Recovering Access to Online Banking and One-Time Passwords

Quick answer

Recover online banking access through your bank’s official account-recovery process. If you have lost the registered SIM or phone, contact both the bank and your mobile network provider. The bank handles your login, registered contact details, and banking-device authorization; the telco handles your SIM and mobile number.

You generally need to restore the ability to receive a new one-time password or PIN (OTP), or re-enrol the bank’s approved authentication method. An expired OTP is not something you can reactivate.

If your phone was stolen, your SIM unexpectedly stopped working, or you see transactions you did not authorize, report the incident immediately rather than waiting to regain access. BSP guidance requires banks to provide assistance for fraudulent or unauthorized transactions and maintain an active, free, 24/7 reporting channel. bsp.gov.ph

Identify what needs to be recovered

The appropriate process depends on what you have lost.

SituationFirst actionForgotten password, but registered phone and email still workUse the password-reset function in the official banking app or website.Lost or damaged SIMAsk the telco about replacement with the same number; tell the bank if the loss creates a security risk.Old number is unavailableRequest a registered-mobile-number update and an alternative identity-verification process from the bank.New phone cannot approve transactionsFollow the bank’s device-registration or authentication-reset procedure.Unexpected loss of mobile service, unfamiliar device alerts, or missing moneyContact the bank’s fraud channel and telco immediately.Bank says the account or funds are restrictedAsk what restriction applies and what documents or legal process are needed; a password reset may not resolve it.

SIM replacement, updating bank records, and registering a banking device are separate tasks. Completing one does not necessarily complete the others.

What Philippine law protects—and what banks may verify

The Financial Products and Services Consumer Protection Act, Republic Act No. 11765, protects financial consumers’ rights to fair treatment, information, protection against fraud and misuse, data privacy, and timely complaint handling. Banks must provide a consumer assistance mechanism and explain the actions taken or proposed on a complaint or request. Section 12 also prohibits contractual provisions that deprive customers of specified rights, including having complaints addressed and pursuing legal action. bsp.gov.ph

These protections do not entitle someone to bypass authentication merely because they know an account number or possess a phone previously used for banking. Section 6 of the Anti-Financial Account Scamming Act requires institutions to protect account access through adequate controls, including account-owner verification. lawphil.net

Expect the bank to verify your identity before changing a registered number or restoring access. Ask for its requirements through a verified channel. Depending on the institution and your circumstances, this may involve identification documents, account information, branch verification, or an approved remote process.

Recovery may involve more than SMS OTPs

BSP Circular No. 1213, series of 2025, limits reliance on authentication that third parties can intercept or obtain, such as SMS and email OTPs. It requires stronger authentication for institutions engaged in complex electronic services and handling high aggregate online transaction values, with examples including biometric, passwordless, behavioral, and adaptive authentication.

The circular does not establish one identical recovery process for every bank. Your bank may require you to register a replacement device or restore an app-based approval method even after your SIM works again. bsp.gov.ph

How to recover access safely

1. Contact the bank through a verified channel

Open the banking app yourself, type the bank’s official website address, or use the contact details printed on your card or statement. Avoid support numbers supplied by strangers, unsolicited messages, or social-media comments.

Explain precisely what happened:

• Whether the phone, SIM, password, email account, or registered number is unavailable.

• Whether you still control any registered device.

• When you last accessed the account successfully.

• Whether you received unexpected login, device-registration, or transfer alerts.

• Whether any money is missing.

Ask for a reference number and confirmation of any protective action. If compromise is suspected, ask the bank to disable affected digital access, revoke unfamiliar devices, and assess whether cards or transfer facilities also need blocking.

The BSP advises consumers to verify communications, protect credentials, and report suspicious transactions immediately. bsp.gov.ph

2. Restore the SIM or update the registered number

For a lost or stolen SIM, report the loss to the telco promptly. The SIM Registration Act’s implementing rules require immediate barring of a reported lost or stolen SIM, making it unusable for calls, texts, and mobile data. elibrary.judiciary.gov.ph

Ask whether your number remains eligible for replacement. Do not assume that a permanently disconnected or reassigned number can still be recovered.

Requirements are provider-specific:

• Smart’s published replacement procedure allows replacement of a lost or defective SIM with the same number at a Smart Store. It requires a valid government-issued ID and says the registered SIM owner must make the request. Smart Help

• Globe’s SIM-replacement guidance sets out requirements according to the replacement reason and account type. Check the applicable list before visiting. Globe Help & Support

If the number cannot be restored, tell the bank that its ordinary OTP route is unavailable and request its alternative verification procedure. Do not ask a stranger who now holds your former number to forward banking codes.

