Someone phished my OTP or bank details — am I liable, and what do I do now?
Last updated: 2026-07-11 · Educational content; not legal advice.
Short answer
Move first: call your bank or e-wallet's fraud hotline immediately to report the compromise, dispute unauthorized transactions, and lock or reset the account, then change your passwords. On liability, the fact that you were tricked into revealing an OTP does not automatically make every loss your fault — under RA 11765 (Financial Products and Services Consumer Protection Act, 2022) providers owe you fair treatment and a real dispute process, and they carry duties to prevent and detect fraud. The realistic picture is that outcomes turn on the facts of each case, so report fast, file a written dispute, and if the provider won't resolve it, escalate to the BSP. Phishing is also a cybercrime you can report to the PNP Anti-Cybercrime Group or NBI. For the e-wallet-specific liability rules, see the linked answer.
Primary sources
Frequently asked
I gave up my OTP — is it automatically my fault?
Not automatically. Being deceived into sharing an OTP is exactly how phishing works, and RA 11765 requires providers to treat you fairly, run a genuine dispute process, and meet their own fraud-prevention duties. Outcomes depend on the specific facts — so report immediately and put your dispute in writing rather than assuming you have no claim. The e-wallet-specific answer covers the liability nuances.
What do I do in the first minutes?
Call the provider's fraud/dispute hotline to report the phishing and dispute any unauthorized transactions, ask them to lock or freeze the account, then change your password/PIN and revoke device access. Speed matters for both stopping further loss and strengthening your dispute.
Is phishing itself a crime?
Yes. Phishing and unauthorized use of your card or bank credentials can fall under the Access Devices Regulation Act (RA 8484) and computer-related fraud under the Cybercrime Prevention Act (RA 10175). You can report it to the PNP Anti-Cybercrime Group or NBI Cybercrime Division.
Take action
Got a similar problem?
File a complaint and we'll pre-fill BSP, SEC, DTI, and small-claims letters for you.
What to do after an online scam — the first-hour playbook, where to report (PNP Anti-Cybercrime Group, NBI, DOJ Office of Cybercrime), how to spot and report investment/Ponzi scams to the SEC, phishing and OTP theft, online-shopping fraud (undelivered, fake, or misrepresented goods), romance and job scams, and the legal basis under estafa (Revised Penal Code Art. 315), RA 8484, RA 10175, RA 8792, RA 7394, and RA 8799.