Finding an unauthorized bank charge can be stressful because every hour matters. The first goal is to stop further loss, preserve proof, and make the bank treat your report as a formal dispute—not just a casual customer-service inquiry. In the Philippines, banks and other BSP-supervised financial institutions have specific duties under financial consumer protection rules, the Anti-Financial Account Scamming Act, cybercrime laws, and credit card regulations. This guide explains what counts as an unauthorized charge, what the bank must do, how to dispute the transaction, when to escalate to the Bangko Sentral ng Pilipinas, and what documents usually help in real cases.

What Counts as an Unauthorized Bank Charge in the Philippines?

An unauthorized bank charge is any debit, transfer, withdrawal, card purchase, online payment, service charge, or account deduction that you did not approve or that was made through fraud, account takeover, stolen card details, phishing, social engineering, skimming, SIM-related fraud, malware, or other improper access.

Common examples include:

A GCash, Maya, InstaPay, PESONet, QR Ph, or online banking transfer you did not make
Credit card or debit card purchases from merchants you do not recognize
Repeated subscription charges after you already cancelled
ATM withdrawals from a place you never visited
A card-not-present transaction using your card number, CVV, or OTP
A bank fee or penalty that appears inconsistent with your account terms
A loan, cash advance, or BNPL-related debit you never authorized
A transfer caused by phishing, fake bank calls, fake courier links, or fake “account verification” pages

Not every disputed charge is legally the same. This distinction matters because banks handle them differently.

Situation	What it usually means	Practical first step
You did not authorize the transaction at all	Possible fraud, scam, account takeover, stolen card, or unauthorized access	Report immediately to the bank’s fraud hotline/FCPAM and request blocking, reversal, and tracing
You authorized payment but the merchant failed to deliver	Usually a merchant dispute, not pure bank fraud	Dispute with merchant and card issuer; keep receipts and cancellation proof
You sent money to the wrong account	Usually an erroneous transaction	Report quickly, but recovery depends on whether funds remain and whether the recipient cooperates
The transaction is only “pending”	A temporary authorization hold may still reverse	Ask the bank when it will post or expire
The bank charged a fee you question	Possible billing, disclosure, or contract issue	Ask for the fee basis and file a formal complaint if unsupported

Your Legal Rights Under Philippine Law

Several Philippine laws and BSP rules protect account owners and financial consumers.

Financial Products and Services Consumer Protection Act

Republic Act No. 11765, or the Financial Products and Services Consumer Protection Act, protects consumers of financial products and services, including deposits, payments, remittances, credit, and digital financial services. It recognizes key rights, including:

The right to fair and equitable treatment
The right to disclosure and transparency
The right to protection of consumer assets against fraud and misuse
The right to data privacy and protection
The right to timely handling and redress of complaints

For ordinary account holders, the important point is simple: your bank cannot ignore a properly filed dispute. It must have a consumer assistance mechanism and must handle complaints fairly.

BSP Circular No. 1160 on financial consumer protection

Under BSP Circular No. 1160, Series of 2022, BSP-supervised institutions must maintain reporting channels for fraud and unauthorized transactions. These may include phone hotlines, mobile numbers, online portals, email, chatbot, instant messaging, or other monitored channels, and fraud-related concerns should be handled with priority.

For unauthorized transactions, BSP rules require the originating financial institution—the bank or financial institution where the transaction came from—to assist the client. Pending investigation, the bank may need to:

Suspend interest, fees, or charges related to the disputed transaction, if applicable
Hold disputed funds if still intact
Provide reasonable accommodation, such as provisional credit or a temporary hold
Block or freeze accounts or take other steps to protect the consumer’s assets
Formally inform the client of the investigation result within three banking days from conclusion
Reverse or correct the transaction if found unauthorized or fraudulent

Anti-Financial Account Scamming Act

Republic Act No. 12010, or the Anti-Financial Account Scamming Act, is especially relevant to modern digital banking fraud. It covers financial accounts such as deposit accounts, credit card accounts, e-wallets, and other accounts used for financial services.

