Unauthorized withdrawals, transfers, card charges, and e-wallet payments can move through several accounts within minutes. The most important step is to report the transaction immediately through your bank or e-wallet provider’s official fraud channel, secure every affected account, and create a written record of your complaint. Philippine law gives financial consumers rights against fraud and misuse, but reimbursement is not automatic—the result often depends on how quickly the incident was reported, whether the transaction was truly authorized, what security controls were used, and whether the funds can still be traced or held.

What Counts as an Unauthorized Transaction?

An unauthorized transaction is generally a withdrawal, payment, or electronic fund transfer made without the account holder’s knowledge and consent.

Examples include:

A transfer from your bank account that you did not initiate
An ATM withdrawal made using a cloned or stolen card
A credit card purchase from a merchant you do not recognize
An e-wallet cash-out after your account was taken over
Transactions made after a SIM swap or unauthorized device registration
Transfers initiated after criminals gained access through phishing, malware, or stolen credentials

Under BSP Circular No. 1195, an unauthorized electronic fund transfer is one initiated without the sender’s actual or legally attributable knowledge and consent.

However, not every disputed transaction is legally classified in the same way.

Situation	How it is usually treated
Someone accessed your account and transferred funds without permission	Unauthorized transaction
You were deceived into transferring money to a scammer	Social-engineering or scam-induced transaction
You accidentally entered the wrong account number	Erroneous transaction
Your account was debited twice for one payment	Multiple-debit or processing problem
You paid a legitimate merchant but did not receive the product	Merchant or contractual dispute
A transaction appears only as “pending”	Processing issue unless it later posts without authorization

This distinction matters because different investigation, fund-holding, reversal, and chargeback procedures may apply. For example, the rapid return timelines under BSP Circular No. 1195 for rejected, timed-out, or unsuccessful electronic transfers do not automatically apply to unauthorized or erroneous transactions.

Your Rights Under Philippine Financial Consumer Protection Laws

Protection against fraud and misuse

The Financial Products and Services Consumer Protection Act, or Republic Act No. 11765 of 2022, recognizes the right of financial consumers to:

Fair and equitable treatment
Clear and accurate disclosure
Protection of their assets against fraud and misuse
Protection of personal and financial information
Timely handling and resolution of complaints

These protections apply to financial products and services regulated by agencies such as the Bangko Sentral ng Pilipinas, or BSP.

Banks, e-wallet providers, credit card issuers, and other BSP-supervised institutions must maintain a Financial Consumer Protection Assistance Mechanism, commonly called an FCPAM. This is the institution’s internal complaint-handling system, and consumers must be allowed to use it without charge.

While an alleged unauthorized transaction is under final investigation, the financial institution must suspend interest, fees, and charges on the disputed amount or provide a comparable reasonable accommodation. This is especially important for disputed credit card transactions, where continuing finance charges could otherwise increase the consumer’s alleged balance.

Temporary holding of disputed funds

The Anti-Financial Account Scamming Act, or Republic Act No. 12010 of 2024, covers bank accounts, transaction accounts, credit cards, e-wallets, and other financial accounts. It addresses money-mule activity, social-engineering schemes, and other methods used to move or obtain funds through fraudulent accounts. (Lawphil)

Under the law and BSP Circular No. 1215, financial institutions may temporarily hold funds involved in a disputed electronic transfer while conducting coordinated verification.

Where the rules apply:

An initial hold may last up to five calendar days.
The hold may be extended for up to 25 additional calendar days when justified.
The total administrative holding period generally cannot exceed 30 calendar days, unless a court issues an order extending it.
The account holder may be required to submit a sworn complaint, affidavit, police report, or other supporting document during the initial holding period to support an extension.

A temporary hold is not yet a refund. Its purpose is to prevent disputed funds from being withdrawn or transferred again while the involved institutions determine what happened.

Banks are expected to exercise a high degree of diligence

The Supreme Court has repeatedly explained that banking is affected with public interest and that banks must observe a particularly high standard of diligence in handling depositors’ accounts.

In Philippine National Bank v. Pike, the Court held the bank liable for an unauthorized withdrawal where suspicious circumstances and failures in bank procedures should have prompted closer verification. In Consolidated Bank and Trust Corporation v. Court of Appeals, the Court emphasized the fiduciary nature of banking and the high standards expected under the General Banking Law. (Supreme Court E-Library)

Under Republic Act No. 12010, an institution may be required to make restitution when losses resulted from its failure to maintain adequate risk-management systems or exercise the required degree of diligence. Conversely, a financial institution that proves compliance with BSP-prescribed safeguards may have a defense against liability under the Act. A criminal conviction against the scammer is not necessarily required before institutional liability can be considered. (Lawphil)

What to Do Immediately After Discovering an Unauthorized Transaction

1. Report it through the institution’s official 24/7 fraud channel

Call the number printed on your card, use the fraud-reporting function inside the official banking app, or obtain contact information directly from the institution’s verified website.

