Discovering an ATM withdrawal you did not make is especially alarming when the money came from your payroll account and was meant for rent, food, bills, or family expenses. Act immediately, but do not assume that reporting the incident by telephone is enough. You should secure the account, create a written record, preserve ATM and electronic evidence, file a formal dispute with the bank, and escalate the case when the bank’s response is delayed or unsupported.

What Counts as an Unauthorized ATM Withdrawal?

An unauthorized ATM withdrawal is a cash withdrawal made from your bank account without your knowledge or valid consent. It may involve:

A stolen ATM or debit card;
A cloned card created through ATM skimming;
A compromised personal identification number or PIN;
A card temporarily taken and returned without your knowledge;
An employee, relative, partner, caregiver, or coworker using your card without permission;
A fraudulent card replacement or account takeover;
A bank, ATM network, or system error;
Unauthorized access following phishing, social engineering, SIM swapping, or malware; or
An insider or third party who obtained access to your card or banking information.

A payroll account is still a deposit account. The fact that your salary was deposited through an employer does not reduce your rights as a financial consumer.

Do not confuse an unauthorized withdrawal with an ATM cash-dispensing problem. When your account was debited but the ATM released no cash—or released only part of the amount—the proper complaint is usually “cash not dispensed,” “partial dispense,” or “ATM debit without cash,” rather than an unauthorized transaction.

What to Do Immediately After an Unauthorized ATM Withdrawal

1. Block the card and secure every banking channel

Contact the bank through its official hotline, mobile application, website, or branch. Do not rely on a telephone number sent through an unfamiliar text message.

Ask the bank to:

Block the ATM or debit card;
Disable ATM withdrawals and card transactions;
Temporarily secure the account if additional withdrawals are possible;
Deauthorize unfamiliar mobile devices;
Reset online and mobile banking access;
Replace the card and PIN;
Review recent transactions for other suspicious activity; and
Give you an incident or reference number.

Change your mobile banking password, email password, and telephone PIN where applicable. If you suspect SIM swapping or loss of your phone, contact the telecommunications provider immediately.

The Bangko Sentral ng Pilipinas requires BSP-supervised financial institutions to maintain accessible fraud-reporting arrangements, including active 24-hour channels appropriate to their operations. A report of suspected fraud should receive an immediate written acknowledgment.

2. Clearly state that you are disputing an unauthorized cash withdrawal

Use direct language. For example:

I dispute the ATM withdrawals dated [date and time] totaling ₱[amount]. I did not make or authorize these transactions. My card was [still in my possession/lost or stolen on this date]. Please block further access, preserve all ATM and electronic records, investigate the transactions under your financial consumer protection procedures, and provide a written acknowledgment and case reference number.

Do not describe the transaction merely as “missing money.” Identify each disputed withdrawal by:

Date;
Approximate time;
Amount;
ATM location, if shown;
Transaction reference number; and
Whether the card was with you at that time.

3. Ask the bank to preserve ATM evidence immediately

Evidence may be overwritten or deleted under the bank’s retention policies. Ask the bank in writing to preserve:

ATM CCTV footage;
The ATM’s electronic journal;
Switch and authorization logs;
Card-reading data showing whether the chip, magnetic stripe, or another method was used;
PIN verification and failed-attempt records;
The ATM identification number and exact location;
Cash-dispensing and ATM-balancing records;
Fraud-monitoring alerts;
Card replacement or PIN-reset records;
Mobile and online banking device logs; and
Internal communications concerning the transaction.

You may not automatically receive a copy of the CCTV footage because it can contain personal data belonging to other people. The bank can nevertheless preserve and review it, and may release relevant material to investigators or pursuant to lawful process.

