The First Five Days After a Corporate Account Takeover: What Philippine Businesses Must Do

A finance team notices a transfer that should not have gone out. The amount is large, the destination is unfamiliar, and by the time anyone asks questions, the instinct is to assume the money is already gone. The assumption is often wrong, and the first five days after discovery decide whether it stays wrong.

Philippine law gives businesses a real mechanism to freeze and trace funds after a fraudulent transfer, but the window to use it is short, and the way a business behaves inside that window can determine whether money comes back at all.

The Window Is Five Days, Not Thirty

Republic Act No. 12010, the Anti-Financial Account Scamming Act (AFASA), authorizes banks and other covered institutions to temporarily hold disputed funds, under rules the Bangko Sentral ng Pilipinas has since set out in Circular No. 1215.¹ The circular is more specific than the headline figure suggests, and the specifics matter enormously for a business trying to act quickly.

The hold begins with an initial period of up to five calendar days, counted from the time the institution places the hold or receives the holding request. It can be extended by up to another 25 calendar days, but only where the circumstances reasonably indicate the funds are genuinely disputed and only if the company has already given its bank supporting documentation within that first five-day window, unless the industry protocol provides otherwise.² Thirty days is the statutory ceiling, not a freeze a company receives automatically on the day it reports fraud, and extending a hold beyond 30 days requires a court order. The process also has limits on what it can reach. Circular 1215 applies to electronic transfers between financial accounts. A hold can attach only to funds still held within the Philippine banking chain, so money that has already left it cannot be held, although the coordinated verification process applies whether or not the funds remain in the financial system. Because the circular excludes certain categories of transactions and does not clearly address every payment rail, including large-value and cross-border transfers, a company should confirm with its bank during the first call whether the payment it is disputing falls within the process.³

This distinction changes how a business should think about the incident. The first five days are not a deadline for filing a police report or for finishing an internal investigation. They are the window in which the company must get the bank to act, and in which supporting documentation starts to matter for keeping that action alive. A company that spends its first week assembling a complete forensic file before contacting anyone has likely spent its most valuable five days on the wrong task.

Corporate Accounts Are Already Covered

A common assumption is that AFASA was written for individual victims of scams, money muling, and social engineering schemes, and that a company defrauded through its own bank account sits outside that framework. The text of Circular 1215 does not support that assumption.

The circular defines an Account Owner as ‘the person, natural or juridical, to whom a financial account belongs.⁴ The Financial Products and Services Consumer Protection Act, which governs the consumer-complaint mechanism a fraud report ultimately uses, defines a financial consumer the same way, as a person or entity, natural or juridical.⁵ A corporation’s account is inside this framework, not an incidental beneficiary of rules written for someone else.

This matters for how a company frames its first call to the bank. A treasury officer reporting a corporate account takeover is not asking for an exception or a favor. The company is invoking a process the regulation already contemplates for exactly this situation.

Why Who Authorized the Transfer Changes the Legal Picture

Fraudulent transfers differ in ways the law treats differently, and the distinction can change what a company is able to claim.

Where an attacker steals a password, a one-time PIN, or another authentication credential and uses it to take control of a company’s banking session, the transaction fits AFASA’s definition of a social engineering scheme cleanly. The statute describes exactly this pattern: deception used to obtain sensitive identifying information, resulting in unauthorized access and control over the account.⁶

A different pattern, more common in business email compromise, looks like this instead: a fraudster impersonates a supplier, a counterparty, or an executive, and a finance employee who still holds valid banking credentials and genuine authority sends the payment, believing the instruction is legitimate. The employee was deceived, but the employee retained control of the account throughout. On a literal reading of the statute, this scenario sits less comfortably inside the social engineering definition, because the attacker never obtained the credentials that gave them direct control.⁷

No Philippine court or BSP issuance has yet resolved whether this kind of business email compromise counts as an AFASA offense in its own right. What is clearer is that Circular 1215’s hold process does not depend entirely on that classification. The circular allows a bank to treat a transaction as disputed on several alternative grounds, including that it is unusual, lacks a clear economic purpose, or appears connected to unlawful activity.⁸ A payment redirected to an account with no prior business relationship, inconsistent with the company’s known supplier history, is a reasonable candidate for those grounds even where the social engineering classification remains an open question.

