If a transaction is unfamiliar, contact the bank, card issuer, or payment platform today through its official app or a trusted phone number. Ask it to secure the account and open the appropriate fraud or billing-error case. Don't wait for a police report or a merchant response before giving notice.

Write down when you noticed the payment, when you reported it, and the case number. Save the statement, transaction details, alerts, messages, and any records that show where you were or who controlled the account. This guidance is for U.S. consumers and personal accounts. Business accounts and some payment types follow different rules.

The payment rail determines the dispute process

People often use "chargeback" to describe any payment dispute. The legal process for a credit-card billing error is different from a Regulation E claim, a wire recall, or a cryptocurrency theft report. Start by identifying how the payment was made.

The deadlines are not all the same

• Credit card: The 60-day period is tied to the statement, not necessarily the date the transaction occurred. The FTC's credit-card dispute guidance describes the written-notice process.
• Debit card, ATM, and eligible ACH transfers: The two-business-day liability rule applies when you learn that an access device was lost or stolen. It isn't a two-day deadline for every unfamiliar debit. If you report later, liability for certain later transfers can rise to $500. Failing to report an error within 60 days after the statement was sent can also put later transfers at risk.
• Regulation E investigations: The bank generally has 10 business days to investigate after receiving notice. If it needs more time, it generally must provide provisional credit within that period when the rule's conditions are met. It may require written confirmation of an oral notice. New accounts and certain point-of-sale or international transactions can have longer investigation periods, sometimes up to 45 or 90 days under the rule. The official Regulation E commentary provides regulatory background.
• Provisional credit: This is temporary, not a final refund. The institution can remove it after completing the investigation if it finds that no error occurred, but it should send the required written explanation.

Build an evidence package

One screenshot rarely settles a dispute. A useful package connects the exact payment to your account, explains why you say you didn't authorize it, and shows when you reported it.

Download records from the bank or platform while they are available. Keep one unedited copy and make a separate copy for highlighting or labeling. A screenshot should show the full relevant screen, including the date, amount, merchant or wallet, status, and app or web address when available. A spreadsheet can index the records, but it doesn't replace the original statement.

Redact information that isn't needed to match the account and transaction. Never send a password, one-time code, full Social Security number, private key, or cryptocurrency seed phrase.

Make the records easy to check

• Keep the full statement page and transaction detail instead of cropping down to the amount.
• Put the statement, alert, password change, phone call, and dispute notice in one chronology. Use UTC for cryptocurrency records.
• Preserve original email files and headers, message exports, receipts, and downloaded statements when possible. Note when and how you obtained each file.
• Ask the institution to review IP, device, session, authentication, and transfer-authorization records. An IP address can support a timeline, but it doesn't identify a person by itself.
• For an ATM claim, include the ATM ID, receipt, exact time, whether you had the card, and a request that the bank preserve relevant journal and video records. Retention and release practices vary.
• Don't overstate what a record proves. A police report, affidavit, screenshot, or blockchain hash is corroboration; none automatically proves fraud or guarantees reimbursement.

Handle the payment according to its type

Credit-card charges

The Fair Credit Billing Act covers billing errors on credit cards, including many unauthorized charges. Send the dispute in writing to the address for billing inquiries shown on the statement, not simply the address used for payments. Make sure the issuer receives it within 60 days after the first statement containing the error was sent. Keep a copy and proof of delivery.

The issuer generally must acknowledge the dispute in writing within 30 days unless it has already resolved the matter. It must resolve it within two billing cycles and no later than 90 days. After a properly submitted billing-error notice, you generally don't have to pay the disputed amount or related finance charges while the issuer investigates. Continue paying the rest of the bill on time.

Federal law generally limits liability for unauthorized credit-card use to $50. Many issuers advertise zero-liability protection, but that is a policy with conditions. Follow the issuer's procedure and the FCBA written-notice deadline even if customer service says the charge will probably be removed.

Debit cards, ACH debits, and ATM withdrawals

Regulation E is the main federal framework for a qualifying electronic fund transfer from a personal account. Call the bank promptly, even if you plan to send a letter. Ask the representative to record the date and time of notice, give you a claim number, and explain whether the bank requires written confirmation.

For an ATM dispute, save the receipt and record:

• The ATM's address or identification number
• The exact time and amount
• Whether you still had the card
• Travel, work, phone-location, or witness records that may show where you were

Use only records you can obtain lawfully. Ask the bank to preserve the ATM journal and video promptly; the bank may not provide those records directly, but your request creates a clear preservation issue.

