An unfamiliar charge on your Philippine credit card can be frightening, especially when the amount is large, the merchant is overseas, or the bank says the transaction was “authenticated.” Act immediately: block the card, report every disputed transaction to the issuer, preserve evidence, and submit a formal written dispute. Philippine rules give cardholders specific complaint rights, but the outcome often depends on how quickly the incident was reported and what the bank’s investigation shows.

What Is an Unauthorized Credit Card Transaction?

An unauthorized credit card transaction is a purchase, cash advance, payment, or other charge made without the cardholder’s knowledge or permission.

Common examples include:

Online purchases made using stolen card details
Charges made after a physical card was lost or stolen
Transactions using a counterfeit or skimmed card
A credit card added to someone else’s digital wallet
Account takeover after a phishing call, fake bank message, or compromised email
Cash advances or quasi-cash transactions the cardholder did not make
Repeated charges after an unauthorized subscription or merchant enrollment
Fraudulent use of a supplementary card

Not every unfamiliar charge is necessarily fraud. A merchant’s billing name may differ from its store name, a hotel or fuel station may post a temporary authorization, or a legitimate subscription may renew automatically. Check these possibilities quickly, but do not delay reporting a genuinely suspicious transaction.

Unauthorized transaction versus merchant dispute

These are handled differently:

Situation	Usual classification
You never dealt with the merchant	Unauthorized transaction or fraud
You bought something but it was defective	Merchant or consumer dispute
The merchant charged more than agreed	Billing error or merchant dispute
You cancelled a subscription but were charged again	Recurring-payment dispute
A family member used the card without clear permission	Fact-sensitive; the bank may investigate access and authority
You received the goods but want to return them	Refund or contractual dispute, not ordinarily fraud

A chargeback is the card-network process through which an issuer may seek reversal of a transaction from the merchant’s acquiring bank. It is not an automatic refund, and it does not replace your legal right to dispute the charge with the issuing bank.

Your Rights Under Philippine Law

Several Philippine laws and Bangko Sentral ng Pilipinas regulations apply.

Financial consumer rights under RA 11765

The Financial Products and Services Consumer Protection Act, Republic Act No. 11765 of 2022, recognizes a financial consumer’s rights to:

Equitable and fair treatment
Disclosure and transparency
Protection of assets against fraud and misuse
Data privacy and protection
Timely handling and redress of complaints

BSP-supervised institutions must provide assistance and relevant information concerning fraudulent or unauthorized transactions. They must also maintain a consumer-assistance mechanism for receiving, investigating, and resolving complaints.

Credit card protections under RA 10870

The Philippine Credit Card Industry Regulation Law, Republic Act No. 10870 of 2016, governs credit card issuers, acquirers, and credit card transactions. It requires issuers to maintain a customer-assistance unit and gives cardholders up to 30 calendar days from the statement date to report a billing error or discrepancy. The issuer must take action within 10 business days from receipt of the notice. (Supreme Court E-Library)

BSP Circular No. 1003 further provides that the bank must conduct a thorough investigation, make appropriate corrections, and send a written explanation or clarification within 90 days after receiving the notice and relevant records. It should do this before taking collection action on the contested amount, subject to the investigation’s result. (Supreme Court E-Library)

The 30-day period should not be treated as permission to wait. Card-network deadlines, merchant records, surveillance footage, device logs, and fraud-tracing opportunities may be lost with delay.

Protection while the investigation is pending

Under BSP Circular No. 1160, BSP-supervised institutions should assess disputed transactions fairly and transparently. Depending on the circumstances, protective measures pending investigation may include:

Suspending disputed interest, fees, or charges
Placing a hold on disputed funds that remain recoverable
Providing a provisional credit or temporarily holding the disputed amount
Blocking the account or taking other measures to prevent further loss

If the transaction is found to be unauthorized or fraudulent, the institution should correct or reverse it, including related interest, charges, and fees, and make any provisional credit permanent. These accommodations are not necessarily applied automatically, so request them expressly in the written dispute.

Criminal laws covering credit card fraud

The Access Devices Regulation Act, Republic Act No. 8484 of 1998, prohibits acts such as using counterfeit or unauthorized access devices, trafficking in stolen access devices, altering transaction records, and disclosing card information without authority.