It penalizes money muling and social engineering schemes. A social engineering scheme happens when a person obtains sensitive identifying information—such as usernames, passwords, bank details, credit card details, debit card details, e-wallet information, or other credentials—through deception or fraud, resulting in unauthorized access and control over a financial account.

RA 12010 also allows institutions to temporarily hold funds subject of a disputed transaction, within the period set by the BSP, not exceeding 30 calendar days unless extended by a court.

Under BSP Circular No. 1215, Series of 2025, temporary holding generally works this way:

Holding stage	Maximum period	What happens
Initial holding	5 calendar days	The bank may hold disputed funds if they are still in the same bank or request other involved institutions to hold them
Extended holding	Additional 25 calendar days	The hold may be extended if there are reasonable grounds and supporting documents
Beyond 30 calendar days	Only by court order	Further holding generally requires a court of competent jurisdiction

This is why immediate reporting is critical. If stolen funds have already passed through multiple accounts or been withdrawn as cash, recovery becomes much harder.

Cybercrime Prevention Act and access device fraud laws

If the unauthorized charge involved hacking, phishing, online fraud, identity theft, or misuse of card or account credentials, criminal laws may also apply.

Relevant laws include:

Republic Act No. 10175, or the Cybercrime Prevention Act of 2012, which penalizes offenses such as illegal access, computer-related fraud, and computer-related identity theft
Republic Act No. 8484, or the Access Devices Regulation Act of 1998, as amended by Republic Act No. 11449, which covers fraudulent acts involving credit cards, debit cards, account numbers, and other access devices
Article 315 of the Revised Penal Code on estafa, when deception caused the victim to part with money or property

Credit card rules under RA 10870

For credit cards, Republic Act No. 10870, or the Philippine Credit Card Industry Regulation Law, is important. In lost or stolen card cases, transactions made before reporting the loss or theft to the credit card issuer may be charged to the cardholder. This is why you should report a lost card or suspicious credit card transaction immediately and keep proof of the exact time of reporting.

That does not mean the bank always wins simply because a transaction happened before your report. If there are signs of bank system failure, weak authentication, failure to block after notice, suspicious transaction patterns, or merchant/acquirer issues, the facts still matter.

Supreme Court doctrine: banks must exercise the highest degree of diligence

Philippine jurisprudence consistently treats banking as a business affected with public interest. In Bank of the Philippine Islands v. Casa Montessori Internationale, the Supreme Court emphasized that banks must handle depositors’ accounts with meticulous care.

In BDO Unibank, Inc. v. Seastres, the Supreme Court reiterated that banks are required to exercise the highest standard of diligence in handling bank accounts. This doctrine is helpful when a bank denies liability too quickly despite obvious red flags, weak verification, ignored warnings, or poor fraud controls.

What to Do Immediately After Seeing an Unauthorized Charge

1. Secure your account first

Before arguing about reimbursement, stop further loss.

Do these immediately:

Lock or freeze the card in the bank app, if available.
Change your online banking password.
Change the password of the email account linked to the bank.
Remove unknown devices from your banking app or email account.
Turn off online, international, ATM, or card-not-present transactions if the app allows it.
Call the bank and ask to block the affected card or account if needed.
Do not uninstall your banking app yet if it contains transaction history or alerts you need to screenshot.

If you suspect SIM swap, lost phone, malware, or compromised email, treat the incident as bigger than one bank charge. Your bank account may not be the only account at risk.

2. Take screenshots and preserve evidence

Do not rely on memory. Banks, BSP, police, and prosecutors look for details.

Save:

Screenshot of the unauthorized transaction
Date and exact time shown in the app or statement
Amount
Transaction reference number
Merchant name, recipient name, recipient account, or wallet number, if shown
SMS, email, or app notification
OTP messages received
Call logs from suspicious callers
Links or websites used, especially phishing pages
Chat messages from scammers
Proof of your location, if relevant
Proof that your card was in your possession, if relevant
Prior cancellation request, if the issue involves recurring subscription charges

Use cloud backup or email copies to yourself. If your phone is later lost, wiped, or repaired, you may lose key proof.

