Seeing online gambling charges on your credit card that you never authorized can be frightening, especially when the merchant name is unfamiliar, the amount is large, or the bank app says the transaction was “approved.” In the Philippines, you should treat this as both a bank dispute and a possible cybercrime/access device fraud case. The fastest practical goal is to stop further charges, preserve evidence, dispute the transaction within the bank’s deadline, and escalate properly if the bank does not handle the case fairly.

First: Is This a Credit Card Fraud Case or a Gambling Issue?

If someone used your credit card details, card number, CVV, OTP, online banking credentials, or card-linked wallet without your permission to fund an online gambling account, the main legal issue is unauthorized use of an access device, not your participation in gambling.

A credit card is an “access device” under the Access Devices Regulation Act of 1998, Republic Act No. 8484. RA 8484 was strengthened by Republic Act No. 11449, which added offenses involving card skimming, fraudulent online access, hacking, and unauthorized access to credit card, debit card, ATM, payment card, and online banking accounts.

The fact that the merchant is an online gambling site matters because:

gambling merchants are often high-risk merchants;
some gambling operators may be foreign, unlicensed, or using payment gateways with confusing billing names;
online gambling-related fraud may involve identity theft, account takeover, phishing, SIM compromise, or stolen card data;
banks often ask for more proof because gambling transactions are sometimes voluntarily made by cardholders and later disputed after losses.

The key question is simple: Did you authorize the transaction?

If the answer is no, do not frame the dispute as “I lost money gambling.” Frame it accurately as: “My credit card was used without my permission to pay an online gambling merchant.”

Immediate Steps to Take Within the First 24 Hours

1. Block or lock the credit card immediately

Use your bank’s mobile app, hotline, or fraud hotline to:

lock the card;
block online transactions;
block international transactions, if available;
request card replacement;
ask the bank to stop recurring or merchant-initiated transactions;
request monitoring for related attempts.

Do this even if the bank says the transaction is still “pending.” Many banks can still place internal alerts or prevent additional transactions.

2. Report the unauthorized charge to the bank and get a reference number

Call the bank first, then follow up in writing through email, secure message, or the bank’s dispute form.

Ask for:

a fraud report or dispute reference number;
the date and time of your report;
the name or ID of the agent, if available;
confirmation that the card was blocked;
confirmation that interest, penalties, and finance charges on the disputed amount will be suspended while the investigation is pending.

Under the Financial Products and Services Consumer Protection Act, Republic Act No. 11765, financial service providers must have a consumer assistance mechanism and, for disputed amounts or unauthorized transactions, must suspend interest, fees, and charges or provide similar reasonable accommodation while the final investigation is pending.

3. Dispute the transaction in writing

A phone call is helpful, but a written dispute is stronger. Send a short, clear email or fill out the bank’s dispute form.

Include:

your full name;
last four digits of the card only;
transaction date and time;
amount;
currency;
merchant descriptor exactly as shown;
statement that you did not authorize, participate in, or benefit from the transaction;
statement that the card was used for online gambling without permission;
request for reversal, chargeback investigation, and written explanation of the bank’s findings.

Do not include your full card number, CVV, PIN, passwords, OTPs, or full screenshots showing sensitive card details.

4. Preserve evidence before apps or websites update

Take screenshots and save PDFs of:

SMS or app transaction alerts;
email alerts;
credit card statement;
bank app transaction details;
merchant name or descriptor;
dispute confirmation from the bank;
call logs to the bank hotline;
emails sent and received;
suspicious links, phishing messages, or OTP messages;
gambling site page, if visible from the transaction descriptor or email receipt.

Under the Electronic Commerce Act of 2000, Republic Act No. 8792, electronic documents and data messages are legally recognized. The Supreme Court’s Rules on Electronic Evidence also allow electronic documents to be used as evidence if properly authenticated.

In practical terms, keep the original emails, SMS, device logs, and files. Screenshots help, but original electronic records are better.