In a Philippine administrative case involving unauthorized withdrawals from another person’s payroll account, ATM transaction records and CCTV evidence helped establish who made the withdrawals. The case illustrates why a prompt preservation request is important. (Lawphil)

4. Save your own evidence

Immediately obtain or preserve:

Screenshots of the account balance and disputed transactions;
SMS, email, or application alerts;
A downloadable bank statement or transaction history;
Your payroll slip;
Proof of when your salary was credited;
Photographs of the card, without exposing the full card number;
Evidence showing where you were when the withdrawal occurred;
Attendance records, travel records, receipts, toll records, or location history;
Suspicious messages, links, calls, or emails;
Communications with the bank;
The bank’s complaint reference number; and
Proof that you reported a lost or stolen card.

Do not delete scam messages even when they are upsetting. They may show how your information was obtained.

5. Move or protect the remaining balance

Ask the bank how to protect money still in the account. Depending on the circumstances, the bank may recommend:

Transferring the balance to a newly opened account;
Replacing the card while keeping the account;
Temporarily restricting withdrawals;
Lowering transaction limits; or
Placing additional authentication controls.

Do not move money through a link or account suggested by an unknown caller claiming to be a bank employee.

6. Inform your employer’s payroll or human resources office

Ask your employer to confirm:

The exact salary amount deposited;
The date and time of payroll credit;
The payroll account number used;
Whether the payroll file was successfully processed; and
Whether other employees reported similar incidents.

Request a payroll certification, payslip, or proof of remittance if the bank asks for it.

An employer that correctly credited wages to the employee’s designated bank account is not automatically responsible for a later fraudulent ATM withdrawal. The main dispute will usually be between the account holder, the bank, and the person who made the withdrawal. The situation may be different if the employer or its representative mishandled the card or PIN, deposited the salary into the wrong account, withheld part of the wage, or gave account access to another person. Philippine labor law permits wage payment through banks under applicable conditions, but the employer must still prove that the correct wages were paid. (Lawphil)

Your Rights Under Philippine Banking and Consumer Protection Law

Right to a free and effective complaint process

Under Republic Act No. 11765, the Financial Products and Services Consumer Protection Act of 2022, financial service providers must maintain a consumer assistance mechanism that is free and accessible.

The implementing rules in BSP Circular No. 1160 require banks and other BSP-supervised institutions to prioritize fraud claims and investigate them within a reasonable period proportionate to their complexity. The institution where the disputed transaction originated generally has the primary responsibility to assist the account holder. (Lawphil)

Right to reasonable accommodation while the investigation is pending

A bank may provide measures such as:

Suspending disputed fees or charges;
Holding funds that remain intact;
Temporarily restricting the account;
Giving provisional credit; or
Providing another reasonable accommodation.

A provisional credit is a temporary credit while the investigation is ongoing. It is not automatically required in every case and does not necessarily mean that the bank has accepted liability.

For a disputed or unauthorized transaction, RA 11765 requires the financial service provider to suspend interest, fees, and charges connected with the disputed transaction while the final investigation is pending, or provide a similar reasonable accommodation. (Bureau of Small and Medium Enterprises)

Right to a written investigation result

After completing its investigation, the bank must formally communicate the result within three banking days. If it finds that the transaction was unauthorized or fraudulent, it should promptly correct or reverse the transaction or make any provisional credit permanent.

The rules do not impose one universal number of days for completing every ATM investigation. A straightforward ATM balancing problem may be resolved more quickly than a case involving several banks, a foreign ATM, card cloning, or criminal investigation.

Protection after reporting a lost access device

Under Republic Act No. 8484, the Access Devices Regulation Act of 1998, an ATM card, account number, and similar means of obtaining money can be considered access devices.

When an access device is lost or stolen, the cardholder must notify the issuer upon learning of the loss. A holder who fully follows the issuer’s reporting procedure is protected from financial liability for fraudulent use occurring from the time the loss or theft was reported. (Lawphil)

This makes the exact reporting time important. Record:

When you discovered the loss;
When you called the bank;
The name or identifier of the person who received the report;
The bank’s reference number; and
Any written acknowledgment.

Transactions made before the report remain subject to investigation based on the circumstances, including whether the cardholder exercised reasonable care.

