Report an unauthorized transaction as soon as you notice it. First identify how the money moved: a debit-card purchase, ACH debit, credit-card charge, payment-app transfer, and wire may have different notice rules and recovery options. The familiar 60-day period is not one universal deadline.

This guidance is for personal U.S. accounts. Business accounts, international remittances, wires, and a platform's own terms may be treated differently.

Start with the payment rail

For the federal electronic-transfer error process, see the Regulation E error-resolution rule. For credit-card billing errors, the FTC's credit-card dispute guidance describes the separate written-notice procedure.

Mistake 1: Waiting for the 60-day deadline

For a consumer electronic fund transfer covered by Regulation E, the 60-day notice period generally starts when the statement identifying the transfer is sent or made available. If you miss that period, transfers made later can become your responsibility, and the institution may be able to decline an investigation under that error-resolution procedure.

There is also a shorter liability rule. If you learn that a debit card or another access device was lost or stolen, notifying the institution within two business days can limit liability to the lesser of $50 or the amount transferred before notice. Waiting longer can expose you to more loss.

These rules aren't a reason to wait. Report the transaction when you see it, even if the statement deadline has passed. State when you discovered the problem and explain any delay. The institution may extend the notice period when circumstances prevented timely notice.

Some new-account, point-of-sale, and foreign-initiated transactions can give an institution more time to complete its investigation. That changes the investigation schedule, not the date on which you should report the transaction.

Mistake 2: Contacting the wrong party or relying only on a phone call

Start with the bank or credit union that holds the affected account, or the issuer of the affected card. If an app, merchant, or digital wallet was involved, report the problem there as well when its account or funds are affected.

A phone call is useful for blocking a card or stopping additional withdrawals. Oral notice can generally begin a Regulation E error report, although the institution may ask you to confirm it in writing within 10 business days. Follow up with a secure message or letter that lists the transactions, and keep a copy showing when you sent it.

Credit-card disputes have a stricter formal step. To use the FCBA billing-error procedure, send a written notice to the billing-disputes or billing-inquiries address on the statement. That may not be the address used for payments. The issuer must receive the notice within 60 days after the first statement containing the error was sent. The FTC sample dispute letter can help organize the details.

A complaint to the CFPB is an escalation route. It doesn't replace the original notice to your bank or card issuer.

Mistake 3: Describing a scam inaccurately

Use facts rather than a label that sounds more likely to succeed.

For Regulation E purposes, it matters whether another person initiated the transfer without authority or whether you personally entered and sent the payment. If a criminal used your credentials to initiate a transfer, say that. If a scammer persuaded you to open the app, enter a payment, or approve a recipient yourself, describe that sequence instead of claiming that someone else physically initiated the payment. The distinction can affect which legal protection and recovery process apply.

When reporting a scam, explain:

• How the scammer contacted you
• Who initiated the transfer
• Whether you entered a password, one-time code, or payment instruction
• What the recipient promised
• When you realized it was a scam

Ask the bank and payment provider to review the transaction under the appropriate unauthorized-transfer or scam-recovery process. Accurate wording gives the institution facts it can investigate and avoids creating a contradiction in your claim.

Mistake 4: Calling a merchant problem fraud

Fraud and a purchase dispute are different claims.

Use an unauthorized-transaction report when you didn't make or permit the transaction. Use a merchant or billing dispute when you made the purchase but:

• The merchandise or service never arrived
• The amount was wrong
• You were charged twice
• The seller promised a refund that wasn't posted
• The goods were materially different or defective
• A recurring charge continued after you validly canceled it

Credit-card billing-error protections cover certain purchase problems, but a defective or materially different item may involve a different legal basis or dispute process than an unauthorized-use claim. Debit-card and payment-app procedures can differ again.

If the problem is non-delivery, say that. If a promised credit is missing, say the refund or credit wasn't posted. Calling either problem "fraud" can send it to the wrong review process. Contacting the seller may help, but don't let that conversation cause you to miss a notice deadline for the card or account.