Clearly state:

“I am reporting an unauthorized transaction. I did not initiate or consent to it. Please block further transactions, open a fraud case, and request the temporary holding and tracing of the transferred funds.”

For account-to-account electronic transfers covered by BSP Circular No. 1215, a complaint-initiated holding request should be made through the originating institution’s 24/7 fraud-reporting channel.

Do not wait until you have obtained a police report. Report to the bank or e-wallet provider first because the chance of preserving the funds decreases as the money moves through additional accounts.

2. Lock every potentially affected access point

Depending on the incident, immediately:

Lock or freeze the card through the official app
Disable online banking or e-wallet access
Ask the institution to log out all registered devices
Change your password and transaction PIN using a trusted device
Change the password of the email account connected to your financial account
Remove unfamiliar devices or beneficiaries
Ask your mobile provider whether a SIM replacement or SIM swap occurred
Request replacement cards, account credentials, or mobile banking registration when necessary

Do not reuse a password that may have been exposed. Avoid clicking links in messages claiming to be follow-ups from the bank; scammers commonly contact victims again while the complaint is ongoing.

3. Obtain a case or reference number

Ask the representative to provide:

Complaint or fraud-case reference number
Date and exact time of your report
Name or identifier of the receiving representative
Transaction reference numbers
Amount, date, time, and recipient institution
Confirmation that the account or card was blocked
Confirmation that a fund-holding or tracing request was initiated

BSP rules require the originating institution to acknowledge the complaint and provide a case reference number. The account holder should also be informed whether funds were successfully held and what other remedies remain available.

Write down the details even when the complaint was made by telephone. Follow the call with an email or in-app message so that there is a timestamped written record.

4. Preserve all evidence

Create one folder containing:

Screenshots of the unauthorized transaction
Bank or e-wallet statements
SMS and email transaction alerts
Phishing messages, websites, social-media accounts, or telephone numbers involved
Call logs and chat conversations
Device-security alerts
SIM replacement notifications
Merchant names and transaction descriptors
Copies of previous complaints and replies
A chronological account of what happened

Do not delete scam messages or reset the affected device before preserving relevant evidence. Keep original electronic files where possible because screenshots alone may not show metadata, sender information, or complete URLs.

Your written timeline should state:

When you last accessed the account normally
When you first learned of the transaction
Whether you received an OTP, login alert, or password-reset message
Whether you clicked a link, installed an application, shared a screen, or spoke with someone claiming to represent the bank
When you reported the incident
What actions the institution took

Accuracy matters. Republic Act No. 12010 penalizes malicious or knowingly false reporting of disputed transactions. (Lawphil)

5. Submit a formal written complaint to the institution

Your complaint should identify the disputed transactions individually rather than merely saying that “money disappeared.”

Include:

Your full name and masked account or card number
Transaction date and time
Amount
Transaction reference number
Recipient or merchant information shown in the records
A direct statement that you did not initiate or consent to the transaction
The date and time of your first fraud report
Your complaint reference number
The security measures already taken
Copies of supporting documents

Request specific relief:

Immediate blocking of further access
Temporary holding and tracing of transferred funds
Coordinated verification with recipient institutions
Preservation of logs and transaction records
Written investigation findings
Reimbursement or reversal when warranted
Suspension of interest, penalties, and charges on the disputed amount
Correction of any negative credit reporting caused by the disputed transaction

Do not send your complete PIN, password, OTP, CVV, or unmasked card information in an ordinary email.

6. Submit an affidavit or police report within the initial holding period

For a disputed electronic transfer, the institution may ask for a sworn complaint, affidavit, police report, or similar document to justify extending an initial five-day hold.

A useful affidavit normally states:

The identity of the account holder
Ownership of the affected account
Complete details of each disputed transfer
A categorical denial of authorization or consent
How and when the incident was discovered
Any suspected phishing, account takeover, SIM swap, or impersonation
Steps taken immediately after discovery
Confirmation that the facts are true based on personal knowledge

Because the initial holding period is short, ask the institution immediately what supporting document it requires. Notarial fees vary by location, while filing a police incident report ordinarily does not involve a filing fee.

