-Financial Account Scamming Act, if deception was used to obtain the victim’s PIN, card details, password, or other sensitive information;
Illegal access, computer-related fraud, or computer-related identity theft under the Cybercrime Prevention Act, if the offender unlawfully accessed or manipulated a computer system or identifying information; or
Robbery, instead of theft, if violence, intimidation, or force was used to obtain the card, PIN, or money.

The correct charge depends on the evidence—not merely on what the complainant calls the incident. Police investigators and prosecutors determine which offenses the established facts support.

The principal offense: access device fraud

Republic Act No. 8484, as strengthened by Republic Act No. 11449, directly regulates fraudulent use of access devices.

The amended law expressly treats a payment card used for ATM cash withdrawals as an access device. Section 9(s) prohibits fraudulently accessing, with or without authority, an ATM account, debit-card account, online-banking account, credit-card account, or application. The offense does not require a completed monetary loss.

This provision can apply when, for example, a person:

Takes or keeps someone else’s ATM card and uses the PIN without permission;
Uses a card and PIN that were initially entrusted for a limited purpose but exceeds that authority;
Uses stolen card information to create or operate a duplicate card;
Secretly obtains account credentials and uses them to withdraw cash; or
Continues using account access after the owner has withdrawn permission.

The prosecution must still prove the accused’s identity and the fraudulent character of the access. An ATM journal showing that a withdrawal occurred does not, by itself, establish who operated the machine.

Possible penalties under the amended access-device law

The exact penalty depends on the prohibited act and surrounding circumstances. For a first offense under Section 9(s), the amended Section 10 generally provides imprisonment of six to ten years and a fine of ₱500,000 or twice the value obtained, whichever is higher, without prejudice to civil liability.

Different penalties apply to counterfeiting, skimming, possession of multiple unauthorized devices, repeat offenses, and economic sabotage. Economic sabotage under RA 8484 may arise when the offense involves hacking a bank’s system, skimming affecting at least 50 payment cards, or prohibited acts affecting at least 50 specified accounts or cards. It carries life imprisonment and a fine within the statutory range.

These are statutory ranges, not predictions of a sentence. The charge proven, the date of the acts, the allegations in the Information, and applicable sentencing rules all matter.

When theft may also apply

Article 308 of the Revised Penal Code covers the taking of personal property belonging to another, without the owner’s consent, with intent to gain, and without violence, intimidation, or force upon things.

An unauthorized withdrawal may therefore be investigated as simple theft when the evidence shows that the offender intentionally took money belonging to another person without permission. The Supreme Court has recognized that prosecution under a special law such as RA 8484 does not automatically prevent prosecution under the Revised Penal Code where the facts and legal elements support it. See Laurel v. Abrogar, G.R. No. 155076.

Theft penalties are based substantially on the value taken, using the thresholds introduced by Republic Act No. 10951. A lawyer or prosecutor should calculate the applicable penalty from the precise amount and the acts alleged rather than relying on an informal online penalty table.

Qualified theft is not automatic

Unauthorized ATM withdrawals are sometimes loosely described as “qualified theft,” especially when the suspected offender is a relative, caregiver, household member, or employee. That label is not automatically correct.

Qualified theft based on grave abuse of confidence requires proof of a relationship involving special trust or a higher degree of confidence, plus grave exploitation of that trust in committing the taking. Ordinary access, employment, friendship, cohabitation, or knowledge of the PIN may not be enough.

In Balagtas v. People, G.R. No. 257483, the Supreme Court stressed that merely occupying a position involving money does not necessarily establish the special trust and grave abuse required for qualified theft. Without sufficient proof, the proper offense may be simple theft.

Relevant evidence may include:

Why the accused possessed the card or knew the PIN;
The precise limits of any permission given;
Whether the accused had exclusive or specially entrusted access;
Messages or instructions showing the permitted purpose;
Prior dealings between the parties; and
Acts showing that the offender deliberately exploited the special trust.

When card skimming or counterfeiting applies

Section 9(q) of RA 8484, as amended, specifically prohibits skimming, copying, or counterfeiting a credit, payment, or debit card and obtaining its information with intent to access the account. Liability may arise whether or not cash was withdrawn or monetary injury occurred.

