If someone used your credit card without your permission, act fast. In the Philippines, your strongest protection usually comes from two parallel moves: disputing the charge with the credit card issuer immediately and preserving evidence in case the transaction is part of credit card fraud, identity theft, phishing, card skimming, or online account compromise. This article explains your rights under Philippine law, what to do in the first few hours, how to dispute unauthorized credit card transactions, when to report to the PNP or NBI, and what documents you should prepare.

What Counts as Unauthorized Use of a Credit Card?

Unauthorized credit card use happens when a transaction is charged to your card without your consent. It may involve the physical card, the card number, an online account, a mobile wallet linked to the card, or your personal information.

Common examples include:

Your wallet was stolen and someone used your card before you could block it.
Your card details were used for online purchases even though the card is still with you.
Someone obtained your OTP, CVV, password, or app login through phishing.
A merchant charged you twice or charged an amount you did not approve.
A family member, employee, or household helper used the card without authority.
A supplementary cardholder exceeded permission or used the card after authority was withdrawn.
A scammer used your details to subscribe to apps, games, hotel bookings, airline tickets, crypto platforms, or online stores.

Philippine law treats a credit card as an “access device” in many fraud situations. Under the Access Devices Regulation Act of 1998, or Republic Act No. 8484, an access device includes a card, code, account number, PIN, or other means of account access that can be used to obtain money, goods, services, or anything of value. The same law also defines an “unauthorized access device” to include one that is stolen, lost, expired, revoked, canceled, suspended, or obtained with intent to defraud. (Lawphil)

Your Main Legal Rights Under Philippine Law

1. You Have the Right to Dispute Billing Errors and Unauthorized Charges

Under the Philippine Credit Card Industry Regulation Law, or Republic Act No. 10870, credit card issuers must give cardholders up to 30 calendar days from the statement date to report an error or discrepancy in the billing statement. BSP Circular No. 1003, which implemented RA 10870 for credit card issuers, states that the bank must act within 10 business days from receipt of the notice and relevant documents, and must conduct a thorough investigation within 90 days after receiving the notice. (Supreme Court E-Library)

This 30-day period is important. Do not wait for the due date. Do not assume the bank will automatically detect the fraud. Report the unauthorized credit card transaction as soon as you see the SMS alert, app notification, email confirmation, or billing statement.

2. Lost or Stolen Cards Must Be Reported Immediately

RA 10870 provides that when a credit card is lost or stolen, transactions made before reporting the loss or theft may be for the cardholder’s account. But BSP rules add an important protection: this does not remove the cardholder’s right to dispute the transaction, and if the transaction is found to be unauthorized or fraudulent, the bank must correct or reverse it, including related finance charges and fees. (Supreme Court E-Library)

This is why the exact time of your report matters. Save the hotline call reference number, chat transcript, email acknowledgment, or ticket number. In a disputed case, the difference between “reported at 9:02 p.m.” and “reported the next day” can matter.

3. Financial Consumers Have Rights Against Fraud and Misuse

The Financial Products and Services Consumer Protection Act, or Republic Act No. 11765, protects financial consumers’ rights to fair treatment, transparency, protection of consumer assets against fraud and misuse, data privacy, and timely complaint handling. It applies to financial products and services, including credit and digital financial services. (Supreme Court E-Library)

For unresolved complaints against BSP-supervised financial institutions, the Bangko Sentral ng Pilipinas provides a second-level Consumer Assistance Mechanism. BSP materials explain that consumers should first report the concern to the bank’s Financial Consumer Protection Assistance Mechanism (FCPAM) or customer service channel before escalating to BSP.

