An unfamiliar credit card charge can mean a stolen card, copied card details, a hacked shopping account, a dishonest family member, or a merchant name you simply do not recognize. Whatever the cause, act quickly. Your immediate priorities are to stop further transactions, notify the card issuer, formally dispute every unauthorized charge, preserve evidence, and escalate the matter if the issuer does not handle the complaint fairly.

What to Do Immediately After Discovering an Unauthorized Credit Card Charge

1. Lock or block the card

Use the bank’s mobile app, website, or emergency hotline to lock the card immediately. Ask the issuer to:

Block the physical and virtual card;
Disable cash advances and online, contactless, and overseas transactions;
Remove the card from digital wallets, when possible;
Cancel recurring card tokens associated with unfamiliar merchants; and
Issue a replacement card with a new card number, expiry date, and security code.

Do not wait until office hours. BSP-supervised financial institutions are expected to maintain active fraud-reporting channels, generally including closely monitored channels available around the clock.

2. Report the transaction to the card issuer immediately

Call the number printed on the back of the card or use the bank’s official app or website. Avoid calling a number contained in a suspicious text message or email.

Tell the bank clearly:

“I did not make, authorize, benefit from, or consent to these transactions. I am formally disputing them as unauthorized.”

Ask for:

The complaint or case reference number;
The exact date and time the card was blocked;
The list of transactions placed under dispute;
The dispute form and documentary requirements;
Confirmation that finance charges and collection activity on the disputed amount will be suspended;
The investigation deadline; and
Written acknowledgment by email, SMS, or secure message.

A verbal report may be legally recognized, but sending a follow-up email or submitting the bank’s dispute form creates a stronger paper trail.

3. Identify every suspicious transaction

Review more than the most recent billing statement. Check at least the previous three to six months for:

Small “test” charges;
Repeated transactions below your alert threshold;
Cash advances;
Online purchases;
Foreign-currency transactions;
Digital wallet transactions;
Installment conversions; and
New recurring subscriptions.

Fraudsters sometimes test stolen card details with a small purchase before attempting a larger transaction.

4. Secure the accounts connected to the card

Change the passwords for your:

Online banking account;
Primary email account;
Shopping and food-delivery apps;
Digital wallets;
Mobile-phone account; and
Any account where the card was saved.

Use a different password for each account and enable multi-factor authentication. Log out unfamiliar devices and check whether your email address, mobile number, delivery address, or security settings were changed.

If your phone or SIM may have been compromised, contact your telecommunications provider immediately. A replacement credit card will not solve the problem if the offender still controls your email, mobile number, or banking profile.

5. Preserve evidence before deleting anything

Save or screenshot:

Transaction alerts and billing statements;
Suspicious texts, emails, calls, and chat messages;
The bank’s acknowledgment and case number;
Your call history showing when you reported the fraud;
Login alerts and unfamiliar device information;
Merchant names, dates, amounts, currencies, and transaction references;
Proof that you were elsewhere when a physical purchase occurred;
The card itself, if it remains in your possession; and
Communications with anyone suspected of using the card.

Do not alter screenshots. Keep the original email, message, or electronic file whenever possible because metadata may help investigators.

6. Continue paying the undisputed portion of your bill

Disputing one transaction does not automatically suspend the rest of the account. Pay the minimum amount or undisputed balance specified by the issuer while the complaint is pending.

Clearly identify the contested transactions in writing. BSP credit card rules allow issuers to continue collecting amounts that the cardholder has not identified as billing errors.

Your Rights Under Philippine Credit Card Law

The principal legal protections come from the following:

Republic Act No. 10870, the Philippine Credit Card Industry Regulation Law;
BSP Circular No. 1003, which implements detailed credit card rules;
Republic Act No. 11765, the Financial Products and Services Consumer Protection Act;
BSP Circular No. 1160, on financial consumer protection standards; and
Republic Act No. 8484, the Access Devices Regulation Act of 1998, as amended by Republic Act No. 11449.

You generally have 30 calendar days from the statement date to report a billing error

Credit card issuers must give cardholders up to 30 calendar days from the statement date to report an error or discrepancy. Notice may be given in writing, verbally, or through another documented means. (Lawphil)

Do not treat this as permission to wait. Report the transaction as soon as you receive the alert, even if the billing statement has not yet been generated.

