An unexpected debit, card purchase, online transfer, cash advance, or “merchant charge” on your Philippine bank account can feel frightening, especially when money has already left your account or your credit card bill is due. The most important thing is to act quickly, keep proof, and use the correct sequence: secure the account, report to the bank’s fraud or dispute channel, ask for written confirmation, then escalate to the Bangko Sentral ng Pilipinas (BSP) if the bank’s response is unsatisfactory.

What Counts as an Unauthorized Bank Charge?

An unauthorized bank charge is any transaction posted to your deposit account, debit card, credit card, e-wallet-linked bank account, or online banking account that you did not approve.

Common examples include:

A debit card purchase you did not make
A credit card online transaction from an unknown merchant
ATM withdrawals you did not perform
Online bank transfers to unknown accounts
InstaPay or PESONet transfers made after phishing, OTP theft, SIM compromise, or account takeover
Recurring subscription charges you already cancelled
Double posting or duplicate merchant charges
Foreign currency card charges while your card was in the Philippines
Cash advance or quasi-cash transactions you never authorized
Bank fees, penalties, or finance charges imposed because of a disputed transaction

Not every wrong charge is fraud. Some are merchant errors, delayed postings, subscriptions with poor cancellation records, family or supplementary-card use, or bank system errors. But from a consumer-protection standpoint, you should report it as a disputed or unauthorized transaction until the facts are clear.

Your Main Rights Under Philippine Law

Philippine law now gives financial consumers stronger protection than before. The most important law is the Financial Products and Services Consumer Protection Act, Republic Act No. 11765 (2022). It requires financial service providers to maintain a free consumer assistance mechanism and, for disputed amounts or unauthorized transactions, to suspend interest, fees, and charges or give similar reasonable accommodations while the investigation is pending. (Supreme Court E-Library)

BSP Circular No. 1160, Series of 2022, implements this framework for BSP-supervised institutions, including banks and applicable non-bank financial institutions. It recognizes the consumer’s rights to fair treatment, transparency, protection of assets against fraud and misuse, data privacy, and timely complaint handling.

For fund transfers and alleged unauthorized transactions, BSP rules say the complaint should be filed with the Originating Financial Institution (OFI), usually the bank or app where the money came from. The OFI is primarily responsible for assisting its customer and coordinating with the Receiving Financial Institution (RFI), the institution that received the funds. Pending investigation, institutions may suspend interest, fees, or charges, hold disputed funds if still intact, provide reasonable accommodations such as non-withdrawable provisional credit, and block or freeze accounts when needed.

If the transaction is found to be unauthorized or fraudulent, the BSP rules direct the institution to correct or reverse the transaction, including related interest, charges, and fees, or make any provisional credit permanent. Liability may depend on the account holder’s actions before, during, and after the transaction, as well as acts or omissions of the bank, its employees, agents, outsourced providers, or other service providers.

Step-by-Step: What to Do Immediately

1. Secure the account first

Do this before arguing about who is liable:

Lock or temporarily block your card in the banking app, if available.
Change your online banking password.
Disable online transactions, international use, or cash advance if the app allows it.
Remove saved cards from e-commerce sites, ride-hailing apps, delivery apps, gaming platforms, and digital wallets.
If your SIM or phone may be compromised, call your telco and the bank using another device.
If your email was compromised, secure it because many banks send OTPs, password reset links, or transaction alerts there.

Do not wait for the transaction to “settle.” Report while it is still pending if possible. In practice, speed matters because receiving banks may still be able to hold or trace funds.

2. Call the bank’s official fraud hotline

Use only the number printed on the back of your card, the official bank website, the official mobile app, or verified bank communication channels. Do not call numbers sent by strangers through SMS, Messenger, Viber, WhatsApp, Telegram, or email.

