">

The payment method sets the deadline

Start with the account that lost the money. For an unauthorized electronic transfer from a personal U.S. bank account, contact the bank as soon as you see it. Regulation E usually requires notice no later than 60 days after the statement first showing the error was sent. If your debit card or another access device was lost or stolen, a separate two-business-day rule can affect your liability.

Credit-card disputes follow a different federal process: the issuer must receive written notice within 60 days after the statement containing the billing error was sent. Digital wallets, bank wires, and crypto withdrawals don't have one universal deadline. Their terms, the payment rail behind the transaction, and the facts of the account compromise matter.

A transaction is unauthorized when you didn't make it and didn't authorize someone else to make it. A purchase you recognize but never received, a duplicate charge, or a missing merchant refund may need a different billing or merchant dispute.

U.S. deadlines at a glance

Payment type Deadline or timing that usually matters Rule or policy that controls
Debit card, ATM, and many consumer EFTs Two business days after learning an access device was lost or stolen affects liability. Otherwise, notice is generally due within 60 days after the statement first shows the error. Regulation E
Unauthorized ACH debit from a personal account Generally, within 60 days after the statement showing the debit was sent Regulation E, plus bank and ACH procedures
Credit card The issuer must receive written notice within 60 days after the statement with the billing error was sent. Fair Credit Billing Act and Regulation Z
PayPal, Venmo, Zelle, and similar wallets No single federal deadline covers every dispute. Report it immediately under the platform's terms and to the linked bank or card issuer. Platform policy and the underlying payment rail
Ordinary bank wire No universal 30- or 60-day consumer deadline. Contact the sending bank immediately. Bank agreement, transfer system, and applicable law
Crypto exchange withdrawal No universal federal deadline. Use the exchange's security process immediately. Exchange terms and the facts of the account compromise

These deadlines don't substitute for one another. A 120-day period sometimes appears in card-network chargeback rules for certain purchase disputes. It isn't a universal consumer deadline and doesn't replace the federal 60-day written-notice period for an unauthorized credit-card billing error.

What to do in the first 24 hours

Speed can give a bank or platform a better chance to stop a transfer or freeze money. It also creates a clear record of when you reported the problem.

  1. Use an official contact channel. Call the number on the back of the card or on a statement, or use the company's official app or website. Don't use a number from a suspicious text or email.
  2. Lock down access. Freeze the card, change online-banking and email passwords, sign out of other sessions, remove unfamiliar devices, and ask whether the account or wallet should be closed and replaced.
  3. Request a concrete recovery step. For an ACH or wire, ask about a stop, reversal, recall, or request to freeze funds at the receiving bank. For a card transaction, ask the issuer to open a fraud case and replace the card.
  4. Create a written record. A phone call can be the fastest first step, but send written notice too. Written notice is required for the federal credit-card billing-error process.
  5. Save the trail. Keep statements, transaction IDs, screenshots, fraud alerts, emails, text messages, call dates, representative names, and case numbers.
  6. Watch what happens next. Review later statements and change any password you reused on another service.

You don't need to wait for a police report before notifying the financial institution. If the bank or platform requests one, provide it afterward.

Regulation E: debit cards, ATMs, ACH, and bank-account transfers

Regulation E, 12 CFR part 1005 covers many electronic fund transfers from consumer accounts. That includes many debit-card, ATM, ACH, and online-banking transactions. The protections aren't identical for business accounts, so a business checking account may be governed by different rules and account terms.

Why two business days can matter

If you learn that your debit card, PIN, or another access device was lost or stolen, notify the bank within two business days. When you do, liability for unauthorized transfers is generally limited to the lesser of $50 or the amount transferred before you gave notice.

The two-day rule isn't a universal deadline for every suspicious debit-card transaction. It is tied to learning that the access device was lost or stolen. If notice comes later, potential liability for transfers made after the two-business-day period and before notice can rise to the lesser of $500 or the amount of those transfers, when the conditions in Regulation E are met.

If you still have the physical card but its number appears to be compromised, report the fraud immediately and keep track of the separate 60-day statement deadline. Don't wait to see whether another charge appears.

The 60-day statement rule

For many Regulation E errors, the bank must receive your notice within 60 days after it sends the periodic statement that first shows the unauthorized electronic transfer. The clock usually runs from the statement, not from the day you happen to notice the charge.

Missing the 60-day period can expose you to liability for later transfers that the bank can show would have been prevented by timely notice. It doesn't automatically make you responsible for every transaction, and it doesn't erase the facts surrounding the original claim.

Give the bank enough information to locate the error: the account, transaction date, amount, and reason you believe the transfer was unauthorized. Regulation E allows oral notice. If the bank asks for written confirmation, send it within 10 business days; failing to do so can affect the bank's provisional-credit obligation while it investigates.

Investigation and provisional credit

Under the error-resolution procedures in 12 CFR 1005.11, the institution must investigate promptly and usually determine whether an error occurred within 10 business days after receiving your notice.

When more time is needed, the institution can usually extend the investigation to 45 calendar days by provisionally crediting the disputed amount within 10 business days and following the required notice procedures. Certain new-account, point-of-sale, and foreign transactions have special timing rules and can allow an investigation lasting up to 90 calendar days.

Provisional credit isn't a final decision. If the bank concludes that no error occurred, it can remove the credit after giving the required explanation. Keep the notice, investigation result, and account statements together.