Your Rights When Disputing Unauthorized Credit Card Gambling Charges

Bank dispute rights under BSP credit card rules

BSP rules on credit card operations require credit card issuers to maintain a consumer assistance unit for credit card complaints. Under BSP Circular No. 1003, Series of 2018, cardholders are generally given up to 30 calendar days from the statement date to report errors or discrepancies in the billing statement.

Once the cardholder submits the notice and relevant documents, the credit card issuer must:

Bank obligation	Practical meaning
Act within 10 business days from receipt of notice and documents	The bank should not ignore your dispute after receiving the required documents.
Conduct a thorough investigation within 90 days after receipt of notice	The bank should investigate, correct records if appropriate, and issue a written explanation or clarification.
Correct or reverse unauthorized or fraudulent transactions if found valid	This should include finance charges and related fees connected to the fraudulent transaction.

If your physical card was lost or stolen, transactions before reporting may initially be treated as your account, but BSP rules still preserve your right to dispute them. If the transaction is found unauthorized or fraudulent, it should be corrected or reversed.

Why the 30-day statement deadline matters

Many cardholders report the fraud as soon as the SMS arrives, but forget to file the formal billing dispute after the statement is generated. Do both.

A good practice is:

report immediately upon discovering the charge;
block the card;
submit the formal dispute form;
once the billing statement arrives, send another written notice identifying the same charge as disputed;
pay only the undisputed portion of your bill, unless the bank instructs otherwise in writing.

Paying the undisputed portion helps avoid late fees, negative credit reporting, and collection issues on legitimate charges.

Criminal laws that may apply

Unauthorized credit card use for online gambling may involve several Philippine laws, depending on how the fraud was done.

Law	When it may apply
RA 8484, as amended by RA 11449	When someone uses, accesses, possesses, skims, copies, or fraudulently uses credit card or payment card information.
RA 10175, Cybercrime Prevention Act of 2012	When the fraud involves computer-related identity theft, computer-related fraud, illegal access, phishing, hacking, or misuse of identifying information.
Revised Penal Code, Article 315 on estafa	When deceit or fraudulent acts cause damage, depending on the facts.
Civil Code, Articles 19, 20, 21, 1170, and 2176	Possible civil liability for bad faith, willful injury, breach of obligation, negligence, or quasi-delict.
Data Privacy Act of 2012, RA 10173	When your personal data, card data, or identity information was improperly processed, disclosed, accessed, or misused.

RA 10175’s Implementing Rules recognize computer-related fraud and computer-related identity theft. In Disini v. Secretary of Justice, G.R. No. 203335, the Supreme Court reviewed the constitutionality of the Cybercrime Prevention Act and left key cybercrime provisions enforceable, while striking down or limiting certain provisions affecting speech and privacy.

Does It Matter If the Online Gambling Site Is Legal or Illegal?

Yes, but not in the way many victims fear.

If your card was used without permission, your first issue is still unauthorized use. You are not automatically treated as a gambler simply because your card funded a gambling transaction.

However, the merchant’s status may affect investigation and recovery.

PAGCOR-licensed online gaming

Some online gaming platforms operating in the Philippines are regulated by the Philippine Amusement and Gaming Corporation. PAGCOR maintains information on PAGCOR-accredited online gaming sites and regulates games of chance within Philippine territory.

If the merchant is PAGCOR-accredited, the bank or law enforcement may have a clearer path to request merchant records through official channels.

Illegal or offshore gambling operators

Offshore gaming operations have been banned in the Philippines. Republic Act No. 12312, the Anti-POGO Act of 2025, bans and declares unlawful offshore gaming operations in the Philippines. Before that, Executive Order No. 74 ordered the cessation and winding up of offshore gaming operations.

If the transaction went to an illegal or foreign gambling operator, recovery may be harder because:

the operator may not cooperate;
the merchant may be using a payment gateway or shell descriptor;
records may be outside the Philippines;
law enforcement may need international cooperation;
the website may disappear quickly.