A late complaint may be harder to prove and may be challenged under the card agreement. However, missing the 30-day period does not mean you should surrender automatically. Report the transaction anyway, explain why the delay occurred, and ask the issuer to investigate under its fraud procedures and broader obligations under the Financial Products and Services Consumer Protection Act.

The issuer must act on a properly documented complaint

Under BSP’s credit card regulations:

Stage	Regulatory period
Cardholder reports billing error	Up to 30 calendar days from statement date
Issuer takes action after receiving notice and relevant records	Within 10 business days
Issuer completes a thorough investigation, makes appropriate corrections, and sends a written explanation	Within 90 days after receiving notice

The issuer should send its explanation before taking action to collect the contested amount, subject to the investigation’s result. If the transaction is found unauthorized or fraudulent, the correction should include related finance charges and fees.

The ten-business-day rule does not necessarily mean that a final refund must be issued within ten days. It means the issuer must take action on the complaint. Complicated cases involving overseas merchants, card networks, delivery records, digital wallets, or device authentication may take longer, subject to the 90-day investigation period.

Lost or stolen cards have a special rule

Republic Act No. 8484 states that properly reporting a lost access device absolves the holder from financial liability for fraudulent use occurring from the time the loss or theft is reported. (Lawphil)

BSP’s credit card regulation initially places transactions occurring before the loss report on the cardholder’s account. However, the cardholder still has the right to dispute them. If the investigation finds that they were unauthorized or fraudulent, the issuer must correct or reverse them, including related finance charges and fees.

This makes the exact reporting time important. Record the date, hour, hotline used, name or identifier of the bank representative, and reference number.

Banks must protect consumer assets against fraud and misuse

The Financial Products and Services Consumer Protection Act recognizes the financial consumer’s rights to:

Fair and equitable treatment;
Protection of assets against fraud and misuse;
Data privacy and protection;
Disclosure and transparency; and
Timely handling and redress of complaints.

Banks must give consumers relevant information and assistance concerning unauthorized transactions. They must also investigate claims fairly and reasonably, considering not only what the cardholder did but also the acts, omissions, controls, and compliance failures of the institution, its employees, agents, and service providers.

A bank should therefore do more than say, “The transaction was authenticated.” It should evaluate the entire transaction, including the authentication method, device and location information, merchant records, fraud alerts, account changes, and possible failures in its security controls.

How to Prepare a Strong Credit Card Dispute

Submit a short, factual narrative supported by documents. Avoid speculation and emotional accusations that cannot yet be proved.

Information your dispute should contain

Include:

Your full name and the last four digits of the card;
Your contact details;
The date you discovered the unauthorized transaction;
The date and time you first reported it;
Each merchant name, transaction date, posting date, amount, and currency;
A statement that you did not make or authorize the charge;
Whether the physical card remained with you;
Whether you received or disclosed an OTP, PIN, password, or security code;
Whether your phone, SIM, email, or shopping account was compromised;
Any related police, NBI, or PNP reference number; and
The remedy requested, usually reversal of the transaction, fees, interest, and related charges.

You may also request that the issuer preserve and examine:

Three-Domain Secure or 3-D Secure authentication records;
OTP generation, delivery, and validation records;
Device fingerprint and IP information;
Digital wallet enrollment records;
Merchant authorization and settlement records;
Proof of delivery and delivery address;
Signed sales slips;
Terminal and point-of-sale records; and
Fraud-monitoring alerts generated before or during the transaction.

The bank may not disclose all internal security information to you, but identifying the relevant records helps ensure that the dispute is not treated as a simple unsupported denial.

Useful supporting documents

Situation	Helpful evidence
Physical card was with you	Photograph or copy of card, proof of your location, attendance records, travel documents
Card was stolen	Police blotter, affidavit of loss, report time, CCTV availability
Online purchase	Account login history, delivery-address records, merchant correspondence
Phone or SIM compromise	Telco report, SIM replacement records, unauthorized password-reset messages
Family member or employee suspected	Messages, admissions, purchase records, delivery details, workplace access records
Overseas transaction	Passport pages, immigration or travel records, proof you were in another country
Merchant claims delivery	Proof that address or recipient is unknown, building logs, courier correspondence

An affidavit of loss may be useful when the physical card disappeared, but it does not replace the bank’s fraud-dispute form. Likewise, a police report supports the complaint but does not by itself compel an automatic refund.

What If an OTP, PIN, or Password Was Used?

Use of an OTP or correct password is important evidence, but it does not automatically answer every case.