Is the Bank Required to Refund the Unauthorized Withdrawal?

A refund is not automatic merely because the account holder says the transaction was unauthorized. The bank must investigate, while the account holder should provide a clear account and available evidence.

Factors that may affect responsibility include:

Whether the card was lost or remained with the account holder;
When the loss or suspicious transaction was reported;
Whether the PIN was shared, written on the card, or stored with it;
Whether the card was voluntarily lent to another person;
Whether phishing, coercion, or social engineering occurred;
Whether the ATM or banking system had a security weakness;
Whether fraud-monitoring controls detected unusual activity;
Whether the bank complied with BSP security and consumer protection rules;
Whether a bank employee, agent, or service provider contributed to the loss; and
Whether transaction and CCTV evidence supports the account holder’s statement.

The use of the correct PIN is important evidence, but it does not always prove that the account holder personally made or knowingly authorized the withdrawal. PINs can be observed, obtained through deception, compromised through skimming, disclosed under coercion, or misused by someone trusted with temporary access.

In Far East Bank and Trust Company v. Chante, the Supreme Court dealt with disputed ATM transactions associated with a system defect. The Court emphasized the bank’s responsibility for the security of its system and examined whether the bank had actually proven that the depositor was responsible for the withdrawals. The case does not mean that every disputed ATM withdrawal must be refunded, but it shows that a bank cannot treat its electronic records or the use of a PIN as unquestionable in every situation. (Supreme Court E-Library)

The broader banking doctrine is that banks must handle depositors’ accounts with a high degree of care. In Simex International (Manila), Inc. v. Court of Appeals, the Supreme Court stressed that banks must treat their customers’ accounts with meticulous care because banking is affected with public interest. (Lawphil)

At the same time, account holders are expected to protect their cards, PINs, passwords, and authentication credentials. A bank may deny or reduce a claim when persuasive evidence shows that the customer authorized the transaction or was seriously negligent. Any denial should still explain the factual and contractual basis rather than merely state that “the correct PIN was used.”

How to File a Formal Dispute With the Bank

Submit a written complaint through the bank’s official complaint channel. Include:

Your full name and contact details;
The last four digits of the account or card;
A list of every disputed withdrawal;
A chronological explanation of what happened;
Whether the card remained with you;
The date and time you reported the incident;
Steps already taken to secure the account;
A request for preservation of CCTV and transaction logs;
The resolution you are requesting; and
Copies of supporting documents.

Ask the bank to confirm:

The case reference number;
The office handling the investigation;
Any affidavit or dispute form required;
The expected investigation process;
Whether provisional credit will be considered; and
When you should expect an update.

Keep the original documents. Submit copies unless the bank specifically requires an original.

Documents commonly requested

Document	Why it may be needed
Valid government-issued ID	To verify the complainant’s identity
Bank dispute form	To identify the questioned transactions
Affidavit of unauthorized withdrawal	To provide a sworn chronological account
Bank statement or transaction history	To show the disputed entries
SMS or application alerts	To establish discovery and timing
Proof of card possession	Helpful when the card never left your control
Lost-card report	Important when the card was stolen or misplaced
Payslip or payroll certification	To confirm the salary credit
Police or NBI report	Supports allegations of theft, cloning, or fraud
Travel, attendance, or location evidence	May show that you could not have used the ATM
Bank complaint acknowledgment	Required when escalating to the BSP

A bank may require an affidavit to be notarized. Bring a valid ID and sign the document in front of the notary unless the notary lawfully uses an authorized remote notarization process.

Never place your PIN, one-time password, mobile banking password, or card verification code in an affidavit or email. Unless specifically required through a secure bank process, identify the card only by its last four digits.

When and How to Escalate the Complaint to the BSP

You must ordinarily complain to the bank first. The bank’s Financial Consumer Protection Assistance Mechanism is the first-level complaint process.

If the bank fails to act, does not respond adequately, or issues a denial you believe is unsupported, elevate the complaint through the BSP Consumer Assistance Mechanism.