Skimming may be indicated by:

The genuine card remaining with the owner while withdrawals occur elsewhere;
Several affected customers who used the same ATM or terminal;
A suspected overlay, false keypad, hidden camera, or card-reading device;
Withdrawals in a distant place within an implausible time; or
Bank findings that a duplicate or counterfeit card was used.

Do not touch, remove, or dismantle a suspected skimming device. Move to a safe place, notify the ATM operator or bank, and report it to law enforcement. Photograph it only if this can be done safely.

When phishing or social engineering applies

The Anti-Financial Account Scamming Act, Republic Act No. 12010, applies when someone obtains sensitive identifying information through deception or fraud, resulting in unauthorized access and control over a financial account.

A social engineering charge may be appropriate when an offender:

Pretends to represent a bank or financial institution;
Sends a fraudulent SMS, email, social-media message, or instant message;
Directs the victim to a fake banking page;
Deceives the victim into revealing a PIN, password, card details, or verification code; or
Uses the acquired information to take control of the account.

Under RA 12010, social engineering is generally punishable by imprisonment of ten to twelve years, a fine of ₱500,000 to ₱1 million, or both, at the court’s discretion. Higher statutory ranges apply when the target was a senior citizen, and life imprisonment or a higher fine may apply when the circumstances constitute economic sabotage.

The law also covers money-mule activities when a person knowingly uses, lends, sells, rents, or permits the use of a financial account to receive, transfer, or withdraw proceeds from crimes or social engineering schemes.

A simple unauthorized ATM withdrawal is not automatically an AFASA social-engineering case. There must be evidence of the deceptive acquisition of sensitive information or another act specifically covered by that law.

When the Cybercrime Prevention Act may apply

Republic Act No. 10175 may apply if the incident involved conduct such as:

Accessing a computer system without right;
Unauthorized input, alteration, or deletion of computer data;
Interfering with a computer system and causing damage with fraudulent intent; or
Intentionally acquiring, using, or misusing another person’s identifying information without right.

The mere fact that an ATM contains a computer does not eliminate the need to prove the elements of the particular cybercrime charged. A routine withdrawal using a stolen physical card and known PIN may present a different legal theory from hacking a bank’s system, altering transaction data, or installing malware.

Theft, estafa, or robbery?

Theft

Theft is generally the better Revised Penal Code theory when the offender merely takes money without consent and without violence, intimidation, or force.

Estafa

Estafa may become relevant where the victim voluntarily delivered money or property because of deceit, or where the offender received it under a legal obligation to deliver or return it and later misappropriated it. Merely knowing a PIN or being handed an ATM card does not automatically make every unauthorized withdrawal estafa. The nature of possession, the agreement between the parties, and when the fraudulent intent arose must be examined.

Robbery

Robbery may apply if the offender used violence or intimidation against a person, or legally recognized force upon things, to take property. For example, forcing a victim to surrender a card and PIN at knifepoint is materially different from secretly taking a card from a wallet.

If threats, physical violence, abduction, or coercion are continuing, personal safety comes first. Call 911 or go to the nearest police station rather than confronting the offender.

Special issue when the suspected offender is a family member

Article 332 of the Revised Penal Code creates an absolutory cause for theft, swindling, and malicious mischief committed by certain relatives, subject to its exact statutory conditions. It generally concerns spouses, ascendants and descendants, certain relatives by affinity, and siblings or siblings-in-law living together. It creates civil liability even when the specified Revised Penal Code offense is exempt from criminal liability.

This rule is narrow and fact-dependent. It does not protect strangers who participate, does not convert robbery into a purely civil matter, and should not be assumed to defeat liability under a separate special law such as RA 8484. The parties’ legal relationship and living arrangements must be verified.

What to do immediately after discovering a withdrawal

1. Secure the account

Contact the bank through the number printed on the card, the bank’s official website, or its official application. Ask the bank to:

Block the ATM or debit card;
Disable compromised online or mobile access;
Reset credentials and authentication methods;
Check for other unauthorized transactions;
Record the dispute as fraud; and
Give you a complaint or case-reference number.