Republic Act No. 11449 of 2019 expanded the prohibited acts to cover skimming, possession of fraud-related software or devices, fraudulent access to credit card and online banking accounts, and hacking. (Lawphil)

Where fraud was committed through a computer or online account, the Cybercrime Prevention Act, Republic Act No. 10175 of 2012 may also apply, particularly its provisions on computer-related fraud and computer-related identity theft. (Lawphil)

What to Do Immediately After Discovering the Transaction

1. Block or freeze the credit card

Use the issuer’s official mobile application or call the number printed on the back of the card or shown on the issuer’s official website.

Ask the issuer to:

Block the physical and virtual card
Prevent further online and cash-advance transactions
Check whether the card was enrolled in an unfamiliar digital wallet
Issue a replacement card with a new card number
Review other recent transactions for related fraud
Provide the exact date and time when the block was recorded

Do not call a number contained in a suspicious text message, email, or social-media advertisement. Fraudsters sometimes send fake “fraud alerts” to obtain the card number, CVV, password, or one-time password.

2. Obtain a report or reference number

Record:

The date and time of your call
The hotline or channel used
The representative’s name or agent number
The complaint or case reference number
The date and time the card was blocked
The bank’s promised next step and deadline

Take screenshots of the in-app report and save confirmation emails or text messages.

This evidence can become important if another charge is posted after the bank was already notified.

3. Identify every disputed transaction

Prepare a clear list rather than writing only “I was hacked.”

Information	Example
Transaction date	6 July 2026
Posting date	8 July 2026
Merchant descriptor	ABCDIGITAL*SG
Amount and currency	PHP 24,950 or USD 425
Transaction type	Online purchase
Reason disputed	Cardholder did not make, authorize, or benefit from transaction
Alert received	SMS at 2:14 a.m.
Card status	Physical card remained in cardholder’s possession

Include small “test charges.” Fraudsters sometimes make a low-value transaction before attempting a much larger one.

4. Submit a formal written dispute immediately

A hotline call blocks the card, but it may not complete the billing-dispute process. Submit the issuer’s dispute form through its secure email address, branch, application, or customer-assistance channel.

Your written dispute should state:

Your full name and masked card number
Each transaction being disputed
That you did not make, authorize, participate in, or benefit from the transaction
Whether the physical card remained with you
Whether any OTP, password, PIN, or CVV was disclosed
Whether you received a suspicious call, link, application prompt, or login alert
The time you reported and blocked the card
The relief requested, including reversal of the charge and related fees
A request for written acknowledgement and an investigation timeline

Avoid sending the complete card number, CVV, PIN, password, or OTP by ordinary email. The BSP specifically warns consumers not to send full account or card credentials when filing a BSP complaint.

5. Ask the bank to preserve and disclose relevant records

Request that the investigation consider:

Merchant name, location, and merchant category
Whether the transaction was card-present or card-not-present
Whether a chip, magnetic stripe, contactless process, digital token, or manual card entry was used
IP address, device information, and authentication records, where available
OTP delivery and validation records
Digital-wallet enrollment records
Time stamps and fraud-monitoring alerts
Proof of delivery or recipient details for an online purchase
Signature, sales slip, terminal log, or ATM record, when applicable
The reason the transaction was not blocked as suspicious

The bank may be unable to release all internal or third-party information because of security and privacy restrictions. It should nevertheless explain the basis of its decision sufficiently for the consumer to understand the result.

6. Secure related accounts

If phishing or account takeover may have occurred:

Change your online-banking password using a trusted device.
Change the password of the email account connected to the card.
Sign out other active sessions.
Remove unfamiliar devices and digital wallets.
Replace reused passwords on other services.
Contact your mobile provider if your SIM unexpectedly lost service.
Scan the affected device for malicious applications.
Review bank accounts and electronic wallets linked to the same phone number or email address.

Do not erase or reset the device until screenshots and relevant evidence have been preserved.

7. Contact the merchant in parallel

Ask the merchant to cancel the transaction, stop shipment, preserve the order records, and issue a refund where possible.

Request:

The order number
Delivery name and address
Email address or telephone number used
Proof of delivery
Refund or cancellation confirmation

A merchant refund can resolve the monetary loss faster, but do not withdraw the bank dispute until the refund has actually posted.

