Report the transaction immediately to the bank, card issuer, or payment platform that processed it. Secure your account access at the same time, then protect the deadline that applies to the payment method.
Credit cards generally use Regulation Z and the Fair Credit Billing Act (FCBA). Debit cards, ATM withdrawals, ACH debits, and many online bank transfers may fall under Regulation E.
PayPal and Venmo add their own procedures. Crypto transfers are different and often irreversible.
Turns out, "unauthorized" does not mean every bad purchase. If you personally approved a payment after a scammer persuaded you, the bank or platform may classify it as authorized. Report it anyway, but expect a different review.
Start by following the money
The payment route controls the first deadline and the evidence that matters.
| Payment route | Main framework or policy | First action |
|---|---|---|
| Credit card purchase | FCBA and Regulation Z | Send written notice to the issuer's billing-inquiries address within 60 days of the statement containing the error. |
| Debit card or ATM withdrawal | Regulation E for a covered consumer account | Report it immediately. The two-business-day rule can affect liability when a card or access device was lost or stolen. |
| ACH debit or online bank transfer | Regulation E in many consumer-account situations | Notify the bank quickly and ask whether it needs written confirmation. |
| PayPal or Venmo payment | Platform rules plus the linked credit or bank account's protections | Use the platform's reporting flow and notify the linked issuer when money left that account. |
| Crypto transfer | Exchange terms, account-security facts, and the funding rail | Open an exchange security case immediately. There is no automatic refund rule for every crypto loss. |
| Traditional wire | Bank agreement and separate wire-transfer rules | Call the bank's wire or fraud department and request a recall without delay. |
The Federal Reserve's official Regulation E commentary provides regulatory background. Company policies can offer more protection than federal law.
Do these things before arguing about the charge
Do these steps in order. A phone call creates a case record, but it does not replace every written notice requirement.
- Save the transaction details. Record the amount, date, time, merchant or recipient descriptor, transaction ID, and whether the item is pending or posted. Take screenshots if they are available.
- Call a known phone number. Use the number on the card, statement, or official app. Say, "I am reporting a transaction I did not authorize." Ask for a claim number.
- Block further access. Freeze or replace the card. For debit and ACH fraud, ask whether the bank recommends a new account number or additional restrictions.
- Secure connected accounts. Change your bank, email, and payment-app passwords. Sign out other sessions, turn on multifactor authentication, and contact your mobile carrier if a SIM swap may be involved.
- Notify the platform. Report the activity to PayPal, Venmo, or the exchange. If the payment used a credit card or bank account, notify that issuer too.
- Create a record. Write down the call time, representative's name, promised documents, and next deadline. Continue monitoring the account.
The FTC's guidance for lost or stolen cards also recommends prompt reporting, account monitoring, and multifactor authentication. Don't wait for a police report before making the fraud report.
"Unauthorized" is not the same as "unfair"
Use accurate words in your claim. The bank will usually sort the issue into a fraud claim, a billing error, a cancellation issue, or a merchant dispute.
| What happened | Process to start |
|---|---|
| You did not make or permit the charge or transfer | Report unauthorized activity to the issuer or platform. |
| You recognize the merchant but the amount is wrong or duplicated | Use a billing or account-error process and contact the merchant if useful. |
| You authorized a recurring debit but now want future payments stopped | Cancel with the merchant and ask the bank about a stop-payment order. A stop payment does not automatically resolve a debit already posted. |
| You pressed send after a scammer persuaded you | Report the scam and ask for a fraud review. The authorization question may be harder. |
| A family member or roommate used the account with permission | The transaction may not qualify as unauthorized. The facts and account agreement matter. |
Don't call a recognized purchase account takeover just to improve your odds. A clear timeline is more useful than an exaggerated description.
Credit card charges: use the FCBA written-dispute process
Credit card fraud disputes normally go to the issuer, not only the merchant. An unauthorized charge can be treated as a billing error under the FCBA.
Find the address on the statement marked for billing inquiries or billing-error disputes. Send a written notice that identifies the account by its last four digits, the amount, the date, the merchant, and why you did not authorize the charge. The notice must reach the issuer within 60 days after the first statement containing the error was sent.
The FTC's guidance on disputing credit card charges includes a sample letter. Keep a copy and use trackable delivery.