3. Report to the bank’s official fraud channel

Use official channels only. Do not call numbers sent by suspicious text messages or social media accounts. Use the number on your card, the bank’s official website, the official app, or verified branch contact details.

When reporting, clearly say:

“I am formally disputing an unauthorized transaction. Please block further transactions, investigate this as fraud, issue a complaint/reference number, preserve all records, and, if applicable, initiate temporary holding and coordinated verification under AFASA and BSP rules.”

Ask for:

Complaint or case reference number
Name or ID of the bank representative, if available
Date and time of report
Confirmation that the card/account was blocked
Confirmation that your report was forwarded to the fraud/dispute unit
Email address where you can submit supporting documents
Expected timeline for investigation
Whether provisional credit is available
Whether the funds can still be held or traced

If the bank only says “we will check,” send a written follow-up by email or in-app message so there is a paper trail.

4. File through the bank’s FCPAM

Every BSP-supervised institution must have a Financial Consumer Protection Assistance Mechanism, or FCPAM. This is the bank’s first-level complaint process.

Your FCPAM complaint should include:

Your full name
Account type, but avoid exposing full account numbers unless submitted through a secure official channel
Last four digits of card or account, if enough to identify
Transaction date, time, amount, and reference number
A clear statement that you did not authorize the transaction
What you want the bank to do: reverse, refund, waive fees, block account, trace funds, preserve records
Screenshots and supporting documents
Your contact details
Request for written acknowledgment and written resolution

Avoid emotional accusations. Be factual and specific. A clean timeline is more useful than a long angry email.

5. Ask whether AFASA temporary holding is possible

If the charge involved a bank transfer, e-wallet transfer, or movement of funds to another account, ask the originating bank whether it can initiate temporary holding of disputed funds.

Under AFASA and BSP Circular No. 1215, banks may coordinate with receiving financial institutions to hold disputed funds if the money is still traceable and not yet withdrawn. The initial holding period is short, so delays can be costly.

This does not guarantee recovery. It means the bank may be able to stop the money from moving further while the transaction is verified.

6. Submit a sworn complaint, affidavit, or police report if requested

For extended holding or formal investigation, banks may request supporting documents such as:

Sworn complaint
Affidavit of unauthorized transaction
Police report or cybercrime complaint
Valid ID
Screenshots and transaction records

A sworn affidavit is a written statement signed under oath before a notary public or authorized officer. It should state what happened, what transaction you dispute, why you believe it was unauthorized, and what evidence supports your claim.

If you are abroad, the bank may accept a notarized affidavit depending on its policy. If the document must be used formally in the Philippines, you may need either:

Consular notarization before a Philippine Embassy or Consulate; or
Apostille/authentication, depending on where the document was executed and what the receiving office requires

For general authentication rules, see the DFA’s official Apostille information site.

7. Report criminal activity to law enforcement

If the unauthorized charge involved phishing, hacking, scam calls, identity theft, fake bank pages, account takeover, or money mule accounts, report to law enforcement. This is separate from the bank dispute.

The BSP’s complaint guide identifies these agencies for scam or fraud reports:

Agency	When relevant	Contact channel commonly used
PNP Anti-Cybercrime Group	Online scams, hacking, phishing, cyber fraud	acg@pnp.gov.ph
NBI Cybercrime Division	Cybercrime complaints and investigation	ccd@nbi.gov.ph
Cybercrime Investigation and Coordinating Center	Cybercrime reporting and coordination	report@cicc.gov.ph

A police or NBI complaint can help support your bank dispute, especially where the bank asks for a police report before extended holding or deeper fraud review.

8. Escalate to the BSP if the bank does not act properly

The BSP Consumer Assistance Mechanism, or BSP-CAM, is a second-level recourse. You generally must report first to the bank’s FCPAM or customer service channel.

