When money leaves your account through identity theft, the first call should go to the company that handled the transaction. That may be the card issuer, bank, PayPal, or another payment provider. Ask it to stop further activity and open a fraud or unauthorized-transaction case. Then create a written record, file an FTC report, freeze your credit, and deal with any tax issue through the IRS.

The FTC report can support your paperwork and produce a recovery plan, but it doesn't issue a refund. The payment rail controls the deadline, the investigation, and the evidence you need. A 60-day credit-card billing deadline isn't universal for every payment app. Likewise, a bank's 10-business-day investigation rule doesn't mean every case will be refunded in 10 days.

The payment method sets the refund rules

Stop more losses before you sort out the paperwork

Call the number on the back of the card, the bank statement, or the official app. Skip any number that arrives in a text, email, or social-media message about the problem.

Ask the company to block the card or account access, stop pending transactions where possible, reset credentials and external-transfer permissions, and replace the card or move funds if the account itself was exposed. Get a case number and ask where written proof should go. A street address, secure upload path, or fax line may matter later.

Change passwords from a device you trust. Start with your email. If a thief controls your email, they can reset bank and payment-app passwords, read alerts, and hide messages. Turn on multifactor authentication, use unique passwords, and check recovery addresses, phone numbers, forwarding rules, and active sessions.

Keep screenshots, texts, call records, and transaction alerts. Don't delete them. They can show when the takeover began and when you reported it.

Name the problem before you file

Don't call every issue identity theft or an unauthorized charge. The bank or platform will classify the claim, and the label changes the route.

A truly unauthorized transaction means you didn't make or approve it. A thief used your card number, or someone moved money after taking over your account.

A merchant billing problem means you authorized the purchase but got charged twice, charged the wrong amount, or didn't receive the item. That's usually a billing-error or merchant dispute.

An authorized scam payment means you sent the money because someone impersonated a bank, government agency, employer, or relative. Report it and ask for a recall, but don't assume it receives the same treatment as a transaction you never approved.

When you report it, state exactly what you did and didn't authorize. If you approved a payment while being deceived, say that. If your login credentials were stolen, say that too.

Unauthorized credit-card charges

Call the issuer right away, then send a written billing-error dispute. The FTC's credit-card dispute guidance explains the written process.

Send the letter to the billing-dispute address on your statement, not the payment address. It must reach the issuer within 60 days after the first statement showing the error was sent to you. Keep a copy and proof of delivery.

Include:

• Your name and account number, or only the permitted portion of the number.
• The merchant, transaction date, amount, and statement date.
• A clear statement that you didn't authorize the charge.
• The date you discovered the transaction and when you notified the issuer.
• Copies of relevant statements, alerts, an FTC or police report, and other evidence.

If you didn't receive the bill because the issuer had an old address, include proof of a written change of address. For the billing-error route, the issuer may need to have received that written notice at least 20 days before the billing period ended.

Under the federal billing-error process:

• The issuer generally must acknowledge the dispute in writing within 30 days, unless it has already resolved the problem.
• It generally must complete the investigation within two billing cycles, and no later than 90 days after receiving the dispute.
• If you followed the written process, you generally don't have to pay the disputed amount or related finance charges while the investigation is pending.
• You still need to pay the undisputed portion of the bill on time.

Federal liability limits and issuer zero-liability policies may help, but they don't make every claim automatic. The result can depend on whether the physical card was lost, when you reported, what evidence exists, and the issuer's policy.

The 10-business-day and 45-day timelines used for bank transfers don't create a universal 10-to-45-day credit-card refund promise.

Debit cards and bank transfers

Debit-card purchases, many ACH transactions, and other electronic fund transfers may fall under Regulation E. Report them as soon as you notice them. Don't sit on the 60-day statement deadline.

Tell the bank:

1. Which transactions are unauthorized.
2. When you first noticed them.
3. Why you didn't make or approve them.
4. Whether your card, PIN, phone, email, or online-banking credentials were stolen.
5. What you want the bank to block, replace, or investigate.

