If a transaction still doesn't belong to you after a quick check, notify the bank, card issuer, or payment platform today. Use an official phone number or secure message, protect the account, and save the transaction record. For some claims, a call starts the process but a written notice preserves the legal deadline.

This information is for U.S. consumer accounts. Business accounts, commercial cards, and some international transfers follow different rules. It is general consumer information, not legal advice.

Start with these steps

Check the charge, but don't wait

A statement descriptor may use a parent company, payment processor, or shortened merchant name. Before reporting the transaction, consider whether it came from:

• A recurring subscription or free trial
• An authorized user
• A digital-wallet token
• A family or household member
• A recent purchase that posted later than expected

If you still don't recognize it, report it while you continue investigating. Waiting for a merchant to reply can make a liability or billing-dispute deadline harder to meet.

Be precise about what happened. A payment you approved after a scammer deceived you may be treated differently from a payment made by someone who accessed your account without permission. A purchase you made but never received, a duplicate charge, or an incorrect amount may be a billing or merchant dispute rather than an unauthorized transaction.

Contact the right institution through an official channel

Call the number on the back of the card, on a statement, or on the institution's official website. Don't use a number from a suspicious text, email, or search advertisement.

Say plainly, "I did not authorize this transaction." Depending on the payment type, ask the representative to:

• Lock or replace the card
• Secure online banking or payment-app access
• Block future ACH debits if that service is available
• Open a fraud or billing-error claim
• Give you a claim number and expected response date
• Identify the address for written notice
• Explain whether the institution needs a written statement, affidavit, or other form

If the account or wallet may have been taken over, ask whether changing the account number or closing the compromised account is appropriate. A merchant might explain an unfamiliar descriptor or issue a voluntary refund, but contacting the merchant does not replace formal notice to the issuer when a federal deadline applies.

Secure connected accounts

From a device you trust, change the passwords for the bank, card, email, and payment accounts. Use unique passwords and turn on multifactor authentication. Sign out unfamiliar devices and revoke app connections you don't recognize.

If your phone number may have been taken over, contact your mobile carrier. Never give a supposed investigator your one-time verification code, PIN, recovery phrase, or permission to control your device remotely.

Preserve the record

Save the statement or account-activity page, transaction alert, descriptor, date, amount, confirmation number, and related messages. Write a short timeline that includes:

• When the transaction occurred or posted
• When you first noticed it
• When you called or filed the claim
• The names or departments you contacted
• What each representative told you
• Every document you sent

Keep original documents. When sending copies, redact full account numbers, passwords, Social Security numbers, and other information that isn't needed to investigate the claim.

Make other reports when they help

A police report isn't a universal requirement for a bank dispute. It can still document identity theft, a stolen device, or an account takeover. You can report fraud through the FTC's ReportFraud portal and internet crime through the Internet Crime Complaint Center.

Those reports create a record; they don't automatically recover the money and don't replace notice to the bank, card issuer, or payment platform.

The payment source determines the process

Two deadlines are often confused: the credit-card 60-day written-notice period and Regulation E's two-business-day liability rule. Neither is a reason to delay reporting.

Credit card charges: use the FCBA billing-error process

For an unauthorized credit-card charge, call the issuer first to protect the account. Then send a written billing-error notice to the issuer's billing-inquiries address. That address may be different from the payment address.

The letter must generally reach the issuer within 60 days after the first bill showing the error was sent. The clock is tied to the statement, not simply to the purchase date. Keep a copy of the letter and proof of delivery. The FTC's credit-card dispute guidance describes the process.

The issuer generally must:

• Acknowledge the written complaint within 30 days, unless it has already resolved the issue
• Investigate and resolve the dispute within 90 days
• Avoid treating the disputed amount as delinquent while the billing-error process is being handled, as long as you pay the undisputed portion and other required amounts

If you've moved, send the issuer your address change in writing. The FCBA process has an address condition: the issuer generally must have received the change at least 20 days before the billing period ends.

Federal law generally limits liability for unauthorized credit-card use to $50. Many issuers and card networks offer zero-liability protection, but that is a company or network policy with terms and exceptions. It isn't identical to the statutory FCBA limit.

Continue paying the undisputed balance and required charges on the rest of the account. Don't stop paying the entire statement because one charge is under review.

Debit cards, ACH, and other electronic transfers

Regulation E may cover an unauthorized electronic fund transfer from a consumer checking, savings, or another covered account. Examples can include some debit-card, ATM, ACH, and online-banking transactions.

The timing of your report affects potential liability:

• If a debit card or other access device was lost or stolen, reporting it within two business days after learning of the loss generally limits liability to $50.
• If you report later but within 60 days after the statement showing the unauthorized transfer was sent, liability can rise to $500.
• After 60 days, later transfers may create substantially greater liability if the institution can show that timely notice would have prevented them.

Those rules don't make every debit claim automatically zero-liability. The result can depend on the account, the access device, when you learned about the problem, and whether later transfers occurred. Report small test withdrawals as well as large ones; a fraudster may be checking whether the account is active.

