Report an unauthorized transaction as soon as you see it. Call the bank, card issuer, or payment provider through an official channel, then make a written record of the amount, date, merchant or recipient, and what you know.

US rules aren't one-size-fits-all. Credit cards, debit cards, ACH transfers, peer-to-peer payments, and wires can have different legal frameworks, deadlines, and dispute routes. The payment rail matters more than calling something "fraud"; this is general information, not legal advice.

Find the payment rail first

Name the payment method before choosing the dispute label. It usually determines both the deadline and the next step.

Turns out, a card-network chargeback is a process, not automatically a federal consumer right. An issuer may use that network process while the Fair Credit Billing Act or Regulation E supplies the legal framework.

Use the label that matches the facts. A forgotten subscription, duplicate charge, wrong amount, or undelivered item may belong under merchant policy or a billing-error process instead.

Build a record that makes sense

Make the record easy to read. Someone reviewing it should be able to see what appeared, when you noticed it, where you were, whether you still had the card or phone, and what happened afterward.

• Transaction details: Save the statement or account page, transaction ID, amount, date, merchant or recipient, and any displayed location.
• Your timeline: Note when you discovered the transaction, where you were, whether the card or phone was with you, and whether anyone had permission to use the account.
• Supporting records: Keep travel receipts, work records, device-location history, or other material that supports your account. A mismatch helps, but may not decide the claim.
• Security history: Save login alerts, password-change notices, multifactor authentication messages, and screenshots of suspicious activity.
• Communications: Record call dates, case numbers, secure messages, letters, merchant replies, and the institution's final decision.
• Outside records: A police report can support an identity-theft, card-theft, or ATM claim. It does not replace timely notice to the financial institution.

The timeline may feel repetitive. Keep it anyway.

Thing is, no general federal rule requires a notarized affidavit, police report, IP log, or three separate kinds of evidence in every case; the institution may ask for a signed statement, but sign only one that is accurate and don't guess at an IP address or claim someone bypassed multifactor authentication without reliable records.

Some useful records may sit with the institution or merchant. They can include login history, delivery information, an ATM journal, or surveillance. Ask that relevant material be preserved, and ask what can be shared.

An IP address can support your account. It doesn't identify a person by itself.

Report the transaction in a workable order

Secure access before you argue about the transaction. Keep notes while you do it.

1. Secure the account. Lock the card in the banking app if possible, then use the official number on the card or statement. Request a replacement when needed. Change exposed passwords and PINs, sign out of unfamiliar sessions, and save suspicious messages before deleting them.

2. Give prompt notice. State the transaction date, amount, and merchant or recipient. Say plainly, "I did not authorize this transaction." If a card, phone, or other access device was lost or stolen, tell the institution when you learned it was missing.

3. Put it in writing. Follow the institution's instructions after the call. For a credit card, send written billing-error notice to the billing inquiries address on the statement, not the payment address. For a debit or bank-account claim, use the secure-message or written-notice channel the institution provides.

4. Send a focused evidence file. Include the statement page, a short timeline, relevant security alerts, and your communication history. Label files with dates and keep the originals.

5. Watch for more activity. Review the account regularly and report new unauthorized transfers separately. Provisional credit may be reversed, so don't spend money you may later have to repay.

6. Read the decision closely. Ask which facts the institution relied on and whether it treated the matter as an unauthorized transfer, a card-network dispute, or a merchant disagreement. Those categories are not interchangeable.

A neat folder isn't the point. A dated timeline and case number are.

Check the deadlines before they pass

Deadlines differ by payment rail. The familiar two-business-day rule belongs to a specific Regulation E liability rule, not every disputed payment.

Under the Regulation E liability rule, liability generally stays at the lesser of $50 or the unauthorized transfers made before notice when the consumer reports the loss or theft of an access device within two business days. If notice comes later but within 60 days after the statement first shows the alleged transfer, the possible liability can rise under the rule's formula, subject to a $500 ceiling. After 60 days, the consumer can face later transfers that the institution establishes would not have happened with earlier notice.

