If you see a transaction you didn't authorize, contact your bank, credit union, card issuer, or payment service through an official channel immediately. Ask the provider to secure the account, open a formal dispute, and tell you which recovery options remain.

Two facts shape the next step: the payment rail and whether you actually approved the payment. A debit-card purchase, an ACH debit, a credit-card charge, a wire, and a cryptocurrency transfer don't follow the same rules. A scammer who initiated a transfer without your permission presents a different dispute from a scammer who persuaded you to enter a code or press "send."

The guidance below is for U.S. consumers. Accounts used mainly for personal, family, or household purposes generally have stronger federal protections than business accounts.

Start with these steps

1. Check the transaction, but don't wait to report it

Review the merchant name, date, amount, and status. A statement descriptor may belong to a legitimate merchant, a subscription, a household member, or a payment processor. If you still don't recognize the transaction, report it even if it's pending.

Use the number on the back of your card, the bank's official website, or the provider's mobile app. Don't use a number supplied in a suspicious text, email, or incoming call.

2. Lock down the account

Take the steps that fit the suspected exposure:

Never share a one-time code or give a caller remote access to your device. A legitimate bank representative won't ask you to move money to a "safe" account.

3. Open the dispute with the right provider

Describe the event plainly. For example:

That last fact matters. Don't describe a payment as wholly unauthorized if you personally approved it. Give the provider the exact sequence so it can apply the right process.

Get the following before ending the call or chat:

You don't need to wait for a police report before notifying the provider. Send a report later if the bank or another provider requests one.

4. Save the evidence

Write a short timeline while the details are fresh. Keep copies of:

Don't alter screenshots or exaggerate what happened. A clear, truthful timeline helps the provider decide which rule and dispute process apply.

Identify the payment rail

Payment method Main framework or policy First contact
Debit card, ATM, prepaid card, or ACH from a personal account Regulation E may apply to an unauthorized electronic fund transfer Bank or credit union
Credit card Fair Credit Billing Act, Regulation Z, and issuer policies Credit-card issuer
Payment app or peer-to-peer transfer The linked account's rules, the app's policy, and the facts of the transfer Bank and payment app
Domestic or international wire Bank agreement, applicable state law, and often UCC Article 4A; generally not Regulation E Sending bank
Cryptocurrency transfer Exchange or wallet terms and the funding method; no automatic Regulation E refund Exchange, wallet provider, and bank or card issuer

The federal starting point for many unauthorized transfers from a consumer bank account is Regulation E's liability rule. The rule does not turn every fraud loss into a Regulation E claim.

Debit cards, ACH, and other electronic transfers

Regulation E generally covers electronic fund transfers involving a qualifying consumer account. It can apply to many debit-card, ATM, ACH, and certain payment-app transactions. Ordinary credit-card charges and wire transfers generally follow different rules.

The main Regulation E deadlines

The timing of your notice can affect liability:

The two-business-day rule concerns learning that an access device was lost or stolen. It isn't a reason to wait when you simply discover an unfamiliar transfer. Report the error as soon as you find it, and treat 60 days after the statement was sent as an important federal deadline.

These are liability standards, not a guarantee that every claim will be approved. The institution may investigate whether the transfer was unauthorized, whether you received a benefit, and whether the account qualifies for the protection. A bank or card issuer may also provide stronger zero-liability terms under its own agreement.

How the bank's investigation usually works

You can often give the initial notice by phone. The bank may require written confirmation within 10 business days after an oral notice, so send a secure message or letter promptly even if a representative has already opened the case.

Under the usual Regulation E process, the bank generally has 10 business days to investigate. If it needs more time, it generally must provide provisional credit and can take up to 45 days to complete the investigation. Special timing rules can apply to some point-of-sale debit transactions, foreign-initiated transfers, and recently opened accounts.

Provisional credit isn't necessarily final. The bank can remove it after deciding that no error occurred, subject to the applicable notice and account rules. Ask when the credit will appear and how the bank will communicate its final decision.

Unauthorized ACH debits

For an unfamiliar ACH debit from a personal checking or savings account, contact the bank and ask:

For a recurring debit, cancel the authorization with the merchant and separately tell the bank to stop future debits. Ask which form the bank requires and how much advance notice it needs.

Regulation E may apply to an unauthorized ACH transfer from a qualifying consumer account. Business accounts generally don't receive the same federal protection, so the account agreement and ACH reporting procedures become more important. If the account is used for a business, notify the bank immediately and review those terms.

Unauthorized credit-card charges

Credit-card charges use a different process from debit-card and ACH transactions. The FTC's guide to disputing credit-card charges describes the written billing-error procedure.

  1. Call the issuer immediately to report the charge and request a replacement card if needed.
  2. Send a written dispute to the issuer's billing-error or billing-inquiries address, not merely the address used for payments.
  3. Make sure the issuer receives the notice within 60 days after the first statement containing the error was sent.
  4. Identify the charge by date, merchant, and amount, and state that you dispute it as unauthorized.
  5. Keep a copy of the letter and proof of delivery.
  6. Pay the undisputed part of the statement and follow the issuer's instructions while the review is pending.

The issuer generally must acknowledge a written billing-error complaint within 30 days unless it resolves the issue sooner. It generally must resolve the dispute within two complete billing cycles and no later than 90 days.

