What to Do After a Credit Card Scam in the Philippines: Chargebacks and Legal Steps

This guide is written for the Philippine context. It explains—clearly and practically—what to do the moment you spot a fraudulent charge, how the chargeback process works with Philippine issuers, and the legal/administrative remedies available if things don’t get resolved.

Quick checklist (do these now)

Secure the card/account
- Call your bank’s 24/7 hotline from the number on the card/app.
- Ask to block the card, replace it, and disable online/overseas usage until the replacement arrives.
- Change your online banking and email passwords; enable/refresh 2-factor authentication.
Document everything
- Take screenshots of SMS/email alerts, app notifications, and the transaction details page.
- Save the statement showing the disputed charge(s).
- Note the date/time you discovered the scam and whom you spoke to at the bank.
File a dispute/chargeback request with your bank (issuer)
- Fill out the bank’s dispute form (often in-app or emailed) and submit supporting evidence.
- Send within the bank’s required window (commonly 30 days from statement date, sometimes shorter—so do it immediately).
Report to authorities (helps evidence & future investigation)
- PNP Anti-Cybercrime Group or NBI Cybercrime Division: file an incident report/complaint.
- If personal data may be compromised, notify the National Privacy Commission (NPC) and follow their guidance.
Escalate if the bank is unresponsive or denies your claim
- Use the bank’s Consumer Assistance/Complaints channel first (keep reference numbers).
- Then escalate to Bangko Sentral ng Pilipinas (BSP) consumer assistance if unresolved.

Understanding your rights and the playing field

Chargeback is a network remedy, not a statute. It’s the scheme (Visa/Mastercard/JCB/AmEx/UnionPay) process that lets your issuer pull back funds from the acquirer/merchant if certain rules are met (fraud, goods not received, etc.).
Philippine banks must follow financial consumer protection standards—fair treatment, timely complaint handling, and clear disclosure—under the Financial Consumer Protection Act and BSP regulations.
Fraud involving cards may fall under:
- Access Devices Regulation Act (R.A. 8484) – covers illegal possession/use of access devices (e.g., skimming, cloned cards).
- Cybercrime Prevention Act (R.A. 10175) – for computer-related offenses (phishing, hacking).
- Data Privacy Act (R.A. 10173) – if your personal data was compromised.
- Consumer Act (R.A. 7394) – if dealing with deceptive sales practices of local merchants.
- Revised Penal Code (Estafa) – depending on the facts (swindling/defraud).

Bottom line: You don’t need to prove a crime to file a chargeback. But reporting helps build a record and can support your case if the bank pushes back.

The chargeback process in practice (Philippine issuers)

1) Start with a cardholder dispute

You’ll submit:
- Dispute/chargeback form or affidavit
- Government ID
- Statement copy & screenshots
- Any merchant correspondence (if any)
Deadlines are strict. Submit immediately; banks often require within 30 days of statement (some within 20–30 days of posting). Late filings are commonly rejected by network rules.

2) Provisional handling by the bank

The issuer may:
- Block the card and issue a replacement.
- Post a temporary credit while investigating (policy varies by bank). Don’t assume it’s guaranteed.
- Request additional evidence or a police/NBI report (not always mandatory but helpful).

3) Issuer files a chargeback (if grounds exist)

The issuer uses network reason codes (e.g., “fraud—card not present,” “services not provided,” “not as described”).
Typical time window to file against the acquirer is often up to ~120 days from the transaction/expected service date, but it varies by scheme and reason code. Your earlier internal bank deadline matters more—don’t wait.

4) Merchant/acquirer “representment”

The merchant can fight back with evidence (e.g., delivery proof, 3-D Secure authentication logs).
If the bank still believes your claim stands, it can escalate (pre-arbitration/arbitration) under scheme rules.

5) Outcomes

Permanent credit (charge reversed) if your issuer prevails or the merchant doesn’t contest.
Re-debit (you lose) if the merchant proves the charge is valid—especially where there’s strong customer authentication (e.g., OTP/3-D Secure) and evidence suggests account takeover via shared OTP or authorized action.

Important: If you shared an OTP or approved a push notification, banks frequently claim you authorized the transaction. That’s not always the end of it—explain how deception occurred (e.g., spoofed bank caller/website) and provide your police/NBI report and forensic evidence if any.

Evidence that strengthens your dispute

Fraud discovery timeline: When you first saw it; why the delay (if any).
No possession/no benefit: You didn’t receive goods/services; you were elsewhere (provide location proof).
Technical clues: Device/IP/geolocation mismatches (request from bank/merchant if possible).
Phishing artifacts: Screenshots/links of fake sites, emails, or SMS; caller ID logs; recordings.
Merchant behavior: Unresponsive, impossible T&Cs, sudden site shutdowns.
Official reports: Police/PNP-ACG/NBI reports; NPC acknowledgment if data breach suspected.

Parallel tracks: administrative and legal remedies

A) With your bank and BSP

Bank internal complaints: Use formal complaint channels (email/webform). Ask for a written response and case number.
Escalate to BSP if the bank is unresponsive or you disagree with the outcome. Prepare:
- Complaint narrative, requested relief (e.g., reversal), copies of your submissions, and the bank’s replies.
- Keep everything polite, factual, chronological.

B) With law enforcement

PNP Anti-Cybercrime Group (ACG) or NBI Cybercrime Division File an incident report or criminal complaint. Bring ID, dispute docs, and evidence. These offices can coordinate with banks/merchants and may request data to trace perpetrators.

C) With the National Privacy Commission (NPC)

If your card data was leaked via a business’ security lapse, you can lodge a complaint or seek guidance on breach reporting, rights to access/correction/erasure (as applicable), and possible accountability of the data controller/processor.