This risk often grows exactly where it’s least visible. Companies that scale quickly, outsourcing treasury or back-office functions without keeping clear visibility over who actually holds transaction authority, are often the ones who discover that gap only after a fraudulent transfer has already gone out, a pattern closely related to the loss of operational control covered in Digital Assets, Outsourcing, and Loss of Control. A business should not assume the fund-hold process is unavailable simply because the fraud involved a deceived employee rather than a stolen password, but it also should not assume AFASA’s criminal liability provisions automatically apply to every business email compromise case.

What to Do in the First Five Days

The sequence below reflects what the regulation actually requires and permits, not a generic cybersecurity checklist.

• The first call. The company’s own bank, not the BSP and not the police, is the first and most urgent call. Circular 1215’s complaint-initiated hold begins with a report through the originating bank’s 24/7 fraud channel.⁹ The bank is permitted to act on the complainant’s account of events for purposes of the initial hold, which means a company does not need a completed investigation or a police report before making this call.¹⁰ A useful way to frame the request is direct and specific: identify the disputed transfers, state that the company is the source account owner or its authorized representative, and ask the bank to initiate the temporary holding and coordinated verification process under Circular 1215. Ask for the case reference number and ask what portion of the funds remains traceable.
• The same day, in parallel. Evidence preservation, law enforcement notification, and independent verification of the fraudulent instruction should happen together, not in sequence. Preserving evidence means keeping original emails with full headers rather than screenshots, internal approval records showing who authorized the payment and under what policy, and any logs of account or device changes around the time of the fraud. Filing with the NBI Cybercrime Division or the appropriate PNP Anti-Cybercrime unit early matters for a reason beyond eventual prosecution: cybercrime investigators have access to preservation and disclosure tools, including warrants compelling a bank to identify an account holder, that a private company cannot obtain on its own.¹¹ Separately, verifying the supposed instruction through a known, independent channel, a phone call to a counterparty using a number already on file rather than one provided in the suspicious message, can sometimes catch a scheme before more funds move.
• Through day five. The company should be building the sworn documentation the bank will need to request an extension before the initial hold lapses. Circular 1215 accepts a sworn complaint, affidavit, police report, or comparable supporting document explaining why the transaction is believed to be fraudulent.¹² This is also the point to press the bank for specific written answers, not just a case number: how much of the disputed amount is still held, whether any portion has already been withdrawn, and whether the funds have moved to another institution. The circular requires receiving institutions to report exactly this back through the chain, and the answer determines whether there is still something left to recover.¹³
• Before the window closes. Confirm the extension request has actually been submitted, not merely requested. If court-enabled preservation or disclosure becomes necessary, this is the point to involve counsel formally rather than treating it as a later step.

Where Liability Can Land, and Why It Isn’t Automatic

A recurring assumption inside companies after an incident like this is that using an authorized employee or officer to move the funds means the loss is automatically the company’s own to bear. Philippine case law does not support that assumption as a blanket rule.

In Banco de Oro Universal Bank, Inc. v. Seastres, the Supreme Court held the bank liable for unauthorized withdrawals made through the chief operating officer of the depositor’s business, finding that the bank had failed to follow its own verification procedures for representative transactions.¹⁴ The case predates AFASA, but the underlying principle still carries weight: a bank’s obligation to exercise a high degree of diligence does not disappear simply because an employee or officer was involved in the transaction. Whether a bank followed its own safeguards, and what authority the employee actually had, remain live questions rather than settled ones in the company’s favor or against it.

