BSP Scam Reimbursement 2026: Warning — How to Claim Your Money Back Under AFASA

If you lost money to a bank scam or e-wallet fraud in the Philippines, you may be entitled to get it back. Under the Anti-Financial Account Scamming Act (AFASA) and its implementing BSP Circulars, banks that fail to meet fraud-prevention requirements must now reimburse victims — and the era of banks blaming customers for OTP breaches is officially over. This BSP scam reimbursement guide walks you through exactly how the law works, who qualifies, and how to file a claim to recover your money.

Key Takeaway

• BSP scam reimbursement is now mandatory for non-compliant banks: If a bank failed to meet the June 30, 2026 deadline for multi-factor authentication and fraud management systems, the bank — not the customer — bears the cost of scams that result from that non-compliance.
• AFASA ended the OTP blame game: Banks can no longer deflect responsibility by claiming the customer entered the one-time password. If the bank still relies exclusively on SMS OTPs for high-risk transactions after the deadline, the bank is liable.
• You can file a BSP scam reimbursement claim up to ₱10 million: The BSP Consumer Complaints Resolution Office (CCRO) can resolve disputes through adjudication — a process that takes months, not years, and does not require a lawyer.
• Banks must freeze suspicious transactions within 30 days: Under AFASA, banks are required to temporarily hold disputed transactions without waiting for a court order or PNP case filing.
• Over 500 cases already filed: The PNP has filed more than 500 cases against fraudsters and scammers in the first year of AFASA, according to BSP General Counsel Roberto Figueroa.

The Problem: Why This Matters

For years, Filipino scam victims faced an impossible situation. A fraudster would trick them into sharing an OTP, drain their account, and the bank would say it was the customer’s fault. The money was gone. The bank would not reimburse. The victim had to file a police report, wait months or years for a case to move through the courts, and rarely saw their money again. For OFWs sending remittances home, this meant thousands of pesos could vanish in seconds with no recourse.

The Anti-Financial Account Scamming Act (Republic Act No. 12010), signed into law in July 2024, changed this fundamentally. AFASA shifted the burden of proof from the customer to the bank. If a bank fails to comply with the law’s security requirements, the bank must reimburse the victim — potentially in full. The BSP set a hard deadline of June 30, 2026 for all BSP-supervised financial institutions to upgrade their authentication systems from interceptable SMS OTPs to phishing-resistant methods like biometrics, passkeys, or hardware security keys.

That deadline has passed. Banks that did not comply are now liable. This is the basis of BSP scam reimbursement.

What AFASA Requires Banks to Do

To understand whether you qualify for BSP scam reimbursement, you need to know what AFASA requires banks to do. The law mandates three key obligations:

1. Multi-Factor Authentication (BSP Circular 1213)

By June 30, 2026, all BSP-supervised financial institutions must phase out SMS and email OTPs for high-risk transactions — including adding new payees, transferring funds to external accounts, and changing security settings. In their place, banks must implement phishing-resistant authentication: biometric authentication (fingerprint, facial recognition), passwordless logins (app-based tap-to-confirm), or hardware security keys. If your bank still relies on SMS OTPs for these transactions after the deadline, it is non-compliant — and that non-compliance is the basis for your reimbursement claim.

2. Real-Time Fraud Management Systems (BSP Circular 1213)

Banks must deploy automated, real-time fraud monitoring systems that detect suspicious transaction patterns — velocity checks, geolocation monitoring, device change events, and blacklist screening. If a transaction deviates from your normal behavior, the system should flag it and require additional verification or block it entirely. A bank without this system cannot claim it took reasonable steps to protect you.

3. Mandatory Transaction Freeze (AFASA Section 12)

Under AFASA, banks are empowered and required to temporarily hold disputed transactions for up to 30 days if they suspect any irregular activity. This means banks can freeze funds before they leave the financial system — without waiting for a court order or PNP case filing. BSP General Counsel Roberto Figueroa stated: “Under AFASA, banks are required to temporarily hold disputed transactions if they suspect any irregular activity. That is how powerful the law is — you no longer have to wait for the PNP to file a case before the funds can be frozen.”