Change the password of the email account linked to the bank if it may also be compromised. Do not use links or telephone numbers contained in a suspicious message.

2. File a written dispute with the bank

Identify each transaction by date, approximate time, ATM location, and amount. Clearly state that you did not make or authorize it. Ask the bank to preserve and investigate:

ATM electronic journals and transaction logs;
Authentication and switch records;
Card-status and PIN-attempt records;
Available ATM or branch CCTV;
Device, location, and fraud-monitoring data;
Card-capture or terminal-maintenance reports; and
Records identifying the acquiring bank or ATM operator.

Ask for written acknowledgment and the bank’s final written findings. A telephone call is useful for stopping further losses, but it should be followed by a documented complaint.

3. Preserve your own evidence

Keep original files whenever possible. Preserve:

The card and the envelope or place where it was stored;
Account statements and transaction alerts;
Screenshots showing the complete message, sender, date, and time;
Emails, chat histories, call logs, and telephone numbers;
URLs of suspected phishing pages;
Bank complaint numbers and correspondence;
Receipts showing where you were at the relevant time;
Travel, employment, attendance, or location records;
Names of people who can verify your whereabouts;
Police blotter entries and affidavits; and
A chronological account written while the events are fresh.

Do not alter screenshots, annotate original files, delete suspicious messages, or surrender the only copy of a document. Provide copies and retain an organized master set.

4. Report the incident to law enforcement

A victim may report to the local Philippine National Police station. Technology-assisted incidents may also be referred to the PNP Anti-Cybercrime Group or the National Bureau of Investigation’s cybercrime investigators.

Bring a valid ID, the disputed-transaction details, proof that the account belongs to you, bank correspondence, and available digital evidence. If you know or suspect the offender, explain the factual basis; do not state speculation as fact.

A police blotter records the report but is not itself the criminal case. The evidence may be referred to the appropriate city or provincial prosecutor for evaluation and filing of charges.

5. Escalate an unresolved bank complaint to the BSP

The financial institution’s consumer-assistance mechanism is the first-level recourse. If its response is absent or unsatisfactory, the complaint may be escalated through the BSP Consumer Assistance Mechanism, including BSP Online Buddy or the official complaint channels listed there.

Attach the complaint previously sent to the bank, the bank’s reply if any, and supporting documents. BSP escalation concerns the institution’s handling of the financial dispute; it does not replace a criminal complaint against the offender.

Can disputed funds be temporarily held?

Under RA 12010 and current BSP rules, supervised financial institutions have procedures for temporarily holding traceable disputed funds and conducting coordinated verification. Current BSP regulations provide for an initial holding of up to five calendar days and, when properly extended, an additional period that brings the total holding period to no more than 30 calendar days unless a competent court orders a further extension.

Supporting documents—such as a sworn complaint, affidavit, or police report—may be required during the initial holding period. Reporting immediately is therefore important.

This mechanism is most useful when disputed funds remain in, or can be traced through, beneficiary accounts. It may offer little practical recovery where cash has already been dispensed from an ATM and removed from the financial system. A temporary hold also does not itself decide criminal guilt or guarantee reimbursement. See the BSP’s current Manual of Regulations for Payment Systems.

What evidence commonly proves—or fails to prove—the case?

Useful bank evidence may establish that a particular card or credential was used, the ATM involved, and the transaction time. Identifying the human operator may require additional proof such as:

Clear CCTV or other video;
Possession or recovery of the card;
Admissions or contemporaneous messages;
Location records;
Witness testimony;
A pattern of withdrawals benefiting the suspect;
Recovery of a counterfeit card or skimming equipment; or
Digital-forensic findings linking a device or account to the activity.

Courts do not treat questionable bank records as automatically conclusive. In Far East Bank and Trust Company v. Chan, G.R. No. 170598, the Supreme Court closely examined inconsistencies in the bank’s ATM evidence in a civil dispute. The decision illustrates why transaction records must be internally reliable and connected to the person alleged to have made the withdrawals.

A victim’s disclosure of a PIN does not automatically prove consent to every withdrawal. Conversely, a denial alone may not identify the offender. The precise permission given, transaction records, credibility of witnesses, and corroborating evidence all matter.