4. Credit Card Fraud Can Be a Criminal Offense

Using someone else’s card details with intent to defraud may fall under RA 8484, as amended by RA 11449. The law prohibits acts such as using an unauthorized access device, disclosing information imprinted on an access device without authority, obtaining money or anything of value through an access device with intent to defraud, and possessing access devices without authority. (Lawphil)

RA 11449 expanded the law to cover modern fraud methods such as card skimming, possession of skimming devices or malware, fraudulent access to online banking or credit card accounts, and hacking. It also increased penalties, with heavier penalties for large-scale or economic sabotage situations. (Supreme Court E-Library)

5. Online Fraud May Also Involve Cybercrime

If the unauthorized charge came from hacking, phishing, malware, compromised online banking, identity theft, or manipulation of computer data, the Cybercrime Prevention Act of 2012, or Republic Act No. 10175, may apply. Its implementing rules include computer-related fraud, computer-related identity theft, and offenses involving computer systems. The NBI and PNP cybercrime units are responsible for cybercrime investigations. (Supreme Court E-Library)

What to Do Immediately After You Discover the Unauthorized Charge

1. Block the Card Right Away

Use the fastest available channel:

Bank hotline
Mobile banking app card lock feature
Official bank chat support
Branch visit
Email to the bank’s official customer service address

Ask for:

Immediate card blocking or cancellation
Replacement card with a new number
Blocking of online and overseas transactions if needed
A written acknowledgment or reference number
A copy of the dispute form or instructions

Do not rely only on a social media message to the bank. Use official channels and keep proof.

2. Write Down the Timeline

Make a short timeline while details are fresh. Include:

Date and time you noticed the charge
Date and time of the transaction
Merchant name as shown in the SMS, app, or statement
Amount and currency
Whether the card was physically with you
Whether you received an OTP or alert
Whether you clicked any link, answered a call, or gave information
Date and time you called or messaged the bank
Name or ID of the bank representative, if available
Reference number

This timeline helps the bank investigator, BSP, police, NBI, or prosecutor understand the facts quickly.

3. File a Formal Dispute With the Card Issuer

A hotline report blocks the card, but you usually still need a formal dispute. Ask the bank for its dispute form or submit a written dispute through the official channel.

Your dispute should clearly state:

“I did not authorize this transaction.”
“The card was in my possession,” if true.
“I did not receive or did not provide an OTP,” if true.
“I request reversal of the transaction, related interest, finance charges, late fees, and any adverse credit reporting.”
“Please preserve transaction logs, merchant details, IP/device logs, authentication records, and chargeback records.”

Under BSP rules for credit card issuers, the notice of billing error or discrepancy may be made through written, verbal, or documented means, but written proof is safer. (Supreme Court E-Library)

4. Pay the Undisputed Portion of the Bill

If your statement has legitimate purchases plus fraudulent charges, pay the legitimate or undisputed portion on time. For the disputed portion, ask the bank in writing to suspend interest, finance charges, late fees, and collection activity while the investigation is pending.

If the due date is near and the bank refuses to confirm suspension, some cardholders pay the disputed amount under written protest to protect their credit standing, then continue seeking reversal. If you do this, make the protest clear in writing so the payment is not misunderstood as acceptance of the charge.

5. Change Passwords and Secure Related Accounts

Do this especially if the charge happened online:

Change your banking app password.
Change your email password.
Log out of all devices.
Remove saved cards from online stores, food delivery apps, ride-hailing apps, travel apps, and browsers.
Turn on multi-factor authentication.
Check whether your SIM, email, or mobile number was compromised.
Review all linked cards and e-wallets.

Many credit card fraud cases are not limited to one transaction. The first small charge may be a “test” transaction before larger purchases.

When to Report to the PNP, NBI, or CICC

Report to law enforcement if:

The amount is substantial.
There are repeated transactions.
Your identity, email, phone, or online account was compromised.
The bank asks for a police report or affidavit.
The merchant or delivery address may identify the suspect.
You know who used the card and want criminal accountability.
The case involves phishing, hacking, malware, SIM-related compromise, card skimming, or fake websites.

BSP’s own complaint guide states that victims of scam or fraud are encouraged to report to law enforcement agencies such as the Philippine National Police (PNP), National Bureau of Investigation (NBI), or Cybercrime Investigation and Coordinating Center (CICC) because they can commence a formal investigation and apprehend scammers.

