If a debit card charge isn't yours, secure the card and call your bank or credit union using an official phone number. Say, "I am reporting an unauthorized electronic fund transfer and giving notice of an error under Regulation E." Record the time of the call, then send the notice in writing through the institution's designated dispute channel.

If the card or another access device was lost or stolen, report that within two business days after learning about the loss. If the card stayed in your possession, the key federal notice period generally runs for 60 days after the bank sent or provided the statement showing the unauthorized transfer. Reporting quickly can limit liability, but it doesn't guarantee an automatic refund.

This article covers U.S. consumer debit cards and bank accounts. Credit cards, business accounts, prepaid cards, ACH withdrawals, and accounts in other countries can follow different rules.

Debit card unauthorized charge checklist

• [ ] Lock the card in the official app, then call the bank to report the transaction and replace the card if needed.
• [ ] Report a lost or stolen card as well as any unfamiliar transfer.
• [ ] Record the merchant, amount, transaction date, posting date, and statement date.
• [ ] Submit written notice through the bank's secure dispute system or designated error-notice address.
• [ ] Keep the confirmation number, uploaded documents, letters, and call log.
• [ ] Ask whether provisional credit applies and when the investigation should be complete.
• [ ] Watch the account and linked cards for additional unauthorized transfers.
• [ ] If the bank denies the claim, request the written explanation and the documents it relied on.

Which rule applies to a debit card dispute?

Regulation E generally governs unauthorized electronic fund transfers from a consumer account. An unauthorized EFT usually means another person initiated a transfer without your authority and you received no benefit from it. A stolen card, compromised card number, or unauthorized PIN transaction may fit that description.

An authorized purchase that later goes wrong is different. If you approved the payment but the item never arrived, the merchant charged the wrong amount, or a service was defective, don't automatically call the transaction fraud. Contact the merchant and ask the bank about its card or merchant-dispute process.

A Visa or Mastercard logo doesn't turn a debit card purchase into a credit card billing dispute. Network rules may affect the bank's internal review, but they don't replace federal notice deadlines. Start with the bank or credit union, not Visa or Mastercard.

Deadlines that can affect liability

Liability rules and the bank's error-resolution deadlines are connected, but they aren't the same thing.

Lost or stolen card

Report the loss or theft within two business days after learning about it. Under the federal rule, your liability is generally limited to the lesser of $50 or the amount transferred before the bank received notice.

Waiting more than two business days can raise potential liability to as much as $500 under the federal calculation. Transfers that occur after those two business days and before notice may also matter if the bank can show that timely notice would have prevented them.

The FTC's guidance on lost and stolen cards recommends reporting unfamiliar charges as soon as you discover them. Don't wait for the next statement if you already know the card is missing.

Card was not lost, but the charge is unauthorized

Report the charge as soon as you see it. For the Regulation E error-resolution process, the bank generally must receive notice no later than 60 days after it sent or provided the periodic statement on which the error first appeared.

That clock usually runs from the statement date, not from the transaction date or the day you happened to open the statement. If you wait past the period, the bank may be able to hold you responsible for later unauthorized transfers if it can show that earlier notice would have prevented them.

Missing the 60-day period can weaken your federal protection, but it doesn't automatically establish that every transaction was authorized. Report the problem anyway and explain when you first discovered it.

How long the bank has to investigate

Under 12 CFR § 1005.11, a financial institution generally must investigate promptly and determine whether an error occurred within 10 business days after receiving a notice of error.

If it needs more time, it may generally use an extended investigation period of up to 45 calendar days if it provides the required provisional credit within 10 business days. The rules allow longer periods - up to 90 calendar days - for certain point-of-sale debit card transactions, foreign-initiated transfers, and newly established accounts. For a new account, the provisional-credit period can be 20 business days.

Provisional credit is temporary. If the bank concludes that no error occurred, it may reverse the credit after giving the required notice. Ask for the written explanation and the documents relied on for the decision.

The bank may require written confirmation after an oral report. Send that confirmation promptly, because failing to provide it within 10 business days can affect the bank's obligation to provide provisional credit.

How to dispute an unauthorized debit charge

1. Secure the card and account first

Use the bank's official app to lock the card if that option is available. Then call the number on the back of the card, a recent statement, or the bank's official website. Avoid numbers supplied in an unexpected text message or email.

Ask the bank to:

• Cancel and replace the card if its number may be compromised.
• Block further transactions and explain how recurring card payments will be handled.
• Change the PIN if it may have been exposed.
• Review linked accounts if the bank login or account number may also be compromised.
• Record the date and time of your report.

If someone accessed online banking, change the password through the official website and turn on multifactor authentication. Never give a one-time verification code to a caller who claims to be from the bank.

2. Write down the dates and transaction details

Before the information disappears from the app, save:

• The merchant name and complete statement description.
• The amount, transaction date, and posting date.
• The last four digits of the affected card or account.
• The date you first noticed the charge.
• The date the statement was sent or made available.
• Whether the physical card was in your possession.
• Related alerts, receipts, travel records, emails, or merchant messages.

A pending transaction can change or disappear before it posts. Report it now, but ask the bank whether it needs the transaction to post before opening the formal claim.

3. Give the bank clear notice

Use plain wording:

I am reporting an unauthorized electronic fund transfer and giving notice of an error under Regulation E. I did not authorize this transaction.

Identify the amount, date, merchant, and affected account. Ask for a case number and the expected investigation timeline. Find out whether the bank requires a fraud form, written confirmation, or a claim submitted through a secure portal.

A phone call can provide immediate notice, but don't rely on the call alone. Follow it with a secure message, online claim, or letter. You don't have to wait for a merchant response or police report before notifying the bank.