Common mistakes to avoid

Waiting for the next bank statement before blocking the card;
Reporting only by telephone and keeping no reference number;
Saying the card was “stolen” when it was voluntarily entrusted for a limited purpose;
Accusing a particular person without explaining the supporting facts;
Deleting phishing messages after taking only a cropped screenshot;
Posting the suspect’s identity, account details, or CCTV images publicly;
Assuming that knowledge of the PIN conclusively proves authorization;
Assuming every employee or trusted person is automatically liable for qualified theft;
Treating a bank’s denial of reimbursement as proof that no crime occurred;
Believing a police blotter alone starts and completes the prosecution;
Filing a knowingly false fraud report to reverse an authorized transaction; or
Confronting a suspect and risking violence or destruction of evidence.

RA 12010 separately penalizes malicious or bad-faith reporting of completely unwarranted information that results in the temporary holding of funds.

When legal help is urgent

Consult a Philippine lawyer promptly when:

The disputed amount is substantial or involves many transactions;
The bank says the correct card and PIN were used and denies the claim;
CCTV, ATM logs, or telecommunications records may soon be overwritten;
The suspected offender is an employee, caregiver, agent, spouse, or close relative;
The card was voluntarily handed over for a limited transaction;
The withdrawals crossed cities, provinces, or countries;
Several victims or accounts are involved;
The incident includes phishing, malware, card cloning, or a money-mule account;
You have received a subpoena, prosecutor’s notice, or demand to submit an affidavit;
You are being accused of making the withdrawals; or
Threats, coercion, or physical harm accompanied the incident.

A person accused should preserve the card, devices, messages, receipts, and location evidence and obtain counsel before giving a detailed sworn statement. Do not delete data, fabricate an explanation, contact witnesses to influence their accounts, or attempt to access the complainant’s account.

Frequently asked questions

Is using another person’s ATM card always illegal?

No. An owner may authorize another person to make a particular withdrawal. Liability depends on the scope of that authority and the user’s intent. Using the card for a larger amount, additional withdrawals, or a different purpose may be unauthorized even if possession of the card began lawfully.

What if the owner voluntarily disclosed the PIN?

PIN disclosure is relevant but is not necessarily blanket consent. Messages, instructions, prior practice, amounts, dates, and the purpose for which access was given should be preserved.

Is an actual cash loss required under RA 8484?

Not for every prohibited act. Fraudulent access under Section 9(s), and skimming under Section 9(q), may be punishable even when the attempt does not result in a completed withdrawal or monetary injury.

Can both access device fraud and theft be investigated?

Yes. One incident may implicate more than one law when the facts satisfy their respective elements. Whether separate charges may properly proceed depends on the acts alleged, the elements of each offense, and constitutional protections against double jeopardy. The prosecutor and, ultimately, the courts resolve those questions.

Is qualified theft the usual charge when a caregiver or employee knew the PIN?

Not necessarily. Qualified theft requires proof of grave abuse of a special relationship of trust. A job title, ordinary familiarity, or routine access does not automatically satisfy that requirement.

Does the bank have to refund every unauthorized ATM withdrawal?

No automatic result applies to every dispute. Liability may depend on the authenticity and security of the transaction, the parties’ compliance with their obligations, the bank’s systems and diligence, the customer’s conduct, and the available evidence. The criminal case against an offender and the consumer or civil claim against a bank are related but legally distinct.

Where should the complaint be filed?

Start by notifying the bank immediately. Report the suspected crime to the police, the PNP Anti-Cybercrime Group, or the NBI where appropriate. A criminal complaint may then be evaluated by the proper prosecutor’s office under the applicable criminal-procedure rules. Venue depends on where essential elements occurred and on the law charged.

Is there a fixed deadline for reporting the withdrawal?

Bank contracts and dispute procedures may impose reporting periods, while criminal offenses have separate prescriptive periods. There is no sensible reason to wait: immediate reporting improves the chance of blocking further transactions, preserving CCTV and electronic records, and tracing any remaining funds.

Official legal sources

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. The appropriate charge and remedy depend on the evidence, transaction records, relationships involved, and applicable law on the date of the acts. Sources and procedures were checked as of September 3, 2026.