Seeing an unfamiliar credit card charge can be stressful, especially if the amount is large, in a foreign currency, or the transaction was made while your card was still in your wallet. In the Philippines, you should act fast: lock or block the card, report the transaction to the issuer, put the dispute in writing, preserve evidence, and escalate to the Bangko Sentral ng Pilipinas (BSP) if the bank does not handle the complaint properly. The key is to create a clear paper trail from the first hour you discovered the charge.

What Counts as an Unauthorized Credit Card Charge?

An unauthorized charge is a credit card transaction made without your knowledge, consent, or participation. It may appear as:

Online purchases you did not make
Foreign currency charges from websites or merchants you do not recognize
Card-not-present transactions where your physical card was never swiped
Transactions after your card was lost or stolen
Duplicate or inflated merchant charges
Cash advances you did not request
Subscription charges after cancellation
Transactions made using stolen card details, cloned cards, phishing, malware, or account takeover

Not every disputed charge is automatically “fraud.” Banks often classify disputes into different categories:

Situation	Usual classification	Example
You never authorized the transaction	Unauthorized or fraudulent transaction	Someone used your card details on an overseas website
You authorized one payment but were charged twice	Billing error or duplicate posting	A hotel charged you twice for the same booking
You bought something but the merchant failed to deliver	Merchant dispute	Online shop did not ship the item
You forgot a subscription or free trial renewal	Contract or merchant issue	App subscription renewed after trial
Your card was lost and used before you reported it	Lost/stolen card dispute	Wallet stolen, then card used at a store

This distinction matters because the bank may ask for different documents, and the investigation route may differ. Still, if you genuinely did not authorize the charge, treat it as urgent fraud until proven otherwise.

Your Key Rights Under Philippine Law

Credit card issuers must have a process for complaints and billing disputes

The Philippine credit card industry is regulated under Republic Act No. 10870, or the Philippine Credit Card Industry Regulation Law, implemented through BSP rules. BSP Circular No. 1003 requires credit card issuers to establish a Consumer Assistance Unit for prompt action on credit card complaints, inquiries, and requests. For billing statement errors or discrepancies, banks must give cardholders up to 30 calendar days from the statement date to report the issue, may receive the report through written, verbal, or other documented means, must act within 10 business days from receipt of notice and supporting records, and must complete a thorough investigation within 90 days after receipt of notice before collecting the contested amount, subject to the investigation result.

For lost or stolen cards, BSP Circular No. 1003 states that transactions made before the cardholder reports the loss or theft are generally for the account of the cardholder, but this is without prejudice to the cardholder’s right to dispute the transaction. If the transaction is found unauthorized or fraudulent, it must be corrected or reversed, including related finance charges and fees.

Interest, fees, and charges on the disputed amount should not keep piling up while the case is being investigated

Republic Act No. 11765, or the Financial Products and Services Consumer Protection Act, requires financial service providers to maintain a Financial Consumer Protection Assistance Mechanism, or FCPAM. For alleged disputed amounts or unauthorized transactions, the provider must suspend the imposition of interest, fees, and charges, or provide similar reasonable accommodations while its final investigation is pending. (Supreme Court E-Library)

BSP Circular No. 1160 reinforces this by requiring BSP-supervised institutions to treat fraud-related concerns with priority, maintain free and active reporting channels, provide immediate written acknowledgement through the same channel, and consider accommodations such as a provisional credit, temporary hold, account blocking, or freezing of funds where applicable. If the transaction is found unauthorized or fraudulent, the institution should correct or reverse it, including related interest, fees, and charges.