Ask the bank to do the following:

Block the affected card or online banking access
Stop further transactions
Tag the transaction as disputed or unauthorized
Start the bank’s Financial Consumer Protection Assistance Mechanism (FCPAM)
Give you a case number or reference number
Tell you the documents required
Confirm whether provisional credit, fee suspension, interest suspension, or temporary hold is available
Confirm the expected turnaround time

BSP Circular No. 1160 requires BSP-supervised institutions to maintain free complaint channels, and fraud-related reporting channels should be available on a 24/7 basis with immediate written acknowledgement through the same channel.

3. Send a written dispute immediately

A phone report is useful, but a written report is easier to prove. Send it by email, secure message inside the banking app, or the bank’s official dispute portal.

Include:

Your full name
Last four digits of the account or card number only, unless the bank’s secure form requires more
Date and time you discovered the charge
Transaction date and posting date
Amount
Merchant name or recipient account, if shown
Transaction reference number
Why you dispute it
What action you want: reversal, provisional credit, card replacement, fee reversal, investigation result, and account protection
Your phone number and email
Attach screenshots, but never include passwords, OTPs, full card numbers, CVV, or PIN

A good short statement is:

I am formally disputing this transaction as unauthorized. I did not perform, authorize, benefit from, or consent to this transaction. Please block further unauthorized activity, investigate under your FCPAM, suspend any related interest, fees, or charges while the dispute is pending, and provide a written investigation result.

4. Preserve evidence

Take screenshots before information disappears. Save:

Bank SMS or email alerts
App transaction history
Card statement or account statement
Merchant emails or receipts you do not recognize
Chat messages, phishing links, scam pages, caller IDs, and numbers used
Time you called the bank and the name or ID of the bank representative
Case reference number
Any denial or resolution letter from the bank
Proof that the card was in your possession, if relevant
Travel records if the charge occurred abroad while you were elsewhere
Prior cancellation emails for subscriptions
Police, NBI, or PNP cybercrime reports, if filed

Do not delete scam messages. They may help investigators trace the social engineering method.

Special Rules for Credit Card Charges

Credit cards have a specific law: Republic Act No. 10870, the Philippine Credit Card Industry Regulation Law. Credit card issuers must have a customer assistance unit for prompt action on complaints, inquiries, and requests. Cardholders must be given up to 30 calendar days from the statement date to report a billing error or discrepancy, and the issuer must take action within 10 business days from receipt of notice. (Supreme Court E-Library)

For a lost or stolen credit card, RA 10870 states that transactions made before reporting the loss or theft are generally for the account of the cardholder. This makes immediate reporting critical. (Supreme Court E-Library)

Practical point: even if the law mentions lost or stolen cards, many modern disputes involve card-not-present transactions, compromised card details, merchant errors, or account takeover. Report them promptly anyway. The bank may investigate through its own fraud process and, for card transactions, through card-network chargeback procedures.

Special Rules for Bank Transfers, E-Wallets, and Scam-Related Transactions

The Anti-Financial Account Scamming Act, Republic Act No. 12010 (2024), also called AFASA, is now very important for digital banking fraud. It covers financial accounts such as deposit accounts, credit card accounts, other bank transaction accounts, e-wallets, and other accounts used for financial products or services. (Lawphil)

AFASA penalizes money muling and social engineering schemes, including deception through electronic communications to obtain sensitive identifying information like usernames, passwords, bank details, credit card details, e-wallet information, and other electronic credentials. (Lawphil)

AFASA also requires institutions to protect access to clients’ financial accounts through risk management systems and controls such as multi-factor authentication, fraud management systems, and verification processes. If an institution fails to employ adequate systems or fails to exercise the highest degree of diligence, it may be liable for restitution of funds, and a criminal conviction is not required before restitution. (Lawphil)

Under AFASA and BSP Circular No. 1215, Series of 2025, institutions may temporarily hold disputed funds for not more than 30 calendar days, unless extended by a court. Once held, the equivalent amount is considered credited but cannot be withdrawn during the holding period, and coordinated verification must begin.

BSP Circular No. 1215 also recognizes complaint-initiated holding through the OFI’s 24/7 fraud reporting channel. Initial holding may be for up to 5 calendar days, with possible extension by up to 25 calendar days if warranted, within the overall 30-day period.