A phone or app report can freeze the card and start an internal claim. Written notice is still the safer way to preserve the FCBA process.
| Stage | What generally happens |
|---|---|
| Issuer receives your written notice | The issuer must acknowledge it in writing within 30 days, unless it has already resolved the problem. |
| Investigation | The issuer must resolve the dispute within two complete billing cycles, and no later than 90 days after receiving the notice. |
| Payment while pending | Pay the balance that is not in dispute by its due date. Follow the issuer's instructions for the disputed amount. |
Federal credit card liability is not automatically zero in every situation. If a physical card was lost or stolen, federal law generally caps unauthorized-use liability at $50 when the applicable conditions are met. If only the account number was stolen while you kept the card, federal protection is generally stronger. Many issuers also provide zero-liability policies, but those are company terms rather than a universal FCBA promise.
Debit card, ATM, ACH, and online bank transfers
Regulation E is the main federal framework for many unauthorized electronic fund transfers from consumer accounts. It generally does not govern credit card transactions, and business-account rules can differ.
The two-business-day rule matters most when you learn that a debit card or other access device was lost or stolen.
| When you act | Why it matters |
|---|---|
| Within two business days after learning the card or access device was lost or stolen | Liability is generally limited to the lesser of $50 or the unauthorized transfers made before notice. |
| After two business days but within 60 days after the statement was sent | Potential liability can rise, sometimes to $500, depending on the transfers and delay. Reporting within 60 days helps protect against later transfers. |
| Within 10 business days after the bank receives notice | The bank generally must investigate or use the longer-investigation procedure. |
| Longer investigation | The bank generally must provide provisional credit when required and finish within 45 calendar days. Certain transactions and some new accounts can have longer periods. |
Two business days is not a safe waiting period for every debit claim. Report the transfer the same day you find it.
If the bank cannot finish its investigation within the initial period, Regulation E generally requires provisional credit for the alleged error, subject to the rule's conditions. The bank can require written confirmation after an oral report. If it later finds no error, it may remove the provisional credit after sending the required notice.
For an unauthorized ACH debit, tell the bank that an electronic fund transfer left your consumer account without authorization. Ask whether it can request an ACH return and whether future debits need a stop-payment order. ACH network deadlines are separate from Regulation E, so prompt action matters.
Credit unions are not outside these protections. For a covered consumer account, ask for the credit union's Regulation E or credit-card dispute process and its correct mailing address.
PayPal, Venmo, and person-to-person payments
Platform reports are not a substitute for notifying the bank or card issuer that funded the payment. Report through both channels when appropriate, and describe the same facts accurately.
| Service | What to do |
|---|---|
| PayPal | Use PayPal's unauthorized-activity instructions. Save the case number and follow any investigation messages. |
| Venmo | Report the activity at once through Venmo and keep the statement showing the transfer. See Venmo's filing timeframes. |
Venmo separates unauthorized activity from purchase problems. Its published 180-day period applies to issues such as an item not received or not as described, while a 60-day period applies to other errors. Those periods are not a safe deadline for an unauthorized-activity report.
PayPal's help process directs users to report unauthorized account activity and says PayPal will investigate. Follow the deadline and instructions shown in your account rather than borrowing a deadline from another type of PayPal dispute.
If a scammer convinced you to send the payment yourself, the platform may treat it as authorized. Still report it immediately, preserve the messages, and ask whether the platform or funding issuer offers a separate fraud or scam review. If one company refunds you, tell the other company so you do not receive duplicate recovery.
Crypto theft and bank wires need separate handling
Crypto assets do not automatically receive FCBA or Regulation E protection because a bank account funded the purchase. The underlying card or bank transaction may have its own dispute rights, while the blockchain transfer and exchange account follow different rules.
For an exchange account takeover, open a security case immediately. Request a withdrawal freeze, reset the exchange and email passwords, end unfamiliar sessions, remove unknown API keys, and save the transaction hash and destination wallet address.
Thing is, a blockchain transfer that you personally approved generally cannot be reversed by the network. An exchange may have a recovery policy, but there is no fixed percentage that every U.S. consumer is guaranteed to recover. Never send a seed phrase, recovery phrase, password, or one-time code to supposed support staff.