Credit card fraud can also be a criminal matter

Credit cards are “access devices” under Republic Act No. 8484, or the Access Devices Regulation Act of 1998. The law treats a credit card as a device used to obtain money, goods, property, labor, services, or anything of value on credit. It penalizes acts such as using an unauthorized access device, using counterfeit access devices, disclosing card information without authority, altering sales slips, or obtaining value through an access device with intent to defraud. (Lawphil)

RA 8484 also specifically provides that when an access device is lost, the holder must notify the issuer upon knowledge of the loss, and full compliance with the issuer’s procedure absolves the holder of financial liability for fraudulent use from the time the loss or theft is reported. (Lawphil)

If the fraud happened online, Republic Act No. 10175, or the Cybercrime Prevention Act of 2012, may also apply. It penalizes computer-related fraud involving unauthorized input, alteration, deletion of computer data, or interference in a computer system with fraudulent intent. The NBI and PNP are the law enforcement authorities responsible for cybercrime enforcement under the law. (Supreme Court E-Library)

What to Do Immediately After You See Unauthorized Charges

1. Lock or block the card immediately

Use your bank’s app, hotline, or official website to lock the card. If your bank app has options like “temporary lock,” “freeze card,” “disable online transactions,” or “block card,” use them right away.

Then call the bank’s official hotline. Do not rely only on replying to an SMS alert. Use the hotline printed on the back of the card, the bank’s official website, or the app.

Ask for:

Permanent blocking of the compromised card
Replacement card issuance
A case number or reference number
Confirmation by email or SMS
A list of all pending, floating, and posted transactions
Temporary disabling of cash advance, online, and foreign transactions if needed

Write down the time of call, name or ID of the agent, and instructions given.

2. Identify every suspicious transaction

Make a simple list. Include both posted and pending transactions.

Detail	What to record
Transaction date and time	As shown in SMS, app, email, or statement
Posting date	When it appeared on the statement
Merchant name	Exact descriptor, even if confusing
Amount	Peso or foreign currency amount
Channel	Online, POS, cash advance, recurring, wallet top-up
Status	Pending, floating, posted, reversed
Evidence	Screenshot, SMS alert, email, statement page

Some merchant descriptors are not obvious. For example, a charge may show the payment processor rather than the store name. Still dispute first if you do not recognize it; you can withdraw or clarify later if the bank identifies it as legitimate.

3. File the formal dispute in writing

Even if the bank says the phone call is enough, send a written dispute by email, secure message, or branch submission. BSP rules allow reports through written, verbal, or documented means, but a written dispute protects you because it proves the date, content, and scope of your complaint.

Your dispute should state:

Your full name and last four digits of the card only
The disputed transactions
That you did not authorize, participate in, benefit from, or receive goods/services from the transactions
When and how you discovered the charges
When you reported the card lost, stolen, or compromised
Your request to reverse the charges and related fees
Your request to suspend interest, penalties, late charges, and collection efforts on the disputed amount while investigation is pending
Your request for written investigation results

Avoid sending your full card number, CVV, full password, PIN, or OTP in email.

4. Preserve evidence before it disappears

Fraud evidence is often lost because people delete SMS messages, block numbers without screenshots, or close browser tabs. Save everything first.

Useful evidence includes:

Credit card statement
SMS or app alerts
Email confirmations you did not initiate
Screenshots of pending and posted charges
Phishing texts, emails, links, sender numbers, and URLs
Call logs from suspicious callers
Timeline of what happened
Proof of your location, if relevant
Passport pages, boarding passes, hotel records, or work attendance logs if the charge was in another place
Police blotter, NBI/PNP complaint, or affidavit if required by the bank
Previous cancellation emails for subscription disputes

If you were tricked into sharing an OTP or card details, say so clearly. Do not hide it. Banks will usually check authentication logs, device data, IP addresses, merchant records, and OTP validation. Your credibility improves when your timeline is complete and consistent.

5. Pay the undisputed portion of your bill

Do not ignore the entire statement. Pay the charges you admit are valid, and clearly tell the bank that you are withholding or disputing only the unauthorized amount and related finance charges.

This matters because BSP Circular No. 1003 allows the bank to collect amounts that were not identified by the cardholder as containing a billing error.

A practical approach is to email the bank before the due date:

“I am paying the undisputed portion of my statement. I continue to dispute the unauthorized transactions listed in my complaint dated [date]. Please confirm that no interest, late payment charge, penalty, collection action, or adverse credit reporting will be applied to the disputed amount while investigation is pending.”