The bank may investigate:

Whether you voluntarily gave the OTP to another person;
Whether a phishing page captured the OTP;
Whether your SIM or phone was taken over;
Whether a new device was enrolled without adequate verification;
Whether the transaction was unusual compared with your normal activity;
Whether the bank generated or acted on fraud alerts; and
Whether the institution’s security systems were adequate.

If you were deceived into sharing an OTP, disclose that fact honestly. A false statement can damage your credibility. Explain exactly what happened, including what the caller or message claimed, what information you disclosed, and when you realized it was fraudulent.

Republic Act No. 12010, the Anti-Financial Account Scamming Act, covers social-engineering schemes used to obtain sensitive information and gain unauthorized control of financial accounts, including credit card accounts. It also requires institutions to maintain proportionate safeguards such as multi-factor authentication and fraud-management systems. Depending on the facts, an institution may be responsible for restitution when it failed to employ adequate controls or exercise the required diligence. (Lawphil)

The 2025 BSP rules on temporarily holding disputed funds under that Act generally exclude ordinary credit card purchase transactions, except where a credit card is used to perform an electronic fund transfer through an automated clearing house. Ordinary unauthorized credit card purchases therefore remain primarily governed by the credit card dispute rules and broader consumer-protection standards. (Bureau of Soils and Water Management)

Common Situations and How They Are Usually Treated

Someone used your physical card

Report the loss immediately and identify the last transaction you personally made. Ask the bank whether the disputed purchase used:

Chip insertion;
Contactless payment;
Magnetic-stripe fallback;
PIN verification; or
A manual or keyed transaction.

A signed receipt is not automatically conclusive, particularly if the signature is visibly different. Conversely, a chip-and-PIN record may make the dispute more difficult, but it should still be investigated if the PIN was compromised or the transaction circumstances are suspicious.

Someone used your card details online

Your physical card may still be in your wallet. Common causes include merchant data compromise, phishing, malware, account takeover, exposed card photographs, or saved card details on a compromised app.

Ask whether the purchase used 3-D Secure authentication and where the goods were delivered. A transaction marked “authenticated” is not necessarily the same as a transaction personally authorized by the cardholder.

A spouse, child, relative, employee, or household helper used the card

Being related to the cardholder does not automatically create authority to use the card. The practical question is whether you expressly or impliedly permitted that person to use it.

The bank may deny the dispute if you habitually gave the person the card, PIN, OTP, or access to the account. However, prior permission for a limited purchase does not necessarily authorize later or unlimited transactions.

Preserve messages showing the agreed limit or purpose. Do not describe the transaction as “fraud” while simultaneously admitting that you knowingly allowed unrestricted use.

A supplementary cardholder made the purchase

A supplementary card is different from someone secretly using the principal card. Under most card agreements, the principal cardholder is responsible for transactions made through an authorized supplementary card, subject to the agreement and any properly imposed limits.

If the charge exceeded a bank-confirmed supplementary limit or occurred after you requested cancellation, include that evidence in the dispute.

The merchant name looks unfamiliar

Before accusing anyone, check whether the billing descriptor belongs to:

A parent company;
A payment processor;
A hotel deposit;
A transport or delivery platform;
An app-store purchase;
A subscription renewal; or
A merchant operating under a different registered name.

Ask the issuer for the merchant category, location, contact details, and transaction description. If the transaction is yours but the amount is wrong, classify it as a billing or merchant dispute rather than unauthorized use.

The merchant has already promised a refund

Continue monitoring the account until the refund posts. A merchant’s promise is not the same as an actual reversal.

Tell the bank if the merchant refunds the transaction while a chargeback or provisional credit is pending. You cannot keep both reimbursements for the same charge.

When Unauthorized Credit Card Use Becomes a Criminal Case

A credit card and its account number are “access devices” under Republic Act No. 8484. Section 9 prohibits several acts relevant to unauthorized card use, including:

Using an unauthorized access device with intent to defraud;
Obtaining money or value through an access device with intent to defraud or gain;
Possessing an access device without authority;
Altering sales-slip information without the cardholder’s authority; and
Effecting a transaction using an access device issued to another person to receive payment or something of value. (Lawphil)

The Supreme Court has likewise recognized that possession and use of a counterfeit credit card can constitute access-device fraud, although the prosecution must still prove the elements of the particular offense and the nature of the card involved. See People v. Gallo, G.R. No. 210266, June 7, 2017. (Lawphil)

Online conduct may also involve Republic Act No. 10175, the Cybercrime Prevention Act, Republic Act No. 12010, or offenses under the Revised Penal Code. The prosecutor determines the proper charge based on the evidence; the victim does not need to identify the final statutory label before reporting the crime.