This is why fast reporting matters. If the scammer’s receiving account still contains the money, the receiving institution may be able to hold it. If the funds were already withdrawn or moved through several accounts, recovery becomes harder.

When to File a Police, NBI, or PNP Cybercrime Report

A bank dispute is for reversal, refund, provisional credit, and consumer redress. A criminal complaint is for investigation and prosecution of the scammer or unauthorized user. You may need both.

Consider filing with the NBI Cybercrime Division, PNP Anti-Cybercrime Group, or the nearest cybercrime-capable unit if:

Money was transferred to another person’s account
You were phished, tricked, or socially engineered
Someone used your identity or account
Your phone, SIM, email, or banking app was compromised
The bank asks for a police report, sworn complaint, or affidavit
You need formal documentation for a large claim

The NBI Citizens’ Charter for computer-crime investigative assistance lists the CyberCrime Division as available to the general public, with complainants proceeding to file a complaint, undergoing interview, executing sworn statements or submitting affidavits, and submitting supporting documents. It states no fee for the listed steps. (National Bureau of Investigation)

Documents You Should Prepare

Purpose	Documents or Evidence
Initial bank report	Screenshot of transaction, statement, SMS/email alert, transaction reference number, date/time, amount, merchant or recipient details
Card dispute	Dispute form, billing statement, proof card was in your possession, cancellation email, merchant communication, travel proof if relevant
Online transfer scam	Transfer receipt, recipient account details if visible, chat logs, phishing link, caller number, screenshots, bank case number
BSP escalation	Copy of complaint filed with the bank, bank reply or proof of inaction, case number, timeline, evidence, requested resolution
NBI/PNP report	Valid ID, affidavit or sworn statement, screenshots, transaction records, device or phone if relevant, bank certification if available
Representative filing for you	Written authorization or Special Power of Attorney, valid IDs of account owner and representative
If account owner is abroad	Consularized or apostilled affidavit/SPA if required, passport copy, proof of Philippine account, overseas contact details

For Filipinos or foreigners abroad, the practical bottleneck is often document execution. If the bank or BSP requires a sworn affidavit or Special Power of Attorney, you may need to sign before a Philippine Embassy or Consulate, or before a local notary with apostille if the country is part of the Apostille Convention. If the document is not in English or Filipino, prepare a translation.

How to Escalate to the BSP

You must generally report first to the bank’s FCPAM or customer service channel. BSP’s Consumer Assistance Mechanism is a second-level recourse. BSP guidance states that all BSP-supervised institutions are mandated to establish their own FCPAM as the first-level recourse, and that dissatisfied consumers may escalate through the BSP Online Buddy (BOB) chatbot or, if they cannot access BOB, by submitting the CIR form by email with proof that they first used the bank’s FCPAM.

The BSP website lists BOB and other consumer assistance channels, including email at consumeraffairs@bsp.gov.ph, mail, phone, and walk-in options. BSP also states that if you submitted through BOB, you receive a case reference number; if by email, you receive an automated acknowledgement; and if by postal mail, BSP responds within seven banking days from receipt of the letter. (BSP)

In your BSP complaint, include:

Bank name
Your bank case number
Date you first reported to the bank
Exact amount disputed
Timeline of events
Bank’s response or lack of response
What you are asking for
All supporting documents

Do not send your PIN, password, full account number, full card number, CVV, OTP, passport, or full ID details unless BSP or the bank specifically instructs you through a secure and official channel. BSP’s own complaint guide warns consumers not to share PINs, passwords, account numbers, credit card or ATM card numbers, passbooks, passports, or other identification cards because these are not required to process BSP-CAM complaints.

BSP-CAM, Mediation, and Adjudication Timelines

If the bank does not resolve the issue, BSP-CAM is the next step. BSP Circular No. 1169, Series of 2023, provides the rules for complaints filed with BSP by financial consumers against BSP-supervised institutions. It covers BSP-CAM, mediation, and adjudication.

