If a transaction isn't yours, contact the bank, credit union, card issuer, or payment service that handled it today. Then send the dispute in writing when the applicable rule requires it.

The correct deadline depends on how the money moved. Credit card billing errors, debit and ACH transfers, wires, and crypto withdrawals don't share one refund process.

This guidance is for U.S. consumers. A scam you personally approved can be treated differently from a transfer a thief initiated, although you should report either event promptly.

First, identify how the money moved

Your next step depends on the payment rail. That label matters.

Turns out, an unfamiliar merchant name isn't proof of fraud. Check the receipt, recurring payments, and whether another authorized user accessed the account before describing the charge.

A purchase you made but never received is a different problem from an unauthorized charge. It may still qualify as a credit card billing error, depending on the facts; the FTC's guidance on disputing credit and debit card charges lists examples such as non-delivery, overcharges, returns, and purchases you didn't make.

Your first hour

Move fast, but keep your description accurate. A useful report says what happened, what you did not do, and when you first noticed it.

1. Save the record before calling. Capture the statement or app screen showing the date, amount, merchant or recipient, and transaction ID. Keep original emails, texts, and security alerts.

2. Use a trusted contact channel. Call the number on the back of the card, on a paper statement, or inside the official app. Don't use a phone number from a suspicious text or email. Ask for a case number.

3. Protect account access. Ask whether the card, account, or online profile should be frozen or replaced. Change compromised passwords from a clean device, sign out other sessions, and turn on multifactor authentication.

4. Stop future debits. Cancel an unfamiliar automatic payment in the payment app. For recurring ACH debits, revoke authorization with the merchant and ask the bank about a stop-payment order. A stop-payment request generally affects future transfers, not one that already posted.

5. Notify connected providers. If PayPal used your debit card or bank account, report the activity to PayPal and the funding institution. Tell each provider that you notified the other one.

6. Write down the timeline. Record the last transaction you recognize, when you discovered the problem, every call, each case number, and any promised follow-up.

To be honest, the boring details help. Keep the dates. Keep the screenshots. They give the investigator something concrete to check.

Deadlines that can change the outcome

The clocks are not interchangeable.

Regulation E and electronic fund transfers

Regulation E generally covers electronic fund transfers from consumer accounts, including many debit card, ATM, ACH, and online banking transactions. Report the error to the bank or credit union as soon as you discover it.

A statement-based deadline also matters. You generally must notify the institution within 60 days after the statement showing the error was sent to you. Waiting can expose you to losses from later transfers.

The well-known two-day rule applies mainly when a lost or stolen access device is involved. If you notify the institution within two business days after learning of the loss or theft, liability can generally be capped at $50. After that, but within 60 days after the statement, potential liability can rise to $500. After 60 days, liability for later transfers can become much higher if the institution can show that the delay caused additional loss.

Those are legal limits, not a promise of a $0 loss in every situation. Some banks offer stronger voluntary protections.

A bank generally has 10 business days to investigate an electronic-transfer error. If it needs more time, it generally must provide provisional credit within that period and may take up to 45 days to complete the investigation. Some new-account, point-of-sale, and foreign transactions can qualify for longer periods. If you reported by phone, the bank may ask for written confirmation within 10 business days.

Provisional credit is temporary. The bank can reverse it after following the required notice procedures if it concludes that no error occurred.

FCBA credit card billing errors

Credit card rules use a different process. The Fair Credit Billing Act generally requires a written notice to the issuer within 60 days after the first statement containing the error was sent.

Send the notice to the billing-inquiries address on the statement, not automatically to the address used for payments. Calling first is sensible, but a phone call alone may not preserve the formal written-dispute process. The FTC's credit card dispute guidance explains the notice and investigation steps.

The issuer generally must acknowledge the complaint within 30 days unless it has already corrected the account. It must resolve the dispute within two complete billing cycles, and no later than 90 days after receiving the notice.

Pay the undisputed part of the balance while the review is pending. Don't ignore the next statement.

Federal law generally limits liability for unauthorized credit card use to $50, subject to the facts. Many issuers provide $0 liability under their own policies, but check the card agreement rather than assuming every situation receives that treatment.

A chargeback isn't every kind of refund

"Chargeback" usually describes a card-network dispute. It doesn't replace a Regulation E error notice for a bank transfer, and it isn't the same as a wire recall or a payment-app investigation.

Use the reason that matches the event. Calling an authorized purchase "unauthorized" can create problems later.

Put the dispute in writing

A clear notice should identify one transaction or a short group of related transactions. State the facts plainly, without guessing how the thief got access.

The FTC provides a sample letter for disputing credit and debit card charges. Adapt the following versions, attach copies, and keep the originals.

Bank, debit card, ACH, or ATM notice

Use the sentence about not authorizing the transfer only if it is true. A person tricked into pressing "send" should describe that event honestly instead.

[Your name]
[Your address]
[Date]

[Bank or credit union]
Re: Notice of an unauthorized electronic fund transfer, account ending [last four digits]

I dispute this transaction: [date], [amount], [merchant or recipient], transaction ID [number]. I first noticed it on [date].

[If accurate: I did not make, authorize, or benefit from this transfer.]

I reported the issue by [phone, app, or secure message] on [date] under case number [number]. Please investigate the alleged error, protect the account from additional unauthorized transfers, correct the account if an error occurred, and send the result in writing.

Please tell me whether provisional credit applies and what additional written confirmation you need. If you deny the claim, please explain the basis for the decision and identify the documents relied on.