3. Follow your bank’s current recovery procedure

Bank procedures are operational requirements, not rules that automatically apply across the industry.

For example, BPI’s account-settings guide provides an app-based mobile-number update for customers with BPI online access and a debit card, followed by activation at a BPI branch ATM within five banking days. It provides branch instructions for customers without the required access or card, and directs customers abroad to its contact center for document-based assistance. BPI

BDO’s current online-banking guide separately explains password resets, mobile-number updates, and replacement-device registration. Its password-reset procedure includes verification through the registered mobile number—so someone who cannot receive that OTP needs assistance beyond repeatedly selecting “reset password.” bdo.com.ph

Ask the bank to confirm the processing period, outstanding documents, and any activation deadline. A timeframe published by another bank does not establish your bank’s deadline.

4. Check the account after access is restored

Review recent transactions, registered contact details, devices, beneficiaries, and security settings. Change compromised passwords using a trusted device and secure the email account used for recovery.

Report any unfamiliar activity separately. Restoring your login does not resolve an unauthorized-transaction complaint.

If an OTP does not arrive

First establish whether you still control the registered number and whether your bank is sending an SMS OTP or requesting approval through its app.

If there are no signs of compromise:

1. Check the masked destination number shown by the bank.

2. Confirm that the SIM can receive ordinary texts and has network service.

3. Check blocked-message or spam folders and the bank’s service advisories.

4. Follow the displayed resend interval and expiry instructions.

5. If overseas, ask your telco whether the line can receive the relevant messages while roaming.

Do not repeatedly guess codes or assume an earlier code remains valid after requesting another. OTP validity and retry limits depend on the service.

Unexpected loss of service combined with banking alerts needs urgent attention because it may indicate account compromise. Contact the bank and telco using another trusted device.

If money has already been transferred

Report the transfer immediately to the originating institution—the bank or provider from which the money was sent. Give the amount, date, time, transaction reference, recipient details available to you, and an accurate account of what happened.

BSP guidance makes the originating institution primarily responsible for assisting its customer with disputed fund transfers. Ask it to investigate and explain what protective and recovery steps it has taken. bsp.gov.ph

Temporary holding of disputed funds

BSP Circular No. 1215, series of 2025, establishes temporary holding and coordinated verification for qualifying disputed electronic fund transfers:

• Initial holding: up to five calendar days.

• Extended holding: up to 25 additional calendar days when justified.

• Total: up to 30 calendar days; a further extension requires a competent court.

For an extension, supporting documents—such as a sworn complaint, affidavit, police report, or other evidence—generally must be submitted within the initial holding period, subject to applicable industry-protocol exceptions. Ask the bank for the exact deadline and required documents immediately.

This procedure excludes erroneous transfers caused by the sender’s incorrect encoding. It also generally excludes credit-card transactions, except electronic fund transfers through an automated clearing house using a credit card.

A hold preserves available funds while the dispute is checked; it does not guarantee a refund. If your own funds are held, you may challenge the hold with evidence establishing the transaction’s legitimacy. bsp.gov.ph

Does use of an OTP automatically defeat a refund claim?

No automatic conclusion should be drawn from that fact alone. Authentication records matter, but liability also depends on the applicable law, the institution’s controls, the circumstances of the transaction, and the evidence.

Section 6 of Republic Act No. 12010, the Anti-Financial Account Scamming Act, provides for restitution where an institution fails to employ adequate controls or exercise the highest degree of diligence in preventing loss from the specified offenses. A criminal conviction is not a prerequisite. The same section protects institutions determined by the BSP to comply with the required systems and controls.

Accordingly, reimbursement is neither guaranteed nor necessarily defeated because an OTP was used or disclosed. Explain honestly whether you entered a code, approved a prompt, installed software, or transferred money after being deceived. bsp.gov.ph

Evidence to preserve

Keep a dated incident file containing:

• Screenshots of error messages, login alerts, number changes, and transaction notifications.

• Relevant SMS messages, emails, chats, sender details, and suspicious website addresses.

• Transaction references, amounts, timestamps, and recipient information.

• Bank and telco case numbers, acknowledgments, replies, and submitted forms.

• Evidence of when your phone or SIM became unavailable.

• A factual timeline of your actions and communications.

Ask the bank in writing to preserve relevant login, device-registration, contact-change, authentication, and transaction records. Circular No. 1213 requires transaction logging that includes relevant authentication, device, and network information. A preservation request does not automatically entitle you to unrestricted copies of every internal record. bsp.gov.ph

Retain original files where possible. Use redacted copies for ordinary correspondence and disclose necessary sensitive material only through verified, appropriate channels.