7. Report suspected cybercrime to law enforcement

A bank complaint focuses on the transaction and the institution’s handling of your account. A criminal complaint focuses on identifying and prosecuting the persons who committed the fraud.

Reports may be made to:

The Philippine National Police Anti-Cybercrime Group
The National Bureau of Investigation Cybercrime Division
The local police station, which can issue a police or incident report
The Department of Justice Office of Cybercrime for appropriate cybercrime-related guidance

Republic Act No. 10175, or the Cybercrime Prevention Act, authorizes specialized cybercrime units of the NBI and PNP to investigate cybercrime offenses. Republic Act No. 12010 also permits BSP coordination with law-enforcement agencies in obtaining cybercrime warrants and pursuing financial-account scamming cases. (Lawphil)

Bring printed and electronic copies of the transaction records, complaint references, messages, telephone numbers, account identifiers, and your timeline.

What Happens After You Report the Transaction?

For covered electronic fund transfers, the process may involve several institutions because the money may have passed through a recipient account and then through one or more subsequent accounts.

Stage	What may happen
Immediate complaint	The originating institution verifies your identity, restricts access, and opens a fraud case
Initial tracing	Transaction details are sent to the recipient institution and, when necessary, subsequent institutions
Initial holding period	Identifiable funds may be held for up to five calendar days
Extended holding period	The hold may be extended by up to 25 days when the evidence justifies continued verification
Coordinated verification	Institutions review account ownership, transaction patterns, authentication records, beneficiary activity, and possible money-mule indicators
Resolution	The hold may be lifted, funds may be returned under applicable rules, or the parties may be advised that further legal proceedings are needed

When funds are successfully held, coordinated verification should generally be completed within 30 calendar days. When no funds were held, verification generally remains subject to a 30-day period, which may be extended to a total of 60 days for meritorious reasons.

Recovery may be difficult when the funds have already been withdrawn in cash, converted into virtual assets, sent abroad, or distributed across numerous accounts. This is why a report made within minutes may produce a very different result from one made several days later.

Does the Bank Have to Refund the Money?

A disputed transaction does not automatically result in reimbursement. The institution will usually examine:

Whether the transaction was actually initiated by the account holder
Whether an OTP, PIN, password, biometric, or registered device was used
Whether the credentials were stolen or obtained through deception
Whether the transaction was inconsistent with the customer’s normal behavior
Whether the institution detected unusual devices, locations, transaction velocity, or beneficiary activity
Whether required authentication and fraud-management controls were functioning
Whether the customer promptly reported the incident
Whether the customer ignored clear and repeated security warnings
Whether bank employees or systems failed to follow required procedures

BSP regulations expect institutions to use risk-management measures capable of identifying unusual transaction frequency, device or contact-information changes, geolocation anomalies, blacklisted accounts, and behavior inconsistent with the customer’s normal activity.

What if you shared the OTP?

Sharing an OTP can significantly complicate the claim, but it does not always settle the entire legal issue.

The institution may argue that use of the OTP shows authorization or that the customer failed to protect security credentials. The consumer may respond that the OTP was obtained through impersonation, account takeover, screen sharing, or another social-engineering scheme and that there was no informed consent to the actual transaction.

The investigation should still consider:

What the OTP message stated
Whether the amount and recipient were clearly disclosed
Whether the customer believed the OTP was for another legitimate purpose
Whether a new device, beneficiary, or mobile number had just been registered
Whether the transaction should have triggered fraud controls
Whether the institution exercised the required degree of diligence

A bank record showing that a transaction was technically “successful” proves that the system processed it; it does not by itself resolve every question about legal consent, fraud, or institutional negligence. Under Republic Act No. 11765, contractual provisions that attempt to waive core rights to complaint resolution, information, or data protection are unenforceable.

Scam-Induced Transfers and Mistaken Transfers

You personally transferred the money to a scammer

Common examples include fake investments, impersonation of bank employees, online-selling scams, romance scams, employment scams, and messages from compromised social-media accounts.

Although you physically pressed the transfer button, Republic Act No. 12010 specifically addresses social-engineering schemes. Report the transfer immediately and request fund holding and coordinated verification. Recovery is still uncertain, particularly when the recipient has already moved the money, but the transaction should not be dismissed merely because the victim performed the final step. (Lawphil)

You transferred money to the wrong account

An accidental transfer is generally an erroneous transaction, not an unauthorized transaction. The receiving institution usually cannot simply debit the recipient’s account and return the money without a legal basis, the recipient’s consent, or an appropriate court order.