This is why preserving evidence early is important.

Step-by-Step Guide to Disputing the Charges

Step 1: Create a simple timeline

Write a one-page chronology while your memory is fresh.

Include:

when you discovered the transaction;
how you discovered it;
whether you had the physical card;
whether you received an OTP;
whether you clicked any suspicious link;
whether your phone, email, SIM, or banking app had unusual activity;
when you called the bank;
what the bank told you;
when the card was blocked;
what documents you submitted.

Banks, police, NBI, PNP-ACG, BSP, and prosecutors all work better with a clear timeline.

Step 2: Submit the bank’s dispute form

Most Philippine banks require a signed dispute form. Some accept online submission; others require email or branch filing.

Common bank requirements include:

Requirement	Notes
Valid government ID	Passport, driver’s license, UMID, PhilID, PRC ID, ACR I-Card for foreigners, or other accepted ID.
Signed dispute form	Use the bank’s official form.
Credit card statement	Mark the disputed transaction only. Mask unrelated sensitive information if appropriate.
Written explanation	Keep it factual. Avoid speculation.
Police report or affidavit	Some banks ask for this, especially for large amounts or repeated transactions.
Screenshots of alerts	Include transaction SMS, app notification, and email confirmation.
Proof card was in your possession	Useful if it was card-not-present fraud.

Do not delay your bank dispute while waiting for a police report. Submit the bank dispute first, then supplement it later.

Step 3: Request a provisional hold on collection of the disputed amount

Ask the bank in writing:

not to charge interest, penalties, or finance charges on the disputed transaction;
not to report the disputed amount as delinquent while under investigation;
not to endorse the disputed amount to a collection agency while unresolved;
to confirm what amount you should pay while the dispute is pending.

Under RA 11765, financial service providers must provide clear information on actions taken or to be taken, and must suspend interest, fees, and charges or give similar reasonable accommodations for alleged disputed amounts or unauthorized transactions pending final investigation.

Step 4: File a report with law enforcement if the amount is significant or the bank requires it

For unauthorized online credit card use, the usual agencies are:

Agency	When to go there
PNP Anti-Cybercrime Group	Online fraud, phishing, account takeover, identity theft, cyber-related card fraud.
NBI Cybercrime Division	Cybercrime complaints requiring investigation, digital evidence preservation, or more formal investigative assistance.
DOJ Office of Cybercrime	Cybercrime reporting and coordination, especially when cross-border elements are involved.
CICC / Inter-Agency Response Center	Scam and cybercrime reporting, especially for quick referral and coordination.

A police blotter is helpful as a record, but it is not the same as a full cybercrime complaint. If you need a stronger record, prepare a complaint-affidavit.

Step 5: Prepare a complaint-affidavit

A complaint-affidavit is a sworn written statement explaining what happened. It is commonly used before the PNP, NBI, or prosecutor.

A practical complaint-affidavit should include:

your name, address, nationality, civil status, and contact details;
the bank and credit card involved, using only partial card details;
the disputed transaction details;
a statement that you did not authorize the online gambling transaction;
a statement that you did not receive the benefit of the transaction;
how and when you discovered it;
what you did immediately after discovery;
list of attachments;
request for investigation and appropriate charges.

Attachments may include:

credit card statement;
SMS/app/email alerts;
bank dispute acknowledgment;
card replacement/blocking confirmation;
screenshots of suspicious messages or websites;
proof that the card was in your possession;
valid ID;
authority to represent, if someone else files for you.

Notarization usually costs a few hundred pesos, depending on location. Government filing with law enforcement generally does not require a private filing fee, but you may incur costs for printing, notarization, transportation, or certified copies.