For a Regulation E error, a bank generally has 10 business days to investigate. If it needs more time, it can generally extend the investigation by providing a provisional credit within the required period. The investigation period can reach 45 calendar days in many cases, with longer periods for certain transactions or new accounts. A provisional credit is temporary. The bank can reverse it after giving its determination if it concludes that the transaction was authorized or that no error occurred.

Regulation E generally applies to consumer accounts, not ordinary business accounts. A business should review its account agreement and report suspected ACH fraud immediately because commercial procedures may have shorter deadlines.

ACH-specific actions

For an unauthorized ACH debit, ask the bank for:

• The ACH originator's name
• The trace or transaction number
• The date and amount of each debit
• The bank's unauthorized-ACH dispute form
• Available options for blocking future debits from the same originator
• Instructions for closing or replacing the affected account

Blocking future withdrawals won't reverse a debit that has already posted. If you originally authorized a recurring debit but now want it to stop, cancel the authorization with the company and ask the bank about its stop-payment procedure. Describe the situation accurately instead of labeling an authorized payment unauthorized.

Peer-to-peer payments, wires, and cryptocurrency

Peer-to-peer payments

If someone entered your bank or payment account without permission and initiated a transfer, report it as unauthorized to both the bank and the payment service. Ask whether either provider can freeze the account, contact the receiving institution, or attempt a recovery.

The situation is different when you personally approved the payment after a scammer impersonated a bank, employer, friend, or government agency. The provider may classify it as an authorized payment, which can make recovery harder. Report the deception anyway and provide the complete message history.

The funding source matters. A payment drawn directly from a personal bank account may raise a Regulation E issue. One funded by a credit card may involve the card issuer's billing-error process. A platform's voluntary reimbursement policy may be broader or narrower than either federal rule.

Wire transfers

Call the bank's wire-fraud department as soon as possible. Request a wire recall, a hold on the receiving account if feasible, and contact with the receiving bank. Give the bank the wire reference number, recipient information, amount, and the exact time you noticed the fraud.

A wire transfer isn't automatically covered by the FCBA or the ordinary debit-card dispute process. The account agreement and applicable funds-transfer rules may control. If a thief used stolen online-banking credentials to initiate the wire, ask the bank to analyze whether the transaction qualifies as an unauthorized electronic fund transfer. If you were tricked into approving it, say so; don't assume the bank will treat it as an account takeover.

Cryptocurrency

A completed on-chain crypto transfer generally has no card-network chargeback mechanism. If an exchange account was compromised, report it immediately, request a security lock, change the credentials, and ask whether the platform can freeze or trace the receiving account.

You can still dispute an unauthorized credit-card or debit-account charge used to buy cryptocurrency. That doesn't mean the exchange or issuer can reverse crypto that has already been sent from a wallet. The platform's terms, the funding method, and the facts of the compromise will determine what recovery is possible.

Keep the claim organized

Once the account is secure, work through the dispute in this order:

1. Write down the dates. Record the transaction date, posting date, amount, descriptor, account type, and the date you first noticed the transaction. For a credit card, save the statement date because the FCBA period is tied to the bill.
2. Check for related activity. Look for other transactions, new payees, address changes, password resets, or unfamiliar devices.
3. Open the claim with the right institution. Use the card issuer for a card purchase, the account-holding bank for an ACH or debit transaction, the platform as well as the funding institution for a wallet or P2P payment, and the wire-fraud team for a wire.
4. Send written notice when required. An in-app dispute can open a case, but don't rely on it alone for an FCBA claim. Use the issuer's billing-dispute address and keep delivery proof. For an electronic fund transfer, ask which secure message, email, or form satisfies the bank's written-confirmation requirement.
5. Send focused evidence. Provide copies and a short timeline. Point out the records that show you didn't authorize the transaction or that an account was taken over.
6. Track the investigation. Record the claim number, requests for documents, provisional-credit date, and promised decision date. Continue reviewing account activity while the claim is pending.
7. Read the decision carefully. If the claim is denied, identify the stated reason and respond to that reason with dates and evidence.

Dispute letter templates

The FTC's sample credit and debit dispute letter provides a useful format. Customize it and use the address specified by your issuer or bank.

Credit card letter

[Date]

[Card issuer name]
Billing Inquiries
[Address shown on your statement]

Re: Unauthorized charge on account ending in [last four digits]

I dispute the charge of $[amount] dated [date] and shown as [merchant descriptor]. I did not make or authorize this transaction. [If applicable: No authorized user had permission to make it.]

Please treat this letter as notice of a billing error under the Fair Credit Billing Act. Please investigate, correct my account, and send me a written explanation of the result.

I have enclosed a copy of the relevant statement and the following records:
[List attachments]

I am paying the undisputed balance on the account.

Sincerely,

[Name]
[Address]
[Phone or secure contact method]

Make sure the issuer receives the letter within 60 days after the first statement showing the charge was sent. Keep the letter, attachments, delivery confirmation, and statement together.