For this liability rule, the 60-day period runs from the statement that first shows the alleged unauthorized transfer. Report it sooner. Delay can make investigation harder and affect liability.

Regulation E has a separate error-resolution clock. Under the error-resolution rule, a financial institution generally must investigate and determine whether an error occurred within 10 business days of receiving notice. It can use a longer timetable if it provides provisional credit within the required period, and special timelines apply to certain accounts and transactions. Oral notice may start the process, although the institution can request written confirmation.

Don't combine the two 60-day references. The liability rule measures one period from the statement that first shows the alleged transfer, while the error-resolution rule generally requires notice within 60 days after the institution sends the statement on which the alleged error first appears.

Credit cards use the Fair Credit Billing Act, not Regulation E. Written billing-error notice generally must reach the issuer within 60 days after it sends the statement containing the error. The issuer generally acknowledges the notice within 30 days and resolves the dispute within two billing cycles, with a 90-day maximum.

A voluntary zero-liability promise is separate from the statutory process. Check the card agreement for that promise.

Card-network windows can differ from federal deadlines. Don't wait for a network window to expire before reporting the problem.

When the records conflict

An unfamiliar merchant name is a lead, not proof. A company may bill under a parent name or payment processor, so compare the descriptor with your receipts and account history.

A correct PIN, chip read, shipping address, or device record may influence the investigation without answering every question. Not every record settles the issue.

To be honest, a denial needs more than a vague label. Ask whether the institution found authorization, treated the notice as late, placed the transaction outside the applicable rule, or classified it as a merchant disagreement.

Ask whether it reviewed the login history, device data, ATM records, delivery details, or authentication events that matter here. Challenge the conclusion, but don't claim one log proves fraud.

What to do after a denial

Start with a short written reconsideration. Identify the transaction, the date you reported it, the factual mistake, and any new material. Keep it brief; a corrected timeline usually beats emotional language.

For a debit, ATM, ACH, or covered peer-to-peer transfer, ask the bank to review the claim under its error-resolution process. If the institution did not follow the applicable process or will not explain its decision, a complaint to the Consumer Financial Protection Bureau may provide another review channel. It doesn't guarantee a refund.

With a credit card, keep proof of the written billing-error notice and the issuer's response. If the issuer says the notice was incomplete or sent to the wrong address, ask for the required submission method and resend it promptly.

For an ATM claim, request preservation of the terminal journal and available surveillance. For a wire, request an immediate recall through the sending bank and ask it to contact the receiving institution. Recovery isn't guaranteed, especially after funds move through several accounts.

Questions that come up

Is a police report or notarized affidavit always required?

No. Neither document is automatically required for every dispute.

The institution may ask for one, especially in an identity-theft or cash-withdrawal case. Send it when requested, but don't postpone initial notice while waiting for a report.

Can an IP log prove the transaction was unauthorized?

Usually, it's supporting evidence, not a decision by itself. An unfamiliar IP address may show activity that doesn't match your usual access pattern, but it could also reflect a mobile network, shared connection, travel, or a privacy service.

Let the bank or merchant weigh it with the other records.

What if I missed the deadline?

Report the transaction anyway and explain the delay. Potential liability may be higher, but the institution still needs the facts and must apply the rules or policies governing the claim.

What if I approved a transfer after a scam?

If you personally approved the transfer after someone deceived you, the facts may differ from a transfer initiated entirely by another person. Tell the bank exactly what the scammer said and what steps you took.

Don't change the description to fit a preferred dispute category.

Does an investigation guarantee a refund?

No. A provisional credit can be reversed. A 10-business-day initial investigation period for a covered electronic transfer, or a longer credit-card review period, is not a promise of a final refund.

Use the official number on your card or statement today. Write down the case number, then send a same-day summary stating the transaction and what happened.