Mistake 5: Providing only vague transaction details

"I don't recognize this charge" is a reasonable starting point, but it may not identify the transaction. A statement descriptor can show a parent company, payment processor, subscription, free trial, or digital wallet rather than the name you remember.

Before reporting, check:

• The exact amount and transaction date
• The merchant descriptor and reference number
• Whether an authorized user made the purchase
• Recurring subscriptions and recent free trials
• Digital wallets linked to the card
• Whether the transaction is pending or posted

Tell the bank what you checked and why the transaction still appears unauthorized. Include when you first noticed it, the last time you had the card if relevant, and any facts about travel, device access, or account compromise.

Don't guess. If you aren't sure whether a transaction is yours, say that you're investigating an unrecognized transaction and ask for identifying information before making a definitive statement.

Mistake 6: Losing the evidence

The institution may have transaction and authentication records, but your own timeline can fill in details that its systems don't show. Save:

• The statement or transaction-history page showing the charge
• Receipts, order confirmations, and delivery records
• Bank alerts, app screenshots, and account-login notices
• Messages, emails, or phone numbers used by a scammer
• Your communication with the merchant, bank, or payment app
• Claim numbers, dates, names, and summaries of every call
• A police or identity-theft report, if you filed one
• Evidence that the card was in your possession or that you were elsewhere

Keep the originals and send copies unless the institution specifically asks for an original. Don't edit screenshots or create evidence after the fact. Full account numbers, passwords, and security codes don't belong in an unsecured email.

Mistake 7: Disputing the charge without securing the account

A dispute addresses transactions that already happened. It may not stop the next withdrawal.

After reporting, ask the institution whether you should:

1. Lock or replace the card
2. Change online-banking and email passwords
3. Turn on multifactor authentication
4. Remove the card from digital wallets
5. Block compromised payment credentials
6. Change the account number if unauthorized ACH debits are continuing
7. Monitor pending and newly posted transactions

If your phone number, email, or device may have been compromised, secure those accounts too. Tell the bank about continuing unauthorized activity rather than assuming it will be added to the first claim automatically.

Mistake 8: Reporting only one transaction from a series

List every transaction you believe is unauthorized, including its date, amount, and statement. A series can include small charges that appeared before a larger withdrawal.

An example format:

Tell the institution when you first discovered the series and whether additional transactions appeared after your initial report. Don't combine everything into one unexplained total. Each transaction may have a separate statement date, evidence trail, and investigation result.

Mistake 9: Treating provisional credit as a final refund

Provisional credit is temporary money placed in the account while an investigation continues. It isn't necessarily a final decision and may later be reversed, so don't assume it is safe to spend.

For a standard Regulation E notice, the institution generally must determine whether an error occurred within 10 business days. If it needs more time, it generally must provide provisional credit, subject to the rule's conditions, and may have up to 45 days to complete the investigation. Certain new-account, point-of-sale, and foreign-initiated transactions can qualify for a longer investigation period.

Credit-card billing disputes follow a different schedule. The issuer generally must acknowledge a written complaint within 30 days unless it has already resolved the issue. It must resolve the dispute within two complete billing cycles and no later than 90 days.

Keep the relevant dates on a calendar. If the bank asks for written confirmation after an oral Regulation E report, respond promptly. If it denies the claim, request the written explanation and ask how to obtain the supporting documents it relied on. Regulation E requires information about the right to request those documents when the institution concludes that no error occurred.

Mistake 10: Assuming apps, wires, foreign transactions, and business accounts work the same way

PayPal, Venmo, and other payment services may use separate categories for unauthorized activity, purchase protection, and person-to-person payments. Their internal deadlines and eligibility rules can change. Report the transaction through the app, then notify the linked bank or card issuer when that funding source was affected.

