If a debit-card transaction isn't yours, freeze or lock the card in your banking app if that option is available, then call your bank or credit union through the number in its official app, website, or statement. Report the transaction as an unauthorized electronic fund transfer under Regulation E, commonly called Reg E. Ask the institution to block further activity, replace the card if needed, and open an error investigation.

A freeze helps contain card activity, but it isn't a dispute. It may not stop a recurring payment, a transaction that was already authorized, or an ACH withdrawal from the account. Report the transaction even if the amount is small.

This guidance is for U.S. consumers with typical checking or other deposit accounts linked to debit cards. Prepaid, payroll, business, and other specialized accounts may have different procedures or protections.

Immediate checklist

You can say:

I did not authorize this debit card transaction. Please block further transactions and open a Regulation E error investigation.

Check the transaction before labeling it fraud

An unfamiliar merchant descriptor doesn't always mean someone stole your card. Check whether the transaction is:

If you still don't recognize it, report it. Don't wait for the transaction to post if the bank can take an initial fraud report while it's pending. Some institutions wait for a pending transaction to post before accepting a formal dispute.

An unauthorized electronic fund transfer generally means someone initiated a transfer without your actual authority and you received no benefit from it. A purchase you authorized but never received, a wrong amount, a duplicate charge, or a missing refund is usually a merchant or billing dispute instead.

Describe the facts accurately. Don't call a purchase "unauthorized" simply because the product was defective or the seller refused a refund. Contacting the seller may help with those problems, but it shouldn't delay notice to your bank when you genuinely suspect fraud.

Report the transaction to your bank

Use the bank's fraud or customer-service number, not a number in an unexpected text, email, or pop-up. Tell the representative:

Before ending the call, ask:

  1. What is my claim or case number?
  2. Has the card been blocked, and will a new card number be issued?
  3. Do I need to provide written confirmation within 10 business days?
  4. What address or secure-message channel should I use?
  5. When should I expect provisional credit or an investigation result?
  6. How should I report related overdraft or insufficient-funds fees?

A phone report can start the process, but written follow-up gives you a record of what you reported and when. If the bank requires written confirmation after an oral report, send it through the specified method within the stated deadline and keep proof of delivery.

Reg E deadlines and liability limits

For most consumer accounts, the main federal notice deadline is 60 days after the statement showing the unauthorized transfer was sent. Report the problem sooner. Delays can affect both your liability and the bank's ability to investigate.

Timing Why it matters
Immediately Limits additional activity and starts the bank's record of your report.
Within 2 business days after learning that your card or another access device was lost or stolen Federal liability is generally limited to $50 when the applicable liability rules are met.
More than 2 business days after learning of the loss or theft, but within 60 days after the statement was sent Liability can be as high as $500 for certain unauthorized transfers made before notice.
Within 60 days after the statement showing the transfer was sent Preserves the main Reg E notice protection for that statement period.
Within 10 business days after notice of the error The bank generally must complete its investigation or provide provisional credit if it needs more time.
Up to 45 calendar days, or up to 90 days in certain cases Reg E can allow a longer investigation for some point-of-sale debit transactions, foreign-initiated transfers, and new accounts.

The two-business-day rule concerns learning that the card or another access device was lost or stolen. It isn't a reason to delay reporting a suspicious charge when the physical card is still with you.

If you miss the 60-day deadline, report the problem anyway and explain when you discovered it. The bank may still investigate under its own policy, but potential liability for later transfers can increase. A bank or card network may offer broader protection than federal law, so check your account agreement without assuming that broader protection applies.

Understand provisional credit

Provisional credit is temporary money placed back in your account while the bank continues investigating. It isn't necessarily a final refund.

If the bank can't finish within the initial 10-business-day period, Reg E generally requires it to provide provisional credit for the alleged error within 10 business days. The period can be 20 business days for certain new accounts. The bank may continue investigating for the longer period allowed by the rule.

A bank that completes its investigation within the initial period may issue a final decision instead of provisional credit. If it decides that no error occurred, it generally must explain the result in writing. You can request the documents it relied on. If provisional credit was issued, the bank may reverse it after giving the required notice.

Treat provisional funds cautiously. If the credit is reversed, a payment made against it could cause an overdraft.

Send a written dispute

Follow the bank's instructions. Use the address listed for error notices, or a secure online-message channel if the bank accepts it for disputes. Don't send your PIN, online banking password, or unnecessary personal information. Include enough information to identify the account and transaction, using only the last four digits of the account when possible.