For cyber-related credit card fraud, the usual agencies are:

Agency	When it is commonly used	Practical notes
PNP Anti-Cybercrime Group (PNP-ACG)	Online fraud, phishing, hacked accounts, scam links, card-not-present fraud	Bring screenshots, transaction records, IDs, and your bank’s dispute acknowledgment.
NBI Cybercrime Division	More complex fraud, identity theft, organized scams, cross-platform evidence	Useful when you need cyber investigation, subpoenas, or forensic handling.
Local police station	Immediate blotter, theft of wallet/card, known suspect nearby	A blotter records the incident but usually does not replace a full cybercrime or fraud complaint.
CICC	Cybercrime coordination, scam reporting, online fraud concerns	Helpful where the issue involves broader cybercrime coordination.

A police blotter can help document the incident, but it does not automatically reverse a credit card charge. The bank dispute process remains necessary.

Documents to Prepare

Document	Why it matters
Government-issued ID	Confirms you are the cardholder or authorized representative.
Credit card statement or app screenshot	Shows the disputed transaction, amount, date, and merchant name.
SMS, email, or app alert	Proves when you received notice of the transaction.
Bank complaint/dispute reference number	Shows you reported the matter promptly.
Written dispute letter or dispute form	Frames your formal demand for reversal.
Proof the card was with you	Useful in card-not-present fraud or cloned card cases.
Screenshots of suspicious links, calls, emails, or chats	Important for phishing or social engineering cases.
Police report, blotter, or cybercrime complaint	Often requested for fraud investigations or insurance/chargeback support.
Affidavit of denial or unauthorized transaction	A sworn statement may be required by the bank, police, NBI, or prosecutor.
Proof of travel or location	Helps if the card was used in a place where you could not have been.

If an affidavit will be used in a Philippine proceeding, it should normally be notarized. For documents executed abroad, the Civil Code recognizes that the forms and solemnities of public instruments are generally governed by the laws of the country where they are executed; documents executed before Philippine consular officials abroad follow Philippine solemnities. (Lawphil)

How to Write a Credit Card Dispute Letter

Keep it short, factual, and firm. Avoid speculation. A good dispute letter usually contains:

Your full name and contact details.
The last four digits of the credit card only.
The transaction date, merchant, amount, and currency.
A clear statement that you did not authorize the transaction.
The date and time you reported the matter.
The reference number from the bank.
A request to reverse the transaction and related charges.
A request to prevent negative credit reporting while the dispute is pending.
A request to preserve records, including authentication logs, merchant records, and chargeback documents.
Attachments.

Example wording:

I am formally disputing the transaction dated [date] in the amount of [amount] charged by [merchant]. I did not authorize this transaction, did not benefit from it, and request immediate investigation and reversal, including any related finance charges, interest, penalties, and fees. I reported this matter on [date/time] through [channel] and was given reference number [number]. Please confirm that collection activity and adverse credit reporting relating to this disputed amount will be suspended while the investigation is pending.

Escalating the Complaint to BSP

Escalate to BSP if the bank:

Does not respond.
Denies the dispute without explaining the basis.
Continues charging interest and penalties on the disputed amount.
Sends the disputed amount to collections.
Refuses to give a reference number.
Fails to provide a clear investigation result.
Gives inconsistent answers through different channels.

BSP’s process is generally second-level. You first report to the bank’s FCPAM or customer service channel. If unresolved, you may escalate through the BSP Online Buddy chatbot or, if you cannot access it, through the BSP Complaint/Inquiry/Reply form and email with proof that you already used the bank’s complaint mechanism.

BSP’s FAQ on Circular No. 1169 explains that BSP-CAM is a second-level recourse mechanism, that you do not need a lawyer to use BSP-CAM, and that the entire BSP-CAM process may take around 55 to 65 days from receipt of the complaint to termination.

For formal adjudication under RA 11765, BSP and SEC may adjudicate certain purely civil financial consumer claims for payment or reimbursement of money not exceeding ₱10 million, subject to the rules and requirements of the regulator. (Supreme Court E-Library)

What If the Bank Says You Are Liable Because an OTP Was Used?

