If a charge or transfer isn't yours, contact the bank, card issuer, or payment service today. Lock down the account first, report the transaction, and create a written record of what you reported and when. The deadline and possible refund depend on the payment method.

For U.S. personal consumer accounts, credit card billing errors generally fall under the Fair Credit Billing Act (FCBA). Unauthorized debit card and ACH transactions generally fall under the Electronic Fund Transfer Act and Regulation E. PayPal, Venmo, and other wallets have their own reporting processes, but a wallet review may not replace notice to the bank or card issuer that funded the payment.

This is general consumer education, not legal advice. Business accounts, wire transfers, and some scam-induced payments may follow different rules or contracts.

Identify the payment before you file a dispute

A merchant name you don't recognize isn't automatically fraud. Check the transaction descriptor, receipts, subscriptions, household authorized users, and recent purchases. If the payment remains unfamiliar, report it promptly rather than waiting for the merchant or app to respond.

Use the most accurate description of the problem:

• Unauthorized transaction: You didn't make or authorize the payment.
• Wrong amount or duplicate charge: You made the purchase, but the amount or number of charges is wrong.
• Goods or services problem: You authorized the purchase but didn't receive what was promised.
• Recurring debit after cancellation: You canceled or revoked permission for a recurring payment, but a later debit posted.

A payment you approved after a scam can be harder to classify. For example, a scammer who impersonated your bank might persuade you to confirm a transfer. Report the incident anyway, describe the deception precisely, and ask whether the bank has a separate scam-recovery process. Don't call an authorized purchase "fraud" just because the product was disappointing.

What to do when you notice the transaction

1. Secure the account

Use the bank or payment service's official app or phone number. Don't use a link from a suspicious email or text message. Depending on what happened, you may need to:

• Lock or replace the card.
• Change the account and email passwords from a trusted device.
• Turn on multifactor authentication.
• Review recent logins, linked accounts, cards, beneficiaries, and transfers.
• Ask whether the bank can block future ACH debits or whether the account number should be changed.
• Contact other financial institutions if you reused the password or used the same compromised device elsewhere.

These steps protect the account but don't open a formal dispute by themselves.

2. Report the transaction and get a case number

Tell the representative what happened and when you first noticed it. You can use wording like this:

"I am reporting a transaction I did not make or authorize. The date is [date], the amount is [amount], and the statement descriptor is [descriptor]. I first noticed it on [date]. Please open an unauthorized-transaction or error investigation and give me the case number."

Ask whether the institution needs a written confirmation, fraud affidavit, police or identity-theft report, replacement card, replacement account, or other information by a particular date.

Write down the date and time of the call, the representative's name, the case number, and the promised response date. A secure message or letter the same day can make the record clearer. For a credit card, a phone call alone may not satisfy the FCBA billing-error process; the written notice must reach the issuer's billing-inquiries address within the applicable period.

3. Save the evidence

Keep a folder with:

• A statement or transaction screen showing the date, amount, and descriptor
• The transaction or confirmation number
• A short timeline showing when you noticed and reported the payment
• Receipts, cancellation notices, and relevant merchant messages
• Screenshots of account alerts or suspicious login activity
• Copies of letters, secure messages, emails, and responses
• A police or identity-theft report if one is appropriate or requested

Don't wait for a police report before making the first notice. The bank may request one later, but requirements vary. Keep the originals and send copies.

4. Put the dispute in writing

State which account is involved, identify the transaction, give the date you discovered it, and say what correction you want. Don't send a full account number through ordinary email. Use the address or secure channel specified by the institution.

For a credit card, use the billing-inquiries address on the statement, not necessarily the payment address. For a debit card or ACH transaction, follow the bank's fraud or error-dispute instructions and provide written confirmation promptly if the bank requests it.

5. Watch the account while the claim is pending

Read each new statement and look for additional unauthorized activity. A provisional credit may be reversed after the investigation, so avoid spending it if you can. Continue paying the undisputed part of a credit card bill, and answer requests for information before their deadlines.

Credit card disputes under the FCBA

The FCBA covers many consumer credit card billing errors, including unauthorized charges. To use the written billing-error process:

1. Send written notice so the issuer receives it within 60 days after the first statement containing the error was sent.
2. Address it to the issuer's billing-inquiries address.
3. Identify the charge and explain why you say it was unauthorized.
4. Keep a copy and proof of delivery.
5. Pay the undisputed balance and required charges while the investigation is pending.

The federal liability limit for unauthorized credit card use is generally $50, although the card agreement may provide greater protection.