A bank generally has 10 business days after receiving notice of an electronic-transfer error to investigate. If it needs more time, it generally must provide provisional credit while continuing the investigation, subject to exceptions. Many ordinary investigations can take up to 45 days, but some transaction types or account situations have different periods.

Provisional credit isn't necessarily final. The bank may reverse it if the final decision goes against you. It should give you a written decision and explain the result. Save that notice and read it carefully.

For liability involving a lost or stolen debit card or access device, earlier notice is safer. The 60-day period runs from the date the statement showing the transfer was sent.

Paper checks, wire transfers, and some remittances follow different procedures. Contact the bank's check-fraud or wire-fraud department immediately and ask whether a stop payment or recall is possible.

If an impersonator tricked you into approving the transfer, still report it. Ask for a recall and submit the messages and payment instructions, but don't assume the bank must treat it as an unauthorized electronic transfer.

File the FTC identity-theft report

Report the incident through IdentityTheft.gov. It creates an FTC Identity Theft Report and a recovery plan.

List the affected accounts, dates, exposed information, and companies you've already contacted. Save or print the report. Banks, creditors, debt collectors, and credit bureaus may ask for it.

The report can strengthen a refund or account-correction request, but the FTC doesn't investigate every individual bank dispute or order a private company to pay you back. You still have to meet the payment provider's notice rules.

A police report may also help if a bank, creditor, insurer, or government agency asks for one. Give police a concise timeline and copies of relevant evidence. Keep your originals unless they need them.

Freeze your credit and remove fraudulent accounts

Freeze your credit with Equifax, Experian, and TransUnion separately. A freeze can stop new accounts, but it won't reverse an existing charge or protect a bank account that has already been compromised.

You can also place a fraud alert. Starting one with one bureau generally leads that bureau to notify the other two. A fraud alert asks businesses to take extra steps before opening credit, but it doesn't block access the way a freeze does.

Check all three reports for credit cards or loans you didn't open, hard inquiries you don't recognize, new addresses or employers, collection accounts tied to fraudulent accounts, and items that belong to someone else because of a mixed file.

Dispute each fraudulent item with the bureau reporting it and the creditor that supplied it. Include a copy of your identity-theft or police report, proof of identity and address, account details, and a direct request to block or remove the information.

A credit-report dispute is separate from a transaction refund. Removing a fraudulent loan from your report doesn't return money taken from your bank account. Handle both tracks.

PayPal and payment apps

Open an unauthorized-activity case in PayPal's Resolution Center as soon as you see the transaction. Secure the account first: change the password, enable multifactor authentication, and review linked bank accounts, cards, phone numbers, and automatic payments.

PayPal's terms and internal process control the platform case. Purchase protection for an eligible item problem is different from an account-takeover claim. Neither is a universal identity-theft refund guarantee.

Don't rely on a generic "180-day PayPal deadline." Time limits can vary by dispute type, transaction, and account terms. Open the case immediately and check the deadline shown for that transaction.

If the payment came from your credit card or bank account, notify that institution too. Give it the PayPal case number and explain that you also opened a platform case. Don't seek duplicate reimbursement; tell each company about the other claim.

For a payment you personally authorized after being deceived, request a recall and submit the messages, phone numbers, payment instructions, and impersonation details. A platform may deny an unauthorized-transaction claim because you approved the payment, but prompt reporting can still help.

Tax identity theft goes through the IRS, not a bank chargeback

Tax identity theft happens when someone uses your identifying information to file a return, claim a refund, create an IRS online account, or misuse your tax records.

If the IRS sends Letter 4883C, 5071C, 5747C, or another identity-verification notice, follow the instructions in that letter. Use official IRS contact methods and don't send tax documents through a link in an unsolicited message.