Report the mistake immediately. The institutions may contact the recipient and attempt recovery, but do not threaten, publicly shame, or impersonate authorities when communicating with the recipient.

The dispute concerns a credit card purchase

The temporary fund-holding framework in BSP Circular No. 1215 primarily concerns electronic transfers from one financial account to another. It generally does not cover an ordinary credit card purchase, except in limited situations involving an electronic fund transfer through an automated clearing house.

For a disputed card purchase:

Block or replace the card
Notify the issuer immediately
Identify each charge
Submit the issuer’s dispute form
Provide any merchant correspondence
Request suspension of interest and charges on the disputed amount
Ask whether a card-network chargeback process is available

A merchant dispute—such as non-delivery of a product—is different from a claim that the cardholder never made the purchase.

Common Mistakes That Reduce the Chance of Recovery

Avoid these frequent problems:

Waiting for a police report before notifying the bank
Reporting only by telephone and keeping no written record
Failing to ask for a complaint reference number
Describing a scam-induced transfer as merely a “wrong transfer”
Deleting phishing messages or resetting a device before preserving evidence
Continuing to communicate through links or numbers sent by the scammer
Paying supposed “fund recovery agents” who demand advance fees
Sending complete passwords, OTPs, PINs, or card details by email
Ignoring requests for an affidavit during the initial holding period
Posting the recipient’s personal information publicly
Filing inconsistent versions of the incident with the bank, police, and BSP
Assuming that an automated denial is the institution’s final legal position

A denial should state the factual and legal basis for the result. Ask for the investigation findings, the authentication method relied upon, and the institution’s response to the specific irregularities raised in your complaint.

How to Escalate the Complaint to the BSP

The BSP Consumer Assistance Mechanism is a second-level recourse. This means the consumer must first give the concerned BSP-supervised institution an opportunity to address the complaint through its FCPAM.

Step 1: Complete the institution’s complaint process

Keep:

The original complaint
Complaint reference number
Institution’s acknowledgment
Follow-up messages
Final response or denial
Evidence that the institution failed to respond within its stated period

Step 2: File with the BSP Consumer Assistance Mechanism

According to the BSP guide on filing a financial consumer complaint, consumers may use the BSP Online Buddy, or BOB, through the BSP’s official channels.

A consumer who cannot use BOB may complete the BSP Consumer Assistance Request form and send it with:

Proof that the complaint was first submitted to the institution
The institution’s response, if any
Transaction records
Supporting correspondence and evidence
A clear explanation of the requested resolution

The BSP warns consumers not to disclose passwords, PINs, complete account or card numbers, or sensitive identification details unnecessarily. High complaint volume may also affect response times.

Step 3: Consider BSP mediation or adjudication

If consumer assistance does not resolve the dispute, Republic Act No. 11765 provides additional remedies.

Mediation is a voluntary process in which a neutral mediator helps the consumer and the financial institution explore settlement. BSP guidance indicates that mediation commonly takes approximately 50 to 60 days overall, depending on the parties and the complexity of the dispute.

Adjudication is a more formal process for purely civil claims involving reimbursement of money. The BSP may adjudicate claims up to ₱10 million, excluding legal interest, attorney’s fees, and litigation expenses. Formal adjudication commonly takes approximately 180 to 240 days, or six to eight months, from complaint to decision.

A formal adjudication complaint must generally be verified under oath, supported by evidence, and accompanied by a certification against forum shopping. “Forum shopping” means pursuing substantially the same claim in multiple tribunals in a manner prohibited by procedural rules.

A lawyer is not formally required for BSP mediation or adjudication, although representation may be useful where the amount is substantial, the facts are technically complex, or parallel civil and criminal proceedings are involved.

Possible Criminal and Civil Remedies

Financial-account scams may involve violations of:

Republic Act No. 12010, the Anti-Financial Account Scamming Act
Republic Act No. 10175, the Cybercrime Prevention Act
Republic Act No. 8484, the Access Devices Regulation Act
Republic Act No. 9160, as amended, the Anti-Money Laundering Act
The Revised Penal Code provisions on estafa, falsification, or related offenses

Republic Act No. 12010 expressly allows prosecution under other applicable penal laws when the facts support additional offenses. (Lawphil)

A civil claim against a financial institution may also arise from breach of contract, negligence, or failure to observe the diligence required by law and banking jurisprudence. Under Articles 1170 and 1173 of the Civil Code, a party may be liable for fraud, negligence, delay, or violation of the terms of an obligation.