What the Bank Should Do After You Report

After your report, the issuer should normally:

Block the compromised card.
Issue a reference number.
Ask you to submit a dispute form and supporting documents.
Review merchant, payment network, device, OTP, CVV, 3D Secure, location, and transaction logs.
Coordinate with the acquiring bank, merchant, or card network where chargeback rules apply.
Decide whether to reverse, temporarily credit, deny, or request more documents.
Give you a written result.

Under BSP Circular No. 1003, the bank must take action within 10 business days from receipt of your notice and relevant documents, and the investigation must be completed within 90 days after receipt of notice.

Under BSP Circular No. 1160, the institution should formally inform the client of the result within three banking days from the conclusion of the investigation. If it provisionally credited the disputed amount but later finds sufficient proof that no unauthorized transaction occurred, it should notify the client before debiting the provisional credit.

Documents Commonly Required by Philippine Credit Card Issuers

Different banks use different forms, but these are the usual requirements:

Document	Usually needed for	Practical notes
Signed dispute form	Almost all disputes	Use the bank’s official form if available
Valid government ID	Identity verification	Passport, driver’s license, UMID, PhilID, PRC ID, etc.
Card replacement/blocking confirmation	Lost/stolen or compromised card	Save SMS/email confirmation
Statement showing charges	Billing dispute	Mark the exact transactions
Affidavit of unauthorized transaction	Larger or complex fraud cases	Some banks require notarization
Police blotter or NBI/PNP cybercrime complaint	Lost/stolen card, scam, phishing, identity theft	Not always mandatory, but useful
Proof of cancellation	Subscription or merchant dispute	Email cancellation, chat transcript, ticket
Travel/location proof	Foreign or impossible-location charge	Boarding pass, passport stamps, hotel/work records
Screenshots of scam messages	Phishing/social engineering	Include sender number, URL, date, and time

If you are abroad and the bank requires a sworn affidavit, ask whether a scanned notarized affidavit is acceptable first. For formal Philippine use, documents executed abroad may need consular notarization or apostille depending on the country and the type of document. The DFA’s Apostille system explains authentication requirements for documents used across borders. (Apostille Philippines)

How to Escalate to the BSP if the Bank Does Not Resolve It Properly

You should escalate if:

The bank refuses to accept your dispute.
No case number is issued.
The bank keeps charging interest or penalties on the disputed amount.
Collections continue despite the pending dispute.
The bank denies the claim with no meaningful explanation.
The bank fails to act within reasonable timelines.
You receive no written result.
Your credit record is affected because of the disputed amount.

BSP’s process generally requires you to report first to the bank’s FCPAM or customer service channel. If you are unsatisfied with the bank’s action or response, you may elevate the matter to the BSP Consumer Assistance Mechanism through BSP Online Buddy or, if you have no access to BOB, by submitting the CIR Form and proof that you first used the bank’s FCPAM.

BSP describes its Consumer Assistance Mechanism as a second-level recourse for consumers who already reported their concern to the BSP-supervised institution and remain dissatisfied or where the institution failed to act within a reasonable period. The full BSP-CAM process may take about 55 to 65 days from receipt of the complaint to termination.

For BSP escalation, prepare:

Copy of your complaint to the bank
Bank’s reply or denial letter
Proof of submission and reference numbers
Credit card statements
Screenshots and supporting evidence
Specific relief requested, such as reversal, removal of charges, correction of records, or suspension of fees

If BSP-CAM does not resolve the matter, BSP rules allow mediation or adjudication in proper cases. BSP adjudication covers purely civil financial consumer complaints where the relief sought is payment or reimbursement of money not exceeding ₱10,000,000, exclusive of legal interest, attorney’s fees, and costs, subject to the limits and exclusions in the rules.

When to File a Police, NBI, PNP, or NPC Complaint

File with NBI or PNP if there is fraud, identity theft, phishing, or cybercrime

A bank dispute is different from a criminal complaint. The bank dispute is about reversal of charges and consumer protection. A criminal complaint is about investigating and prosecuting the person or group behind the fraud.