Step 6: Escalate to BSP if the bank mishandles the dispute

If the bank ignores you, delays without explanation, refuses to give a written basis, continues charging fees on the disputed amount, or sends collectors despite a pending dispute, escalate to the Bangko Sentral ng Pilipinas.

BSP is generally a second-level recourse, meaning you should first report the complaint to the bank’s Financial Consumer Protection Assistance Mechanism or customer service channel. If unresolved, you may escalate through BSP Online Buddy or BSP Consumer Assistance Channels.

BSP’s own guidance says BSP-CAM facilitates communication between consumers and BSP-supervised institutions. BSP materials also state that the BSP-CAM process may take around 55 to 65 days from receipt to termination, depending on the case.

When filing with BSP, attach:

your bank complaint reference number;
proof you first complained to the bank;
the bank’s reply, if any;
your dispute form;
statement of account;
timeline;
specific resolution requested.

Your requested resolution may be:

reversal of unauthorized charges;
removal of related interest and penalties;
correction of credit record;
written explanation of denial;
suspension of collection while investigation is pending.

Common Scenarios and What They Mean

“The bank says an OTP was used. Am I automatically liable?”

Not automatically, but it becomes harder.

Banks often treat OTP entry as strong evidence of authorization. But OTP fraud can happen through phishing, SIM swap, malware, remote access apps, fake bank pages, social engineering, or compromised email/SMS access.

Explain clearly:

whether you received an OTP;
whether you shared it;
whether someone called pretending to be from the bank;
whether your SIM lost signal;
whether your phone had suspicious apps;
whether your email or banking app was compromised.

Never falsely deny sharing an OTP if you actually did. Instead, explain the circumstances, especially if deception or impersonation was involved.

“The transaction is still pending. Should I wait?”

No. Report it immediately.

Some banks will say pending transactions cannot yet be formally disputed until posted. Still, insist on:

blocking the card;
recording your fraud report;
noting that you objected before posting;
preventing further transactions;
sending you the dispute form as soon as available.

Then file the formal dispute once it posts.

“The merchant name is not a gambling site but I suspect gambling.”

Many gambling transactions appear under payment processors, aggregators, or unrelated merchant descriptors. Do not guess in your affidavit as if it is certain. Say:

“The transaction appears to be connected to an online gambling or gaming merchant based on the descriptor / bank information / merchant category / related notification.”

If the bank confirms the merchant category code or merchant type, ask for that confirmation in writing.

“My spouse, child, helper, employee, or friend may have used my card.”

This is sensitive but common.

Marriage, family relationship, employment, or friendship does not automatically authorize someone to use your credit card for online gambling. But banks may deny disputes if you voluntarily shared the card, account access, OTP, or device.

If the suspect is known to you, be prepared for hard questions:

Did you give the person your card?
Did you previously allow use of the card?
Did you share your phone, email, password, or OTP?
Did you benefit from the transaction?
Are you willing to file a criminal complaint?

If you only want the bank to reverse the charge but refuse to identify a known unauthorized user, the bank may treat the dispute with caution.

“The gambling website wants me to submit ID to process a refund.”

Be careful.

Do not send your ID, selfie, card photo, or full card number to a gambling site unless you have verified through official channels that it is legitimate and necessary. Some fraudsters use “refund verification” to collect more personal data.

Ask your bank whether you should communicate with the merchant at all. In many cases, the safer route is through the bank’s dispute and chargeback process.

“The bank denied my dispute because the transaction was authenticated.”

Ask for the written basis of denial.

Request:

the authentication method allegedly used;
whether OTP, 3-D Secure, token, saved card, wallet, or merchant-initiated payment was involved;
date and time of authentication;
device or IP information, if available;
reason the bank concluded you authorized the transaction;
whether the bank considered your fraud report and supporting documents.

Then escalate to BSP if the explanation is incomplete, inconsistent, or unfair.

What Documents Should You Prepare?

