No more blaming OTPs: Banks now forced to reimburse victims of online account fraud
By Derco Rosal
Victims of certain unauthorized digital transactions in the country could soon see their money returned, as banks and e-wallet providers face new potential obligations to reimburse account holders following the expiration of the fraud-prevention deadlines.
One year since the Anti-Financial Account Scamming Act (AFASA) took effect, the Philippine National Police (PNP) has filed more than 500 cases against fraudsters and scammers, the Bangko Sentral ng Pilipinas (BSP) said.
BSP General Counsel Roberto Figueroa clarified that this figure reflects reports from the PNP alone, speaking on the sidelines of a ceremonial signing for an information-sharing agreement with the Department of Justice (DOJ).
Domestic financial institutions were given until June 2026 to upgrade their infrastructure and establish robust security systems. Any scam cases arising after the deadline are now a cross banks must bear.
“If a depositor or bank client becomes a victim of an unauthorized transaction because the bank failed to comply with the requirements of AFASA, the bank will bear the consequences of that noncompliance,” Figueroa said. “This could include full restitution, meaning the bank may be ordered to reimburse the depositor for the full amount lost.”
This shift in liability places a heavier burden of proof on financial institutions, ending the era when banks could easily deflect responsibility by blaming client negligence for one-time password (OTP) security breaches. Under AFASA, banks are now mandated to implement multi-factor authentication (MFA), particularly for complex and high-value transactions.
“I guess the importance of that deadline is that banks can no longer use the defense that it was the customer who entered the OTP if they are still relying exclusively on OTP,” Figueroa said.
Beyond holding banks liable for client losses, the BSP previously signaled that regulators could go so far as suspending a bank's license if it fails to deploy a sophisticated fraud management system (FMS).
In addition to restitution, the law provides immediate “self-help” remedies to prevent stolen funds from being siphoned out of the financial system. Figueroa noted that lenders are now empowered—and required—to take action against suspicious activity without waiting for a court order.
“Under AFASA, banks are required to temporarily hold disputed transactions if they suspect any irregular activity. That is how powerful the law is—you no longer have to wait for the PNP to file a case before the funds can be frozen,” he said.
For victims seeking recovery without the drawn-out timelines of the judicial system, the Financial Consumer Protection Act (FCPA) offers a faster path.
Figueroa pointed out that the BSP’s Consumer Complaints Resolution Office (CCRO) can resolve disputes involving amounts up to ₱10 million through adjudication—a process that typically takes months rather than years.
“Under the FCPA, if your claim is worth no more than ₱10 million, you can file a complaint with the BSP and have it resolved through adjudication. It’s much faster,” he said.