An unauthorized charge made in another country does not automatically become the cardholder’s liability. For a Philippine-issued credit card, the key questions are whether the transaction was genuinely authorized, when the loss or fraud was reported, whether the cardholder protected the card and security credentials, and whether the issuing bank, merchant, or payment processor failed to follow required safeguards. In practice, the cardholder should dispute the charge directly with the Philippine card issuer, which must investigate and, if the transaction is found unauthorized or fraudulent, reverse the amount together with related interest, fees, and charges.

Who may be liable for an unauthorized foreign credit card transaction?

Several parties participate in an overseas credit card purchase:

The cardholder, whose name appears on the account
The issuing bank, which issued the Philippine credit card
The foreign merchant, where the purchase supposedly occurred
The merchant’s acquiring bank or payment processor
The card network, such as Visa, Mastercard, JCB, American Express, or UnionPay
The fraudster who stole or misused the card or card information

Their responsibilities are different.

Party	Possible responsibility
Fraudster	Criminally and civilly liable if identified and prosecuted
Cardholder	May be responsible for an authorized transaction, or may initially bear certain transactions made before reporting a lost or stolen card
Philippine card issuer	Must accept the dispute, investigate fairly, provide appropriate interim relief, and reverse a transaction found unauthorized or fraudulent
Foreign merchant or acquiring bank	May ultimately bear the loss under card-network chargeback rules, particularly where required authentication or verification was missing
Card network	Provides the rules and technical process for allocating the loss among the issuer, acquirer, and merchant, but normally does not deal directly with the cardholder

The cardholder generally does not need to determine which foreign merchant, processor, or bank should ultimately absorb the loss. The immediate claim is normally filed with the Philippine card issuer. The issuer then uses the applicable card-network dispute or chargeback process behind the scenes.

Philippine laws that protect credit cardholders

Republic Act No. 10870: Philippine Credit Card Industry Regulation Law

The principal law governing Philippine credit card issuers is Republic Act No. 10870, enacted in 2016.

Section 15 provides that, when a credit card is lost or stolen, transactions made before the cardholder reports the loss or theft are initially for the cardholder’s account. However, this rule must be read together with the law’s implementing regulations: the cardholder may still dispute the transaction, and an amount found to be unauthorized or fraudulent must be corrected or reversed.

Section 18 requires issuers to give cardholders up to 30 calendar days from the statement date to report a billing error or discrepancy. The issuer must take action within ten business days after receiving the notice. (Lawphil)

Under BSP Circular No. 1003, Series of 2018, the issuer must:

Accept a report made in writing, verbally, or through another documented channel
Take action within ten business days after receiving the notice and relevant records
Conduct a thorough investigation within 90 days
Correct its records when warranted
Give the cardholder a written explanation before collecting the contested amount

The bank may continue collecting amounts that the cardholder has not disputed. This is why the dispute should identify each unauthorized transaction precisely rather than simply stating that the entire statement is incorrect.

Republic Act No. 11765: Financial Products and Services Consumer Protection Act

The Financial Products and Services Consumer Protection Act, or RA No. 11765, strengthens the cardholder’s right to fair treatment, protection against fraud, information security, and effective complaint handling.

While a disputed or allegedly unauthorized transaction is being investigated, the financial service provider must either:

Suspend interest, fees, and charges on the disputed amount; or
Provide a similar reasonable accommodation to the consumer

A credit card agreement cannot validly waive the consumer’s statutory right to complain, obtain redress, protect nonpublic information, or pursue the financial service provider. (Supreme Court E-Library)

BSP Circular No. 1160: How liability is assessed

BSP Circular No. 1160, Series of 2022 requires BSP-supervised institutions to evaluate disputed transactions fairly and reasonably. Fraud concerns must receive priority, and consumers must be given an active reporting channel and an immediate written acknowledgment.