Where to report the crime

You may report to:

The Philippine National Police Anti-Cybercrime Group;
The National Bureau of Investigation’s cybercrime investigators;
The nearest police station, particularly for a stolen physical card;
The city or provincial prosecutor’s office; or
The bank’s fraud investigation unit, which may coordinate with law enforcement.

Republic Act No. 12010 expressly recognizes the investigative roles of the NBI and PNP cybercrime units and allows coordination with the BSP in covered cases. (Lawphil)

Bring printed and electronic copies of your evidence. Investigators may ask you to execute a complaint-affidavit describing the events chronologically.

Under Rule 112 of the Rules of Criminal Procedure, affidavits supporting a criminal complaint are generally subscribed and sworn before a prosecutor or another government official authorized to administer oaths. A notary may be used in the circumstances allowed by the rule. Attach documentary or electronic evidence and label the attachments clearly. (Lawphil)

Do not delay the bank dispute while waiting for a police report. The bank and criminal processes serve different purposes:

The bank dispute seeks reversal or correction of the account;
The BSP process addresses the financial institution’s handling of the complaint; and
The criminal process seeks investigation and prosecution of the offender.

How to Escalate an Unresolved Complaint to the BSP

The bank’s Financial Consumer Protection Assistance Mechanism, or FCPAM, is the first-level remedy. You must generally complain to the bank before escalating the matter to the Bangko Sentral ng Pilipinas.

Escalate when:

The bank does not acknowledge the complaint;
It repeatedly asks for documents you already submitted;
It closes the complaint without a meaningful explanation;
It continues charging interest or collecting the disputed amount without addressing the dispute;
It exceeds the applicable investigation period;
Its explanation does not address the evidence; or
You believe the investigation was unfair or incomplete.

Submit:

Your written narrative;
The bank’s complaint reference number;
Proof that you first used the bank’s FCPAM;
The disputed billing statement;
Your dispute form and attachments;
The bank’s response or denial;
A timeline of all calls and correspondence; and
The specific remedy requested.

You may use the BSP Online Buddy chatbot on the BSP Consumer Corner. If the chatbot is unavailable, the BSP’s current complaint guide allows submission of its Complaint/Inquiry/Reply form with supporting documents through the designated consumer-affairs email channel. Do not include your full PIN, password, CVV, or complete card number in an unsecured submission.

Under the BSP Consumer Assistance Mechanism:

The bank generally has 15 days from the BSP directive to send its answer;
The consumer may reply within 30 days after receiving that answer;
The bank may be required to submit a rejoinder within 10 days;
The BSP may offer mediation; and
Eligible civil money claims may proceed to adjudication.

The BSP and Securities and Exchange Commission may adjudicate qualifying purely civil financial claims seeking payment or reimbursement of up to ₱10 million, exclusive of allowable legal interest, attorney’s fees, and costs. Claims outside that jurisdiction may have to be filed in the appropriate court. (Bureau of Soils and Water Management)

Can You Sue the Person Who Used Your Credit Card?

Apart from criminal liability, the offender may be civilly liable for the amount taken and other provable losses.

Possible bases include:

Article 19 of the Civil Code, requiring people to act with justice, honesty, and good faith;
Article 20, covering damage caused through violation of law;
Article 21, covering willful acts contrary to morals, good customs, or public policy that cause loss; and
Article 2176, on damages caused by fault or negligence independent of a contract.

Actual damages must be proved with receipts, statements, or other competent evidence. Recovery from the perpetrator may be difficult if the person cannot be identified, has no assets, or is outside the Philippines.

A civil claim against the issuer raises different issues, including the card agreement, the adequacy of security controls, the quality of the investigation, and compliance with BSP regulations. BSP adjudication may be more practical than an ordinary lawsuit for an eligible reimbursement claim within its monetary jurisdiction.

What Filipinos and Foreigners Abroad Should Do

A cardholder outside the Philippines should still report the transaction immediately through the issuer’s official international hotline, mobile app, or secure email channel.

When authorizing someone in the Philippines to handle the BSP complaint, provide a written and signed authorization clearly stating the representative’s powers. BSP rules permit representation when the proper written authorization is submitted.