Banks often argue that a transaction is valid because it was authenticated by OTP, CVV, password, 3D Secure, or app approval. That does not automatically end the matter.

The real question is whether the transaction was genuinely authorized and whether you were negligent, tricked, hacked, or the victim of a system failure. Relevant facts include:

Did you actually receive the OTP?
Did you voluntarily give the OTP to someone?
Was the OTP obtained through a fake bank call, fake delivery message, spoofed SMS, or phishing link?
Was your SIM or email compromised?
Did the bank send timely alerts?
Did the bank act promptly after your report?
Were there unusual transaction patterns that should have triggered fraud controls?
Did the merchant perform proper verification?

BSP rules require financial institutions to provide assistance and relevant information relating to fraudulent or unauthorized transactions, and to handle consumer concerns through accessible, fair, timely, and efficient mechanisms.

What If the Bank Sends the Disputed Amount to Collections?

If the amount is still under dispute, write to the bank and collection agency immediately. State that the charge is disputed and attach your dispute reference number.

RA 10870 prohibits credit card issuers and collection agents from harassing, abusing, oppressing, or engaging in unfair collection practices. It also requires credit card issuers to inform cardholders in writing before endorsing the account to a collection agency, including the agency’s full name and contact details. (Lawphil)

The Civil Code may also be relevant where a bank, merchant, collector, or other party acts in bad faith or causes damage contrary to law. Articles 19, 20, and 21 require persons to act with justice, honesty, and good faith, and provide liability for willful or negligent acts that cause damage contrary to law, morals, good customs, or public policy. (Lawphil)

Important Supreme Court Guidance on Lost or Stolen Cards

In Spouses Ermitaño v. Court of Appeals and BPI Express Card Corp., the Supreme Court dealt with unauthorized purchases after a cardholder reported a lost card. The Court emphasized that once the cardholder gave prompt notice of the loss, it was unfair to keep the cardholder liable while the credit card company delayed or failed in notifying merchants. The Court said prompt notice by the cardholder should be enough to relieve the cardholder of liability for unauthorized use after notice. (Supreme Court E-Library)

This case is often useful because it reflects a practical principle: after you promptly report the loss or theft, the cardholder is no longer in control of the bank’s internal blocking, merchant notification, and fraud-prevention systems.

Common Situations and What to Do

The Card Is Still With You, But There Are Online Charges

This usually suggests card-not-present fraud, data compromise, phishing, or a merchant/payment platform issue. Block the card, dispute all unauthorized online charges, and ask the bank to identify whether the transaction used OTP, CVV, 3D Secure, stored card token, or manual merchant entry.

A Family Member Used the Card Without Permission

This can be legally and emotionally complicated. If the person had no authority, you may still dispute the charge, but the bank may ask why the person had access to the card, phone, OTP, or account. If you want criminal action, you must be ready to identify the person and submit sworn statements.

A Supplementary Cardholder Made the Charge

A supplementary cardholder is usually authorized to use the card, but disputes may arise if the purchase exceeded agreed limits or was made after authority was revoked. Notify the bank in writing that authority is withdrawn, cancel the supplementary card, and ask for the card agreement terms. The primary cardholder may still be contractually liable for supplementary card transactions unless the facts show fraud or unauthorized use under the issuer’s rules.

The Merchant Refuses to Refund

A merchant refund and a bank chargeback are different. If the merchant refuses to help, continue the bank dispute. Ask the issuer whether it will initiate chargeback through the card network. Keep delivery records, cancellation requests, merchant chat logs, and proof that you did not receive goods or services.

The Transaction Happened While You Were Abroad

If the card is issued by a Philippine bank, report through the bank’s official international hotline, app, or email. If you need to file Philippine documents while abroad, ask whether the bank, PNP, NBI, or prosecutor requires a notarized affidavit, consular notarization, apostille, or local notarization depending on where the document is executed and where it will be used.