8. Pay the undisputed portion of the bill

Continue paying legitimate transactions and any undisputed amount due. BSP rules allow the bank to collect amounts that the cardholder has not identified as erroneous. (Supreme Court E-Library)

Ask the bank in writing how it will treat the disputed amount while the investigation is pending, including whether:

It will be removed from the minimum amount due
Interest and late charges will be suspended
A provisional credit will be issued
The account will be reported as past due

If the bank insists that the disputed amount must temporarily be paid to protect the account, request its position in writing and state clearly that any payment is being made under protest and without withdrawing the dispute.

Lost or Stolen Credit Cards

Report a lost or stolen card immediately upon discovering the loss.

Section 15 of RA 10870 states that transactions made before the loss or theft is reported are generally for the cardholder’s account. However, the implementing regulations expressly preserve the cardholder’s right to dispute such transactions. If the investigation determines that a transaction was unauthorized or fraudulent, the bank must reverse it, together with related finance charges and fees. (Supreme Court E-Library)

For transactions made after the issuer was notified, preserve proof of the exact reporting time. In Spouses Ermitaño v. Court of Appeals and BPI Express Card Corp., the Supreme Court held that prompt notice should relieve the cardholder of liability for later unauthorized use and rejected a one-sided contract term that kept liability with the consumer until the issuer notified all merchants. (Supreme Court E-Library)

What If the Bank Says an OTP Was Used?

An OTP or authentication record is important evidence, but it should not be the only issue examined.

Under BSP Circular No. 1160, liability for losses from an unauthorized transaction may be assessed by considering:

What the account holder did before, during, and after the transaction
Acts or omissions of the bank, its employees, agents, or service providers
Whether the bank and its providers complied with applicable consumer-protection and security requirements

If you did not receive or disclose the OTP, say so directly and request the delivery and authentication logs.

If you entered an OTP after being deceived by a fake bank representative, disclose that truthfully. Voluntary disclosure may weigh against the consumer, but it does not prevent examination of other circumstances, such as unusual transaction patterns, failures in fraud detection, digital-wallet enrollment, misleading communications, or security weaknesses.

A strong response to an OTP-based denial should address the bank’s actual findings:

To what number was the OTP delivered?
Was the registered number recently changed?
What device initiated the transaction?
Was the OTP for the disputed purchase or for enrolling a new device or wallet?
Did the transaction differ significantly from the cardholder’s normal activity?
Were multiple attempts or fraud alerts recorded?
What safeguards did the bank apply?

Documents to Keep for the Investigation

Document or evidence	Why it matters
Billing statement	Identifies the posted charge and statement date
Transaction alert screenshot	Shows when you first learned of the transaction
Bank complaint acknowledgement	Proves timely reporting
Completed dispute form	Defines the transaction and relief requested
Chronology of events	Makes the facts easier to investigate
Proof the card remained with you	Relevant to online, counterfeit, or cloned-card claims
Passport stamps, travel records, work logs, or receipts	May show you were elsewhere
Suspicious text, email, link, or caller details	Helps trace phishing or social engineering
Device and login alerts	May show account takeover
Merchant correspondence	May identify the buyer, delivery address, or refund
Police, NBI, or CICC report	Supports serious fraud or identity-theft allegations
Bank’s written decision	Needed for BSP escalation

The issuer may request an affidavit of unauthorized transaction or loss. Have it notarized only if the issuer’s procedure requires a sworn document. Keep the original and submit a copy unless the bank specifically requires the original.

How Long Does the Bank Investigation Take?

The applicable periods serve different purposes:

Stage	Regulatory period or practical expectation
Report billing error	Within 30 calendar days from statement date, but report immediately
Initial bank action	Within 10 business days after receipt of notice and relevant records
Full investigation and written explanation	Within 90 days under BSP credit-card regulations
Notice after conclusion of certain fraud investigations	Formal result within three banking days from conclusion
BSP Consumer Assistance Mechanism	Approximately 55–65 days
BSP mediation	Approximately 50–60 days from referral
BSP adjudication	Approximately 180–240 days or six to eight months

The 10-business-day requirement does not necessarily mean the final refund must be completed within 10 days. It means the issuer must act on the complaint; the complete investigation may take longer. (Supreme Court E-Library)

How to Escalate an Unresolved Credit Card Dispute to the BSP

You must ordinarily report the complaint first through the bank or issuer’s Financial Consumer Protection Assistance Mechanism, or FCPAM. This is the first-level remedy.