Debit or ACH notice

[Date]

[Bank name]
[Fraud or electronic-fund-transfer dispute address]

Re: Unauthorized electronic fund transfer from account ending in [last four digits]

I am reporting an unauthorized electronic fund transfer of $[amount] dated [date], shown as [merchant or ACH descriptor]. I did not authorize this transfer and received no benefit from it. I first learned of the transfer on [date].

Please investigate this notice under applicable Regulation E error-resolution procedures. Please tell me if you need written confirmation, an affidavit, or additional information. If the investigation is extended, please provide any provisional credit required by law and send me the written result.

I have enclosed:
[List attachments]

Sincerely,

[Name]
[Address]
[Phone or secure contact method]

Don't include a password, PIN, full security code, one-time code, or crypto recovery phrase in a dispute letter.

Evidence that helps

Attach only relevant copies. Depending on the situation, useful records include:

• The statement or account-activity page showing the transaction
• The first statement date for a credit-card billing error
• Fraud alerts, login notifications, and device alerts
• A transaction ID, ACH trace number, or wire reference number
• Proof that a card or phone was lost or stolen, if applicable
• A truthful timeline showing where you were or who had access
• Emails, texts, call records, and screenshots showing impersonation or account takeover
• A police, FTC, or IC3 report number
• The merchant's response, refund promise, or refusal
• Shipping, return, or cancellation records if the issue is actually a purchase or subscription dispute

An organized, accurate submission is more useful than a large pile of unrelated screenshots. Don't say a payment was unauthorized if you approved it. Explain the deception and ask about recovery options instead.

When the bank or issuer denies the claim

A denial should tell you what the institution found. The stated reason might be that the transaction was authenticated, an authorized user made it, notice was late, or the evidence didn't establish an error.

Respond in writing:

1. Ask for the denial and explanation if you received them only by phone.
2. Request the information the institution relied on, where available.
3. Correct factual errors, such as a wrong date, device location, address, or claim-notice date.
4. Send new evidence through the channel the institution identifies.
5. Ask whether a supervisor or formal reconsideration process is available.
6. Check whether a provisional credit was reversed and whether that caused a fee.

You can file a complaint through the CFPB complaint portal about many banks, card issuers, and other covered financial companies. The FDIC's consumer complaint process explains how to contact a bank and pursue a complaint involving an FDIC-supervised institution. A regulator complaint may prompt a response or review, but it doesn't guarantee reimbursement.

For a large loss, repeated account takeover, or a dispute involving a business account, consider speaking with a qualified consumer attorney or legal-aid organization.

Mistakes to avoid

• Waiting for a merchant, police department, or platform to respond before notifying the bank
• Sending an FCBA letter to the payment address instead of the billing-inquiries address
• Treating the credit-card 60-day rule and the Regulation E two-business-day rule as interchangeable
• Assuming every debit card has zero liability
• Stopping future ACH debits and assuming an already-posted debit was reversed
• Calling an authorized scam payment unauthorized without explaining what occurred
• Ignoring a request for an affidavit or supporting documents
• Withholding both the disputed amount and the undisputed balance without understanding the account consequences
• Sending passwords, PINs, one-time codes, or crypto recovery phrases
• Treating a provisional credit as a final refund
• Filing duplicate claims without telling the institution that another claim is open

Reduce the chance of another loss

Turn on transaction alerts for cards, bank accounts, ACH debits, and payment apps. Review statements regularly rather than waiting for an annual check.

Use unique passwords, a password manager, multifactor authentication, and device-locking features. Remove payment apps and connected services you no longer use. Ask the bank whether it offers ACH blocks, debit filters, card controls, or separate accounts for recurring payments.

If identity information was exposed, consider a credit freeze with each major credit bureau and watch for new accounts or address changes. For crypto, keep recovery phrases offline, use reputable platforms, and never approve a wallet request merely because someone claiming to be support tells you to.

Frequently asked questions

Is every charge I don't recognize unauthorized?

No. It might be a recurring charge, a different merchant descriptor, or a transaction made by an authorized user. Check quickly, then report it if you still believe you didn't authorize it.

Do I need a police report to get a refund?

Not usually as a universal requirement. A bank or platform may request one for a particular claim, and it can help document identity theft or a stolen device. It doesn't replace notice to the bank or issuer.

Is debit-card liability always zero?

No. Regulation E can limit liability according to how quickly you report the lost access device or unauthorized transfer. A bank or card-network policy may provide broader zero-liability protection, so ask which protection the institution is applying.

Can I dispute a payment I approved after being scammed?

You can report it and request a recall or recovery, but it may not meet the definition of an unauthorized transaction because you approved the transfer. Give the bank or platform the complete scam record and act immediately.

Can a credit-card dispute reverse a crypto transfer?

It may address an unauthorized card charge used to buy crypto. It generally can't reverse cryptocurrency that was already sent on-chain. The exchange's terms and the facts of any account compromise will control the response.

If you haven't reported the transaction yet, use the institution's official contact channel now, then save the claim number and note the date you gave notice.