Consider reporting to the NBI Cybercrime Division or PNP Anti-Cybercrime Group when:

Your card details were stolen through phishing
Someone used your identity
A scammer called pretending to be from the bank
Your online banking, email, or phone was compromised
The transaction involved a fake website, fake delivery page, or malicious link
You lost money through a coordinated scam
The bank asks for a police or cybercrime report

RA 10175 gives the NBI and PNP responsibility for cybercrime enforcement, and it allows cybercrime units to handle technical investigations involving computer data, subscriber information, and related evidence subject to legal requirements. (Supreme Court E-Library)

File with the National Privacy Commission if there is a data privacy issue

If the unauthorized charges appear connected to a leak, mishandling, or unauthorized disclosure of your personal data, you may consider a complaint with the National Privacy Commission (NPC). The Data Privacy Act of 2012 protects personal information and recognizes privacy rights in information and communications systems. (National Privacy Commission)

The NPC generally requires exhaustion of remedies, meaning you should first inform the respondent in writing and give it an opportunity to address the privacy violation or personal data breach. The NPC says proof of this written notice must be attached, and lack of sufficient form, substance, or evidence may lead to dismissal. (National Privacy Commission)

Common Scenarios and How to Handle Them

“My card was never lost, but online charges appeared.”

This is common in card-not-present fraud. Your card number, expiry date, CVV, or authentication details may have been compromised through a merchant breach, phishing page, malware, skimming, or leaked saved payment credentials.

Report immediately, block the card, dispute the charges, and ask the bank to identify whether OTP, 3D Secure, device binding, or merchant authentication was used.

“The bank says an OTP was used, so I must pay.”

An OTP is strong evidence, but it should not automatically end the discussion. Ask for the basis of denial and explain the circumstances. Were you tricked by a fake bank caller? Was there SIM swap? Was your phone stolen? Did the bank’s fraud monitoring fail despite unusual location, merchant, amount, or velocity?

BSP Circular No. 1160 states that liability assessment may consider the actions of the account holder before, during, and after the unauthorized transaction, as well as acts or omissions of the institution, its employees, agents, outsourced entities, or service providers.

“A bank caller asked for my OTP.”

Treat this as a scam. BSP’s consumer protection campaign reminds the public to check, protect, and report suspicious activity, and warns that legitimate banks and financial institutions will not call customers to ask for account numbers, credit card details, or one-time passwords. (Philippine Information Agency)

“The merchant is in another country.”

For a Philippine-issued card, dispute with your Philippine card issuer, not just the foreign merchant. The issuer can coordinate through the card network and acquiring bank. If you are abroad, use email, in-app secure messaging, or the international hotline and preserve proof of your location.

“I am a foreigner using a Philippine credit card.”

You generally have the same consumer dispute route with the Philippine issuer if the card was issued by a BSP-supervised bank or credit card issuer. Use the bank’s FCPAM first, then BSP-CAM if unresolved. If you need to submit documents executed abroad, confirm whether the bank requires notarization, consular acknowledgment, or apostille.

“My foreign-issued card was used at a Philippine merchant.”

Start with your foreign issuing bank because it controls your card account, chargeback rights, and provisional credits. You may also contact the Philippine merchant, but BSP escalation is usually most effective when the respondent is a BSP-supervised Philippine institution.

“The bank already sent my account to collections.”

Demand written confirmation that collection activity on the disputed amount will stop while investigation is pending. RA 11765 requires suspension of interest, fees, and charges or similar reasonable accommodations for alleged disputed amounts or unauthorized transactions pending final investigation. (Supreme Court E-Library)

If collectors harass you, document the calls, messages, numbers, dates, and content. RA 10870 and BSP credit card rules regulate collection conduct, and collection agents remain connected to the issuer’s responsibility for customer service standards. (Supreme Court E-Library)

Practical Timeline

Stage	Practical timing	What to do
Discovery	Same day	Lock card, call bank, take screenshots
Formal dispute	Same day to 3 days	Send written dispute and documents
Billing error reporting period	Within 30 calendar days from statement date	Do not wait for the deadline; report immediately
Bank initial action	Within 10 business days from notice and relevant documents	Ask for case status and temporary accommodation
Bank investigation	Up to 90 days after notice under BSP credit card rules	Follow up in writing
Formal result	Within 3 banking days from conclusion under BSP consumer protection rules	Ask for explanation and evidence basis
BSP escalation	After unsatisfactory bank response or inaction	File through BSP-CAM with proof
BSP-CAM	Around 55 to 65 days	Submit replies on time
BSP adjudication, if applicable	Around 6 to 8 months from formal complaint	For qualifying monetary reimbursement claims

Frequently Asked Questions

Do I have to pay unauthorized credit card charges while the bank investigates?