Who Qualifies for BSP Scam Reimbursement

Not every scam qualifies for reimbursement. The key question is whether the bank failed to meet its AFASA obligations. Here are the scenarios where you likely qualify:

You likely qualify if:

• Your bank still used SMS OTP as the sole authentication method for a high-risk transaction after June 30, 2026
• Your bank did not flag or freeze a transaction that deviated significantly from your normal pattern (unusual amount, new payee, foreign destination, odd timing)
• Your bank failed to deploy a real-time fraud management system and a scammer exploited that gap
• You reported the unauthorized transaction promptly (within 72 hours is ideal) and the bank did not take immediate action to freeze the funds

You may not qualify if:

• The bank had implemented MFA and the fraud occurred because you knowingly shared your biometric data or physical device with the fraudster
• The transaction was authorized through a properly implemented phishing-resistant method (biometric, passkey, hardware key)
• You waited an unreasonable amount of time (weeks or months) before reporting the fraud

The distinction matters: BSP scam reimbursement is not automatic for every scam. It is specifically for cases where the bank’s non-compliance with AFASA contributed to the fraud. As Figueroa explained: “If a depositor or bank client becomes a victim of an unauthorized transaction because the bank failed to comply with the requirements of AFASA, the bank will bear the consequences of that noncompliance.”

How to File a BSP Scam Reimbursement Claim: Step by Step

Step 1: Report the Fraud to Your Bank Immediately

Time is critical. The moment you notice an unauthorized transaction, contact your bank’s fraud hotline — not the general customer service number. ScamWatch Pilipinas co-founder Jocel de Guzman urged banks to establish dedicated scam-reporting hotlines separate from general customer service, because “victims of fraud should not have to compete with routine customer inquiries when every minute can make the difference in freezing suspicious transactions, preserving evidence, and minimizing financial losses.”

When you call or visit the bank, provide: your account details, the transaction reference number, the date and time of the unauthorized transaction, the amount, and any messages or communications you received from the fraudster. Request that the bank freeze the transaction immediately under AFASA Section 12.

Keep a record of your report: Note the date, time, the name of the person you spoke with, and the reference number for your complaint. This documentation will be essential for your BSP scam reimbursement claim.

Step 2: File a Police Report

While AFASA allows banks to freeze funds without a PNP case, filing a police report strengthens your claim. Visit your nearest PNP station or file through the PNP Anti-Cybercrime Group online portal. The PNP has already filed over 500 cases under AFASA in the first year, demonstrating that law enforcement is actively pursuing scam cases.

Bring: a copy of your bank complaint, screenshots of fraudulent messages, transaction records, and any other evidence. The police report serves as independent documentation that the fraud occurred.

Step 3: File a Complaint with BSP

If your bank refuses to reimburse you or does not respond within a reasonable timeframe (typically 15-30 days), escalate to the Bangko Sentral ng Pilipinas. The BSP’s Consumer Complaints Resolution Office (CCRO) can resolve disputes involving amounts up to ₱10 million through adjudication.

How to file with BSP:

• Visit the BSP Consumer Protection Department at the BSP head office in Manila, or at any BSP regional office
• Submit a written complaint with: your personal details, bank details, description of the fraud, amount lost, evidence of the bank’s non-compliance (e.g., proof they still used SMS OTP), copies of your bank complaint and police report
• You can also file through the BSP’s online consumer complaint portal at bsp.gov.ph

Figueroa confirmed: “Under the FCPA, if your claim is worth no more than ₱10 million, you can file a complaint with the BSP and have it resolved through adjudication. It’s much faster.” The adjudication process typically takes months rather than years — a significant improvement over the court system.

Step 4: Cooperate with the Investigation

Once your BSP scam reimbursement claim is filed, the BSP will investigate whether the bank complied with AFASA requirements. This may involve: reviewing the bank’s authentication methods at the time of the fraud, examining the bank’s fraud management system logs, and verifying whether the bank took appropriate action when you reported the fraud.

Cooperate fully with the BSP investigator. Provide any additional evidence they request. If the BSP finds that the bank failed to comply with AFASA, it can order the bank to reimburse you — potentially for the full amount lost.

Step 5: If Needed, Escalate to Court

If your claim exceeds ₱10 million or the BSP adjudication does not resolve the matter, you can file a civil case in court. Under AFASA, financial institutions that fail to comply face not only reimbursement obligations but also regulatory penalties — including potential license suspension if they fail to deploy a sophisticated fraud management system.

What This Means for Filipino Professionals and OFWs

For OFWs and their families who rely on digital banking and e-wallets to send and receive remittances, BSP scam reimbursement is a critical protection. Here is what it means in practice:

For OFWs: If your family in the Philippines falls victim to a scam because their bank or e-wallet provider did not implement proper authentication, you now have a legal path to recover the money. The key is acting fast — report within 72 hours, document everything, and escalate to BSP if the bank does not cooperate. For more on protecting your remittances, read our OFW Remittance Protection Laws 2026 Guide.

For Filipino professionals: If you use GCash, Maya, or any BSP-supervised digital banking app, you are protected by AFASA. If your provider still uses SMS OTP as the only authentication for high-risk transactions after June 30, 2026, that is a compliance failure — and you can use it as grounds for reimbursement if you are scammed. Set up MFA on your accounts now with our Multi-Factor Authentication Setup Guide.

