Bank Fraud Dispute Denials Are Not the Final Word

What It Means

• A bank fraud dispute denial is not final. It is step one of a regulator mandated escalation process with defined timelines and no filing fee.
• The burden of proof sits on the bank, not the account holder, once a complete dispute is lodged under BSP Circular 1160.
• Escalating to BSP-CAM after a bank denial takes an average of 55 to 65 days by the BSP’s own estimate, and no lawyer is required.
• The escalation path works least well for OTP authenticated fraud, the single largest fraud category, because a valid authentication event gives the bank a technically defensible reason to deny.
• A parallel liability regime under AFASA and Circular 1213 puts pressure on banks ahead of a June 30, 2026 compliance deadline, independent of any single dispute outcome.

---

A Denial Is a Position, Not a Verdict

A viral post about a BDO fraud denial made the rounds this year, and the pattern in the replies was familiar. Someone gets scammed, the bank investigates, the bank says no, and the account holder assumes that is where it ends. It is not where it ends. It is where a regulator mandated process actually begins.

This is not isolated to one bank. Complaint volume tied to unauthorized transactions has been climbing across BSP-supervised institutions for several years, and most of that volume never reaches the Bangko Sentral ng Pilipinas at all. It stops at the first denial because the account holder does not know there is a second venue, third venue, and fourth venue built into law.

The Regulatory Stack, Mapped

Philippine fraud dispute recourse is not one law. It is a stack, and knowing which layer applies to a given transaction is the actual skill.

Republic Act No. 11765, the Financial Products and Services Consumer Protection Act, is the enabling statute. BSP Circular 1160 implements it and sets the standard of conduct banks must follow, including a duty to investigate fraud claims fairly and assist affected customers. BSP Circular 1169 provides the actual complaint mechanism once a bank’s internal process ends in denial, running through the BSP’s Consumer Assistance Mechanism, mediation, and adjudication. Republic Act No. 12010, the Anti Financial Account Scamming Act, adds a separate track focused on institutional fraud controls and account security. Its 2025 implementing rules, Circulars 1213, 1214, and 1215, layer in authentication requirements, account inquiry powers, and temporary fund holds.

Two of these tracks matter for any individual bank fraud dispute: the consumer redress track under 1160 and 1169, which decides who gets paid, and the institutional liability track under AFASA and 1213, which shapes how much pressure banks face to get authentication right in the first place. The rest of this piece walks through both.

Circular 1160 Puts the Burden on the Bank

Most people treat a bank’s fraud investigation as something they have to disprove. Under Circular 1160, that framing is backward. BSIs are required to provide relevant and timely information and assistance on fraudulent or unauthorized transactions, and to inform account holders clearly of the actions taken on their complaint. The obligation to investigate and substantiate a denial sits with the institution, not the customer.

In practice, this means a denial that consists of a single line, such as a claim that the transaction was OTP authenticated, does not automatically satisfy the bank’s obligation under the circular. It is a starting position that can be challenged, and the next venue exists for exactly that purpose.

The Fight Continues Past a Denial

Once a bank’s Financial Consumer Protection Assistance Mechanism, its own internal complaints desk, ends in denial or goes unanswered, Circular 1169 opens a second-level path through the BSP’s Consumer Assistance Mechanism, known as BSP-CAM. This is a formal, structured exchange: the BSP directs the bank to answer within 15 days, the complainant can reply within 30 days, the bank rejoins within 10 days, and the complainant gets a final reply window of 10 days. The entire BSP-CAM process runs 55 to 65 days from filing to termination, by the BSP’s own published estimate, and it costs nothing to file.

If BSP-CAM does not resolve the dispute, the complainant can move to mediation, which runs another 50 to 60 days, or go straight to adjudication if two rounds of replies with the bank have already gone nowhere. Adjudication is the BSP’s most formal venue, run by a designated Adjudicator with subpoena and contempt powers, and it can order actual reimbursement. The catch and the ceiling: adjudication only covers claims up to ten million pesos, takes 180 to 240 days, and applies only to purely civil claims for a sum of money, not disputes like foreclosure nullification or contract validity. No lawyer is required at any stage, though the formal pleading requirements at adjudication make one useful for larger claims.