You should dispute the unauthorized charges in writing and pay the undisputed portion of your bill. For the disputed amount, RA 11765 requires the financial service provider to suspend interest, fees, and charges or provide similar reasonable accommodations while the final investigation is pending. (Supreme Court E-Library)

How many days do I have to dispute a credit card charge in the Philippines?

Under BSP Circular No. 1003, cardholders must be given up to 30 calendar days from the statement date to report a billing error or discrepancy. Report much earlier if possible, especially for fraud, because delay may affect investigation and liability assessment.

Can the bank deny my dispute because I reported late?

Delay can hurt your case, especially for lost or stolen cards. BSP rules say transactions before reporting a lost or stolen card are generally for the cardholder’s account, but you still have the right to dispute them, and they must be reversed if found unauthorized or fraudulent.

What if the unauthorized charge is still pending?

Report it anyway. Ask the bank to block the card, prevent posting if possible, and monitor the transaction. Some issuers can only formally dispute after posting, but early notice helps prove prompt reporting and may prevent more fraud.

Is a police report required for credit card fraud?

Not always. Many banks first require only a dispute form, ID, and statement. However, a police blotter, NBI complaint, or PNP Anti-Cybercrime report is useful for lost/stolen cards, phishing, identity theft, high-value fraud, or when the bank specifically asks for it.

Can I dispute a charge if I accidentally gave my OTP to a scammer?

Yes. Report honestly and immediately. The bank will likely examine authentication records, your actions, the scam method, and whether bank controls or warnings were adequate. BSP rules allow liability assessment to consider both the account holder’s actions and the financial institution’s acts or omissions.

Can I go directly to BSP without contacting the bank?

Usually, no. BSP’s process generally requires you to complain first through the bank’s FCPAM or customer service channel. If you are unsatisfied or the bank fails to act, you may escalate to BSP-CAM.

Can I sue the bank if it refuses to reverse the charges?

Possible routes include BSP adjudication for qualifying reimbursement claims, or court action where appropriate. BSP adjudication may cover purely civil financial consumer claims for payment or reimbursement up to ₱10,000,000, subject to BSP rules and exclusions. For smaller money claims within court rules, small claims may be relevant, but the proper forum depends on the relief sought and the parties involved.

What if the unauthorized transaction damaged my credit record?

Ask the bank in writing to correct internal records, stop collection activity on the disputed amount, and prevent negative reporting while the dispute is unresolved. If the bank already reported delinquency based on a disputed fraudulent amount, include correction of credit records in your BSP complaint.

Can foreigners file credit card disputes in the Philippines?

Yes, if the card was issued by a Philippine bank or BSP-supervised credit card issuer. Foreigners should keep copies of passport pages, visas, local address records, travel records, and any documents showing they could not have made the disputed transaction.

Key Takeaways

Report unauthorized credit card charges immediately through the bank’s official hotline, app, or branch.
Always follow the call with a written dispute and keep proof of submission.
Under BSP rules, cardholders must be given up to 30 calendar days from the statement date to report billing errors, and banks must investigate and respond within regulated timelines.
For disputed or unauthorized transactions, interest, fees, and charges should be suspended or reasonably accommodated while investigation is pending.
Pay the undisputed portion of your bill, but clearly identify the fraudulent charges as contested.
Preserve screenshots, SMS alerts, emails, statements, call logs, and scam messages.
Escalate to BSP-CAM if the bank ignores, mishandles, or unfairly denies the dispute.
Report to NBI, PNP, or NPC when the case involves cybercrime, identity theft, phishing, or possible data privacy violations.