D) With DTI or local regulators

If the merchant is Philippine-based and engaged in deceptive practices, you can complain under the Consumer Act (R.A. 7394).
For telecom/SMS scamming vectors, also report to your telco’s fraud unit (to help block smishing routes).

E) Civil actions (when the money matters and chargeback fails)

Small Claims: For relatively modest sums, you can sue for money owed without a lawyer (threshold and rules change from time to time—check the latest Supreme Court circular).
Regular civil action: If losses are large or involve consequential damages (e.g., wrongful reporting to credit bureaus, reputational harm).

Tip: Sometimes a firm demand letter (from you or a lawyer) to a local merchant triggers a settlement/refund faster than a full suit.

Special scenarios & how to deal with them

Card-not-present fraud (online) Strongest ground for chargeback if you didn’t authenticate. If the merchant used 3-D Secure and logs show your device/OTP, expect tougher scrutiny—argue social engineering if applicable and supply reports.
Skimming/Cloned card used at POS/ATM Emphasize that you retained physical possession; transactions occurred at places you didn’t visit. For overseas ATM withdrawals/POS, note cross-border EMV liability considerations (your bank knows these).
Recurring/subscription traps Ask your bank to block further debits from the merchant ID. Provide proof you canceled; seek chargeback under “canceled recurring” or “services not provided.”
“Friendly fraud” accusations If a family member used your card without permission, be candid. Banks often require a police blotter attesting lack of authorization.
Mixed basket (some legit, some fraud) Itemize clearly. You can dispute only the fraudulent items in a single merchant transaction when supported by breakdowns.

Timelines (typical, not guaranteed)

You → Bank dispute filing: Immediately (don’t wait for the statement if the app shows the charge).
Bank initial review: Days to a few weeks.
Chargeback life cycle (if contested): Commonly 1–3 months, longer if escalated to arbitration.
BSP escalation: Depends on case load; prepare for weeks/months.
Criminal complaints: Investigations can be lengthy; don’t rely on them for quick refunds.

Because these are process-driven and rule-bound, doing the early steps fast and with clean documentation has the biggest impact on outcomes.

How to write a persuasive dispute narrative (template)

Who you are (name, last 4 digits of card, issuing bank).
What happened (timeline, discovery date/time).
Why it’s unauthorized (no OTP shared / or OTP obtained via deception; no delivery; not your device/location).
What you did (called bank, blocked card, reported to PNP/NBI; attached evidence).
What you want (permanent reversal; block recurring; new card; written confirmation).

One-paragraph example:

I am [Name], holder of credit card ending ****1234 with [Bank]. On 17 Aug 2025 at ~10:42 PM, I received app alerts for two online charges to [Merchant] totaling ₱18,450 that I did not authorize. I did not share any OTP or approval for these transactions. I immediately called your hotline to block the card and filed this dispute within hours. Attached are screenshots of alerts, my statement, and an NBI Acknowledgment of my report. Please process a chargeback for the fraudulent charges, block any recurring debits to [Merchant], and confirm issuance of a replacement card.

If the bank denies your dispute

Ask for the basis in writing, including any authentication logs or “compelling evidence” the merchant provided (e.g., 3-D Secure, IP/device matches).
Rebut specifically: Explain why those logs don’t show your authorization (e.g., you were on a call with a spoofed “bank officer” who harvested OTPs; provide phone records).
Escalate within the bank (Consumer Assistance/FCP office).
Elevate to BSP with your full paper trail.
Consider a demand letter and, if economically sensible, small claims/civil action—especially against local merchants.

Preventive moves after recovery

Replace the card; don’t just unblock.
Audit your digital life: unique passwords via a manager; app-based 2FA; review linked wallets/subscriptions.
Harden devices: OS/browser updates; reputable antivirus; remove shady extensions.
SMS/Call hygiene: Banks don’t ask for OTP/PIN via phone/SMS/links. Ignore and report smishing/calls.
Credit monitoring: If your bank or a bureau offers alerts, enroll.

Frequently asked questions

Do I have to talk to the merchant first? No. For fraud, go straight to your bank. For service/quality disputes, trying the merchant first can help, but keep the chargeback window in mind.

Will a police report guarantee a refund? No—but it strengthens your case and creates a record the bank and regulators take seriously.

What if the charge is in foreign currency? You can still dispute. Refunds typically follow the network’s FX rates and may differ slightly due to timing/fees.

Can the bank collect interest/late fees while the charge is under dispute? Banks may ask you to pay the undisputed amount to avoid interest. Clarify in writing that the disputed amount is under chargeback to avoid negative credit reporting.

What if I shared my OTP because a caller claimed to be the bank? Explain the social engineering in detail, submit the report, and press your bank to evaluate under consumer protection standards. Outcomes vary; strong documentation helps.

Smart, short scripts (use these)

Hotline opener “I need to report fraudulent transactions on my card ending ****1234, block the card, and file a dispute/chargeback. Please give me the case/reference number.”
Follow-up email subject “URGENT: Credit Card Fraud Dispute – Case #[number], Card ****1234”
BSP escalation subject “Request for Assistance – Unresolved Credit Card Fraud Dispute with [Bank], Case #[number]”

Final notes

Speed + paperwork win in chargebacks. File early, keep everything, write clearly.
Use multiple tracks at once: bank dispute, police/NBI report, possible NPC/DTI complaints, and BSP escalation if needed.
For high-value losses or complex fact patterns (account takeover, business-email compromise, mule accounts), consult counsel to coordinate civil, criminal, and regulatory steps.

If you want, I can turn this into a printable one-page checklist and a fill-in dispute letter you can reuse.