Purpose	Documents
Bank dispute	Dispute form, valid ID, statement, transaction alerts, written explanation, screenshots.
Card replacement/security	Valid ID, signed request if required, updated contact details.
Police/NBI/PNP-ACG report	Complaint-affidavit, statement, screenshots, bank records, valid ID, timeline, contact details.
BSP escalation	Proof of bank complaint, bank response, dispute documents, requested resolution.
NPC complaint, if data misuse is involved	Complaint-assisted form, notarized complaint if required, proof you raised the issue with the respondent, evidence of privacy violation.

If your personal data was misused, maliciously disclosed, or improperly processed, you may review the National Privacy Commission’s guidance on filing a data privacy complaint. NPC procedures generally require the complainant to show that the respondent was first informed in writing and given an opportunity to address the issue, unless an exception applies.

Special Notes for OFWs, Expats, and Foreigners

If you are abroad but your card is Philippine-issued

You can usually start the dispute by hotline, app, email, or secure message. Ask the bank if it will accept scanned documents first, with originals to follow if required.

For affidavits:

Filipinos abroad may execute documents before a Philippine Embassy or Consulate.
Some banks accept consular notarization.
If a document is notarized by a foreign notary, it may need an apostille or authentication depending on the bank, agency, or court requirement.
If someone in the Philippines will file for you, prepare a Special Power of Attorney with proper consular acknowledgment or apostille, as required.

If your card is foreign-issued but the merchant is in the Philippines

File the dispute with your card issuer in the country where the card was issued. The chargeback rules and timelines will usually follow your issuing bank and card network.

You may still report to Philippine authorities if:

the gambling operator, payment processor, or suspect is in the Philippines;
the website claims to be Philippine-based;
Philippine phone numbers, bank accounts, e-wallets, or addresses were used;
your identity documents were misused in the Philippines.

For cross-border cybercrime, the DOJ Office of Cybercrime may become relevant because it acts as a central authority for certain international cybercrime cooperation matters.

Practical Timelines

Action	Practical timeline
Block card and report fraud	Immediately, preferably within hours.
File bank dispute	Same day or within a few days; do not wait beyond the statement deadline.
Billing statement dispute deadline	Generally up to 30 calendar days from statement date under BSP credit card rules.
Bank initial action after complete notice	Within 10 business days under BSP credit card rules.
Bank investigation	Up to 90 days after receipt of notice under BSP credit card rules.
BSP-CAM	Around 55 to 65 days, depending on the case.
PNP/NBI investigation	Varies widely; can take weeks to months depending on evidence, cooperation, and whether suspects are traceable.
Prosecutor proceedings and court case	Often months to years if a criminal case proceeds.

The bank dispute is usually the fastest path to reversal. The criminal complaint is important for investigation and accountability, but it is rarely the fastest way to get the money back.

Mistakes That Can Hurt Your Dispute

Avoid these common errors:

waiting until the due date before reporting;
reporting by phone only and never submitting documents;
failing to dispute the charge after the statement is issued;
paying the full disputed amount without marking it as disputed;
ignoring legitimate undisputed charges;
deleting SMS, emails, or app notifications;
sending full card details to the merchant or strangers;
giving the bank incomplete or inconsistent facts;
falsely claiming fraud after voluntarily gambling and losing;
refusing to cooperate when the bank asks reasonable follow-up questions;
assuming a barangay blotter is enough for a cybercrime case.

What to Say in Your Bank Email

Use clear language like this:

I am disputing an unauthorized online transaction on my credit card. The transaction appears on my account as follows: [date], [amount], [merchant descriptor]. I did not authorize this transaction, did not participate in the online gambling activity connected to it, and did not receive any benefit from it.

I reported the incident through your hotline on [date/time] and requested card blocking. Please investigate this as an unauthorized/fraudulent transaction, initiate the appropriate chargeback or reversal process, suspend interest, penalties, and finance charges related to the disputed amount while investigation is pending, and provide written confirmation of your action and findings.