Stage	What Happens	Typical Timeline
Bank FCPAM	First-level bank complaint and investigation	Depends on bank process and complexity
BSP-CAM	BSP facilitates communication after bank complaint is unresolved or ignored	About 55 to 65 days from receipt to termination
Mediation	BSP helps parties negotiate settlement; no lawyer required	About 50 to 60 days from referral
Adjudication	Formal BSP proceeding for money claims against BSP-supervised institutions	About 180 to 240 days, or 6 to 8 months
Court case	Civil or criminal court proceedings	Varies widely; usually longer

BSP adjudication is available for financial consumer complaints that are purely civil in nature and seek payment or reimbursement of money not exceeding ₱10,000,000, exclusive of legal interest, attorney’s fees, and costs.

A lawyer is not required for BSP-CAM or BSP mediation. BSP also says a lawyer is not required in adjudication, although representation may be useful because formal requirements must be observed. If a representative appears in mediation or adjudication, a Special Power of Attorney may be required.

Can the Bank Be Liable?

Yes, depending on the facts.

Banks in the Philippines are not treated like ordinary businesses when handling deposits and accounts. Republic Act No. 8791, the General Banking Law of 2000, recognizes the fiduciary nature of banking and requires high standards of integrity and performance. The Supreme Court has repeatedly held that banks must exercise the highest degree of diligence in dealing with depositors. (Supreme Court E-Library)

In Banco de Oro Universal Bank, Inc. v. Seastres, the Supreme Court affirmed liability for unauthorized withdrawals and stressed that the bank was duty-bound to exercise the highest degree of diligence in handling the depositor’s accounts and verifying withdrawals. (Supreme Court of the Philippines)

Civil liability may also arise under the Civil Code. Article 1170 makes those who are guilty of fraud, negligence, delay, or contravention of their obligations liable for damages. Article 2176 covers quasi-delict, where a person who causes damage through fault or negligence must pay for the damage. (Lawphil)

However, the consumer’s conduct also matters. If the account holder shared an OTP, ignored bank warnings, delayed reporting for weeks, gave remote access to a scammer, or allowed another person to use the account, the bank may argue contributory negligence or denial of liability. This does not automatically defeat a claim, but it can affect the investigation and outcome.

Common Mistakes That Hurt Unauthorized Charge Claims

Waiting too long

Report immediately. For credit cards, RA 10870 gives cardholders up to 30 calendar days from statement date to report billing errors or discrepancies, but waiting is risky, especially for online transfers where funds can move quickly. (Supreme Court E-Library)

Only calling but not sending a written dispute

A hotline call may stop further loss, but a written complaint proves your report, timeline, requested remedy, and evidence.

Sending sensitive information by email or chat

Never send OTPs, PINs, passwords, CVV, full card photos, or full account numbers through ordinary email or chat. Use secure bank forms when required.

Assuming BSP is the first step

BSP will usually ask whether you first complained to the bank’s FCPAM. BSP Circular No. 1169 states that reporting to the bank’s FCPAM is a condition precedent to BSP-CAM.

Paying the entire disputed credit card amount without noting your dispute

If you pay to avoid finance charges, state clearly in writing that payment is made under protest and without waiving your dispute. If you do not pay the undisputed portion, the bank may treat the account as delinquent.

Ignoring small test charges

Fraudsters sometimes test a card with a small charge before making a larger one. Report even small unauthorized charges.

Practical Scenarios

“My credit card was charged by an online merchant I never used.”

Block the card, dispute the transaction in writing, ask if replacement is needed, and request reversal of related finance charges. Check whether family members, supplementary cardholders, or saved online subscriptions caused the charge. If not, treat it as unauthorized.

“Money was transferred from my bank app to an unknown account.”

Call the bank’s fraud hotline immediately and ask for complaint-initiated holding under the bank’s 24/7 fraud process. Provide the transaction reference number, amount, date, time, and recipient details. File a written dispute and consider an NBI or PNP cybercrime report.

“The bank says I gave the OTP, so it will not refund me.”

