">

If a payment was not yours, contact the bank, card issuer, or payment platform that holds the affected account now. Lock the card if you can, use only a phone number on the card or in the official app, and report the exact transaction as unauthorized. Don't wait for a merchant reply, a police report, or the next statement.

For U.S. consumer accounts, the deadline and process depend on the payment method. A credit-card dispute has a different federal procedure from an unauthorized debit-card, ACH, or other electronic bank transfer. A payment you personally approved after being deceived may be treated differently from an account takeover, even when a scam was involved.

Secure the account and make the report

Start by stopping any further activity you can.

A card lock may not stop ACH withdrawals, subscriptions, recurring card charges, wallet payments, or bank transfers. Tell the provider which type of payment you need to stop.

When reporting the transaction, say plainly: "I did not authorize this transaction." Provide the date, amount, merchant description, and transaction or confirmation number. Get a claim number and note the department handling the case.

An unfamiliar merchant name is not always fraud. Statements may use a parent company, payment processor, or a different store name. Check subscriptions and authorized users promptly, but don't let that review delay your report.

Make a record while the details are fresh. Save:

A provider may request a written fraud statement. Give an accurate account of what happened, but don't wait for a police report before notifying the financial institution.

Match the dispute to the payment method

Payment method First action Deadline or urgent point What does not automatically control the claim
Credit-card purchase Report it promptly, then send written notice to the issuer's billing-inquiries address The notice must reach the issuer within 60 days after the first statement showing the error was sent A phone call, app report, or card-network chargeback window does not necessarily replace the Fair Credit Billing Act notice
Debit card, ATM withdrawal, ACH debit, or another qualifying electronic transfer Notify the bank and report an unauthorized electronic fund transfer A lost or stolen access device should normally be reported within two business days; statement errors should be reported within 60 days The two-business-day rule is not a universal deadline for every debit-card fraud report
PayPal, Venmo, or another wallet Report the transaction in the wallet and contact the linked bank or card provider Use the platform's current reporting route and act quickly with the funding source A wallet claim does not automatically preserve rights with the bank or card issuer
Wire transfer Contact the sending bank immediately and ask what action is still possible Speed matters because wires can move quickly Do not assume the credit-card or Regulation E procedures apply
Business account Contact the bank or provider and review the account agreement Act immediately Consumer-account protections may not apply in the same way

The payment rail matters more than the label "fraud." A merchant refund policy may help, but it does not extend a federal dispute deadline. The same is true of a card-network chargeback process.

Unauthorized credit-card charges

For a credit-card charge, reporting the fraud by phone or in the app is sensible, but it may not preserve the full Fair Credit Billing Act, or FCBA, billing-error procedure. To use that process, send a written notice to the issuer's billing-inquiries address, not the address used for payments.

The FTC's credit-card dispute guidance says the written notice must reach the issuer within 60 days after the first statement containing the error was sent to you.

Include:

Keep a copy of the letter and proof that it was delivered. If you recently moved, give the issuer your new address in writing. The FTC notes that the issuer should receive a written address change at least 20 days before the billing period ends.

A short notice can be enough:

Re: Billing error on account ending in
I dispute the $ charge from dated . I did not authorize or participate in this transaction. Please investigate it as a billing error and correct my account. I have enclosed a copy of the statement showing the charge.

While the issuer investigates

Pay the part of the bill you do not dispute. Don't assume a representative's promise to handle the matter changes the written-notice deadline.

For a timely written FCBA dispute, the issuer generally must acknowledge the notice in writing within 30 days unless it has already resolved the matter. It generally must resolve the dispute within two complete billing cycles, and no later than 90 days after receiving the notice.

The disputed amount generally should not be treated as delinquent while the issuer follows the FCBA process and you meet its requirements. If the issuer asks for an affidavit, identification, or a description of where the card was kept, answer by the deadline and keep a copy.

Federal law generally limits liability for unauthorized credit-card use to $50. Many issuers advertise zero-liability policies that go further, but those are issuer or network policies rather than the FCBA deadline itself.

If the issuer denies the claim, request the reason for the decision and the records it can provide about the transaction, such as delivery details, account-login information, or authentication records. A merchant receipt or a record that the account was used does not by itself answer every question about who authorized the payment.

Unauthorized debit-card and ACH transactions

Debit-card purchases, ATM withdrawals, ACH debits, online bank transfers, and other qualifying electronic fund transfers can fall under Regulation E. The rules apply to consumer accounts, not every account or transfer.