Pending investigation, the bank may be required to:

Suspend applicable interest, fees, or charges
Place a temporary hold on the disputed amount
Grant provisional credit
Block the card or account
Take other measures necessary to protect the consumer

If the investigation confirms that the charge was unauthorized or fraudulent, the bank should immediately reverse it, including related interest, fees, and charges, or make a provisional credit permanent. The bank must formally communicate the investigation result within three banking days after the investigation concludes.

Liability is not determined solely by asking whether an OTP, card number, or security code was used. BSP rules allow consideration of:

The cardholder’s actions before, during, and after the transaction
The acts or omissions of the bank, its employees, agents, outsourced entities, or service providers
Any failure by the bank or its providers to comply with financial consumer protection requirements

This means that cardholder carelessness may be relevant, but it does not automatically excuse weaknesses in the bank’s fraud detection, authentication, notification, or complaint-handling systems.

How Supreme Court decisions affect liability

Prompt notice generally protects the cardholder

In Spouses Ermitaño v. Court of Appeals and BPI Express Card Corporation, the cardholder immediately reported a lost card, but unauthorized purchases were still processed afterward. The Supreme Court ruled that prompt notice should be enough to relieve the cardholder from liability for subsequent unauthorized use.

The Court rejected a contract term that kept the cardholder liable until the issuer had notified all participating merchants. After receiving notice, the issuer—not the cardholder—controlled the process of blocking the card and warning merchants. Requiring the cardholder to remain liable because the issuer had not yet completed its own internal notification was considered unfair and contrary to public policy. Read the Supreme Court decision in Spouses Ermitaño v. Court of Appeals. (Supreme Court E-Library)

The issuer must prove that the cardholder incurred the obligation

In Bank of the Philippine Islands v. Spouses Sarda, the bank failed to prove that the supposed cardholders received or authorized the cards and transactions. The Supreme Court held that the bank should bear the resulting loss caused by its own deficient issuance procedures and policies.

The Court emphasized that a bank seeking payment must present adequate proof that the consumer actually obtained and used the credit accommodation. Bare suspicion or conjecture is insufficient. Read the Supreme Court decision in BPI v. Spouses Sarda. (Supreme Court E-Library)

These decisions do not mean every disputed transaction must automatically be refunded. They show that banks cannot rely only on standard-form contract clauses or unsupported assumptions when their own systems, procedures, or evidence are deficient.

Does it matter that the transaction happened abroad?

The location affects the evidence and back-end processing, but it does not remove the Philippine issuer’s duties.

For a Philippine-issued card:

The dispute should be filed with the Philippine issuer.
Philippine consumer protection laws continue to govern the issuer’s treatment of its customer.
The issuer may coordinate with the foreign merchant, acquiring bank, and card network.
The merchant’s local law and the card network’s rules may determine which industry participant ultimately absorbs the loss.
The cardholder ordinarily does not have to sue the foreign merchant before asking the issuer for a reversal.

The position is different when the card itself was issued by a bank outside the Philippines. In that case, the issuer’s home-country law and dispute procedures will usually govern, even when the unauthorized purchase happened in the Philippines. BSP remedies may be unavailable unless the relevant issuer or financial service provider is BSP-supervised in relation to the account.

Common overseas transactions that may look fraudulent

Before filing the dispute, check whether the charge could be explained by one of these situations:

Different merchant name

A restaurant, hotel, airline, or online shop may appear under the legal name of its parent company or payment processor. Search the descriptor carefully, but do not contact an unfamiliar number appearing in a suspicious text message.

Posting date differs from purchase date

The statement may show the date the merchant submitted or completed the charge rather than the date the card was first presented. Time-zone differences can also make a transaction appear one day earlier or later.

Hotel, car rental, and cruise deposits

Hotels and rental companies commonly place temporary authorizations for incidentals, fuel, damage, or late checkout. The final charge may appear separately from the original hold.

Tips and delayed adjustments

In some countries, a restaurant initially authorizes the bill and later submits the total with the tip. Transit operators, toll systems, and offline terminals may also post charges days later.