The funding source still matters:

• A charge appearing on a credit card may call for an FCBA written billing dispute.
• A debit from a checking account may call for a Regulation E notice to the bank.
• A transaction taken from an app balance may require action under the app's current terms.
• A wire transfer may involve different recovery procedures and federal or state rules.

An app deadline or card-network chargeback timeframe isn't a universal substitute for a statutory notice deadline. Likewise, a foreign merchant or foreign-initiated transfer may affect the institution's investigation period without creating an automatic 90-day reporting window.

Regulation E and the FCBA are primarily consumer protections. A business account, commercial card, or business-purpose transfer may have different rights, deadlines, and contract terms.

A filing sequence that leaves a record

1. Stop further loss

Contact the bank, card issuer, or app immediately. Lock or replace compromised credentials, and ask whether the account number must change.

2. Identify the rule and deadline

Read the statement and determine whether the transaction was a debit, ACH, credit-card charge, wallet payment, or wire. Write down the statement date and the date you discovered the transaction.

3. Send a clear notice

For a bank-account transfer, you can use wording such as:

I am reporting an error involving unauthorized electronic fund transfers from my account ending in [last four digits]. The transactions are [dates, amounts, and descriptions]. I did not make, initiate, or authorize these transfers. I first noticed them on [date]. Please investigate and tell me whether you need written confirmation or additional information.

Use that wording only when it accurately describes what happened. If you personally initiated a payment after being deceived, describe the scam and sequence instead.

For a credit card, use the issuer's billing-disputes address. Identify the first statement containing the error, the charge, the amount, and the reason for the billing dispute. Send the notice early enough for the issuer to receive it within the 60-day period.

4. Attach organized evidence

Send copies of the statement, timeline, receipts, alerts, correspondence, and relevant reports. Keep a complete copy of everything you submit, along with delivery confirmation or a secure-message record.

5. Track the investigation

Record the claim number, submission date, requested documents, provisional credit, final decision, and any reversal. Confirm important conversations in writing.

6. Escalate a failed process

If the institution misses a required step, gives no meaningful explanation, or ignores a written dispute, submit a complaint through the CFPB complaint portal. Include a short timeline and copies of your notices.

If the incident involves identity theft or a scam, you can also report it through ReportFraud.ftc.gov. An FTC report creates a government record and may support your documentation, but it doesn't replace notice to the financial institution or guarantee reimbursement.

Quick checklist before you submit

• [ ] I identified the payment type and the institution responsible.
• [ ] I reported the transaction immediately.
• [ ] I checked the statement date and applicable deadline.
• [ ] I listed every disputed transaction separately.
• [ ] I used factual wording that matches what happened.
• [ ] I sent written notice where the credit-card billing-error process requires it.
• [ ] I saved copies, delivery proof, claim numbers, and call notes.
• [ ] I secured the card, account, email, and payment apps.
• [ ] I recorded when to expect the next response or when to follow up.
• [ ] I requested a written explanation and supporting documents if the claim was denied.

Frequently asked questions

Is the 60-day deadline counted from the transaction date?

Not always. For a Regulation E electronic fund transfer, it generally runs from the statement showing the transfer. For a credit-card billing error, it runs from the first statement containing the error. Report the transaction immediately because separate liability rules can apply sooner.

Does an FTC identity-theft report guarantee a refund?

No. It can support your records, but the bank, card issuer, or payment provider still investigates under the rules and terms that apply to the transaction.

Should I report a PayPal or Venmo transaction to both the app and my bank?

If the app account and a linked bank or card were involved, notify each affected provider. Explain which account was debited and whether you initiated the payment or a third party did.

What should I do if the bank says the transaction was authorized?

Ask for the decision in writing and request the documents it relied on. Compare its account of the transaction with your timeline, device records, messages, and other evidence. If the institution failed to follow the dispute process, consider a CFPB complaint.

Open the statement, write down the payment rail and statement date, and contact the correct provider today. Save the confirmation and claim number before you close the call or app.