Enclosures: [statement page, screenshots, messages, report, or other records]

[Your signature]
[Phone number and email]

Credit card billing-error notice

[Your name]
[Your address]
[Date]

[Card issuer]
Re: Billing error on account ending [last four digits]

I am writing to dispute a billing error on my credit card account. The charge is [amount], posted on [date], and identified as [merchant and transaction ID].

I did not make or authorize this charge. [If the issue is a merchant problem instead, describe the non-delivery, incorrect amount, return, or other billing error accurately.]

Please investigate and correct the account. Please send me a written explanation of the result. I will continue paying the portion of the balance that is not disputed.

Enclosures: [statement page, receipt, cancellation record, correspondence, or other records]

[Your signature]
[Phone number and email]

For a credit card, send the letter so it reaches the issuer within the 60-day period. Use the billing-inquiries address, and keep proof of delivery when possible.

Reporting PayPal, Venmo, and Zelle activity

Apps add another layer, but the funding source still matters. Report the activity inside the app and notify the bank or card issuer that supplied the money when appropriate.

PayPal

Open the transaction in PayPal's Resolution Center, choose the option to report a problem, and select unauthorized activity. The PayPal instructions for reporting unauthorized transactions show the current path.

PayPal notes that some unfamiliar activity comes from automatic payments or another person with account access. Check those possibilities, cancel a recurring payment if needed, and save the case confirmation. PayPal's help page says it sends an email after the report, so watch the account email and Resolution Center.

If the PayPal transaction drew money from your bank account or debit card, report the underlying transfer to that institution too. Don't submit contradictory explanations.

Venmo

Use Venmo's current in-app support or official website to report unauthorized account activity. Explain whether someone accessed your account, whether you shared access, or whether you were persuaded to send the payment.

Notify the bank or card that funded the payment. Change the Venmo password and the password for the connected email account, then review logged-in devices and recurring payments.

Zelle

Start with the bank or credit union used to enroll in Zelle. The bank, rather than a merchant-style card dispute process, usually handles the account review and any available recall process.

Thing is, a thief who entered your account and sent money is different from a consumer who knowingly pressed send after an impostor's instructions. Report both situations, but describe the difference clearly. The bank may analyze an account takeover under electronic-transfer rules while handling an authorized scam under different rules or policies.

Ask whether the payment can be recalled, but don't promise yourself a refund. Speed matters.

Wires and crypto need different handling

Wire transfers move quickly. Call the sending bank's wire or fraud department immediately and request a recall, freeze, or other available recovery action. Give the exact amount, date, recipient details, and reference number.

Ordinary wires often follow different rules from debit and ACH transfers. Don't assume the 60-day Regulation E deadline protects a wire. If an online-account takeover caused the wire, ask the bank which consumer-transfer rules and complaint process apply.

For a crypto withdrawal, contact the exchange or wallet provider through its official website. Provide the transaction hash, destination address, time, account email, and security alerts. Secure the exchange account and connected email before doing anything else.

A blockchain transfer may be difficult to reverse. The exchange's terms and the cause of the compromise will matter. If a debit card or ACH transfer used to buy crypto was itself unauthorized, dispute that funding transaction separately. An authorized crypto purchase followed by a scam isn't automatically an unauthorized card charge.

If the bank or issuer denies the claim

A denial should state the reason. Read it closely.

1. Request a final written explanation. Ask what evidence the institution relied on and whether it will conduct a second review. Correct factual errors, such as the last date you used the account or whether you shared a device.

2. File a CFPB complaint when appropriate. The CFPB complaint portal accepts complaints about many bank, credit card, money-transfer, and payment services. Attach a short timeline, your written dispute, the denial, and relevant records.

3. Find the right regulator if needed. The USAGov guide to bank, credit, and securities complaints explains how to start with the institution and identify an appropriate complaint route.

4. Report the underlying scam or identity theft separately. A police report or FTC report can document the event, especially for account takeover or impersonation. It doesn't replace the bank or issuer dispute and doesn't guarantee reimbursement.

A CFPB complaint can prompt a company response, but it doesn't reset a legal deadline or decide a private claim. Keep paying undisputed credit card amounts while the complaint is pending.

Mistakes that weaken an unauthorized-transaction complaint

Questions consumers often ask

How long do I have to report an unauthorized debit?

Report it immediately. For Regulation E transactions, the 60-day statement deadline matters, and lost or stolen access devices create an additional two-business-day liability rule. Waiting can increase exposure to later transfers.

Do I need a police report before disputing the transaction?

Usually, no. Notify the bank or issuer first. A police report may support the record, but institutions can also request their own written statement or affidavit.

Can I get money back from a Zelle scam?

It depends on whether the payment was sent by a thief or knowingly sent by you after deception, along with the bank's review and applicable policy. Report it to the enrolling bank immediately and request a recall.

Can I dispute a credit card purchase I actually made?

Possibly, but not as an unauthorized-use claim. Non-delivery, an incorrect amount, or a return problem may fit a billing-error category. Contacting the seller can help, but don't let that conversation push you past the card issuer's 60-day written-notice deadline.

What if the bank says my device was authenticated?

Authentication is one fact, not a complete explanation. Tell the bank whether you controlled the device, whether anyone had access, whether you approved the transfer, and when you noticed it. Ask for the specific basis of the decision rather than guessing at technical details.

Make the next call

Open the statement now and record the transaction date, amount, first-discovered date, and case number. Call through the official app or the number on the card, then send the correct written notice today.