The issuer generally must acknowledge the written notice within 30 days unless it has already resolved the problem. It generally must resolve the dispute within two billing cycles and no later than 90 days.

When you follow the FCBA process, the issuer generally can't treat the disputed amount as delinquent while it investigates. That protection doesn't cover unrelated charges. Keep paying the amount you agree you owe.

The FTC has a guide to disputing credit card charges and a sample letter for disputing credit and debit card charges.

Debit card and ACH disputes under Regulation E

Regulation E generally covers unauthorized electronic fund transfers from consumer accounts, including many debit card and ACH transactions. It doesn't create one simple 60-day refund guarantee. Liability can depend on what you learned, when you learned it, and when you notified the bank.

• Within two business days: If you notify the bank within two business days after learning that an access device was lost or stolen, liability is generally capped at $50.
• After two business days but within 60 days: Potential liability can rise, commonly to as much as $500 for transfers made before notice, depending on the facts.
• After 60 days: If you don't report the unauthorized transfer within 60 days after the statement showing it was sent, you may be responsible for later transfers that the bank could have stopped with timely notice.

The two-business-day rule concerns learning about the loss or theft of an access device, such as a card or other device used to access the account. If you simply discover an unfamiliar transaction, notify the bank as soon as you see it. Don't wait for the 60-day statement deadline.

The Regulation E rule in 12 CFR Part 1005 generally gives the institution 10 business days to investigate and determine whether an error occurred. If it needs more time, it will generally need to provide provisional credit within that period, subject to the rule's exceptions and permitted amounts. The investigation period is generally up to 45 days, although certain new-account, foreign, or point-of-sale situations can allow more time.

A bank may ask you to confirm an oral report in writing within 10 business days. Follow that instruction and keep proof that you sent it. If the bank decides no error occurred, request the written explanation and the documents it relied on.

Recurring ACH debits and canceled subscriptions

Canceling a subscription doesn't automatically make every later debit an unauthorized-transaction claim. If you gave the merchant permission to debit the account and later canceled, save the cancellation confirmation and contact both the merchant and the bank.

If another recurring debit is scheduled, ask the bank about its stop-payment procedure immediately. A stop-payment request for a future debit doesn't automatically reverse one that has already posted. Report a posted debit separately through the bank's error or unauthorized-transaction process.

Sample written dispute letter

Adapt this letter to the payment method, and include only facts that are true.

[Date]

[Bank or credit card issuer]
[Billing inquiries or fraud-dispute address]
[City, State, ZIP Code]

Re: Written notice of unauthorized [credit card charge or electronic fund transfer]
Account ending in [last four digits]

I am disputing the following transaction:

Date of transaction: [date]
Date I first noticed it: [date]
Amount: [$ amount]
Statement descriptor or merchant: [name]
Transaction or reference number: [number, if available]

I did not make or authorize this transaction. [For an electronic fund transfer, state whether you received any benefit from it.]

I first reported this matter by [phone, secure message, or other method] on [date]. The case number is [number].

Please investigate the transaction and send me your written findings. If this is a credit card billing error, please treat this letter as written notice under the Fair Credit Billing Act. If this is an electronic fund transfer, please treat it as notice under Regulation E and tell me promptly if you require additional written confirmation.

Please correct the account as required and explain any decision that does not resolve the dispute.

Enclosures: [list statements, screenshots, reports, receipts, or correspondence]

Sincerely,

[Your name]
[Address]
[Phone or secure contact information]

For a credit card, make sure the letter arrives at the billing-inquiries address within the 60-day window. For a bank account, use the bank's stated dispute channel and comply with any written-confirmation instruction.

PayPal, Venmo, and other wallet payments

A wallet dispute can involve two reviews: the platform's review and the bank or card issuer's review. Report the transaction to the wallet, but also consider the payment method that supplied the money.

PayPal

PayPal tells users to report a transaction they didn't make or authorize promptly through its Resolution Center. Start with PayPal's fraud and unauthorized-activity page. Save the PayPal case number, transaction ID, messages, and decision.

Notify the funding institution as well:

• If the payment came from a credit card, follow the card issuer's FCBA process.
• If it came from a debit card or personal bank account, ask whether it qualifies as a Regulation E transfer.
• If the PayPal account or PayPal debit card was compromised, change the credentials and use available card-lock or account-security tools.

PayPal's purchase-protection process is different from an unauthorized-payment report. A missing delivery or other item problem may require a different dispute category and different evidence.