You may use:

The BSP Online Buddy or BOB through the official BSP website;
The BSP’s official social media access point for BOB; or
The Consumer Inquiry and Request form sent to consumeraffairs@bsp.gov.ph.

Attach:

Your complaint to the bank;
Proof that the bank received it;
The bank’s response, if any;
The transaction history;
Your affidavit or narrative;
Supporting evidence; and
Your requested resolution.

The BSP’s official complaint guide warns consumers not to send passwords, PINs, full card details, or unnecessary identity documents through ordinary complaint correspondence. BSP submissions receive a reference number that should be used in follow-ups.

BSP Consumer Assistance facilitates communication and attempts to help resolve the dispute. It does not automatically order reimbursement at the initial assistance stage.

BSP mediation and adjudication

If the dispute remains unresolved after BSP Consumer Assistance, the consumer may qualify for mediation or adjudication under BSP Circular No. 1169.

BSP adjudication may cover purely civil claims for payment or reimbursement not exceeding ₱10 million, excluding legal interest, attorney’s fees, and litigation costs. Claims for criminal punishment, labor disputes, and matters already pending or decided in court generally fall outside this process.

A formal adjudication complaint normally requires:

Prior completion of BSP Consumer Assistance;
A verified complaint;
A notarized certification against forum shopping;
Supporting documents;
Sworn witness statements, when applicable; and
A Special Power of Attorney when another person represents the complainant.

“Verification” means the complainant swears that the allegations are true based on personal knowledge or authentic records. A “certification against forum shopping” confirms that the same dispute has not been filed elsewhere, subject to the disclosures required by the rules.

Should You File a Police or NBI Complaint?

A bank dispute and a criminal complaint serve different purposes.

The bank dispute seeks investigation, account correction, and possible reimbursement. A police or National Bureau of Investigation complaint seeks to identify and prosecute the offender.

File a police or NBI report promptly when:

The ATM card was stolen;
Someone secretly used and returned the card;
You suspect ATM skimming or card cloning;
A known person made the withdrawal;
You were deceived into revealing account information;
Your phone or SIM was compromised;
Several accounts were affected;
The bank requests a law-enforcement report; or
You need investigators to request CCTV or records.

Bring:

A valid ID;
Copies of disputed transactions;
The card, if still available;
Bank complaint documents;
Screenshots and messages;
A chronological affidavit;
Information about any suspect; and
The ATM location and approximate time.

The NBI maintains units for cybercrime and fraud-related investigations. Its citizen’s charter describes a complaint process for people requesting investigative assistance for computer-related offenses. (National Bureau of Investigation)

Depending on the facts, unauthorized ATM activity may involve:

Unauthorized access-device use under RA 8484, as amended by Republic Act No. 11449;
Theft or estafa under the Revised Penal Code;
Illegal access, computer-related fraud, or other offenses under Republic Act No. 10175, the Cybercrime Prevention Act of 2012; or
Social engineering or money-mule offenses under Republic Act No. 12010, the Anti-Financial Account Scamming Act of 2024. (Lawphil)

Do not wait for a police or barangay process before blocking the card and notifying the bank. The first hours are important for preventing further loss and preserving records.

A barangay blotter may help document an incident, but barangay conciliation is not a substitute for a bank dispute or criminal investigation. Serious offenses punishable beyond the limits covered by the Katarungang Pambarangay system do not require barangay conciliation before prosecution. (Lawphil)

What If the Fraudster Transferred the Money Before Withdrawing It?

If the account history shows that money was first transferred to another bank or e-wallet and then withdrawn, tell the bank that the case includes an unauthorized electronic fund transfer.

The Anti-Financial Account Scamming Act and BSP rules allow financial institutions to coordinate in tracing and temporarily holding disputed funds in certain account-to-account transfers. These measures are most useful while the money remains in the receiving financial account.