If the issuer rejects the claim, fails to respond, or does not resolve it satisfactorily, escalate the matter through the BSP Consumer Assistance Mechanism.

What to submit to the BSP

Include:

Your name and contact information
The name of the issuer
A concise chronology
The amount and transaction details
The bank complaint reference number
Proof that you first used the issuer’s FCPAM
The issuer’s final response, if any
Your dispute form and supporting evidence
The specific resolution requested

The BSP currently accepts new complaints through the BSP Online Buddy chatbot on the BSP website. Consumers without access to the chatbot may complete the BSP Complaint, Inquiry and Reply Form and send it with supporting documents to consumeraffairs@bsp.gov.ph.

The BSP-CAM facilitates communication between the consumer and the institution. A lawyer is not required. If another person will handle the case, the cardholder must provide written and signed authorization.

Mediation and BSP adjudication

If BSP-CAM ends without resolution, the matter may proceed to:

Mediation, where a BSP mediator assists the parties in negotiating a voluntary settlement; or
Adjudication, where a BSP adjudicator decides a qualifying monetary claim.

BSP adjudication covers civil financial claims seeking payment or reimbursement of up to PHP10 million, excluding legal interest, attorney’s fees, and costs. It does not ordinarily award moral or exemplary damages. Filing is free, but the formal complaint must be verified under oath, accompanied by a certification against forum shopping, and supported by evidence.

For mediation or adjudication through a representative, a Special Power of Attorney is required. A consumer residing abroad can use remote channels for the initial complaint and virtual mediation, but sworn pleadings or an overseas SPA may need notarization and appropriate authentication. Documents executed in a country participating in the Apostille Convention are commonly apostilled for use in the Philippines; documents from non-participating countries may require consular legalization.

When to Report the Matter to Law Enforcement

Report the incident to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or Cybercrime Investigation and Coordinating Center when there is evidence of:

Phishing or identity theft
A fake bank representative
SIM swapping
Hacking or malware
Counterfeit or skimmed cards
Fraudulent delivery addresses
Repeated transactions involving the same suspect
Large losses or organized fraud

A criminal report does not automatically reverse the charge, and the bank dispute does not automatically start a criminal prosecution. They are separate processes that may proceed at the same time.

The BSP’s current complaint guidance lists the PNP, NBI, and CICC as the appropriate law-enforcement channels for scam or fraud investigations.

When a Data Privacy Complaint May Be Appropriate

A complaint with the National Privacy Commission may be relevant when the incident involves a suspected data breach, unauthorized disclosure of card information, unlawful processing of personal data, or inadequate protection of customer information.

The Data Privacy Act, Republic Act No. 10173 of 2012, requires organizations processing personal information to implement reasonable organizational, physical, and technical safeguards. It also penalizes specified forms of unauthorized processing and disclosure. (Lawphil)

An NPC complaint is not a substitute for disputing the transaction with the issuer. Its focus is the handling and protection of personal data, not simply whether a credit card charge should be reversed. The NPC generally requires a verified complaint or notarized complaint-assisted form with supporting evidence. (National Privacy Commission)

Can You Sue the Bank?

A cardholder may pursue appropriate civil remedies when administrative processes do not resolve the dispute.

Under Article 1159 of the Civil Code, contractual obligations have the force of law and must be performed in good faith. Articles 1170 and 1173 address liability arising from fraud, negligence, delay, or failure to perform an obligation with the required care. (Lawphil)

Possible relief may include reimbursement of the unauthorized amount, related interest and charges, and proven damages. However, moral damages for breach of contract are not automatically awarded. Under Article 2220, the claimant generally must establish fraud, bad faith, or conduct sufficiently wanton or reckless to amount to bad faith. (Supreme Court E-Library)

A negative bank investigation alone does not necessarily prove bad faith. The quality of the investigation, the bank’s compliance with BSP rules, the evidence ignored or considered, and the bank’s conduct after notice will matter.