For an ACH debit, save the statement description, company name and ID, trace number, amount, and any authorization or cancellation messages. A debit you once authorized but later wanted to stop isn't automatically the same as a debit initiated without authority. Describe what happened accurately, and ask about stopping future debits separately from recovering one that already posted.

Regulation E coverage can differ for business accounts, transfers that aren't electronic fund transfers under the rule, and payments the consumer personally initiated. Ask the bank which error-resolution procedure it is applying and why.

Online banking and person-to-person payments

Save password-reset emails, login alerts, device notifications, two-factor messages, recovery-phone changes, and messages from the recipient. Ask the institution to review the relevant login time, IP address, device or session information, authentication events, and transfer-authorization record.

An IP address is not a person's identity. Mobile networks, shared connections, virtual private networks, and compromised devices can make location evidence misleading. A familiar device, correct password, or valid one-time code may weigh against a claim, but it doesn't by itself prove who controlled the account. Give the bank the whole timeline, including phishing or social-engineering contacts.

Use precise language. Don't call a payment "unauthorized" merely because a scammer persuaded you to send it. Explain whether the scammer accessed the account, whether you entered the payment, and whether you approved a recipient you didn't recognize. A provider may handle an account takeover differently from a payment you personally approved after deception.

Cryptocurrency transfers

Collect the transaction hash or ID, blockchain and network, sending and receiving addresses, token and amount, date and time in UTC, exchange or wallet account details, and related messages. The IC3 cryptocurrency guidance describes identifying details commonly used for blockchain transactions and accepts reports of online crime.

Contact the exchange, custodian, or wallet provider immediately. Ask whether it can freeze a linked account, flag the receiving address, preserve account and login records, or coordinate with law enforcement. Don't send your seed phrase or private key to the exchange, a supposed investigator, or anyone promising recovery.

A blockchain trace can show where funds moved. It usually can't prove who controlled the receiving address or guarantee that funds will come back. If a credit card funded the cryptocurrency purchase, raise the card issue with the issuer as well. That dispute concerns the card transaction and may not reverse an on-chain transfer.

Report the transaction and preserve proof

1. Stop further access

Use the bank's official phone number or app, not a number in a suspicious message. Lock or replace a card, change the bank and email passwords from a clean device, sign out unknown sessions, and update multifactor authentication. If you suspect a SIM swap, contact the mobile carrier.

Save alerts and relevant screens before resetting a compromised device when it is safe to do so. For an ACH account, ask about blocking or stopping future debits. A stop-payment instruction doesn't automatically reverse a debit that has already posted.

2. Give precise notice

Have these details ready:

• Transaction date, amount, merchant, recipient, or ATM
• Account or card ending and statement date
• When you first noticed the transaction
• Whether the card or device was lost, stolen, or still in your possession
• Whether you entered a password, one-time code, or payment instruction
• What you want the institution to do: investigate, correct the record, replace the card, secure the account, or attempt a recall

Before ending the call, record the date, time, representative's name or ID, case number, and instructions for follow-up. For a debit or eligible electronic transfer, a phone report can be a useful first step. For a credit-card billing error, send the written notice too.

3. Create a dated event log

A short log prevents the important sequence from getting lost:

Keep emails in their original format when possible, including headers. Save text messages, call logs, voicemail, receipts, and account alerts. Don't crop away dates or change the contents of a screenshot. If the bank won't provide raw IP or device records, ask it to preserve them and describe what it relied on in its decision.

4. Send a focused written dispute

Use copies, label the pages, and include a one-page timeline. A reviewer should be able to match each attachment to the transaction without guessing.

You can adapt this factual template:

Subject: Notice of unauthorized transaction or billing error

I am disputing this transaction: [date, amount, merchant, recipient, or ATM]. The account or card ends in [last four digits], and the transaction appears on [statement date or account].

I did not authorize this transaction. [Add a truthful description of what happened, including whether the card or device was in your possession and whether you entered any credentials or payment instructions.] I first noticed it on [date and time] and reported it to [institution] on [date] under case number [number].

Please investigate, secure the account as needed, and send me the written result. Please also tell me whether you need a signed statement or additional documents. I have enclosed [list of records].

Sincerely,
[Name, address, phone, and safe contact method]

For a credit card, send the letter to the billing-inquiry address and keep proof that it arrived. For a debit or ACH claim, use the bank's fraud channel and follow its written-confirmation instructions. If the bank supplies an affidavit or declaration, use its form and sign only statements you can support. Notarization isn't automatically required for every dispute.

