If a fake online store took your money, contact the payment provider today. The right process depends on how you paid: a credit-card billing dispute, a bank review of a debit or electronic transfer, PayPal Purchase Protection, or a fraud review for a wire or payment-app transfer.

Save evidence before the site changes, describe the transaction accurately, and don't assume a chargeback guarantees a refund. The steps below are for U.S. consumers. Your account type, issuer rules, and the facts of the transaction can affect the result.

What to do in the first hour

1. Stop sending information or money. If the site looks malicious, don't make another payment, share a verification code, upload an ID image, or reuse a password. Be wary of links and attachments in follow-up messages.
2. Capture the transaction while the page is available. Save screenshots showing the full web address, product listing, price, promised delivery date, checkout page, confirmation number, and contact details. Keep the confirmation email, messages, and billing descriptor from your statement.
3. Call the payment provider through an official channel. Use the number on the back of your card, your bank's official app or website, or a statement. Don't use a number supplied by the suspicious store.
4. Describe what actually happened. Say whether you didn't authorize the transaction, the order never arrived, the item was counterfeit or materially different, or a promised refund never appeared.
5. Protect any exposed accounts. Lock or replace a compromised card, change reused passwords, and turn on multifactor authentication. If you entered online-banking credentials, tell the bank immediately.
6. Contact the seller only when it appears safe. A short written refund request may create useful evidence. Don't wait for the seller's response before contacting your bank or issuer or meeting a dispute deadline.

Scam website checklist

One red flag doesn't prove that a site is fraudulent, and a scammer won't necessarily make every mistake below. Check several details together.

Navy Federal's online shopping security guidance points to similar checks, including brand-mimicking domains, copied branding, and a genuine way to contact the seller.

Website scanners such as VirusTotal or Google Safe Browsing can provide another signal, not a guarantee. A clean result may simply mean that a new scam hasn't been reported yet. Search for a business through an established brand's official website instead of trusting an advertisement or message link.

Be especially careful with a supposed CAPTCHA that tells you to install software, press unusual keyboard commands, paste code, or give remote access. The FTC's scam guidance says that real CAPTCHAs normally use image- or text-based tasks to check that you're human.

Identify the payment problem correctly

The description you give the provider can affect how it investigates the transaction.

Don't call an approved purchase "unauthorized" just because the seller deceived you. If you clicked Buy or otherwise approved the payment, explain what you authorized and what the seller failed to provide. The bank or issuer can select the appropriate dispute category.

How to dispute a scam website credit-card charge

For a U.S. consumer credit card, the Fair Credit Billing Act process may apply to some billing errors, including charges for goods that weren't delivered or weren't provided as agreed. The FTC's credit-card dispute guidance describes the main steps.

Send written notice promptly

Call the issuer right away to protect the account and ask how it wants the transaction disputed. A phone call is useful, but it may not replace the formal written notice required for the federal billing-error process.

Your written dispute should reach the issuer within 60 days after the first statement containing the error was sent to you. Send it to the billing-inquiries address on the statement. That address may be different from the address used for payments.

Include:

• Your name and account information
• The transaction date, amount, and billing descriptor
• The website address and what you ordered
• Whether the goods were not delivered, were materially different, or the charge was unauthorized
• A brief timeline of your contact with the seller
• Copies of receipts, screenshots, messages, and tracking information

Keep the originals, a copy of your letter, and proof that the issuer received it. If the issuer tells you to use a secure online dispute process, keep a record of that submission too.

You can use wording such as:

I dispute the charge of $[amount] posted on [date] from [billing descriptor]. I [did not authorize this charge / ordered [item] and it was not delivered / received an item materially different from the listing]. The purchase was made through [website address]. Enclosed are copies of the order confirmation, website screenshots, correspondence, and [tracking or other evidence]. Please investigate this billing error and provide the result in writing.

Use only the statement that is true. An inaccurate unauthorized-transaction claim can undermine the dispute.

Track the investigation

For a dispute covered by the FTC-described process, the issuer generally must acknowledge the complaint within 30 days, unless it has already resolved the issue. It generally must resolve the dispute within 90 days. Those are investigation deadlines, not a promise that the claim will be approved.

There is no universal rule requiring every credit-card issuer to provide temporary credit within 10 business days. An issuer may provide provisional credit under its own procedures, and that credit can later be reversed. Don't spend a temporary credit until the issuer confirms the claim is final.

Pay the undisputed portion of the bill and follow the issuer's instructions while the review is open. If the issuer requests more information, respond by the deadline in its notice.

Debit cards, prepaid accounts, bank transfers, and payment apps

A debit-card purchase doesn't follow exactly the same process as a credit-card billing dispute. Regulation E covers many consumer electronic fund transfers, and the Federal Reserve's official Regulation E commentary describes the technical framework.

Report a suspicious debit transaction to the bank immediately. Tell the bank whether you approved the purchase, whether the funds were taken without your permission, and whether the merchandise was missing or misrepresented. Ask:

• Is the bank treating this as an unauthorized electronic transfer or a merchant dispute?
• Must you confirm the claim in writing or electronically?
• Which documents does it need?
• What deadline applies to those documents?
• Will temporary credit be provided, and when could it be reversed?

There isn't one safe, universal "60-day chargeback" or "10-day refund" promise for every debit, prepaid, or payment-app transaction. The timing and protections depend on the account, transaction, and whether you authorized the payment. Acting the same day gives you the best chance of preserving whatever protections are available.

