Change your MPIN or password from the official app, remove unknown device access, report the transaction through the provider’s official support flow and secure the mobile number and email linked to the account. Keep transaction IDs and ticket numbers. Do not pay anyone who promises to recover the money.
An unfamiliar charge is not always fraud: it may be a subscription, linked merchant or transfer made by someone with authorised access. Check quickly, but do not delay an official report while trying to identify every detail.
Emergency steps for GCash or Maya
- Take screenshots of the transaction record. Include the amount, time and reference number, but hide your full mobile number and balances before sharing anything outside official support.
- Secure the account. Reset the MPIN or password inside the official app. Remove unknown sessions or devices when that control is available.
- Secure the linked SIM and email. If the phone or SIM is missing, ask the carrier to bar the line. Change the email password and review its recovery settings.
- File the official report. Use in-app help or the provider’s typed support website. Record the case or ticket number.
- Contact connected institutions. If money moved to a bank, card or another wallet, ask each institution what incident report it needs. Do not edit or delete the evidence.
If the transaction is in GCash
GCash’s current official guidance says to check linked subscriptions, change the MPIN and report an unauthorised transaction through Gigi. It currently asks users to report within 15 days of the transaction date. Follow the live steps on the GCash Help Center, because time limits and menus can change.
If the transaction is in Maya
Open Maya’s official in-app support or its verified support site and use the security or transaction concern flow. Maya lists official support routes on its Security Center. A genuine representative should not ask for your password, OTP or six-digit PIN.
“May unauthorized transaction sa GCash/Maya—ano ang gagawin?” means “There is an unauthorised transaction—what should I do?” The safest answer is to secure access and file the official report immediately. A Facebook commenter, Telegram account or so-called recovery agent is not an official dispute channel.
Evidence worth keeping
- Transaction ID, amount, recipient and exact timestamp
- SMS and email alerts
- Support ticket and chat reference numbers
- Carrier report if a SIM or phone was lost
- Dates and names of institutions contacted
What not to do
- Do not share an OTP, MPIN, password, CVV or remote-control screen.
- Do not install an app sent by a stranger who claims to be support.
- Do not post your full number, ID or transaction history publicly.
- Do not assume that changing the MPIN alone automatically disputes the transaction.
Official sources checked: GCash Help Center and Maya Security Center. This guide explains immediate security steps; the provider decides disputes under its current rules.