The proper remedy depends on the amount claimed, the relief requested, the evidence, and whether proceedings are already pending before the BSP, a court, or another agency. Criminal reporting against the scammer does not replace the consumer complaint against the financial institution, and the bank complaint does not by itself prosecute the offender.

Claims under Republic Act No. 11765 generally prescribe five years from the transaction or from discovery of deceit or nondisclosure, subject to an absolute period of ten years from the violation. These outer limits should never be treated as permission to delay because transaction logs, surveillance records, account balances, and opportunities to hold funds can disappear much sooner.

What If You Are Outside the Philippines?

A Filipino or foreign account holder abroad should still report the incident immediately through the institution’s official digital or international fraud channels.

Practical steps include:

Record the Philippine date and time of every call
Ask whether a scanned affidavit is acceptable initially
Request instructions for submitting original documents
Authorize a representative in the Philippines through a special power of attorney when necessary
Ask the institution whether the authority must be notarized, apostilled, or authenticated
Keep evidence of travel, overseas residence, or physical location when it helps show that an ATM withdrawal or in-person transaction in the Philippines was impossible

For documents executed in a country that is a party to the Apostille Convention, a competent foreign authority may issue an apostille for use in the Philippines. Documents from other countries may require authentication through the appropriate Philippine embassy or consulate, depending on the receiving institution’s requirements. (Philippine Embassy New Delhi)

Frequently Asked Questions

How quickly should I report an unauthorized bank transaction?

Report it immediately—preferably within minutes of discovering it. The law may permit an initial five-day holding period, but that does not mean you have five days to report. The funds may be withdrawn or transferred several times before your complaint reaches the recipient institution.

Can a bank freeze the recipient’s account?

A financial institution may temporarily hold disputed funds under Republic Act No. 12010 and BSP Circular No. 1215 when the required conditions are met. The institution may also restrict account access during verification. The hold generally cannot exceed 30 calendar days without a court order.

Is a police report required before the bank investigates?

You should not wait for a police report before notifying the bank. The institution should open the fraud case upon receiving your report. A sworn complaint, affidavit, or police report may later be required to support an extended hold or further investigation.

Will the bank refund me if I did not share an OTP?

Not automatically. The absence of an OTP may support your claim, but the institution will still examine device access, authentication records, transaction patterns, card use, account security, and other evidence.

Will I lose the case if I shared my OTP?

Not necessarily, but sharing an OTP can weaken the claim. The investigation should still determine what the OTP authorized, how it was obtained, whether social engineering occurred, and whether the institution’s security and fraud-detection measures were adequate.

What if the bank says the transaction was “valid” because it came from my registered phone?

A registered device is relevant evidence, but it is not always conclusive. Devices can be compromised, sessions can be hijacked, remote-access applications can be abused, and criminals can manipulate device registration or mobile numbers. Ask for a written explanation addressing the specific signs of account compromise.

Can I complain directly to the BSP without first complaining to the bank?

The BSP generally requires the consumer to use the financial institution’s FCPAM first. Your complaint reference number, written complaint, and the institution’s response should be included when escalating the case.

How long can a bank investigation take?

For electronic transfers covered by the coordinated verification rules, verification generally has a 30-day framework when funds are held. When no funds are held, the period may be extended to a total of 60 days for meritorious reasons. Other disputes, including credit card cases, may follow different timelines.

Can the BSP order reimbursement?

The BSP may adjudicate purely civil claims for reimbursement of up to ₱10 million, excluding legal interest, attorney’s fees, and costs. The consumer must ordinarily complete the BSP consumer-assistance stage before seeking mediation or adjudication.

What if I accidentally transferred money to the wrong account?

Report it immediately, but understand that this is usually an erroneous transaction rather than an unauthorized one. The receiving institution may attempt to contact the recipient, but return of the money may require the recipient’s consent or appropriate legal proceedings.

Key Takeaways

Report unauthorized transactions immediately through the institution’s official 24/7 fraud channel.
Ask for account blocking, fund tracing, temporary holding, and a complaint reference number.
Preserve transaction records, messages, device alerts, and a detailed timeline.
Submit a written complaint even when you already reported by telephone.
Provide an affidavit or police report promptly when requested during the initial holding period.
An initial hold may last up to five days and may be extended to a total of 30 days without a court order.
A temporary hold is not the same as a refund.
Sharing an OTP may complicate the claim, but it does not automatically eliminate every consumer right.
The financial institution must investigate its own security controls and exercise the high degree of diligence required of banks and other regulated providers.
Escalate an unresolved complaint to the BSP only after first using the institution’s Financial Consumer Protection Assistance Mechanism.