Unauthorized activity doesn't automatically entitle you to a refund. The payment rail controls the first step, so tell the bank, card issuer, or payment app today how the money moved.

Turns out, "identity theft" describes the incident, not the rule that decides the claim. A debit-card or bank-account transfer may fall under Regulation E; an unauthorized open-end credit-card charge may be a billing error under the Fair Credit Billing Act and Regulation Z; a fake account or credit-report entry raises FCRA questions. The FCRA is not a general charge-refund law.

An FTC or police report may help document the theft. It doesn't replace a notice deadline or guarantee a credit.

These steps assume a personal account in the United States. Business accounts, wires, and international payments can follow different rules.

Match the payment to the rule

Start with the rail, not the label. Fraud tells you what happened; it doesn't tell you which deadline applies.

The federal starting point for an unauthorized electronic transfer is 12 CFR 1005.6. The current Regulation E text contains related provisions. State law, card-network rules, and issuer policies may add protection, but meeting the applicable federal deadline should come first.

Debit and bank-account transfers have short clocks

The two-business-day rule has a specific trigger: learning of the loss or theft of an access device. Calling an incident "identity theft" does not create that trigger.

When the rule applies, notify the financial institution within two business days. Liability generally can't exceed the lesser of $50 or the unauthorized transfers made before notice.

Report later, but within 60 days after the statement that first shows the transfer was sent, and the ceiling can rise to the lesser of $500 or $50 plus the transfers made after the two-day period and before notice. Miss that 60-day window, and later transfers may be your responsibility if the institution can show timely notice would have prevented them.

Not every account or transfer fits those provisions. Check the current Regulation E text before assuming the deadline is the same.

Call the fraud department now. Ask how to submit the formal error notice, then send a written follow-up. Don't wait for a police report.

For many Regulation E claims, the bank has 10 business days for its initial investigation. If it needs more time, provisional-credit and extension rules may apply, and some situations have different timing. Ask whether temporary credit was issued and when the written decision is due.

Credit-card disputes use a different process

Credit cards run on a separate track. An unauthorized charge on an open-end credit card may be a billing error under the Fair Credit Billing Act.

Send the notice to the billing-inquiries address on the statement, not the payment address. Name the account, transaction date, amount, and merchant. Say clearly that you didn't authorize the charge.

The written dispute must arrive within 60 days after the first statement showing the error was sent. The issuer generally must acknowledge it within 30 days and resolve it within two complete billing cycles, with a 90-day maximum.

Federal law generally limits liability for unauthorized credit-card use to $50. Some issuers offer zero-liability protection under their own policies.

For a plain-language explanation, see Capital One's FCBA explanation. It is an issuer explainer, so use the address and instructions on your own statement.

Keep paying the undisputed balance. Save the letter, delivery proof, and case number.

FCRA disputes address fraudulent accounts

The FCRA helps correct reporting problems; it doesn't itself send a refund. If a thief opened a loan, credit card, utility account, or another account in your name, dispute the information with both the credit reporting company and the furnisher.

Depending on the facts, you may also request an identity-theft block, place a fraud alert, or freeze your credit file. An FTC or police report can help document the theft and may support a bank affidavit or credit-report dispute.

A freeze helps prevent new credit access. It won't reverse an existing debit or card charge.

Preserve the timeline and supporting records

Write the timeline while the dates are still clear. The first version can be messy; accuracy matters more than polish.

Keep these records:

• Statements, transaction IDs, merchant names, amounts, and dates.
• When you noticed the activity and when you first contacted the provider.
• Emails, chats, screenshots, login alerts, password-change notices, and delivery records.
• FTC, police, or identity-theft-affidavit documents, if you have them.

Use that record in this order:

1. Stop further access. Lock the card or account, change exposed passwords, turn on multifactor authentication, and remove unfamiliar devices.
2. Report the transaction now. Say that you did not authorize it. Record the call time, representative's name, and claim number.
3. Use the required channel. Follow the bank's instructions for a Regulation E claim. Send a credit-card dispute to the billing-inquiries address, and open a case in the payment app too.
4. Create an identity record if needed. File an FTC report, police report, or identity-theft affidavit if it is useful or requested. Consider a credit freeze if new accounts may be involved.
5. Send focused evidence. Provide the timeline and documents showing when you noticed the activity and why you did not authorize it. Don't fill gaps by guessing.
6. Track temporary credit and requests. Provisional credit can later be reversed after the investigation. Respond by the provider's stated deadline.
7. Keep legitimate payments current. Continue paying undisputed credit-card charges and handling legitimate account activity.
8. Challenge a denial in writing. Request the decision, correct factual errors, and use the appropriate regulator if the provider did not follow the dispute process.

Payment apps change the analysis

PayPal, Zelle, Venmo, and Cash App don't share one refund policy. Provider terms and the funding rail may determine which protection is available.

Thing is, a payment you never initiated may be treated differently from one you personally approved after someone deceived you. Describe exactly how access occurred, whether you approved the payment, whether you shared a security code, and whether an impersonator pressured you.

Open the platform case promptly. Also notify the bank or card issuer that funded the payment before its own deadline expires.

If two providers are reviewing the same transaction, tell each provider about the other claim. Keep both case numbers and use the same factual description.

If the provider says no

A denial often turns on timing, authorization, account type, or missing evidence. Ask for the reason in writing.

Request the records or policy the provider relied on, if it can disclose them. Then send a short appeal listing the transaction, the date you gave notice, the facts showing that you did not authorize it, and the documents attached.

For a credit-card claim, repeat the dispute in writing even if you first reported it by phone.

If a bank or issuer mishandled a bank-account or credit-card dispute, submit a complaint through the CFPB complaint portal. The CFPB says companies generally respond within 15 days, and consumers have 60 days to provide feedback on the response. A complaint can prompt a review, but it isn't a guaranteed refund.

State regulators and local legal-aid services may offer another route, especially after a large loss or a repeated failure to investigate.

Put the essential facts in the first notice

Keep the first message short. You can adapt this wording:

I did not authorize the transaction dated [date] for [$amount] at [merchant]. Please open an unauthorized-transaction or billing-error investigation and tell me where to send supporting documents. My preferred written contact method is [email or mailing address].

Call the fraud number on the statement, save the case number, and send the required written notice before waiting for a police report or merchant response.