A traditional wire often follows different rules from an electronic fund transfer covered by Regulation E. Call the bank's wire desk, request a recall or freeze, and provide the amount, date, beneficiary, and wire trace information. If stolen credentials initiated the wire, say so; if you approved it after a scam, describe that fact instead.
Build an evidence file that answers the bank's questions
Good evidence answers three questions: what happened, why you did not authorize it, and when you reported it.
| Evidence | What it can show |
|---|---|
| Statement and transaction screenshot | The exact amount, date, descriptor, and account involved. |
| Personal timeline | Your last legitimate use, when you noticed the transaction, and when you contacted the company. |
| Security records | Card possession, login alerts, password changes, multifactor prompts, or a suspected device compromise. |
| Messages and emails | What a merchant, scammer, or platform said, including requests for codes or payment. |
| Police or identity-theft report | A supporting record when someone stole your identity or device. It is not a universal substitute for the bank's investigation. |
| Call records and claim numbers | Proof of notice and the company's responses. |
Ask the institution to review login, device, and transaction records. You may not receive every security detail, but you can request the documents relied on for a denial.
A police report can help. It is not always required to open a dispute.
Keep original files and avoid sending irrelevant material. Never share login credentials, one-time passcodes, or crypto recovery phrases.
Copy-and-edit dispute templates
Use the credit card template for the issuer's billing-inquiries address. Use only the last four digits unless the company requests more through a secure channel.
Credit card written notice:
[Your name]
[Your address]
[Date]
[Issuer name]
Billing Inquiries
[Address shown on the statement]
Re: Billing error, account ending in 1234
I dispute a charge of $[amount] posted on [date] from [merchant]. I did not make or authorize this transaction. Please treat this letter as a billing-error notice under the Fair Credit Billing Act and investigate it.
Please send your written results and credit any amount found to be unauthorized. Enclosed are [statement page, screenshots, timeline, and other evidence].
I will pay the portion of the balance that is not in dispute by its due date.
Sincerely,
[Your name]Debit card or ACH secure-message script:
Subject: Unauthorized electronic fund transfer, account ending in 1234
I am reporting an unauthorized electronic fund transfer under Regulation E. The transaction was $[amount] on [date], described as [descriptor or recipient]. I did not authorize this transfer.
Please confirm the claim number and tell me whether you need written confirmation or additional documents. If the investigation will take longer than the initial investigation period, please explain how provisional credit will be handled.
Attached are [statement page, screenshot, timeline, and other evidence].Customize every sentence. Do not sign an affidavit that says something you cannot truthfully support.
If the bank denies the claim
A denial is a decision, not proof that the transaction was authorized. To be honest, a short chronology often helps more than an angry letter.
- Ask for the denial in writing, the exact reason, and the documents or records used to reach it.
- Compare the reason with your facts. Correct errors about the date, device, card possession, PIN, recurring payment, or timing of your report.
- Send a focused appeal with the timeline and new evidence. If this is a credit card claim, confirm that your written notice went to the billing-inquiries address.
- File a complaint with the CFPB when a bank or card issuer mishandled the investigation, missed a required response, or failed to explain its decision. A complaint can create a documented escalation, but it does not guarantee a refund or decide the claim like a court.
- Consider the institution's regulator, a consumer legal-aid service, or small claims court if the amount justifies further action.
Keep paying amounts that are not in dispute. After a final denial, review the account's due date and payment instructions while you decide whether to continue the appeal.
Common questions
Does the two-business-day rule apply to every debit fraud claim?
No. It mainly affects liability after a lost or stolen debit card or access device. Report every unauthorized debit immediately, even if the card is still in your possession.
Can I dispute a payment with both PayPal and my bank?
Yes, when the bank account or card funded the payment. Tell both companies about the other claim and report the facts consistently.
Will provisional credit stay in my account?
Not necessarily. If the bank completes its review and finds no error, it can generally reverse provisional credit after giving the required notice.
What if the charge is still pending?
Report it and secure the account now. The issuer may require the transaction to post before opening a formal billing-error claim, but early notice can help prevent additional activity.
Do I need a police report?
Usually, you should not wait for one before reporting the transaction. Provide it if relevant, and ask what other evidence the institution will accept.
Start with the transaction itself: save the statement detail, call the known fraud number, and record the exact time you reported it. If a credit card is involved, send the written notice to the billing-inquiries address before the 60-day deadline.