Dynamic currency conversion

A merchant may offer to charge the card in Philippine pesos instead of the local currency. The resulting exchange rate or service fee may be unfavorable, but that does not necessarily make the purchase unauthorized.

Duplicate or inflated charges

A duplicate charge, wrong amount, or unprocessed refund is usually a billing or merchant dispute, not identity theft. It should still be reported within the applicable period, but the bank may use a different chargeback reason and request receipts or correspondence with the merchant.

What to do immediately after seeing an unauthorized foreign charge

Lock or block the card immediately. Use the bank’s mobile app if available, then contact the issuer’s official fraud hotline. Ask for a permanent block and replacement card when appropriate.
Record the exact time of your report. Save the reference number, date, time, channel used, and name or identification number of the bank representative. This can be decisive when charges were made shortly before or after notification.
Dispute every transaction in writing. Even if you already called, send an email, secure message, or completed dispute form identifying:
- Transaction date and posting date
- Merchant descriptor
- Country
- Foreign-currency amount
- Peso amount
- Reason you deny authorization
Submit the dispute within 30 calendar days from the statement date. Do not wait for the next billing cycle. Some network chargeback periods may be longer, but the Philippine statutory reporting period should be treated as the safer deadline.
Request suspension of interest and fees. State expressly that the amount is disputed and ask the issuer to suspend related finance charges, late fees, and collection activity while the investigation is pending. Also ask whether provisional credit will be granted.
Continue paying the undisputed portion. Do not ignore the entire bill merely because one charge is disputed. Ask the issuer to confirm how the minimum payment should be calculated while the dispute is under investigation.
Preserve evidence. Keep screenshots, transaction alerts, emails, receipts, travel records, passport entry and exit stamps, location history, police reports, and proof that the physical card remained with you.
Respond promptly to requests for documents. Chargeback systems operate within strict deadlines. A valid dispute can fail procedurally if the cardholder ignores the bank’s request for a signed form or supporting evidence.
Ask for the written investigation result. If the claim is denied, request a clear explanation of the authentication method and evidence relied upon.

Evidence that can strengthen an unauthorized transaction claim

Evidence	Why it helps
Bank fraud-report reference number	Establishes when the issuer was notified
Statement and transaction alert	Identifies the exact charge and timing
Passport stamps and travel itinerary	May show that the cardholder was not in the transaction country
Proof that the card remained in the cardholder’s possession	Supports a card-data theft or card-not-present claim
Police report for a stolen wallet or device	Documents the incident and reporting time
Merchant receipts or signature records	May reveal a different signature or purchaser
SMS and email records	Shows whether an OTP or transaction alert was received
Screenshots of phishing messages	Supports a social-engineering investigation
Device and account-security records	May show an unfamiliar login, device, or IP location
Prior communications with the merchant	Useful for duplicates, cancellations, or missing refunds

A foreign police report can be helpful, especially when the card or phone was stolen abroad, but it is not automatically a legal prerequisite for every credit card dispute. The bank should not refuse to receive an initial report merely because a police document is not yet available.

What if the bank says an OTP was used?

An OTP, PIN, chip record, contactless token, or 3-D Secure authentication result is important evidence. It may indicate that someone had access to the cardholder’s phone, email, device, or security information.

However, the existence of an OTP record does not by itself explain:

Who actually entered the OTP
Whether the cardholder was deceived by a fake bank representative
Whether the mobile number or device had been compromised
Whether the bank’s authentication and fraud controls functioned correctly
Whether the transaction amount or merchant changed after authentication
Whether the consumer received a clear warning identifying the transaction being approved

The bank should investigate the complete circumstances. The cardholder should give a precise account of what happened rather than simply writing, “I did not authorize it.”

Where the cardholder knowingly gave an OTP to another person despite clear warnings, the bank may treat that conduct as a substantial factor in allocating the loss. Even then, BSP rules require consideration of the bank’s own acts, omissions, systems, and compliance—not only the cardholder’s mistake.