For businesses: Companies that use corporate banking services should verify that their bank has implemented AFASA-compliant authentication. If a business account is compromised due to the bank’s non-compliance, the business can claim reimbursement under the same process.

Common Mistakes to Avoid

1. Waiting too long to report. The longer you wait, the harder it is to freeze funds and prove your case. Report unauthorized transactions within 72 hours. The 30-day freeze provision under AFASA only helps if the bank is notified in time to act.

2. Calling general customer service instead of the fraud hotline. General customer service agents may not have the authority or training to freeze transactions. Ask specifically for the fraud or security department.

3. Not documenting the bank’s authentication method. If your bank still used SMS OTP, take screenshots of the login and transaction process before the bank has a chance to update their system. This is your evidence of non-compliance.

4. Accepting the bank’s first “no.” Banks may initially deny reimbursement, hoping you will give up. AFASA gives you the right to escalate to BSP. If the bank says no, file with the BSP CCRO.

5. Not filing a police report. Even though AFASA allows fund freezing without a PNP case, a police report provides independent documentation that strengthens your claim. It also contributes to the broader effort to prosecute scammers.

Tools and Resources

• BSP Consumer Protection Department — File complaints and seek adjudication for claims up to ₱10 million. bsp.gov.ph
• PNP Anti-Cybercrime Group — File police reports for online fraud and scam cases. pnp-acg.ph
• Scam Watch Pilipinas — Citizen watchdog tracking active scams and providing consumer guidance. Facebook page
• AFASA Full Text (RA 12010) — The complete law is available at lawphil.net
• BSP AFASA Booklet with IRRs — The implementing rules and regulations, available at bsp.gov.ph

Summary and Next Steps

The BSP scam reimbursement framework under AFASA represents the strongest consumer protection in Philippine banking history. Banks that failed to meet the June 30, 2026 deadline for multi-factor authentication and fraud management systems are now liable for scams that result from their non-compliance. If you have been scammed, here is what to do immediately:

1. Report to your bank’s fraud hotline now — request a transaction freeze under AFASA Section 12
2. File a police report — visit your nearest PNP station or the PNP Anti-Cybercrime Group
3. Document the bank’s authentication method — screenshot the login and transaction process as evidence
4. If the bank refuses, file with BSP CCRO — for claims up to ₱10 million, adjudication is faster than court
5. Monitor your accounts — set up transaction alerts and enable MFA on all financial accounts

For more on protecting yourself from digital fraud, read our guides on AI Voice Cloning Scams Targeting OFWs and Philippine Cybersecurity Threats 2026.

Frequently Asked Questions

What is BSP scam reimbursement?
BSP scam reimbursement is the process by which a bank or financial institution that failed to comply with AFASA requirements must repay a customer who lost money to fraud as a result of that non-compliance. If the bank did not implement multi-factor authentication or a real-time fraud management system by the June 30, 2026 deadline, the bank bears the cost of the scam — not the customer.

How long do I have to report a scam to qualify for reimbursement?
There is no specific deadline stated in AFASA for reporting, but acting within 72 hours is strongly recommended. The 30-day transaction freeze provision under AFASA Section 12 only works if the bank is notified in time to freeze the funds before they leave the financial system. The longer you wait, the harder recovery becomes.

What if my bank says it was my fault for sharing the OTP?
Under AFASA, banks can no longer use the “you entered the OTP” defense if they were still relying exclusively on SMS OTPs for high-risk transactions after June 30, 2026. BSP General Counsel Roberto Figueroa confirmed: “Banks can no longer use the defense that it was the customer who entered the OTP if they are still relying exclusively on OTP.” If the bank had implemented phishing-resistant authentication (biometrics, passkeys, hardware keys) and the fraud still occurred through your actions, the bank’s liability may be reduced.

How much can I claim through BSP adjudication?
The BSP Consumer Complaints Resolution Office (CCRO) can resolve disputes involving amounts up to ₱10 million through adjudication. For claims exceeding ₱10 million, you may need to file a civil case in court. The BSP adjudication process typically takes months rather than years.

Does BSP scam reimbursement cover GCash and Maya?
Yes. AFASA applies to all BSP-supervised financial institutions, which includes e-wallet providers like GCash and Maya. If your e-wallet provider failed to implement AFASA-compliant authentication and fraud management, you can file a reimbursement claim through the same process.

Can I get my money back if the scammer already withdrew it?
It depends. If the bank froze the transaction within the 30-day window, the funds may be recoverable. If the funds already left the financial system, recovery is harder but not impossible — the bank may still be ordered to reimburse you if it was non-compliant with AFASA. File your claim and let the BSP investigation determine the outcome.