If you believe someone filed a federal return with your information, review the IRS identity-theft affidavit guidance. Form 14039 may be completed and submitted when the IRS directs you to do so. The Taxpayer Advocate Service identity-theft guidance also notes that a police report may be submitted instead of Form 14039 in some situations.

Form 4506-F is a request for a copy of a fraudulent return, not a universal first step. Use it only if your IRS instructions call for it.

Tax identity theft can delay a legitimate refund while the IRS verifies your identity and corrects its records. Don't file a duplicate return or pay a third party promising to release the refund quickly unless the IRS specifically instructs you to take that step.

If the case remains stuck after you've tried to resolve it with the IRS, or the delay is causing serious financial harm, the Taxpayer Advocate Service may be an escalation option.

Build one claim file

Create a secure folder for each affected account. Put in it:

• A timeline of when the theft occurred, when you discovered it, and when you reported it.
• Statements, transaction IDs, account-opening notices, and fraud alerts.
• Names of representatives, call dates, case numbers, and promised follow-up dates.
• Copies of dispute letters and delivery confirmations.
• FTC, police, or IRS reports and notices.
• Screenshots of suspicious messages, login alerts, phone numbers, and payment instructions.
• Documents showing possession of the card or that the account was compromised.

Send copies rather than originals. Don't put a full Social Security number in ordinary email, and use secure upload when available.

If you have identity-theft insurance, read the policy before filing. Coverage may be limited to specified expenses or services. Notify the insurer promptly, keep receipts, and continue the bank, card, credit-bureau, and IRS processes separately.

If a refund or dispute is denied

Ask for the decision in writing. Request the reason, the transaction information relied on, and the procedure and deadline for reconsideration.

Then send a short appeal:

1. Identify the transaction and original case number.
2. State whether you authorized it.
3. Give the exact date you reported it.
4. Add new evidence or explain what the investigator overlooked.
5. Request a final written determination.

For a credit card, send the appeal to the issuer's billing-dispute or fraud department and keep paying the undisputed balance. For a debit or bank transfer, ask for the written Regulation E determination and explain why the transaction wasn't authorized. If the bank or issuer still doesn't address the issue, a complaint to the Consumer Financial Protection Bureau may be an escalation option.

For a credit-report error, dispute again only when you have a specific new document or explanation. Also contact the creditor or debt collector that supplied the information. If the item remains, keep the investigation results and use the applicable regulator or complaint channel.

For PayPal, use the platform's appeal or review process and separately follow up with the card issuer or bank that funded the payment. For tax identity theft, follow the IRS notice process and consider the Taxpayer Advocate Service after trying to resolve the matter with the IRS.

Common questions

Does an FTC identity-theft report guarantee a refund?

No. It documents the theft and gives recovery steps. The bank, card issuer, payment platform, creditor, or IRS must still apply its own rules and investigate.

How long does an identity-theft bank refund take?

A bank generally has 10 business days to investigate an electronic-transfer error. If it needs more time, provisional credit may be required, and many ordinary investigations can take up to 45 days. The outcome depends on the transaction, notice date, and exceptions.

Is a credit-card refund always completed within 10 to 45 days?

No. Under the federal written billing-error process, the issuer generally must acknowledge the dispute within 30 days and resolve it within two billing cycles, no later than 90 days. Some issuers move faster, but 10 to 45 days isn't a universal credit-card deadline.

What if I sent the money to a scammer myself?

Report it immediately, ask for a recall, and preserve the evidence. Because you initiated the payment, an automatic unauthorized-transaction refund may not apply.

Should I use Form 4506-F or Form 14039?

Form 14039 is the IRS identity-theft affidavit used when the IRS directs you to report suspected tax identity theft. Form 4506-F concerns getting a copy of a fraudulent return. Follow the instructions in your IRS notice rather than choosing a form from a general checklist.

Pick the rail that matches your loss: call the card issuer, bank, or platform using a verified number, secure the account, get a case number, and send the required written notice before the deadline. If your Social Security number was used, file the FTC report and start the credit-freeze or IRS step that matches the abuse.