When may the cardholder still be held responsible?

A cardholder is more likely to be held liable when evidence shows that:

The cardholder personally made or approved the purchase
An authorized supplementary cardholder made the transaction
The cardholder received and benefited from the goods or services
The dispute is based only on buyer’s remorse
The physical card was lost, and the transaction occurred before the loss was reported, subject to the right to prove that it was unauthorized or fraudulent
The cardholder unreasonably delayed reporting despite receiving transaction alerts
The cardholder intentionally allowed another person to use the card or credentials
The dispute contains false statements or fabricated evidence

A transaction may also be difficult to reverse when the cardholder deliberately authorized payment to a scammer. For example, a person may knowingly approve a purchase or money transfer after being deceived into believing it was a legitimate investment, emergency payment, or government fee. The deception may support a criminal case, but the payment can still appear technically authorized in the bank’s records.

Criminal liability of the fraudster

Unauthorized credit card use can constitute access-device fraud under RA No. 8484, the Access Devices Regulation Act of 1998, as expanded by RA No. 11449 in 2019. Prohibited acts include using an unauthorized access device with intent to defraud, skimming or copying card information, fraudulent account access, and certain forms of hacking. (Lawphil)

The Anti-Financial Account Scamming Act, RA No. 12010 of 2024, expressly includes credit card accounts within the definition of financial accounts. It penalizes social-engineering schemes in which a person uses deception or electronic communications to obtain sensitive financial information and gain unauthorized access or control. (Supreme Court E-Library)

Depending on the conduct, the incident may also involve:

Estafa under Article 315 of the Revised Penal Code
Computer-related fraud under RA No. 10175, the Cybercrime Prevention Act
Identity theft
Data privacy violations
Falsification or use of falsified documents

A criminal report and a credit card dispute serve different purposes. The criminal complaint seeks to identify and prosecute the offender. The bank dispute determines whether the charge should remain on the cardholder’s account. One process should not unnecessarily delay the other.

How to escalate the dispute if the bank denies it

1. Request reconsideration from the issuer

Ask for:

The complete reason for denial
The type of transaction: chip, magnetic stripe, contactless, manual entry, online, recurring, or wallet token
Whether an OTP or 3-D Secure authentication occurred
The transaction’s merchant category, country, date, time, and currency
Whether a signed receipt, proof of delivery, or merchant response exists
The bank’s response to each piece of evidence you submitted

Not every internal fraud record can be disclosed in full, but the bank should provide a meaningful and transparent explanation.

2. File through the BSP Consumer Assistance Mechanism

The bank’s Financial Consumer Protection Assistance Mechanism is the required first-level remedy. If the complaint remains unresolved or the bank does not act, the consumer may escalate it through the BSP Consumer Assistance Mechanism, or BSP-CAM.

The BSP currently accepts escalated complaints through the BSP Online Buddy chatbot or through a completed Complaints, Inquiries and Requests form sent to the official consumer affairs email. The complaint should include proof that the issue was first reported to the bank, the bank’s response, supporting evidence, and the specific resolution requested. See the BSP’s current Consumer Assistance Channels and Chatbot page. (Bureau of Soils and Water Management)

BSP guidance indicates that the CAM process may take approximately 55 to 65 days, although complex cases and incomplete submissions can take longer. A lawyer is not required for BSP-CAM.

3. Consider BSP mediation or adjudication

If BSP-CAM does not resolve the dispute:

The parties may proceed to voluntary mediation.
A qualifying consumer claim may proceed to BSP adjudication.
BSP may adjudicate purely civil financial claims for payment or reimbursement of up to ₱10 million, excluding legal interest, attorney’s fees, and litigation costs.
BSP guidance estimates approximately 50 to 60 days for mediation and 180 to 240 days for adjudication.
Filing a formal BSP adjudication complaint is free, but formal requirements—including verification under oath and certification against forum shopping—must be observed.

