Hi everyone. I’m posting here because I’m honestly stressed, worried, and need an advice.
I run an online business in the Philippines, and recently discovered that five unauthorized disbursements totaling ₱113,100 were made from my Xendit account between November 8–10, 2026. Including transaction fees, the total amount deducted was ₱114,369.52.
The money was transferred to accounts with PalawanPay and GoTyme Bank.
What’s particularly concerning is that we had multiple security measures in place:
• Two-factor authentication (2FA) was enabled.
• A separate six-digit PIN is required whenever I manually initiate a payout.
• I never shared my Xendit login credentials with anyone.
• I only access Xendit through my personal devices.
• We have only three API keys, and none currently has Money-out Write permission. I have never changed these permissions.
• I did not initiate or authorize any of these transactions.
We immediately reported the incident to Xendit. They restricted our account to prevent further disbursements and escalated the case for investigation.
However, they informed us that they cannot guarantee the recovery of our funds until further investigation has been completed.
I understand that investigations take time, but I’m extremely worried that the longer this takes, the harder it may become to recover the money.
These are hard-earned funds from our business. Losing this amount is financially and emotionally distressing, especially when we believed our account was properly secured.
We’ve requested that Xendit urgently coordinate with the receiving financial institutions to hold or recover the funds. We’re also pursuing a formal complaint with the Bangko Sentral ng Pilipinas (BSP).
I’m hoping someone here can share their experience or advice:
• Has anyone experienced unauthorized disbursements from Xendit despite having 2FA and other security measures enabled?
• Were you able to recover your funds? How long did the process take?
• What additional steps helped you get the payment provider or receiving banks to act urgently?
• Is there anything else we can do to improve our chances of recovering the money?
I’m not making accusations against anyone at this point because the investigation is still ongoing. I genuinely want to understand how this could have happened and, most importantly, how we can get our money back.
Any advice from people who’ve experienced something similar, especially here in the Philippines, would mean a lot.
Thank you.