According to the BSP’s official guide on how to file a complaint against a BSP-supervised institution, you may escalate to BSP-CAM if you are not satisfied with the bank’s action or response. BSP-CAM may be accessed through the BSP Online Buddy, or BOB, on the BSP website or official Facebook page. If you cannot access BOB, you may use the BSP Complaint/Inquiry/Reply form and email it to the BSP with proof that you first went through the bank’s FCPAM.

The BSP-CAM process is not the same as a criminal case. It facilitates handling of financial consumer complaints against BSP-supervised institutions. For scams and fraud, law enforcement may still be necessary.

Sample Timeline for Disputing an Unauthorized Charge

Time from discovery	What to do	Why it matters
First 10 minutes	Lock card/account, change passwords, secure email and phone	Stops additional unauthorized transactions
First hour	Call official bank fraud hotline and get reference number	Creates proof of notice and may trigger blocking or tracing
Same day	Submit written FCPAM complaint with screenshots	Turns the report into a documented formal dispute
Within 1–2 days	Submit affidavit, police report, or additional proof if requested	Supports temporary holding, chargeback, or investigation
If bank response is delayed or unsatisfactory	Escalate to BSP-CAM with proof of bank complaint	Uses BSP’s consumer redress mechanism
If fraud, hacking, or scam is involved	File with PNP ACG, NBI Cybercrime Division, or CICC	Starts criminal investigation and may help trace perpetrators

What Documents Should You Prepare?

Document	Why it helps	Notes
Screenshot of transaction	Shows amount, date, time, and reference number	Capture full screen if possible
Bank statement	Confirms posting of charge	Download PDF if available
SMS/email/app alerts	Shows notification timeline	Preserve OTP messages
Written bank complaint	Proves you formally disputed	Email or in-app message is useful
Bank reference number	Tracks your case	Ask for this during first report
Affidavit of unauthorized transaction	Supports formal investigation	May need notarization
Police/NBI/CICC report	Supports fraud or cybercrime angle	Especially useful for phishing, hacking, scam, or money mule cases
Proof of card possession	Helps in card-present disputes	Example: photo of card in your possession, travel/location proof
Merchant cancellation proof	Helps in subscription or recurring-charge disputes	Keep emails and cancellation confirmation
Government ID	Verifies identity	Submit only through official secure channels

What the Bank May Ask During Investigation

Banks often ask detailed questions because liability may depend on what happened before, during, and after the transaction. Expect questions like:

Did you lose your card?
Did anyone borrow your phone?
Did you click a link before the transaction?
Did you share an OTP, PIN, password, CVV, or screenshot?
Did you receive a call from someone claiming to be from the bank?
Was your SIM card replaced or deactivated?
Did you install remote access apps?
Did you use public Wi-Fi?
Did you transact with the merchant before?
Did you previously authorize a subscription?

Answer truthfully. If you clicked a phishing link or shared an OTP, say so. Under Philippine law, social engineering is recognized as a fraud method. The issue is not simply “you shared an OTP, so you automatically lose.” The bank may still need to show that its systems, warnings, monitoring, authentication, and response met the required standard. But your own actions may affect the bank’s liability assessment.

Common Mistakes That Can Hurt Your Dispute

Waiting too long before reporting

Delay is one of the biggest problems. For fund transfers, money can move through several accounts within minutes. For lost or stolen credit cards, transactions before notice may be charged to the cardholder under RA 10870.

Reporting only through a branch employee or casual chat

A conversation with a branch staff member may not trigger fraud handling. Use the bank’s official fraud hotline, dispute email, in-app report, or FCPAM. Always ask for a reference number.

Sending sensitive information through unsafe channels

Do not send full card numbers, CVV, PIN, OTP, passwords, or complete IDs through social media messages or unverified email addresses. BSP itself warns consumers not to share PINs, passwords, account numbers, credit card or ATM card numbers, passbooks, passports, or other IDs when these are not required for complaint processing.

Ignoring small test charges

Fraudsters often test an account with a small amount before making a larger transaction. Report even small unauthorized debits.

