An unauthorized transaction can sometimes be refunded. Reporting it quickly gives the provider a chance to stop, recall, or investigate the payment, but speed alone does not decide the claim.
The payment method and your role in approving the payment matter most.
This information is for U.S. consumers using personal accounts. It is not legal advice.
Find out who actually moved the money before you report it.
Identify the payment type first
Turns out, the name on a transaction line may not tell you which rules apply. Open the transaction details and look for the card issuer, bank, payment app, transfer company, exchange, or wallet provider behind it.
| Payment type | Contact first | Rule or limitation to understand |
|---|---|---|
| Credit card | Card issuer | A written Fair Credit Billing Act billing-error notice generally must reach the issuer within 60 days after it sent the first statement showing the error. |
| Debit card, ATM withdrawal, or ACH debit | Bank or credit union | Regulation E may set liability limits and investigation duties for qualifying unauthorized electronic fund transfers. Prompt notice matters. |
| PayPal, Venmo, or another payment app | The app, then the linked card issuer or bank | The app's terms and the underlying card or bank funding route can create separate claims. |
| Wire transfer or remittance | Sending bank or transfer company | Request a recall immediately. A normal card dispute or ordinary electronic-transfer process may not fit the transaction. |
| Cryptocurrency | Exchange, wallet provider, and law enforcement | A confirmed blockchain transfer generally cannot be charged back like a card purchase. |
Take these steps today
Secure your email first if you think it was compromised. Someone with inbox access may be able to reset your financial-account password again.
- Protect account access. Lock or replace an exposed card, change financial-account passwords, sign out of unfamiliar sessions, and turn on two-factor authentication. Contact your mobile carrier if a SIM swap is possible.
- Save the transaction record. Capture the amount, date, merchant or recipient, transaction ID, and the date you first noticed the payment. Screenshot pending activity before it changes or disappears.
- Use an official reporting channel. Call the number on the card or statement, or use the provider's official website or signed-in app. Do not call a support number from an unexpected text or email.
- State the facts without guessing. If you did not authorize the payment, say so. Ask for a fraud or error case number and write down the representative's name, date, and promised next step.
- Send written notice when needed. A phone call can stop more activity, but it may not meet a written-notice requirement. Keep copies of letters, forms, uploads, and delivery records.
- Stop the next withdrawal. For a recurring debit, revoke authorization with the merchant when appropriate and ask the bank what stop-payment option applies.
- Monitor the account. Watch for more transactions, evidence requests, provisional credits, and a final decision. Keep paying the undisputed portion of a credit card bill on time.
Separate unauthorized use from a scam or merchant dispute
Providers usually need to answer one question: did another person make the payment, or did you approve it after being deceived?
A stranger using your card number, bank credentials, or account without your permission is usually an unauthorized-use or unauthorized-transfer report. If someone took over your account, report the takeover too. Login alerts, unfamiliar-device records, and account-security changes can help show what happened.
Impostor cases are harder. If you typed a one-time code, gave a scammer a login, or pressed "send" after a convincing lie, tell the provider exactly that, because it may treat the transfer as one you authorized even though the deception and pressure were real.
Don't call a normal refund disagreement fraud. A defective item, a missing delivery, a wrong amount, or a purchase you no longer want may be a merchant dispute or billing error instead. The FTC's guidance on unordered products and billing errors covers some of those situations.
Credit card charges: use the written billing dispute process
Call the issuer promptly, then send a written billing-error notice. The FTC's credit card dispute guidance says the issuer should receive the letter within 60 days after sending the first statement that showed the error.
Use the billing-inquiries address on the statement. It may not be the same as the payment address.
Include the card account ending, transaction date, merchant, amount, and the charge you are challenging. State that you did not authorize it and ask the issuer to treat the letter as a billing-error notice under the Fair Credit Billing Act. Keep a copy and use a delivery method that leaves a record.
An address change can matter here. To receive the full protections of this process, the issuer must have received your written change of address at least 20 days before the billing period ends.
The issuer generally must acknowledge a written complaint within 30 days, unless it resolves the matter sooner. It must resolve the dispute within two billing cycles and no later than 90 days after receiving the notice.
During the investigation, you generally do not have to pay the disputed amount or related finance charges. Pay the undisputed balance by its due date.
Federal law generally limits liability for unauthorized credit card use to $50. Issuer and card-network zero-liability policies may provide broader coverage, but those are company policies with their own conditions.
Debit cards and ACH transfers have different deadlines
Debit purchases, ATM withdrawals, and many ACH debits can fall under Regulation E. Notice timing can affect the amount of loss you may bear.
| When you notify the bank | General liability rule for a qualifying unauthorized electronic transfer |
|---|---|
| Within two business days after learning that a card or other access device was lost or stolen | Liability is generally limited to $50. |
| More than two business days later, but within 60 days after the statement showing the error was sent | Liability can be as high as $500. |
| More than 60 days after the statement was sent | You may risk additional losses that occur before you notify the bank. |
These are general statutory limits, not automatic refund amounts. They do not necessarily cover every scam, wire transfer, business account, or payment you personally approved.
Notify the bank or credit union as soon as you spot the transaction. Ask how it wants written notice and whether it requires a signed statement or affidavit.
For a qualifying error, a bank that cannot finish its investigation within 10 business days generally must provide provisional credit. It can complete the investigation over as many as 45 calendar days, although some new-account and international cases have different time frames. That credit is temporary and may be reversed with required notice if the bank finds no error.