Keep it factual. Do not accuse a specific person unless you have a basis.

Frequently Asked Questions

Can I refuse to pay the unauthorized gambling charge?

You can dispute the charge and request that the bank suspend interest, penalties, and collection on the disputed amount while investigating. But continue paying undisputed charges unless the bank gives different written instructions. This protects you from late fees or negative account treatment on legitimate purchases.

What if the bank says the transaction was valid because my card details and OTP were used?

Ask for a written explanation and the authentication details relied on by the bank. OTP use is strong evidence, but it does not automatically defeat a fraud claim if phishing, SIM swap, malware, impersonation, or account takeover occurred. Provide evidence of how your credentials may have been compromised.

Do I need a police report before the bank will reverse the charge?

Not always. Many banks allow you to start the dispute without a police report. However, for large gambling-related charges, repeated transactions, suspected identity theft, or denied disputes, a PNP-ACG or NBI Cybercrime complaint can strengthen your record.

Can I file a case against the online gambling site?

Possibly, but it depends on whether the site, payment processor, or operator can be identified and whether it is within Philippine jurisdiction. If the site is illegal, offshore, or using fake merchant details, the more realistic first steps are bank dispute, law enforcement report, and BSP escalation if the bank mishandles the dispute.

Am I in trouble because the transaction involved online gambling?

If your card was used without permission, you are the complainant, not the gambler. Problems arise if the investigation shows that you voluntarily made the gambling transaction and later disputed it after losing. Be truthful and precise in your statements.

What if the gambling site is PAGCOR-accredited?

A PAGCOR-accredited operator may be easier to trace than an illegal site, but you should still dispute through your bank first. Ask the bank to obtain merchant records through proper channels. Do not send sensitive documents directly to the site unless verified and necessary.

Can I report this to BSP right away?

BSP generally expects you to complain to the bank first through the bank’s consumer assistance channel. If the bank ignores you, delays, gives an unsatisfactory response, or continues charging fees on the disputed amount, you can escalate to BSP through BSP Online Buddy or other BSP consumer assistance channels.

What if I am outside the Philippines?

Report to the bank immediately through hotline, app, or email. If you need to execute an affidavit for Philippine use, ask whether the bank or agency requires consular notarization or an apostilled foreign notarization. If a representative will act for you in the Philippines, a properly executed Special Power of Attorney may be required.

Can the bank send collectors while my dispute is pending?

The bank can collect undisputed amounts, but it should handle disputed unauthorized transactions fairly and should suspend interest, fees, charges, or provide similar accommodation while the investigation is pending under RA 11765. If collectors pursue the disputed amount despite a pending fraud dispute, document everything and escalate.

How long does it take to get the money back?

Some reversals happen quickly, especially if the bank identifies obvious fraud. Others take 45 to 90 days or longer, especially where the merchant is foreign, the transaction was authenticated, or the bank needs more documents. BSP credit card rules refer to a 90-day investigation period after notice, while chargeback timelines may also depend on card network rules.

Key Takeaways

Treat unauthorized online gambling charges as credit card fraud, not merely a gambling complaint.
Block the card immediately, report the transaction, and get a bank reference number.
File a written dispute and do not miss the 30-day statement-date window under BSP credit card rules.
Ask the bank to suspend interest, penalties, and collection on the disputed amount while investigating.
Preserve electronic evidence: alerts, statements, emails, screenshots, call logs, and suspicious links.
RA 8484, as amended by RA 11449, and RA 10175 are the main laws for unauthorized card use and cyber-related fraud.
File with PNP-ACG or NBI Cybercrime Division when the amount is significant, identity theft is involved, or the bank requires a formal report.
Escalate to BSP if the bank ignores, delays, mishandles, or unfairly denies your dispute.
If you are abroad, start the bank dispute immediately and prepare consular or apostilled documents only if required.
Be accurate and consistent: a real fraud claim is strongest when supported by a clear timeline and complete records.