Commercial banks in the Philippines are now legally required to reimburse victims of unauthorized online transactions, following the expiration of a grace period that had given lenders until June 2026 to deploy mandated fraud management systems under the Anti-Financial Account Scamming Act (AFASA).
For bank clients and e-wallet users in the Philippines, the development removes a common obstacle in past fraud disputes: banks blaming the customer for entering a one-time password (OTP) during a scam. Under AFASA, banks are now required to use multi-factor authentication (MFA) for high-value and complex transactions, and can no longer point to OTP entry alone as grounds to deny a claim. Account holders who lose money to unauthorized transactions after the June 2026 deadline may now have stronger legal grounds to demand full restitution from their bank.
One year after AFASA took effect, the Bangko Sentral ng Pilipinas (BSP) has received over 500 fraud-related complaints referred by the Philippine National Police (PNP). BSP General Counsel Roberto Figueroa disclosed the figure on the sidelines of a ceremonial signing for an information-sharing agreement with the Department of Justice, clarifying that the number reflects PNP-referred reports alone.
Domestic financial institutions were given until June 2026 to upgrade their infrastructure and establish security systems mandated under AFASA. Scam cases occurring after that deadline now place liability on the bank rather than the depositor.
“If a depositor or bank client becomes a victim of an unauthorized transaction because the bank failed to comply with the requirements of AFASA, the bank will bear the consequences of that noncompliance,” Figueroa said. “This could include full restitution, meaning the bank may be ordered to reimburse the depositor for the full amount lost.”
Figueroa added: “I guess the importance of that deadline is that banks can no longer use the defense that it was the customer who entered the OTP if they are still relying exclusively on OTP.”
The BSP has previously indicated that regulators could suspend a bank’s license if it fails to deploy a sophisticated fraud management system.
The law also grants banks “self-help” powers to intervene before losses are finalized. “Under AFASA, banks are required to temporarily hold disputed transactions if they suspect any irregular activity. That is how powerful the law is – you no longer have to wait for the PNP to file a case before the funds can be frozen,” Figueroa said.
Victims do not need to go through the courts to seek recovery. Under the Financial Consumer Protection Act (FCPA), the BSP’s Consumer Complaints Resolution Office (CCRO) can adjudicate disputes worth up to ₱10 million, a process Figueroa said typically takes months rather than years. “Under the FCPA, if your claim is worth no more than ₱10 million, you can file a complaint with the BSP and have it resolved through adjudication. It’s much faster,” he said.
The BSP has not indicated whether it will publish periodic tallies of AFASA-related reimbursement cases as banks adjust to the new liability standard.