Federal law generally limits liability for unauthorized credit-card use to $50. Many issuers offer broader zero-liability policies, but check the card agreement rather than assuming one policy covers every transaction.

A charge for something you bought but didn't receive is not the same as a charge you never authorized. It may qualify as another billing error or merchant dispute. Describe what happened accurately. Contacting the merchant can produce a legitimate refund, but it shouldn't replace notifying the card issuer before the legal deadline.

Payment apps and peer-to-peer transfers

Report a suspected unauthorized payment to both the app and the bank connected to it. Save the app's transaction ID, recipient information, messages, and security alerts.

The way the payment started matters. If someone accessed your account and sent money without your permission, say that directly. If you entered a verification code or pressed "send" after a scammer impersonated a bank employee, the provider may classify the event differently. The outcome can depend on the sequence of events and the app's reimbursement policy.

Don't send more money to anyone promising to recover the first payment. Recovery scammers often target people who have already reported a loss.

Recovering a fraudulent wire transfer

A wire recall is a request, not a guaranteed reversal. Call the sending bank's fraud or wire department immediately and ask it to:

  1. Mark the transfer as fraud.
  2. Check whether it is still pending.
  3. Send a recall or reversal request.
  4. Contact the receiving bank and request a hold on the recipient account.
  5. Give you written confirmation of the request and a case number.

Provide the amount, date, beneficiary details, receiving-bank information, email addresses, and messages that led to the transfer. If a compromised email account was involved, secure it immediately and tell the bank that the communication channel may still be compromised.

For internet-enabled wire fraud, file a report with the FBI's Internet Crime Complaint Center and consider notifying local law enforcement. A report doesn't guarantee reimbursement, but it creates a record and may help investigators connect related cases.

Regulation E generally doesn't govern ordinary wire transfers. The bank's agreement and, where applicable, state law and UCC Article 4A may control instead. Don't assume the liability limits for a debit card apply to a wire.

Cryptocurrency and investment-scam payments

A blockchain transfer can be difficult or impossible to reverse after confirmation. Contact the exchange, wallet provider, or platform immediately. Ask it to freeze the account, preserve records, and flag the receiving wallet.

Collect the transaction hash, wallet addresses, platform username, amount, asset, date, and messages. Change the exchange and email passwords, revoke unknown sessions, and turn on multifactor authentication.

The way you funded the transaction still matters:

Tell the bank or card issuer what you approved and what the scammer did. A claim that says a transaction was wholly unauthorized when you knowingly approved it can undermine the investigation.

If the provider denies the claim

A denial can reflect the provider's classification of the transaction, the timing of your notice, or missing information. Common reasons include:

Ask for the decision in writing. Request the facts and documents the provider relied on, point out any incorrect assumption, and send a concise timeline with supporting records. Keep paying undisputed amounts and continue monitoring the account while you challenge the decision.

If the matter remains unresolved, use the institution's complaint or executive-resolution channel. For a complaint involving an FDIC-supervised bank, the FDIC Consumer Complaint Process asks for a chronological description with names, dates, amounts, and details of your contact with the bank. A regulatory complaint can prompt a response, but it doesn't guarantee a refund or replace the original dispute.

Written dispute template

Adapt this to the payment method and the provider's instructions:

Subject: Notice of unauthorized transaction

I am disputing a transaction on my account ending in [last four digits]. The transaction was made on [date] for [amount] to [merchant or recipient]. I did not authorize it and received no benefit from it. I noticed the transaction on [date]. Please investigate it under the applicable dispute process, secure the account against additional unauthorized activity, and confirm the case number, any written-notice deadline, and the expected decision date.

Use the credit-card issuer's billing-error address for a credit-card dispute and identify the statement date. For a bank-account dispute, use the bank's secure message system or the address supplied by its fraud department. Don't include a full account number unless the institution specifically requires it through a secure channel. If you approved a payment after being deceived, change the wording to describe that fact instead of calling the transaction wholly unauthorized.

Reduce the risk of another loss

Once the account is secure, set up controls that make unusual activity easier to spot:

Frequently asked questions

Are debit-card and credit-card disputes handled the same way?

No. Debit-card and many ACH disputes from qualifying consumer accounts generally fall under Regulation E. Credit-card billing errors use the FCBA and Regulation Z. Their deadlines, notice methods, and investigation procedures differ.

What if I report a debit transaction after 60 days?

Notify the bank anyway. The 60-day rule can affect liability for later transfers, but it doesn't mean every earlier transaction is automatically lost. Explain when the statement was sent, when you discovered the problem, and why notice was delayed.

What if I gave a scammer my login or verification code?

Report the incident accurately and secure the account immediately. Whether the resulting transfer is considered unauthorized can depend on how the scammer accessed the account, what you approved, and the applicable law and provider policy.

Does Regulation E cover cryptocurrency?

Not automatically. The underlying bank or card payment may have its own protections, but a completed cryptocurrency transfer is governed primarily by the platform, wallet, and transaction circumstances. Ask each provider to identify the payment rail and dispute process.

Can a wire transfer always be recalled?

No. The sending bank may be able to request a recall or hold, especially before funds are withdrawn, but a recall isn't guaranteed. Call the bank's wire-fraud team immediately and file an IC3 report for online fraud.