4. Send the written notice through the right channel

Follow the bank's instructions for error notices. A branch employee, general customer-service email, or ordinary mailing address may not be the designated channel for a Regulation E notice. If you mail the letter, use delivery tracking and keep a copy.

Include enough information to identify you, the account, and the transaction. Never put your PIN, online banking password, or full debit card number in an unsecured message.

5. Keep the records that may answer the bank's questions

Save copies rather than sending originals. Useful records can include:

• The statement or transaction screen showing the charge.
• Alerts showing when the transfer occurred.
• A timeline of where you and the card were, if that is relevant.
• Evidence that the card was lost, stolen, or still in your possession.
• Messages with the merchant or suspected scammer.
• A police or identity-theft report, if you made one.
• Notes showing when you contacted the bank and what it told you.

The bank may ask for an affidavit or report as part of its process, but don't assume one is required in every case. Ask what it needs and submit it without delaying the initial notice.

6. Contact the merchant when it makes sense

A merchant contact may help with a duplicate charge, incorrect amount, canceled service, or undelivered purchase. Keep the message factual and save the reply.

For a transaction you truly didn't authorize, the bank comes first. A merchant refund request doesn't replace notice to the bank. If the merchant later refunds the money, tell the bank so the account isn't credited twice.

7. Track the claim and watch for more transfers

Keep a running record of:

• The date, time, and method of each contact.
• Representative names or identification numbers.
• Case and confirmation numbers.
• Documents submitted and their submission dates.
• Promised follow-up dates.
• Provisional credits, reversals, or other account changes.

Continue checking the account and related cards. Report each additional unauthorized transfer promptly instead of assuming it was included in the first claim.

Sample letter for an unauthorized debit card charge

Send the letter to the bank's designated error-notice address or upload it through the bank's secure system. The FTC sample dispute letter provides another format. Keep your original documents.

Subject: Notice of unauthorized electronic fund transfer

[Your name]
[Your address]
[Date]

[Bank name]
[Error-notice or fraud department address]

Re: Account ending in [last four digits]

I am writing to report and dispute an unauthorized electronic fund transfer under Regulation E, 12 CFR 1005.11. On [date], a transaction for $[amount] described as [merchant description] was posted to my account ending in [last four digits].

I did not authorize this transfer, did not give anyone permission to make it, and received no benefit from it. I first noticed the transaction on [date]. [The card was in my possession, or I reported the card lost or stolen on [date and time].]

Please investigate this error and correct my account. If the investigation cannot be completed within the applicable initial period, please provide any provisional credit required by Regulation E. Send the results in writing. If you determine that no error occurred, please provide the written explanation and the documents relied on for that determination.

Enclosures: [statement excerpt, transaction record, timeline, and other supporting documents]

Sincerely,
[Your name]
[Safe contact information]
[Bank case number, if available]

If the bank denies the claim

1. Get the written decision. Ask the bank to identify the transaction, explain why it found no error, and provide the documents it relied on.
2. Check the underlying facts. Look for a wrong date, merchant description, card number, travel detail, or assumption that another person had your permission.
3. Send a focused follow-up. Include the original case number, proof that you gave timely notice, and the evidence that answers the bank's stated reason for denial.
4. Ask about any provisional-credit reversal. Request the notice and explanation if temporary funds were removed.
5. File a complaint with the Consumer Financial Protection Bureau. Include a short timeline, the bank's response, the correction you want, and proof of your notices. A CFPB complaint can obtain a company response, but it isn't a guaranteed appeal or refund.
6. Contact the appropriate bank regulator. The Office of the Comptroller of the Currency complaint information applies to national banks and federal savings associations. A state bank or credit union may have a different regulator.
7. Report identity theft separately when appropriate. A police or identity-theft report can document what happened, but it doesn't replace notice to the bank.

Details that can hurt a claim

• Waiting for the monthly statement after learning that the card was lost or stolen.
• Calling the merchant without notifying the bank.
• Treating the 60-day period as running from the day you opened the statement.
• Sending the notice to the wrong bank address.
• Failing to provide written confirmation when the bank requests it.
• Calling an authorized purchase "unauthorized" because the merchant later caused a problem.
• Sending a PIN, password, full card number, or unnecessary personal documents.
• Assuming provisional credit is permanent.
• Treating a Visa or Mastercard deadline as a substitute for Regulation E notice.
• Giving up after a denial without asking for the written reasoning and supporting records.

Frequently asked questions

Does a phone call count as notice?

Generally, an oral notice can count. The bank may require written confirmation within 10 business days, however. Send the confirmation anyway and keep proof of the submission.

Is the 60-day deadline measured from the transaction date?

Usually, no. The Regulation E error-notice period generally runs from the date the bank sent or provided the statement on which the error first appeared. A lost or stolen card creates a separate reason to report within two business days.

Can I dispute a debit card payment for an item that never arrived?

Ask the merchant for a refund and ask the bank about its card-dispute process. An authorized purchase that went wrong isn't automatically an unauthorized electronic fund transfer under Regulation E.

Do I have to contact the merchant before the bank?

No. Notify the bank first when the transaction is unauthorized. You can contact the merchant in parallel when doing so is safe and may resolve an authorized billing problem.

How long will it take to get the money back?

The bank generally has 10 business days to make its initial determination. If it needs more time, the provisional-credit and extended-investigation process may apply, with longer periods for certain transactions and new accounts. No investigation deadline guarantees that the bank will ultimately find an error.

Make the official call now, record the time, and send the written notice through the bank's designated channel before the applicable deadline.