Deleting messages or resetting the phone too soon

Your phone may contain critical evidence: OTP logs, phishing links, scam call records, device notifications, and app alerts. Preserve evidence before factory reset or repair.

Filing a false or exaggerated report

AFASA penalizes malicious reporting. A person who, with malice or in bad faith, reports completely unwarranted or false information that results in temporary holding of funds may face liability. Report facts accurately.

Special Situations

The bank says the transaction used an OTP

An OTP is strong evidence, but it is not always the end of the dispute. Ask the bank for details:

What device initiated the transaction?
Was there a new device enrollment?
Was there a password reset before the transfer?
Was the transaction unusual based on your account history?
Was the recipient a newly added beneficiary?
Were there multiple failed attempts?
Did the bank’s fraud system flag the activity?
Was the OTP sent after a suspicious login or SIM-related event?

If the OTP was obtained through deception, the case may involve social engineering under RA 12010 and computer-related fraud or identity theft under RA 10175.

The charge is from a merchant you recognize but did not approve

This happens with subscriptions, free trials, app purchases, hotels, airlines, online platforms, or duplicate card charges. Gather:

Cancellation confirmation
Refund request
Merchant emails
Terms and conditions
Proof that the amount differs from what you authorized

File both a merchant dispute and a card issuer dispute. If the merchant is local and the issue is consumer-service related, DTI may be relevant. If the issue is the bank or card issuer’s handling, BSP is the proper financial regulator.

The unauthorized charge happened while you were abroad

Filipinos abroad, OFWs, and foreigners with Philippine bank accounts should still report immediately through official digital channels. Time zone differences do not stop the need for fast reporting.

Practical points:

Use the bank’s international hotline, app chat, official email, or secure message center.
Ask the bank whether it accepts a scanned affidavit first, followed by the original.
If an affidavit or SPA is required, ask whether consular notarization or apostille is needed.
If someone in the Philippines will act for you, the bank may require written authorization or a Special Power of Attorney.
Keep proof of your location abroad if it helps show that an ATM withdrawal or in-person transaction in the Philippines was impossible.

The bank denies your claim

Ask for the denial in writing and request the factual basis. A useful written request may ask for:

Investigation result
Reason for denial
Transaction authentication method
Whether a new device or beneficiary was enrolled
Whether the transaction was flagged by fraud systems
Whether funds were traced or held
Why provisional credit or reversal was denied
Copies of documents you are entitled to receive under bank policy and applicable law

Then escalate to BSP-CAM if the response is incomplete, delayed, or unsupported.

The bank gives provisional credit

Provisional credit is temporary. The bank may later reverse it if the investigation finds that the transaction was authorized or that the dispute is not valid. Ask whether the credit is temporary or final, and keep monitoring your account until the bank issues a written final resolution.

Where to File Complaints

Concern	First office/channel	Escalation or related office
Unauthorized bank transfer, debit, ATM withdrawal, or online banking transaction	Bank’s fraud channel and FCPAM	BSP-CAM
Unauthorized credit card charge	Credit card issuer’s dispute/fraud unit and FCPAM	BSP-CAM
E-wallet fraud under BSP-supervised provider	E-wallet provider’s FCPAM	BSP-CAM
Phishing, hacking, cyber fraud, identity theft	PNP ACG, NBI Cybercrime Division, or CICC	Prosecutor’s office after investigation
Data breach or misuse of personal data	Financial institution’s data protection contact	National Privacy Commission, if appropriate
Merchant failed to deliver goods/services	Merchant and card issuer	DTI for consumer trade issues, BSP for issuer handling
Financing or lending company / online lending app issue	Company complaint channel	SEC, especially for lending/financing companies

Practical Complaint Template

Use this as a clear structure for your bank complaint:

I am formally disputing an unauthorized transaction on my account.