For a recurring ACH debit, contact both the merchant and the bank. Save confirmation that you revoked authorization or requested a stop payment.
PayPal, Venmo, and other payment apps
Open a case through the app's signed-in support or dispute process. Explain whether the account was taken over, the payment was made without permission, or you were tricked into sending it.
Thing is, the app's case and the linked bank or card claim may run on separate tracks. If the payment drew funds from a linked account, notify that bank or card issuer too. Give both companies the same factual timeline and disclose any credit issued by the other one.
Attach the transaction record, messages, login alerts, and any notice from the linked bank or card provider. App deadlines usually come from the provider's own terms and can vary by payment type, so open the case quickly and save the confirmation screen.
A completed payment can be difficult to reverse, especially if you approved it yourself. Ask the provider to attempt a reversal or contact the recipient's provider. Never pay a supposed support agent to release a refund.
Wire transfers and remittances
Call the sending bank or transfer company immediately. Ask for a fraud review and a recall.
Have the recipient details, amount, date, confirmation number, and scam messages ready. A recall is only a request, not a guaranteed refund, and it may work only while funds remain available at the receiving institution.
Report substantial losses, identity theft, or related fraud to local law enforcement. Keep the report number with your bank case records.
Cryptocurrency usually has no chargeback path
A confirmed blockchain transaction normally cannot be reversed the way a card transaction can. An exchange may be able to freeze an account or help an investigation if the funds remain on its platform, but no refund is guaranteed.
Use the exchange's or wallet provider's official support channel. Change credentials, remove unfamiliar devices or API access, and preserve the transaction hash, wallet addresses, amount, date, platform records, and communications.
For online cryptocurrency fraud, file a report through the FBI's Internet Crime Complaint Center cryptocurrency guidance. An IC3 complaint can support law-enforcement work, but filing one does not itself return the funds.
Be wary of recovery offers. The FBI's cryptocurrency investment fraud guidance warns that a supposed recovery service can become a second scam, especially when it demands an upfront payment.
Build evidence that answers the provider's questions
A clear, dated timeline often helps more than a large folder of screenshots. Keep the original files, send readable copies, and redact unnecessary full account numbers. Never send passwords.
| Keep | Details to preserve |
|---|---|
| Transaction proof | The statement or app screen, amount, date, merchant or recipient, and transaction reference. |
| Account-security records | Fraud alerts, login notices, device history, location information, and account-security changes. |
| Scam or merchant communications | Emails, texts, chat logs, invoices, phone numbers, and website addresses connected to the payment. |
| Your reporting record | When you noticed the transaction, when you reported it, case numbers, representative names, letters, uploads, and delivery confirmations. |
| Outside reports | A police report number or IC3 confirmation number, when one applies. |
Explain both what you recognize and what you do not. If a card was used in another state while you were at work, say that and attach support for the timing. Do not alter screenshots or exaggerate the facts.
If the provider denies the claim
Read the written denial closely. Its stated reason tells you what evidence or explanation the provider believes is missing.
| Denial or problem | Useful response |
|---|---|
| "The transaction was authorized." | Explain who had access, whether you approved that specific payment, and what account-takeover evidence you have. |
| "The device or PIN was used." | State whether the device, card, or PIN was stolen or exposed. Device or PIN use is evidence, but it does not by itself answer who authorized the payment. |
| "You reported it too late." | Provide the statement date, the date you discovered the transaction, and records of your calls or letters. |
| "The evidence is insufficient." | Ask which document or fact is missing, then send a concise supplement. |
| Provisional credit was reversed. | Request the final written explanation and, where applicable, the documents the provider relied on. Check any appeal deadline. |
After asking the bank or card issuer to correct the issue, you can consider a complaint to the Consumer Financial Protection Bureau. A CFPB complaint may prompt a formal company response, but it does not guarantee a refund or replace the original dispute notice.
Keep IC3 and police reports available if investigators contact you. For a large loss, review the account agreement, including arbitration terms, and consider local court options before filing suit.
How long can the refund take?
There is no single refund deadline.
A credit card issuer generally has 30 days to acknowledge a written billing-error notice and up to two billing cycles, but no more than 90 days, to resolve it.
For a qualifying Regulation E error, a bank generally investigates within 10 business days or provides provisional credit while completing an investigation that may take up to 45 calendar days, subject to exceptions. Payment apps use their own review process.
Crypto cases can stay unresolved because the transfer may be irreversible. A pending status or provisional credit is not a final refund.
FAQ
Can I dispute a credit card charge after 60 days?
You should still contact the issuer. The Fair Credit Billing Act's written-dispute protection is tied to the 60-day period after the first statement showing the error was sent, so a late notice can make the legal process harder.
Do I need a police report to get a refund?
Not for every claim. A report can support an identity-theft, account-takeover, wire, or cryptocurrency case, but it does not replace prompt notice to the bank, issuer, or platform.
What if I authorized a payment after a scammer tricked me?
Report it honestly and request a recall or reversal. The provider may handle it differently from a transfer made entirely by an intruder, so recovery is less certain.
Should I dispute the same transaction with more than one provider?
Notify every provider involved, particularly when an app used a card or bank account for funding. Do not seek duplicate reimbursement, and tell each provider about any credit or settlement.
Open the transaction details now. Note the first statement date, report the loss through the official app or phone number, and save the case number before moving on.