Credit-card fraud: the 60-day notice must be written

The Fair Credit Billing Act treats an unauthorized credit-card charge as a billing error. To use the federal billing-error procedure, send a written dispute so the issuer receives it within 60 days after the statement containing the charge was sent.

Use the billing-dispute or billing-inquiries address printed on the statement. It may be different from the address used for payments. Include:

The issuer generally must acknowledge the dispute in writing within 30 days, unless it has already resolved the matter. It must resolve the dispute within two billing cycles and no later than 90 days, according to FTC billing-error guidance.

While the investigation is pending, you generally don't have to pay the disputed amount or related finance charges. Pay the undisputed part of the bill by its due date. Federal law generally limits liability for unauthorized credit-card use to $50, and many issuers provide broader zero-liability protection under their card terms. Check the issuer's policy for exceptions.

A phone call may open the issuer's internal fraud investigation, but it doesn't replace the written notice needed for the federal billing-error procedure. Send the letter before the 60-day period expires and keep proof of delivery.

ACH and digital-wallet disputes

An unauthorized ACH debit from a personal checking or savings account is often an electronic fund transfer covered by Regulation E. Notify the bank that holds the account, not just the company that initiated the debit. The bank may also ask you to contact the merchant or payment platform.

A recurring payment you once authorized raises a different question. Stopping future payments isn't the same as disputing a transfer that already occurred. Tell the bank whether you never authorized the debit, revoked authorization, or are challenging its amount or timing.

PayPal, Venmo, Zelle, and similar services

There is no single federal 60-to-180-day deadline for every wallet dispute. The platform may set different time limits for an account takeover, an unauthorized card charge, an item-not-received claim, or a payment you personally approved.

When the facts involve more than one account, use both channels:

The exact sequence matters. If someone accessed the account and sent money without your permission, say that plainly. If you personally approved a payment after an impostor manipulated you, the bank or platform may classify it differently, and reimbursement may depend on its policy and the facts. Describe who initiated the payment, who entered the credentials, and what you were told. Don't assume the classification before the institution investigates.

Wire-transfer fraud has no standard 30-day rule

An ordinary bank wire generally isn't governed by the debit-card notice deadlines in Regulation E. The bank's wire agreement, the transfer system, applicable law, and facts such as whether the bank followed its security procedures may control.

Call the sending bank's wire-fraud department immediately. Ask for:

A recall isn't guaranteed, particularly after the recipient withdraws or moves the money. International remittance transfers may have separate federal requirements, so ask the bank which rules it is applying. Don't assume that a 30- or 60-day number found online applies to an ordinary wire.

Crypto withdrawals and exchange accounts

An unauthorized withdrawal from a crypto exchange isn't automatically covered by Regulation E or the credit-card billing-error rules. The exchange's user agreement and security procedures usually provide the first reporting route. The bank or card used to fund the account may have a separate dispute process.

Contact the exchange's security team immediately and request an account freeze. Preserve:

A confirmed blockchain transfer can be difficult or impossible to reverse. If a bank or card transaction that funded the crypto purchase was itself unauthorized, dispute that funding transaction separately. Report cyber-enabled fraud to the Internet Crime Complaint Center and local law enforcement. Be wary of anyone promising guaranteed crypto recovery in exchange for an upfront fee.

A statute of limitations for a court claim is a different issue from a deadline for reporting a stolen exchange withdrawal. Don't treat a securities-fraud limitation period as a general reporting deadline. Any court claim depends on the facts, parties, contract, and state law.

If you missed the deadline

Send the dispute anyway. Explain when you discovered the transaction, why notice was delayed, and what you did after finding it. A missed deadline can reduce a legal protection, but it doesn't stop a bank, issuer, or platform from investigating or attempting voluntary recovery.

Ask for the decision in writing. If a bank denies the claim, ask it to identify whether the reason was:

Use the appropriate complaint route if the institution doesn't address the issue. The OCC complaint page handles issues involving national banks and federal savings associations. The FDIC consumer complaint process explains how to submit a complaint and what information to include. Use the regulator that supervises your institution. A complaint doesn't extend a dispute deadline or guarantee reimbursement.

For a large loss, a lawyer or legal-aid organization can evaluate state-law claims, contract terms, and the time limit for filing a court case. That court-filing deadline is separate from a bank's credit-card or Regulation E notice period.

Questions about unauthorized-transaction deadlines

Does the 60-day period start on the transaction date?

For many Regulation E claims and credit-card billing errors, the federal notice period is tied to when the statement showing the error was sent. The two-business-day rule is different: it starts when you learn that a card or other access device was lost or stolen. Wallet, wire, and crypto policies may use a transaction date, settlement date, discovery date, or another term.

Is a $50 liability cap automatic?

No. For a debit account, the result depends on whether an access device was lost or stolen and when you notified the bank. Credit-card law has a separate federal limit, while an issuer's zero-liability policy may provide more protection.

Can I dispute a transaction after 60 days?

You can still report it and request a review. Federal protection may be reduced, especially for later transfers that timely notice could have prevented. Give the institution a written timeline and ask for its decision rather than abandoning the claim.

Do I need to contact the app, bank, and card issuer?

Contact each relevant party promptly. The app may control its own reimbursement process, while the bank or card issuer may control the legal dispute for the account that was charged. Keep a single timeline, save every case number, and describe the transaction consistently. If you're unsure which payment rail was used, report it to the bank and platform today and ask for written instructions.