Separately, the NBI’s announcement in March 2026 of an arrest involving a company’s own administrative executive, who used legitimate online banking credentials and OTP access to move funds through 176 unauthorized transfers, illustrates one way corporate account fraud can originate from inside a company’s own access controls rather than from an external attack.¹⁵ The case was filed as qualified theft in relation to the Cybercrime Prevention Act, a reminder that AFASA is not the only, or even the primary, legal tool available depending on how the fraud actually occurred.

Building Readiness Before It Happens

The companies that handle this well tend to have made a few decisions in advance, not during the crisis itself.

A standing board resolution naming who within the company has authority to report fraud and act on the company’s behalf removes a delay that often costs real time in the first hours. Saving the bank’s 24/7 fraud reporting contact inside the company’s treasury runbook, rather than relying on someone finding it under pressure, does the same. Asking the bank in advance whether it has a dedicated form for reporting a disputed transaction under AFASA, and keeping a copy in the same runbook, removes another source of delay. A template affidavit prepared in advance, even in outline form, shortens the path to the sworn documentation the extension request requires. A basic log-preservation habit, retaining original emails and account change notifications rather than deleting them once a problem is resolved, protects evidence the company may not know it needs yet. A corporate account takeover can also involve compromised personal data, which carries its own notification clock, covered in When a Cyberattack Becomes a Legal Problem.

None of this works well as an afterthought. Treating fraud readiness as something designed into how the business runs, rather than a checklist added after an incident, is what tends to separate companies that recover quickly from companies that improvise under pressure for the first time during the crisis itself, the same principle covered in Compliance Is Now a Business Design Decision.

Separately from any incident, a company should confirm that its bank maintains the fraud monitoring and account-change controls BSP now requires of larger digital financial institutions, including detection of behavioral anomalies and of changes to a customer’s device or account information, and customer notifications of events such as device registration and profile updates.¹⁶ Businesses that sell or collect payments online face this exposure through an additional channel, since the transactions regulated by the Internet Transactions Act run through the same bank accounts and payment channels this kind of fraud targets. A business relationship with a bank that takes these obligations seriously is itself a form of risk management.

Before It Becomes a Crisis

The businesses that recover well from an incident like this rarely handle it entirely on their own, and they rarely start building the relationship that helps them after the fraud has already happened. Knowing which legal mechanism preserves the money, which evidence preserves the claim, and which decisions in the first five days actually matter is not something to work out for the first time under pressure.

AJA Law works across disputes, cybercrime, and data privacy to support businesses facing exactly this kind of incident, from the first call to the bank through any later recovery or liability question. For businesses that want a response plan in place before an incident happens, or support with an active case, a conversation with our team is a reasonable next step. Contact AJA Law.

Need help understanding what this means for you?

Every situation depends on its own facts, documents, timing, and objectives. AJA Law can help you understand the legal issues involved, assess the practical implications, and identify sensible next steps.

Initial inquiries are welcome. There is no charge to contact us, and we will let you know if a formal consultation or engagement would be appropriate.

TALK TO US

Footnotes

1. Republic Act No. 12010 (Anti-Financial Account Scamming Act), approved 20 July 2024, Secs. 7 to 9.
2. BSP Circular No. 1215, s. 2025.
3. Id.
4. Id.
5. Republic Act No. 11765 (Financial Products and Services Consumer Protection Act).
6. Republic Act No. 12010, Sec. 4.
7. Id.; BSP Circular No. 1215, supra note 2.
8. BSP Circular No. 1215, supra note 2.
9. Id.
10. Id.
11. EastWest Rural Bank v. PNP Anti-Cybercrime Group, G.R. No. 273720, 29 July 2025.
12. BSP Circular No. 1215, supra note 2.
13. Id.
14. Banco de Oro Universal Bank, Inc. v. Seastres, G.R. No. 257151, 13 February 2023.
15. National Bureau of Investigation, press release, 3 March 2026.
16. BSP Circular No. 1213, s. 2025.