Tell the bank you are reporting an unauthorized electronic fund transfer. Give the date, amount, account, and transaction reference. Ask how it wants the report documented and whether the account or debit card should be replaced.

An oral report can start the error-resolution process. The bank may require written confirmation within 10 business days of an oral notice when the regulation's conditions are met. If it requests a form or written statement, return it promptly.

The two deadlines people often confuse

If a debit card or another access device was lost or stolen, reporting the loss within two business days after learning of it generally limits liability to no more than $50. Waiting longer can increase potential liability.

That does not mean every unauthorized debit transaction must be reported within two days. When an unauthorized electronic transfer appears on a periodic statement, report it within 60 days after the statement was sent or made available. A longer delay can expose you to losses from later unauthorized transfers.

Explain the facts rather than trying to fit the event into a label. For example, say whether your physical card was lost, whether only the card number was used, whether your phone or online-banking credentials were compromised, and when you learned about the activity.

Investigation and provisional credit

A bank generally has 10 business days to investigate a reported Regulation E error. For a new account, the initial period can be 20 business days.

If the bank needs more time and uses an extended investigation period, it generally must provide provisional credit for the alleged error if the applicable conditions are met. Some investigations can last up to 45 days, and certain transactions can allow a longer period of up to 90 days.

Provisional credit is temporary, not a final refund. The bank can reverse it after completing the investigation if it finds no error, subject to required notices and procedures. Keep the decision notice. If the bank finds no error, ask for its written explanation and copies of the documents it relied on.

Stop future ACH debits as a separate task

A posted ACH withdrawal and a future recurring withdrawal require different actions.

  1. Report the posted debit to the bank as unauthorized.
  2. Revoke future authorization with the company that initiated the debit, preferably in writing.
  3. Ask the bank whether it can place a stop-payment order or block future ACH debits.
  4. Save the revocation, stop-payment request, and claim number.
  5. Watch the account for additional withdrawals.

Stopping a future payment does not resolve a debit that has already posted. That past transaction still needs its own error report.

Wallet and person-to-person payment disputes

For a payment through PayPal, Venmo, or another digital wallet, report the transaction through the official app or website. Include the transaction ID, amount, date, login alerts, password-change notices, and any evidence that someone accessed the account without permission.

Then notify the funding source:

Platform deadlines can vary by product, payment type, and account history. Check the current instructions in the app or the provider's official help materials rather than relying on a claimed universal deadline.

The facts make a difference. Someone taking over your wallet account and sending money without permission is not the same as a payment you approved after a scammer impersonated a bank, friend, seller, or government agency. Report what actually happened, and keep the description consistent with the wallet and the funding provider.

Never send a password or one-time security code to anyone who calls unexpectedly and says they are investigating the payment.

If the claim is denied

Read the denial notice closely before submitting another report. A denial may turn on a claimed authorization, a missed deadline, insufficient information, the wrong payment category, or a provider record you have not seen.

Take these steps:

  1. Request the decision in writing. Ask why the claim was denied and what transaction records or evidence the institution reviewed.
  2. Check the payment method. Confirm whether the provider treated it as a credit-card billing error, a Regulation E electronic-transfer claim, a wallet dispute, a wire issue, or another process.
  3. Use the provider's appeal process. Follow the deadline in the denial notice and respond to specific factual errors rather than resubmitting the same statement.
  4. Add missing evidence. A timeline, security alerts, account records, or proof that you reported the event promptly may address a gap in the original review.
  5. Escalate when appropriate. A complaint to the Consumer Financial Protection Bureau may help obtain a response from a covered financial company, but it does not guarantee a refund or extend a dispute deadline. If the institution is a national bank, the Office of the Comptroller of the Currency complaint process is another route.
  6. Consider local help for a substantial loss. Depending on the provider and account, a state financial regulator, state attorney general, credit-union regulator, legal-aid office, or consumer attorney may be relevant.

If the incident exposed personal information, consider placing a credit freeze with each major credit bureau and adding a fraud alert. A freeze can restrict new credit applications, but it will not reverse the transaction or stop activity in the affected account.

Errors that can weaken a dispute

Official references

Do this next

Save the statement or transaction screen, contact the provider through an official channel, and write down the claim number. If the charge is on a credit-card statement, send the written billing-error notice to the issuer's billing-inquiries address before the 60-day deadline even if a phone or app fraud claim is already open.