5. File reports when they add useful documentation

A police report can document an ATM theft, identity theft, or account takeover, but it doesn't decide whether the bank must refund the money. Obtain the report or incident number and provide it if the institution requests it.

For online fraud and cryptocurrency theft, submit the transaction details and supporting records to the Internet Crime Complaint Center and report the incident to the exchange or recipient platform. These reports may create investigative leads, but they don't replace notice to the bank or platform.

6. Track the investigation

Watch for additional transfers, provisional credits, reversals, and requests for information. Reply by the stated deadline and save every notice. If a provisional credit is removed, ask for the written findings and the documents or evidence the institution relied on.

A denial should identify the reason. It might refer to a card-present transaction, PIN or one-time-code use, claimed authorization, merchant information, or a login record. Ask for the specific reason and send a focused response to that point rather than repeating the same screenshot.

Under Regulation E, a consumer can generally request the documents used to support a finding that no error occurred. Make that request in writing and keep a copy.

If the bank or issuer denies the claim

Read the denial against the transaction you actually reported. A response about a merchant refund, delivery problem, or product complaint may not answer an unauthorized-use dispute.

Ask for:

1. The exact reason for denial
2. The date the institution received your notice
3. The records it relied on
4. The deadline and method for appeal
5. The status of any provisional credit or account restriction

Then submit a concise rebuttal. Address each stated reason with the evidence you have. For an eligible Regulation E claim, request the documents supporting the finding. For a credit-card billing error, check that your written notice went to the correct billing-inquiry address and arrived within the 60-day period.

Escalation depends on the institution. A complaint to the Consumer Financial Protection Bureau can create a formal record, and the institution's federal or state supervisor may have a separate complaint process. A complaint doesn't extend a statutory or contractual deadline. Police and IC3 reports address possible crime, not the bank's reimbursement decision.

If you suspect identity theft, consider a credit freeze or fraud alert and change credentials that were reused elsewhere. For a large loss, repeated identity theft, or a dispute involving a frozen account, prompt advice from a qualified consumer-law or identity-theft professional may be worthwhile.

Mistakes that weaken a dispute

• Waiting for a police report before notifying the bank
• Relying only on a phone call for a credit-card billing error
• Treating an unfamiliar merchant descriptor as proof of fraud without checking subscriptions or authorized users
• Sending edited screenshots with missing dates, URLs, or transaction details
• Claiming that a card was stolen or a security code was bypassed when you don't know that
• Calling a payment "unauthorized" when you personally sent it after being deceived, instead of explaining the scam accurately
• Sending full passwords, one-time codes, private keys, or seed phrases
• Assuming a police report, IP address, or blockchain record alone guarantees a refund
• Missing a written-response, appeal, or statement deadline while waiting for a merchant

Common questions

Is a screenshot enough to prove an unauthorized transaction?

Usually not. It can show what appeared on your screen, but a statement, dated report, account-access records, and clear timeline give the reviewer more to test. Keep the original screenshot and the underlying statement.

Does an unfamiliar IP address prove someone else made the transfer?

No. IP data can be shared, dynamic, routed through a VPN, or tied to a compromised device. It becomes more useful when combined with login times, device changes, two-factor events, and records showing where you were.

Are unauthorized credit-card charges always zero liability?

Not under federal law in every case. The general statutory cap is $50, while many issuers offer zero-liability policies with conditions. Report the charge promptly and follow both the issuer's process and the FCBA written-notice procedure.

What if a scammer tricked me into sending the payment?

Tell the bank or platform who entered the payment, what instructions you received, and how the deception occurred. Fraudulent account access can be treated differently from a payment the customer personally approved. The available remedy depends on the facts, provider terms, and payment rail.

Can a cryptocurrency transfer be reversed?

Sometimes a platform or law-enforcement action can stop or recover funds, but an on-chain transfer is often irreversible. Send the hash, addresses, and account records to the platform and report the theft quickly. Don't pay a third party promising guaranteed recovery.

This is general U.S. consumer information, not legal advice. Deadlines, coverage, and remedies can change with the account type, state law, contract, and transaction facts.

Official references

• FTC guidance on using credit cards and disputing charges
• Consumer Financial Protection Bureau's Official Staff Commentary on Regulation E
• IC3 cryptocurrency guidance and reporting information

If you haven't reported the transaction yet, use the institution's official channel today and save the time, representative details, and case number before you end the contact.