Banks May Now Be Forced to Refund Customers Who Lose Money to Fraud

(SPOT.ph) Lost money after a scammer got into your bank account? You may be entitled to a refund if the bank failed to catch the red flags.

Banks and other financial institutions were given until June 2026 to upgrade the systems they use to catch suspicious transactions. With that deadline now over, the Bangko Sentral ng Pilipinas (BSP) said banks should reimburse victims when they failed to exercise the “highest degree of diligence” required of them in the Anti-Financial Account Scamming Act (AFASA).

“If a depositor or bank client becomes a victim of an unauthorized transaction because the bank failed to comply with the requirements of AFASA, the bank will bear the consequences of that noncompliance,” BSP General Counsel Roberto Figueroa said. “This could include full restitution, meaning the bank may be ordered to reimburse the depositor for the full amount lost.”

That does not mean every scam victim is automatically entitled to a refund—the keyword here is may. AFASA lays out when a bank can actually be made to pay.

Also read: Wrong Send? What to Do If You Transfer Money to the Wrong Person

To qualify, the money must have been lost through a financial account scam covered by AFASA.

For most victims, this means a social-engineering scheme: A scammer tricks you into giving away sensitive information, then uses it to access or take control of your account. This can happen through fake bank calls, phishing links, or messages asking for your username, password, card details, or one-time password (OTP).

In many cases, victims end up giving the OTP themselves. Because the correct code was entered, banks have previously argued that the customer approved the transaction—and was therefore responsible for the loss.

But an OTP is only one layer of security. Even when a customer was fooled into entering it, the bank is still expected to catch other warning signs. BSP Circular No. 1213 requires institutions to use real-time systems that can detect and block suspicious transactions. These systems should look at unusually rapid transfers, recent changes to account information, unexpected locations, and activity that does not match the customer’s normal behavior

That is why banks can no longer rely on the OTP alone to argue that the customer authorized the transaction, especially if they failed to put stronger safeguards in place.

“The importance of that deadline is that banks can no longer use the defense that it was the customer who entered the OTP if they are still relying exclusively on OTP,” Figueroa said.

Customers who notice an unauthorized transfer should report it to the bank as soon as possible. Keep your transaction records, complaint reference numbers, text and email alerts, screenshots, and conversations with the scammer.

AFASA allows banks to temporarily freeze the transaction when they detect suspicious activity. They no longer need to wait for police to file a case or for a court to issue an order before they do so.

If the bank refuses to act, you can escalate the case to the BSP's Online Buddy chatbot on its website. Those who can't access the chatbot may send a complaint form by email via consumeraffairs@bsp.gov.ph, together with proof that they already raised the issue with the bank. The BSP said consumers who skip the bank’s internal complaint process will generally be directed back to the institution first.

The faster the transaction is reported, the better the chance that the money has not yet been withdrawn or moved through other accounts.

Also read: Banks Can Now Freeze Suspicious Money Transfers Under New BSP Rule