Venmo

Venmo payments can be funded in different ways, so one deadline or chargeback rule doesn't apply to every Venmo transaction. Use Venmo's current in-app reporting and support process, then notify the bank or card issuer that funded the payment.

Tell the institution whether you made the payment, approved it after a scam, or never authorized it. Those facts can affect the available protection and recovery process. An in-app review doesn't necessarily extend a legal deadline for a bank or card dispute.

If you report the same transaction to the wallet and the funding institution, disclose the other case and any credit or refund. Don't seek duplicate recovery for the same loss.

A chargeback isn't a universal fraud remedy

"Chargeback" often describes a card issuer's or payment network's dispute process. For a credit card, the issuer is usually the place to begin. Visa or Mastercard procedures may operate behind the scenes, but their time limits and evidence rules vary; a generic 120-day rule doesn't apply to every transaction.

A debit card dispute under Regulation E is not the same as a credit card chargeback. Give the bank the transaction details and say you're reporting an unauthorized electronic transfer when that is accurate. Merchant records such as receipts, delivery information, or login data may affect the decision. Answer the issuer's questions, but don't reshape the facts to fit a preferred category.

If the bank or issuer denies the claim

Ask for the decision in writing. Find out why the institution concluded that the payment was authorized, and request the documents it relied on when available.

Then check the record for a missed step: the wrong address, a late notice, a missing written confirmation, or an unanswered request for information. If you have relevant new evidence, send a short appeal that lays out the timeline and corrects specific factual errors. Keep the case number in the subject line.

A CFPB complaint can document the institution's handling of the dispute and give the company another opportunity to respond. It doesn't replace a timely FCBA or Regulation E notice, guarantee a refund, or act as a court.

If personal information was stolen, review your credit reports and consider a fraud alert or credit freeze. Dispute inaccurate account information separately. For a large loss, repeated account closures, a business account, or a matter involving court deadlines, a consumer attorney or legal-aid organization may be worth contacting.

When escalating, include dates, amounts, case numbers, copies of notices, and the denial. Redact passwords, full account numbers, Social Security numbers, and unrelated financial information.

Will the dispute affect your credit?

Filing an unauthorized-transaction dispute isn't itself a negative credit-report item. A missed credit card payment can still cause a credit problem if you stop paying the undisputed balance or don't follow the billing-error process.

If an identity thief opened an account or placed inaccurate information on your credit report, that is a separate credit-reporting dispute. The Fair Credit Reporting Act addresses inaccurate credit information; it doesn't by itself decide whether the bank must refund a transaction.

Mistakes that can delay a claim

• Waiting for the merchant or payment app before notifying the bank or card issuer
• Looking only at the transaction date and missing the statement-based deadline
• Sending a credit card dispute to the payment address instead of the billing-inquiries address
• Reporting by phone only when written FCBA notice is needed
• Failing to state when you first learned about the loss or transaction
• Ignoring a request for an affidavit or written confirmation
• Spending provisional credit before the investigation is final
• Describing an authorized purchase as unauthorized because the product or service was disappointing
• Failing to secure the account and check for additional transfers

Frequently asked questions

Is the 60-day deadline measured from the transaction date?

Not always. For a credit card, the FCBA period generally runs from when the first statement showing the error was sent. For a debit or ACH transaction, Regulation E's important 60-day notice period also relates to the statement showing the transfer. Report the transaction immediately either way.

Do I need a police report before the bank will investigate?

Don't delay the first notice while obtaining a report. The bank may request a police report, affidavit, or other documentation, but the requirements vary. Ask what it needs and provide truthful information promptly.

What if I approved a transfer because a scammer tricked me?

Report it immediately and explain that you approved it only because of the deception. The bank may treat it differently from a transfer made without your authorization, but it may have a separate scam-recovery or reimbursement process.

Should I report a PayPal or Venmo payment to both the app and my bank?

Notify both when appropriate, especially when the wallet drew money from a bank account or card. Tell each provider about the other report and any refund. The wallet's review doesn't necessarily protect the deadline for a bank or card dispute.

Can a CFPB complaint guarantee a refund?

No. It can create another review and response opportunity, but it doesn't replace prompt notice to the financial institution or guarantee a particular result.

Official references

• Regulation E, 12 CFR Part 1005
• FTC: Using Credit Cards and Disputing Charges
• FTC: Sample Letter for Disputing Credit and Debit Card Charges
• PayPal: Report Fraud and Unauthorized Activity

If the transaction is still unfamiliar, call the institution today, get a case number, and send the written notice through the correct channel before the deadline that applies to your payment type.