You can adapt this format:

Subject: Notice of error - unauthorized debit card transfer

I am reporting an unauthorized electronic fund transfer from my [checking or other account, last four digits]. The transaction details are:

  • Date: [date]
  • Amount: [$amount]
  • Merchant: [merchant name]
  • Reference number: [number, if available]

I did not authorize this transfer and did not receive any benefit from it. [If true, explain when the card or access device was lost or stolen.]

Please investigate this notice under Regulation E and provide provisional credit if required. Please send me the written result. If you determine that no error occurred, please provide the documents supporting that finding.

Enclosures: [statement page, screenshots, correspondence, or report]

Sincerely,
[Name and safe contact information]

The FTC sample letter for disputing credit and debit card charges offers a similar structure. Keep a copy of everything you send and retain the originals.

Gather evidence without delaying the report

Useful records include:

A police report can support your account, but don't wait to obtain one before notifying the bank. The bank may ask for additional information. Answer truthfully and keep copies of your responses.

Protect the account from related transactions

An unauthorized debit can push an account below zero and trigger fees or rejected payments. Tell the bank that the disputed transfer caused the problem and ask it to review any resulting overdraft or insufficient-funds fees. Put that request in your written notice. Fee relief may depend on the bank's findings and account terms, so don't assume it will happen automatically.

A card freeze doesn't protect every payment connected to the account:

Ask whether replacing only the card is enough or whether the underlying account also needs protection.

Debit card disputes are not credit card billing disputes

Debit card transactions usually draw money directly from a deposit account and are handled under Reg E's electronic-transfer error procedures. Credit card billing errors are handled under a different federal framework, Regulation Z.

Don't assume that a deadline or procedure for a credit card applies to a debit card. The FTC's credit-card dispute guidance describes that separate process. Card networks and issuers can also have their own chargeback procedures, but a network deadline doesn't replace prompt notice to your bank under Reg E.

The term "chargeback" is often used casually. Your bank may send a card-network dispute behind the scenes, but your task is to give the bank timely and accurate notice of the unauthorized electronic transfer.

If the bank denies the claim

A denial doesn't end the paper trail. Take these steps:

  1. Request the decision in writing if you received it only by phone.
  2. Ask for the documents supporting the finding, including transaction information the bank relied on.
  3. Check the claim category. Ask whether the bank evaluated it as an unauthorized EFT under Reg E or as a merchant-return dispute.
  4. Submit overlooked facts such as a card replacement date, travel records, merchant correspondence, or additional suspicious transactions.
  5. Ask for a supervisor or formal reconsideration channel and follow the stated deadline.
  6. File a complaint with the Consumer Financial Protection Bureau or the bank's federal regulator if the bank did not follow its error-resolution process. Attach a timeline, copies of notices, the case number, and the written decision.

A regulator complaint can prompt a response or review, but it doesn't guarantee a refund. If a significant amount remains disputed, consider advice from a qualified consumer-law professional in your state.

Prevent another debit card fraud attempt

Common questions

Should I freeze the card before calling the bank?

Yes, if you can do it quickly, but freezing the card doesn't replace reporting the transaction. Call the bank immediately afterward and confirm whether the card was blocked or replaced.

Do I have 60 days to report an unauthorized debit card charge?

For most consumer accounts, Reg E's main notice period is 60 days after the statement showing the transfer was sent. You should report it immediately. If the card or another access device was lost or stolen, the two-business-day rule can affect the federal liability limit.

Will the bank permanently refund the money right away?

Not necessarily. The bank may provide provisional credit while investigating. It can later reverse that credit if it determines the transaction was authorized or that no error occurred.

Do I need to contact the merchant first?

No. Contacting the merchant can help identify a confusing descriptor or resolve an authorized purchase problem, but it shouldn't delay your bank report when you believe the transaction is fraudulent.

What if the transaction is still pending?

Report it and ask what the bank wants you to do. Some banks wait for a transaction to post before opening a formal dispute, but early notice can still help protect the account.

What if I noticed the charge after 60 days?

Report it anyway and explain when you discovered it. The bank may investigate under its policy, although missed notice can affect liability and the bank's legal obligations.

Sources

These are general U.S. consumer guidelines, not legal advice. Your account type, bank agreement, and transaction facts can affect the result. If the transaction is still unresolved, lock the card and contact the bank today using an official number.