Ask for the full investigation result, including logs relied upon, risk alerts, device information available to you, and the basis for denial. Under BSP rules, liability assessment may consider both the account holder’s actions and the bank’s acts or omissions, including compliance with consumer protection and fraud-prevention rules.

“I am abroad and cannot go to the branch.”

Report through the official app, hotline, or email. Ask the bank whether it accepts scanned documents, video verification, or a consularized/apostilled affidavit. If a representative in the Philippines will deal with the bank or BSP for you, prepare a written authorization or SPA with sufficient authority.

Frequently Asked Questions

Do I have to pay a disputed credit card charge while the bank investigates?

Pay at least the undisputed portion of the bill. For the disputed amount, ask the bank in writing to suspend finance charges, late fees, and penalties while the investigation is pending, citing RA 11765 and BSP consumer protection rules. (Supreme Court E-Library)

How long does a bank investigation take?

It depends on the bank, transaction type, and whether another institution or merchant is involved. BSP rules require banks to handle fraud-related concerns with utmost priority and resolve them within a reasonable time based on complexity. After the investigation concludes, the bank must formally inform the client of the result within three banking days.

Can BSP order my bank to refund me?

BSP-CAM first facilitates communication. If unresolved, mediation or adjudication may follow. BSP adjudication can cover purely civil money claims up to ₱10,000,000 against BSP-supervised institutions.

Do I need a lawyer to file with BSP?

No. BSP states that a lawyer is not needed for BSP-CAM or mediation, and a lawyer is not required in adjudication. However, adjudication has formal requirements, so legal help may be useful for large claims, complex evidence, or repeated denial.

What if the unauthorized charge came from GCash, Maya, or another e-wallet linked to my bank?

Report to the institution where the funds originated and the e-wallet provider if both are involved. AFASA covers e-wallets and other financial accounts under BSP-supervised institutions, and coordinated verification may apply. (Lawphil)

Is a police report required before the bank refunds me?

Not always. But banks may ask for a sworn complaint, affidavit, or police/NBI/PNP report for fraud cases, especially large transfers or scam-related claims. BSP Circular No. 1215 recognizes sworn complaints, affidavits, police reports, and other supporting documents in the temporary holding and coordinated verification process.

What if the bank denies my claim because I clicked a phishing link?

A phishing link can hurt your claim, but it does not automatically end the matter. Ask for the written basis of denial and check whether the bank complied with its own fraud controls, transaction alerts, MFA, risk monitoring, account blocking duties, and consumer assistance rules.

Can the receiving account be frozen?

For disputed transactions, funds may be temporarily held under AFASA and BSP rules if the requirements are met and the funds are still traceable or intact. The general AFASA holding period cannot exceed 30 calendar days unless extended by a court. (Lawphil)

Can foreigners complain to the BSP?

Yes, if the complaint concerns a BSP-supervised institution and a Philippine financial product or service. Foreigners should prepare passport identification, Philippine account details, overseas contact information, and properly notarized, consularized, or apostilled authorization documents if someone in the Philippines will represent them.

What if the charge is from a subscription I forgot to cancel?

That may be a merchant or contract issue rather than bank fraud. Still, dispute it with the merchant and the bank, submit proof of cancellation, and ask whether the bank can block future recurring charges from that merchant.

Key Takeaways

Report unauthorized bank charges immediately through the bank’s official fraud channel.
Always get a case number and send a written dispute.
Ask the bank to suspend interest, fees, and charges related to the disputed amount while investigation is pending.
For credit cards, report billing errors or discrepancies within 30 calendar days from statement date.
For online transfers and scams, fast reporting may allow temporary holding or tracing of funds under AFASA and BSP rules.
Escalate to BSP only after reporting to the bank’s FCPAM, unless the issue is bank inaction that you can document.
Preserve screenshots, statements, alerts, chat logs, and call records.
Do not share OTPs, PINs, passwords, CVV, or full account/card details.
BSP-CAM, mediation, and adjudication are available for unresolved complaints against BSP-supervised institutions.
A bank may be liable when it fails to exercise the required diligence, but the consumer’s actions before, during, and after the transaction also matter.