Claims for broader damages, issues outside BSP’s adjudicatory authority, or amounts beyond its jurisdiction may require a court action.

Filing the complaint while you are outside the Philippines

A Filipino or foreign cardholder abroad can usually report the charge and pursue the bank’s internal complaint process electronically. Ordinary bank disputes and BSP-CAM complaints generally do not require the cardholder to return to the Philippines.

Practical steps include:

Use the bank’s international hotline or secure app messaging.
State all transaction times in both local time and Philippine time when possible.
Preserve proof of your location when the charge occurred.
Obtain a local police report when the physical card, phone, or wallet was stolen.
Keep the originals of foreign documents in case the bank or BSP later asks to inspect them.

A representative may act in BSP-CAM with appropriate written authorization. More formal mediation or adjudication may require a Special Power of Attorney. When an SPA or sworn document is executed abroad for official use in the Philippines, it may need notarization at a Philippine embassy or consulate, or notarization followed by an apostille in a country covered by the Apostille Convention. Exact authentication requirements should be confirmed for the particular proceeding.

Frequently Asked Questions

Am I liable simply because the unauthorized transaction was made abroad?

No. The foreign location does not by itself establish authorization. The issuer must investigate the circumstances and evidence.

What if my physical card never left my possession?

Report the transaction immediately. The card information may have been obtained through skimming, a compromised merchant, phishing, malware, account takeover, or an online data breach.

What if the transaction happened after I reported my card lost?

Prompt reporting strongly supports the cardholder. Under Spouses Ermitaño, the issuer cannot unfairly shift post-notification losses to the cardholder merely because its own blocking or merchant-notification process was delayed.

What if the transaction occurred before I reported the loss?

RA No. 10870 initially places pre-report lost-card transactions on the cardholder’s account. However, the cardholder may still dispute the charge, and the issuer must reverse it if the investigation finds it unauthorized or fraudulent.

Should I pay the disputed transaction while the bank investigates?

Ask the bank to suspend interest, fees, and collection on the disputed amount. Continue paying undisputed charges and obtain written confirmation of the adjusted minimum payment. Ignoring the entire statement may cause avoidable penalties on legitimate balances.

How long can the bank investigate?

Under BSP credit card regulations, the issuer must take action within ten business days after receiving the notice and supporting records and must complete a thorough investigation within 90 days. It should formally communicate the result within three banking days after the investigation concludes.

Can the bank reject my claim merely because an OTP was entered?

An OTP is significant evidence but should be assessed together with the surrounding facts, including possible social engineering, device compromise, fraud alerts, transaction details, and the bank’s own controls.

Do I need a police report from the foreign country?

Not in every case. It is particularly useful when a physical card, phone, passport, or wallet was stolen, but the issuer should accept an immediate fraud report while additional documents are being obtained.

Can I file a BSP complaint while living abroad?

Yes. BSP-CAM complaints can be submitted electronically after the complaint has first been raised with the issuing bank.

What if the card was issued by a foreign bank?

The issuer’s home-country rules normally govern. Philippine BSP remedies may not apply unless the account or issuer falls within BSP supervision.

Key Takeaways

An overseas location does not automatically make an unauthorized charge the cardholder’s responsibility.
Report and block the card immediately, and preserve proof of the exact reporting time.
Dispute the charge within 30 calendar days from the statement date.
The issuer must investigate and reverse a transaction found unauthorized or fraudulent, including related interest, fees, and charges.
Lost-card transactions made before reporting are initially charged to the cardholder, but they remain disputable.
An OTP or other authentication record is evidence, not a complete substitute for a fair investigation.
Continue paying undisputed portions of the bill while requesting suspension of charges on the contested amount.
Escalate unresolved complaints first through the bank’s consumer assistance mechanism and then through BSP-CAM.
Report suspected criminal conduct separately to Philippine or foreign law enforcement authorities.