They generally do not allow a bank to “freeze” cash that has already been physically dispensed by an ATM. This is why you should distinguish between:

A direct ATM cash withdrawal;
An electronic transfer to another account;
A transfer followed by an ATM withdrawal; and
A debit where no cash was released.

BSP Circular No. 1215 specifically focuses its temporary holding mechanism on electronic transfers from one financial account to another.

Common Problems That Weaken an ATM Withdrawal Claim

Waiting several days before reporting

Delay may allow additional withdrawals and make CCTV or device evidence harder to preserve. It can also create questions about when the loss was actually discovered.

Reporting only by telephone

A telephone call is useful for blocking the card, but it may not contain the full dispute. Follow it with a written complaint and keep the acknowledgment.

Sharing the card or PIN

Giving a card to a relative, partner, coworker, or household employee creates factual and legal difficulties. The bank will examine whether the transaction was truly unauthorized and whether the cardholder failed to protect the access device.

Authorization for one withdrawal does not necessarily authorize every later withdrawal, but proving the limits of permission may require messages, witnesses, or other evidence.

Accepting “correct PIN used” as the entire explanation

Ask for a reasoned written decision. Relevant questions include:

Was the original card chip read?
Was the magnetic stripe used?
Did the transaction occur at an unusual place or time?
Were several withdrawals attempted?
Did the amount match the daily limit?
Did the fraud-monitoring system generate an alert?
Was the card reported lost before the transaction?
Was there a card replacement or PIN reset?
Did the bank review CCTV and the electronic journal?

The bank may not disclose proprietary security data, but it should explain the factual basis of its conclusion sufficiently for the consumer to understand and challenge it.

Posting sensitive details online

Do not publish the full account number, card number, bank reference, identification document, signature, address, or screenshots containing authentication information. Public posts can create a second security problem.

Filing under the wrong transaction type

A “cash not dispensed” claim is investigated through ATM balancing and dispense records. An “unauthorized withdrawal” claim focuses on who accessed the account. Describe what actually happened so the bank sends the case to the correct team.

Special Considerations for Overseas Filipinos and Foreign Account Holders

A Filipino or foreigner outside the Philippines may still dispute an unauthorized withdrawal involving a Philippine bank account. Use the bank’s official international contact channels and BSP’s online complaint process.

Prepare:

A clear scanned narrative;
The disputed transaction list;
Proof of your location abroad;
Passport travel stamps, boarding passes, employment records, or overseas receipts;
Proof that the ATM card remained with you, if applicable; and
A Philippine contact person, when useful.

When another person will sign, submit, or appear for you, the bank or BSP may require a Special Power of Attorney. For formal proceedings, it should comply with the receiving office’s notarization requirements. An SPA executed abroad may generally be notarized through a Philippine embassy or consulate, or apostilled by the competent authority when executed in a country where the Apostille Convention applies, subject to the specific agency’s requirements. (Philippine Embassy in New Delhi)

Foreign nationality does not by itself remove the consumer protections applicable to an account maintained with a Philippine bank. Identity verification may take longer when the account holder is abroad or when foreign-language documents require translation.

Possible Timelines and Practical Expectations

Stage	Practical timing
Card blocking and initial fraud report	Immediately, preferably within minutes of discovery
Written acknowledgment	Should be given promptly after the report
Submission of affidavit and documents	Commonly within the period specified by the bank
Bank investigation	No single universal deadline; depends on complexity
Communication of final result	Within three banking days after the investigation concludes
BSP Consumer Assistance	After the bank has been given the first opportunity to resolve the complaint
BSP mediation or adjudication	After BSP Consumer Assistance, subject to jurisdiction and complete documents
Police or NBI complaint	As soon as theft, cloning, fraud, or a known suspect is reasonably suspected

Common bottlenecks include incomplete affidavits, inconsistent transaction details, slow coordination between different banks or ATM operators, inability to retrieve old footage, overseas document requirements, and failure to preserve the original complaint reference.