Account/Card: [last four digits only, if appropriate] Transaction date and time: [date/time] Amount: [amount] Merchant/recipient/reference number: [details]

I did not authorize, initiate, or benefit from this transaction. I request immediate blocking of further unauthorized transactions, investigation, preservation of records, reversal or reimbursement of the disputed amount, waiver of related charges, and, if applicable, tracing and temporary holding of disputed funds under AFASA and BSP rules.

Attached are screenshots and supporting documents. Please provide a written acknowledgment, case reference number, and timeline for resolution.

Frequently Asked Questions

How fast should I report an unauthorized bank charge?

Immediately. Report as soon as you see it, even if the amount is small. Fast reporting improves the chance of blocking the account, stopping further charges, and holding funds before they are withdrawn or transferred again.

Can the bank refuse to refund me because an OTP was used?

The bank may consider OTP use as part of its investigation, but it should not be the only question. If the OTP was obtained through phishing, scam calls, malware, or fake bank pages, the facts may involve social engineering or cybercrime. The bank’s own fraud controls, warnings, transaction monitoring, and response time may still be relevant.

Do I need a police report to dispute an unauthorized charge?

Not always for the initial bank report. You should report to the bank first and immediately. However, a police, NBI, or CICC report may help if the bank requests supporting documents, if temporary holding must be extended, or if the case involves phishing, hacking, identity theft, or scam networks.

What is BSP-CAM?

BSP-CAM is the Bangko Sentral ng Pilipinas Consumer Assistance Mechanism. It is a second-level process for complaints against BSP-supervised institutions. You generally need to complain to the bank’s FCPAM first before escalating to BSP.

How long does BSP-CAM take?

BSP’s FAQ on Circular No. 1169 states that the BSP-CAM process may take around 55 to 65 days from receipt of the complaint up to termination. Actual timing can vary depending on the complexity of the dispute and the completeness of documents.

Can I go directly to BSP without complaining to the bank first?

Usually, no. BSP generally requires you to first report the concern to the bank’s FCPAM or customer service channel. If the bank fails to act, gives an unsatisfactory response, or delays without proper explanation, you may escalate to BSP-CAM.

What if the unauthorized charge is on my credit card?

Report immediately to the credit card issuer and ask that the card be blocked. Under RA 10870, transactions made before reporting a lost or stolen card may be for the cardholder’s account, so timing matters. Still, you may dispute the charge if you did not authorize it or if there are signs of fraud, weak verification, duplicate billing, or merchant error.

Can the bank temporarily freeze the recipient’s account?

Under AFASA and BSP rules, institutions may temporarily hold disputed funds if the requirements are met and the funds are still traceable. The initial holding period is generally up to 5 calendar days, extendible by up to 25 more calendar days under the rules. Further extension requires a court order.

What if I am an OFW or foreigner outside the Philippines?

Report through the bank’s official online, email, app, or international hotline channels immediately. If the bank asks for an affidavit or authorization, ask whether it will accept a consularized or apostilled document. Keep proof of your location abroad, especially if the transaction supposedly happened physically in the Philippines.

Can I sue the bank?

A civil case may be possible if the bank’s negligence, breach of contract, or failure to follow regulations caused loss. Depending on the amount and nature of relief, some purely monetary financial consumer disputes may fall under BSP adjudication procedures, while more complex claims may require court action. Supreme Court decisions have repeatedly held banks to a very high standard of diligence because banking is affected with public interest.

Key Takeaways

Report the unauthorized charge immediately through the bank’s official fraud channel and FCPAM.
Secure your account first: lock the card, change passwords, remove unknown devices, and preserve evidence.
Ask for a written acknowledgment, case reference number, investigation timeline, and fraud-unit handling.
For transfers and e-wallet movements, ask whether temporary holding and coordinated verification under AFASA are possible.
Keep screenshots, transaction references, OTP logs, call logs, emails, and affidavits.
Escalate to BSP-CAM if the bank fails to act properly after you first use the bank’s complaint process.
Report scams, hacking, phishing, or identity theft to PNP ACG, NBI Cybercrime Division, or CICC.
Do not file false or exaggerated reports; AFASA penalizes malicious reporting that causes improper holding of funds.