Common Mistakes That Weaken a Credit Card Fraud Claim

Waiting for the next statement

Report the transaction as soon as it appears in an alert or application. Waiting can allow more transactions and make recovery harder.

Reporting only by telephone

A call is essential for blocking the card, but follow it with a documented written dispute.

Giving a vague account

Specify every charge, date, amount, and reason for disputing it. Attach a clear chronology.

Deleting suspicious messages

Preserve phishing texts, emails, call logs, links, application notifications, and screenshots. Do not click the link again.

Withholding inconvenient facts

If you entered an OTP, installed an application, gave remote access, or spoke with a fake bank employee, disclose it. An incomplete account may damage credibility when the bank later retrieves its logs.

Assuming a card replacement ends all recurring charges

Ask whether merchant tokens, recurring-payment instructions, and digital-wallet credentials connected to the old card have also been disabled.

Ignoring the legitimate part of the bill

Failure to pay undisputed charges can create avoidable interest, collection, and credit-record problems.

Filing directly with the BSP before complaining to the issuer

The BSP ordinarily requires proof that the consumer first used the bank’s FCPAM. A premature complaint may be referred back to the issuer.

Frequently Asked Questions

Am I automatically liable because the transaction happened before I blocked the card?

No. A transaction before the report may initially be charged to the account, particularly in a lost-or-stolen-card case, but you retain the right to dispute it. If the investigation finds that it was unauthorized or fraudulent, it should be reversed with related charges.

Does the bank have to refund an unauthorized transaction immediately?

Not necessarily. The bank may investigate first. You may request provisional credit, suspension of disputed charges, and removal of the disputed amount from collection while the investigation is pending.

What if I reported the transaction more than 30 days after the statement date?

Submit the dispute anyway and explain the delay. The bank may rely on its contractual or regulatory reporting period, but circumstances such as late delivery of the statement, incapacity, account compromise, or delayed discovery may still be relevant. Do not assume the claim is hopeless.

Can the bank reject my claim only because an OTP was entered?

An OTP is strong evidence of authentication, but the investigation should consider the entire transaction, including device, account, wallet-enrollment, security, fraud-monitoring, and consumer-conduct records. Explain exactly how the OTP was or was not received and used.

Should I pay the disputed amount while waiting?

Pay the undisputed balance. Ask the bank in writing whether the disputed amount, interest, and penalties will be suspended. If you decide to pay temporarily to protect the account, state that the payment is under protest and that the dispute remains pending.

Can I dispute an unauthorized transaction made by my spouse or child?

Yes, but the result is fact-sensitive. The bank may examine whether that person had possession of the card, previous permission, access to the account, or authority as a supplementary cardholder. A household disagreement is not automatically treated as third-party fraud.

Can an overseas Filipino file a BSP complaint from abroad?

Yes. The initial BSP complaint may be filed through online or email channels. A representative may act with written authority, while mediation or adjudication representation requires a Special Power of Attorney.

Can a foreigner use Philippine consumer-protection procedures?

Yes, when the complaint involves a financial product or service of a BSP-supervised Philippine institution. Nationality does not remove the institution’s obligations under Philippine financial-consumer rules.

Do I need a police report before the bank will investigate?

Not always. Report to the bank immediately even if no police report is available. The issuer may later request an affidavit or law-enforcement report, particularly for large, repeated, or identity-theft-related transactions.

Will filing with the BSP erase the charge automatically?

No. BSP-CAM first facilitates resolution between the consumer and the institution. If the dispute remains unresolved, mediation or formal BSP adjudication may be available.

Key Takeaways

Block the card and report suspicious transactions immediately.
Follow the hotline report with a detailed written dispute and preserve the reference number.
Philippine credit card rules give consumers up to 30 calendar days from the statement date to report billing errors, but earlier reporting is much safer.
Ask the issuer to suspend disputed interest and charges and to consider provisional credit.
Pay legitimate, undisputed charges while the investigation is pending.
An OTP record is relevant but should be assessed together with the conduct and security measures of both the consumer and the institution.
Escalate an unresolved complaint to the BSP only after using the issuer’s consumer-assistance mechanism.
Report phishing, hacking, identity theft, skimming, and organized fraud separately to the PNP, NBI, or CICC.
Keep every statement, screenshot, dispute form, acknowledgement, merchant response, and written bank decision.