Consumer claims under RA 11765 generally prescribe five years from the transaction or, where deceit or nondisclosure prevented earlier discovery, five years from discovery, subject to an absolute maximum of ten years from the transaction. These periods should not be treated as a reason to delay. Evidence becomes harder to obtain long before the legal prescriptive period expires.

Frequently Asked Questions

Can the bank deny my claim because the correct PIN was entered?

The correct PIN is relevant evidence, but it is not conclusive in every case. The PIN may have been observed, stolen, obtained through deception, or used by someone who temporarily possessed the card. Ask the bank to consider CCTV, card-reading data, ATM logs, fraud alerts, and your evidence—not only PIN verification.

What if the ATM card was still in my wallet?

Report the transaction immediately. Possible explanations include card cloning, compromised credentials, an account or system issue, fraudulent replacement, or temporary unauthorized access. Keep the card and do not destroy it because the bank may need to inspect or replace it.

Will the bank refund the money immediately?

Not necessarily. The bank normally investigates first. It may give provisional credit or another temporary accommodation, but this is not guaranteed in every case. If the investigation confirms that the withdrawal was unauthorized, the bank should promptly correct the transaction.

How long does an ATM fraud investigation take?

There is no single mandatory investigation period for every case. Banks must resolve fraud claims within a reasonable period based on complexity and communicate the formal result within three banking days after completing the investigation. Cases involving another bank, a foreign ATM, suspected cloning, or law-enforcement requests may take longer.

Do I need a police report before complaining to the bank?

No. Report to the bank immediately even without a police report. A police or NBI report may later strengthen the case and is especially useful when the card was stolen, a suspect is known, or criminal activity is apparent.

Is my employer required to replace the stolen payroll money?

Usually not when the employer correctly deposited the full salary into your own account and the unauthorized withdrawal occurred afterward. The employer should help confirm the payroll credit. Employer responsibility may arise when the employer mishandled the card or PIN, deposited the wrong amount, used the wrong account, or otherwise failed to pay wages properly.

What if a family member used my card without permission?

You may still report the withdrawals as unauthorized. The bank will investigate whether you shared the card or PIN and whether previous transactions were permitted. Preserve messages or evidence showing what permission, if any, was given. A criminal complaint is possible, although family relationships can affect the practical handling of the case.

What if the ATM debited my account but gave me no cash?

Report it as an ATM cash-dispensing dispute. Give the bank the ATM location, date, time, amount, and receipt or reference number. The bank can compare the ATM’s electronic journal, cash balance, and dispensing records. This is different from claiming that another person withdrew the money.

Can I demand a copy of the ATM CCTV footage?

You can ask the bank to preserve and review it. Direct release may be restricted because the recording may contain other people’s personal information or because it forms part of a security investigation. Police, prosecutors, courts, or other authorized bodies may request it through lawful procedures.

Can I sue the bank or the person who withdrew the money?

Potentially. Depending on the evidence, remedies may include BSP adjudication, a civil case for reimbursement or damages, and a criminal complaint against the offender. BSP adjudication is limited to qualifying monetary claims within its jurisdiction. Court action may be more appropriate when the case involves additional damages, several defendants, disputed ownership issues, or relief that the BSP cannot grant.

Key Takeaways

Block the card and report the unauthorized ATM withdrawal immediately.
Obtain a written acknowledgment and bank reference number.
Ask the bank to preserve CCTV, ATM journals, authorization logs, and fraud-monitoring records.
Save statements, alerts, payroll records, messages, and evidence showing where you were.
Notify your employer to confirm the salary credit, but understand that the bank dispute is usually separate from the employer’s payroll obligation.
The use of a correct PIN does not automatically prove that you authorized the withdrawal.
Report a lost card as soon as possible because protection under RA 8484 is strongest from the time the issuer receives the report.
Escalate unresolved complaints to the BSP only after first giving the bank an opportunity to act.
File a police or NBI complaint when theft, cloning, social engineering, or a known suspect is involved.
Do not send or publish your PIN, password, OTP, full card number, or other authentication information.