How to escalate an unresolved complaint

Start with the bank’s consumer assistance mechanism

Submit a written complaint identifying the problem, previous reports, outstanding requirements, and the outcome you seek. For example, distinguish a request to update your number from a request to investigate and reimburse a transfer.

If disputed transactions generate interest, fees, or charges, request the protections under Section 8(f) of RA 11765: suspension of those charges or similar reasonable accommodations while the final investigation is pending. This does not automatically suspend unrelated obligations. bsp.gov.ph

Escalate to the BSP if the bank does not resolve the concern

The BSP’s complaint guide directs consumers to complain to the institution first. You may then escalate an unsatisfactory response through BSP Online Buddy (BOB) on the BSP website. Complete the conversation until you receive a reference number.

If you cannot access BOB, the guide allows submission of the Complaint/Inquiry/Reply form to consumeraffairs@bsp.gov.ph, with proof of your prior complaint.

BSP-CAM does not require your PIN, password, account or card number, passbook, passport, or other identification cards. Follow its instructions when redacting attachments. bsp.gov.ph

Bank inaction can also justify escalation. You do not need a lawyer for BSP-CAM. Observe subsequent notices carefully: BSP’s procedural guidance provides a 30-day period to reply to the institution’s Answer and a 10-day period to reply to its Rejoinder.

BSP assistance is distinct from adjudication. Formal BSP adjudication covers qualifying purely civil financial disputes seeking solely payment or reimbursement of up to ₱10 million, excluding legal interest, attorney’s fees, and litigation costs. A request solely to restore access is not itself that kind of money claim. bsp.gov.ph

Use other authorities for the appropriate issue

For suspected fraud or identity theft, report to the PNP or NBI; BSP guidance also identifies the Cybercrime Investigation and Coordinating Center. A criminal report serves a different purpose from the bank complaint. bsp.gov.ph

For inaccurate personal data, request correction from the bank or telco. The National Privacy Commission’s rectification guidance explains the right to dispute inaccurate data. This right does not eliminate legitimate identity verification. privacy.gov.ph

A privacy complaint generally requires first notifying the respondent in writing and showing inadequate action or no response within 15 calendar days, subject to the applicable rules and exceptions. Consult the NPC’s complaint requirements before filing. privacy.gov.ph

Common mistakes to avoid

• Waiting for SIM replacement before reporting fraud. Make the bank report immediately.

• Sharing an OTP with a supposed recovery agent. Enter credentials only in the verified recovery process you initiated.

• Assuming a password change removes every unauthorized device. Ask the bank to confirm device and session revocation.

• Paying an unofficial “account recovery” service. Use the bank and telco directly.

• Deleting evidence after regaining access. Keep it until the dispute is resolved.

• Describing a mistaken transfer as hacking. Accurate facts determine the proper remedy.

• Assuming every case requires an affidavit of loss. Obtain the provider’s current requirements before paying for documents.

When help is urgent

Seek immediate bank and telco assistance for stolen devices, unexpected SIM-service loss accompanied by security alerts, unauthorized contact changes, or continuing transfers.

Get legal help promptly if substantial funds are missing, a temporary hold is nearing expiry, the bank alleges your involvement in fraud, or access is restricted by a court or regulatory order. Ask about an approved alternative channel if you urgently need salary, pension, medical, or living-expense funds; availability depends on the restriction and account status.

Frequently asked questions

Can the bank send an OTP to any number I provide?

You must complete the bank’s approved verification and contact-update process. Simply supplying a new number does not establish authority to redirect banking credentials.

Do I always need an affidavit of loss or police report?

No single checklist applies to every recovery request. Requirements differ between SIM replacement, bank verification, and a fraud investigation. Ask which document is required and for what purpose.

Can I recover access while abroad?

Ask your bank about remote verification and overseas support. BPI, for example, expressly provides contact-center instructions for customers outside the Philippines. This does not establish the same procedure for other banks. BPI

Can a relative handle the complaint?

The institution may require written authority and additional verification. BSP-CAM permits authorized representation under its procedural requirements. Giving someone your password or OTP is not a substitute for proper authorization. bsp.gov.ph

Must access be restored within 24 hours?

Do not assume a universal 24-hour restoration guarantee. Ask for your bank’s applicable processing period and distinguish it from emergency blocking, SIM replacement, device activation, and fraud-investigation timelines.

This article provides general Philippine legal information, not advice on a particular account or dispute. The applicable remedy depends on the facts, records, and current institution-specific procedures. Sources checked on 23 October 2026.

Double-click to edit...