For affidavits, special powers of attorney, or other documents signed abroad, the receiving bank, prosecutor, or agency may require:

Execution before a Philippine embassy or consulate; or
Local notarization followed by an apostille if the country is a party to the Apostille Convention.

Documents from countries not covered by the Convention may require the applicable consular authentication process. Requirements vary depending on the receiving office, so confirm the required form before paying for authentication. The Philippine government’s official Apostille information portal provides current authentication guidance. (Apostille Philippines)

If the card was issued by a foreign bank but used fraudulently in the Philippines, the reimbursement dispute will primarily be handled under the foreign issuer’s contract and governing law. The Philippine merchant, recipient, or perpetrator may nevertheless be investigated locally when the relevant acts occurred in the Philippines.

Common Mistakes That Can Weaken Your Case

Waiting for the next statement before reporting the fraud;
Reporting only one charge when several are unauthorized;
Failing to obtain a complaint reference number;
Relying entirely on a phone call without written follow-up;
Paying the full disputed amount without clearly reserving your objection;
Stopping all payments, including undisputed amounts;
Deleting phishing messages, login alerts, or merchant communications;
Giving inconsistent explanations about OTPs, PINs, or family access;
Contacting a suspected offender before preserving evidence;
Sharing full card details in social media posts or unsecured emails;
Assuming a police report automatically produces a bank refund; or
Accepting a one-line denial without requesting the factual and contractual basis.

Frequently Asked Questions

Am I automatically responsible if the correct OTP was used?

No. OTP use is significant evidence, but the issuer should still examine how the OTP was obtained, whether your phone or SIM was compromised, whether a new device was enrolled, and whether its own controls were adequate. Voluntarily giving an OTP to a scammer may weaken your claim, so explain the circumstances truthfully.

Can the bank make me pay while the transaction is being investigated?

The issuer may collect undisputed amounts. For the specifically contested amount, BSP rules require an investigation and a written explanation before collection action, subject to the investigation’s result. Ask the issuer in writing to suspend interest, fees, and collection activity on the disputed transaction.

What happens if I reported the stolen card only after transactions occurred?

Transactions before the loss report may initially be charged to your account. You may still dispute them, and they must be corrected or reversed if the issuer finds that they were unauthorized or fraudulent. Transactions after your documented loss report should receive stronger protection. (Lawphil)

Can I dispute an unauthorized charge after 30 days?

File the dispute immediately even if more than 30 days have passed. Explain the reason for the delay and provide all available evidence. The bank may invoke the contractual or regulatory reporting period, but broader fraud-investigation and consumer-protection obligations may still be relevant.

Do I need a police report before the bank will investigate?

Not necessarily. You should notify the bank at once rather than waiting for a police report. The issuer may later request one, especially for a stolen card, repeated fraud, identity theft, a known offender, or a large amount.

What if my spouse or child used the card without asking me?

Family relationship alone does not automatically authorize card use. However, the bank will examine whether you previously gave that person the card, PIN, OTP, account access, or implied permission. Preserve messages showing any limits you imposed.

How long does an unauthorized transaction refund take?

The issuer should take action within ten business days after receiving your notice and relevant records and should complete its investigation within 90 days. A provisional credit may be provided earlier, but it can be reversed if the bank later finds that the transaction was authorized.

Can I complain directly to the BSP without contacting the bank?

Ordinarily, no. The BSP Consumer Assistance Mechanism is a second-level remedy. First submit the complaint to the bank’s FCPAM and preserve proof that you did so.

Should I contact the merchant as well as the bank?

Yes, when the merchant can be identified. Ask for cancellation, proof of purchase, delivery information, or a refund. However, do not rely only on the merchant. File the formal dispute with the issuer within the required period.

Key Takeaways

Block the card and report unauthorized transactions immediately.
Obtain a written acknowledgment and complaint reference number.
Formally identify every disputed transaction and continue paying undisputed amounts.
Report billing errors within 30 calendar days from the statement date whenever possible.
The issuer should act within 10 business days and complete its investigation within 90 days.
A transaction before a lost-card report may still be reversed if found unauthorized or fraudulent.
Preserve transaction alerts, messages, device records, merchant details, and proof of your location.
OTP or PIN use is evidence, but the bank should evaluate the full circumstances and its own security controls.
Escalate an unresolved complaint to the BSP only after using the bank’s consumer-assistance mechanism.
Consider a PNP, NBI, or prosecutor complaint when there is theft, deliberate unauthorized use, identity fraud, phishing, or a known offender.