The Decision Tree: What Actually Applies Depends on the Transaction

The mechanism that helps most depends heavily on what kind of fraud occurred, and this is the piece most coverage of this topic skips.

Transaction Type	What Applies	What It Actually Does
E-wallet or bank-to-bank transfer	Circular 1215 fund hold	Lets the receiving institution temporarily hold disputed funds for up to 30 days while a coordinated verification process runs across institutions
Credit card charge	Circular 1160 and 1169 only	No automatic fund hold. Circular 1215 explicitly excludes ordinary credit card transactions from its holding mechanism, except where the card is used to perform an electronic fund transfer through an automated clearing house
OTP authenticated transfer or charge	Circular 1160 burden of proof, weakened by valid authentication	The bank can point to a completed, technically valid authentication step as evidence the transaction was authorized, which is the hardest position for a consumer to overcome at any venue

For a wrong send or a bank transfer to a scammer’s account, the 1215 fund hold gives the account holder real standing: it can freeze the money before it moves further, and 30 days is enough time to build a BSP-CAM case if the receiving bank refuses to cooperate. For a disputed credit card charge, that standing does not exist. The dispute runs on the standard 1160 and 1169 track alone, and the account holder is working purely on burden of proof and card network chargeback rules, not a regulatory fund freeze.

The liability shift AFASA created under Circular 1213 adds a separate layer worth understanding here. Institutions handling high transaction volumes now face fraud management system requirements, including geolocation monitoring and blacklist screening, ahead of a June 30, 2026 deadline. That does not change the outcome of any single dispute filed today, but it changes the evidence trail a bank will have to produce in every dispute filed after that date. A bank that cannot show it met that standard walks into every future case with a weaker position than one that can, a pattern covered in more detail in the breakdown of what Circular 1213 actually protects.

The Negligence Trap

This is the part that gets glossed over in most consumer-facing coverage of this topic, and it is the part that matters most.

Social engineering and OTP-exploitable schemes account for the majority of financial fraud losses reported in the Philippines, and these are precisely the cases where the escalation path is weakest. When a scammer tricks an account holder into approving a transaction, entering an OTP, or authorizing biometric confirmation themselves, the bank’s system performed exactly as designed. The authentication was valid. The bank did not fail to protect the account; the account holder was manipulated into unlocking it voluntarily.

That distinction matters at every venue in the stack. At BSP-CAM, at mediation, and at adjudication, a bank can present a clean authentication log as evidence that its systems worked and that the loss was not the result of institutional failure. The escalation path still exists and still costs nothing to use, but the outcome tilts toward the bank precisely in the fraud pattern that produces the most victims. An account holder pursuing a bank fraud dispute after clicking a phishing link and approving their own OTP is fighting a structurally harder case than one disputing a transaction they never touched.

This is not a reason to skip the process. It is a reason to document everything, from the moment of first contact with the scammer through the moment the transaction cleared, because the strength of a bank fraud dispute at BSP-CAM or adjudication depends entirely on whether the account holder can show the authentication itself was obtained through deception, not merely that money was lost.

Institutions with weaker fraud monitoring, smaller banks and rural banks without the compliance infrastructure larger institutions have built out, are the ones most exposed once Circular 1213’s June 2026 deadline arrives. They face the same burden of proof standard as major banks in every bank fraud dispute filed against them, with less documentation to meet it.

The compliance deadline for stronger authentication lands in less than a year. Complaint volume tied to unauthorized transactions keeps climbing regardless. Account holders who escalate in writing, cite Circular 1160’s burden of proof by name, and document the manipulation behind an OTP approval recover more often than those who accept a first denial as the end of the conversation. That gap between what the law provides and what most people actually use is where the advantage currently sits.

Stay ahead of the cost structures, capital flows, and market recalibrations that shape Philippine business in Business & Money section of Hemos PH.