The Card Was Used in the Philippines but You Are a Foreigner

A foreigner can report fraud involving transactions in the Philippines. If your card was issued abroad, your first dispute is usually with your foreign card issuer, because chargeback rights and timelines are controlled by your issuing bank and card network. If the suspect, merchant, delivery address, or transaction occurred in the Philippines, you may also report to Philippine law enforcement.

Frequently Asked Questions

How long do I have to dispute an unauthorized credit card charge in the Philippines?

Under RA 10870 and BSP rules, cardholders must be given up to 30 calendar days from the statement date to report a billing error or discrepancy. Report earlier if you discover the charge through SMS, app notification, or email before the statement arrives. (Supreme Court E-Library)

Am I automatically liable for charges made before I reported my lost card?

Not automatically in every situation. RA 10870 says transactions before reporting a lost or stolen card may be for the cardholder’s account, but BSP rules preserve your right to dispute. If the transaction is found unauthorized or fraudulent, the bank should correct or reverse it, including related charges and fees. (Supreme Court E-Library)

Do I need a police report to get a credit card charge reversed?

Not always. Some banks investigate based on the dispute form, statement, and transaction records. However, a police report, blotter, or cybercrime complaint can help where the amount is large, the bank requires it, your identity was stolen, or you want criminal investigation.

Should I pay the disputed amount while the bank investigates?

Pay the undisputed portion of your bill. For the disputed amount, ask the bank in writing to suspend interest, penalties, and collection while the investigation is pending. If you decide to pay to avoid delinquency, state clearly that payment is made under protest and that you are not admitting liability.

What if the bank denies my dispute?

Ask for the written basis of denial, including whether the transaction used OTP, CVV, chip, swipe, 3D Secure, stored credentials, or manual merchant processing. Then escalate through the bank’s FCPAM. If unresolved, file with BSP-CAM and attach your dispute records, denial letter, timeline, and evidence.

Can the person who used my credit card go to jail?

Yes, depending on the facts. Unauthorized use of a credit card or credit card details with intent to defraud may violate RA 8484, as amended by RA 11449. Online hacking, phishing, identity theft, or computer-related fraud may also involve RA 10175. (Supreme Court E-Library)

Can I sue the bank for damages?

Possibly, if the facts show bad faith, negligence, unfair collection, failure to follow applicable regulations, wrongful credit reporting, or refusal to correct a proven unauthorized charge. Civil Code Articles 19, 20, and 21 may support damages in appropriate cases, and RA 11765 gives financial regulators consumer redress and adjudication powers for certain financial consumer claims. (Lawphil)

What if I gave my OTP because I was tricked by a fake bank caller?

Report it immediately anyway. Giving an OTP can make the dispute harder, but it does not mean you should give up. Explain exactly how the scam happened, preserve the phone number, screenshots, call logs, SMS headers, and links, and report to the bank and cybercrime authorities.

Can BSP order the bank to refund me?

For unresolved complaints, BSP provides consumer assistance, mediation, and adjudication mechanisms under RA 11765 and BSP Circular No. 1169. BSP and SEC may adjudicate certain purely civil claims involving payment or reimbursement of money up to ₱10 million, subject to the rules. (Supreme Court E-Library)

Will filing a barangay blotter help?

A barangay blotter may record what happened, but credit card fraud and cybercrime usually require the bank dispute process and, when criminal investigation is needed, the PNP, NBI, or cybercrime authorities. Do not rely on a barangay record alone to preserve your bank rights.

Key Takeaways

Block the card immediately and save the reference number.
File a formal dispute with the bank as soon as possible, ideally well within the 30-day statement period.
Pay only the undisputed portion unless you decide to pay the disputed amount under written protest.
Preserve evidence: screenshots, SMS alerts, emails, call logs, statements, merchant records, and bank acknowledgments.
Report to PNP, NBI, or CICC if the case involves fraud, phishing, hacking, identity theft, skimming, or a known suspect.
Escalate to BSP if the bank ignores, delays, mishandles, or unfairly denies your complaint.
Prompt reporting matters because Philippine law and Supreme Court guidance strongly protect cardholders who quickly notify the issuer of loss, theft, or unauthorized use.