If you sent a wire, ACH transfer, or payment-app transfer, contact both the financial institution and the payment service immediately. Ask for a recall, reversal, or fraud investigation. A card chargeback process may not apply, and recovery isn't guaranteed once the recipient has withdrawn or moved the funds.

If the scammer obtained your card number, bank login, or payment-app credentials, ask whether the account or card should be closed and replaced. Review recent transactions for small test charges and keep monitoring the account after the case is closed.

PayPal scam website disputes

PayPal Purchase Protection is a PayPal program. It isn't the same as a credit-card billing-error right. Read the eligibility rules for the particular transaction in PayPal's U.S. Purchase Protection terms.

The U.S. terms say that a dispute must be opened within 30 days of delivery or fulfillment, when that condition applies, or within 180 days of the payment, whichever comes first. Treating 180 days as a guaranteed deadline for every purchase could be too late.

To start a PayPal case:

1. Open the transaction in PayPal's Resolution Center.
2. Choose the reason that matches the facts, such as an item not received or materially not as described.
3. Upload the order confirmation, listing screenshots, seller messages, tracking information, and photos of anything you received.
4. Answer PayPal's requests promptly.
5. If PayPal requires escalation, turn the dispute into a claim before the deadline shown in the case or the applicable terms.

PayPal's terms also say that you can't pursue a PayPal Purchase Protection claim and a card-issuer claim at the same time or obtain a double recovery. If a credit or debit card funded the PayPal payment, ask the funding issuer which route is available before opening parallel cases.

A vanished website can support your evidence, but it doesn't guarantee a PayPal decision in your favor. Eligibility, payment type, delivery evidence, and the seller's response still matter.

Build an evidence packet

Put the material in date order and write a one-page timeline. Include:

• The exact site address, seller name, and checkout or payment page
• The product description, price, shipping promise, and return policy
• The order confirmation, invoice, and statement showing the billing descriptor
• Emails, chats, text messages, and attempted calls
• Tracking information or proof that no valid tracking exists
• Photos of an item that is counterfeit, damaged, empty, or materially different
• The seller's promised refund and the date it was due
• Dispute, bank, PayPal, FTC, or IC3 reference numbers
• Notes showing when you reported the matter and who handled it

Send copies instead of irreplaceable originals. Redact full card numbers, passwords, security codes, and unnecessary identity documents. Don't edit screenshots in a way that removes the date, address, amount, or surrounding context.

Report the scam website

A report won't replace a payment dispute or guarantee that your money will come back. It can still help investigators and warn other shoppers.

1. FTC: Use the FTC's scam information and reporting resources.
2. FBI IC3: Submit an internet-crime complaint to the Internet Crime Complaint Center, particularly for a substantial loss, phishing, or a coordinated online scheme.
3. Payment provider: Give the bank, card issuer, PayPal, or payment app the website, seller messages, and transaction details.
4. Advertising and social platforms: Report the ad, account, listing, or message that led you to the site.
5. Domain or hosting provider: Use the domain's registration information to find a reporting contact. Don't assume the registrar can refund a completed payment.
6. Law enforcement: Consider a local report for a significant loss, identity theft, threats, or evidence of organized crime.

Stick to the facts: what you ordered, what you paid, what happened, and how the seller responded. Never publish a full account number or identity document in a public report.

If the dispute is denied

A denial tells you what the provider found, but it may leave room to correct an incomplete record.

• Read the decision. Look for whether the issuer says the transaction was authorized, the item was delivered, the evidence was incomplete, or the claim was filed too late.
• Ask for the decision and relevant evidence in writing.
• Submit a focused appeal with the missing documents. Examples include a delivery mismatch, an explanation of why an item is counterfeit, or proof that the seller's tracking belongs to another address.
• Follow every deadline in the issuer's letter. An appeal doesn't automatically extend the original notice period.
• If a credit-card issuer failed to follow the applicable billing-error process, consider a complaint to the Consumer Financial Protection Bureau after giving the issuer an opportunity to correct the problem.
• For a large loss or identity-theft matter, consider a licensed attorney or law-enforcement agency instead of paying an online "recovery expert."

Be skeptical of anyone who promises a guaranteed refund for an upfront fee, asks for remote access, or requests your bank password. A second recovery scam often follows the first payment scam.

Scam website dispute timelines

Frequently asked questions

Is a website safe because it uses HTTPS?

No. HTTPS helps encrypt the connection between your browser and the site, but scammers can obtain certificates too. Check the domain, seller identity, policies, payment method, and independent business information.

Should I call an authorized purchase unauthorized?

No. If you approved the purchase but the seller deceived you or failed to deliver, describe those facts. If someone used your card without permission, report it as unauthorized. Accurate details help the provider use the correct process.

Can I recover money paid with a debit card?

Possibly, but there is no blanket guarantee. Contact the bank immediately, explain whether the transfer was unauthorized or the merchant failed to provide the goods, and complete the bank's required process.

Can I dispute the same PayPal payment with PayPal and my card issuer?

PayPal's Purchase Protection terms say not to pursue both claims at the same time or seek double recovery. Check the current terms and ask the funding issuer which route fits before filing a second case.

What should I do if I gave the site my password?

Change that password anywhere you reused it, enable multifactor authentication, and contact the affected bank or service through an official channel. If you provided sensitive identity information, monitor your accounts and use an identity-theft response service.

If the transaction posted today, save the evidence, call the official payment-provider number, and write down the case reference before moving on to anything else.