Yes. A U.S. consumer who did not authorize a transaction on a personal account can legally dispute it through the channel that matches the payment rail. Deadlines and liability follow that rail too.
"Unauthorized" means you did not give permission. A stolen card can fit. Account takeover can fit. An ACH debit made without your approval can fit.
A late delivery, a duplicate charge, or a subscription renewal you forgot usually needs a different dispute reason.
Did a scammer persuade you to press Send? Describe that honestly. The bank may classify a payment you approved after a lie differently from a transfer an attacker initiated without you. That distinction can change the outcome.
This covers personal U.S. accounts. It isn't legal advice.
Identify the payment rail first
The same-looking charge on a statement can follow different federal rules depending on whether it ran as credit, debit, ACH, wire, or an app payment. Use this table before you call:
| Payment type | Start with | Main rule or policy | Timing to remember |
|---|---|---|---|
| Credit card | Card issuer | Fair Credit Billing Act and Regulation Z | Written notice should reach the issuer within 60 days after the statement containing the error was sent |
| Debit card or ATM | Bank or credit union | Electronic Fund Transfer Act and Regulation E | Two-business-day and 60-day notice rules can affect liability |
| ACH debit | Bank or credit union, plus the originator | Regulation E may apply to a consumer electronic fund transfer | Report it promptly; the 60-day statement window matters |
| Wire transfer | Sending bank's wire or fraud department | Wire rules, the account agreement, and the facts | Call immediately and request a recall |
| PayPal or another payment app | The app and the institution that funded it | Platform terms plus the funding rail | Report through both channels promptly |
These federal protections generally cover personal, family, or household accounts. Business accounts and some specialized products may have different agreements.
Credit card charges: the Fair Credit Billing Act
An unauthorized credit card charge is a billing error. The Fair Credit Billing Act and Regulation Z give you a written-notice path that is stronger than a phone call alone.
Mail the dispute to the issuer's billing-inquiries address. That address may differ from the one you use for payments. Your letter should reach the issuer within 60 days after the first statement containing the error was sent.
Put these facts in the letter:
- Your name, address, and account number or last four digits
- The transaction date, merchant name, and amount
- A clear statement that you did not authorize the charge
- A request to remove the charge and related finance charges
Send a copy of the relevant statement if useful. To be honest, the paperwork can feel fussy when a fraud alert already tells the story. The date, amount, and exact wording can decide whether the issuer treats your message as a formal billing-error notice. Hold on to the original statement.
The issuer generally must acknowledge a written dispute within 30 days. It can skip that acknowledgment if it already corrected the problem. It must investigate and resolve the matter within two complete billing cycles, and never more than 90 days after receiving the notice. Pay the undisputed part of the balance on time. A billing dispute doesn't suspend your responsibility for unrelated charges.
Federal law generally limits liability for unauthorized credit card use to $50. Your issuer may provide $0 liability under its own agreement. That extra protection is a policy benefit with possible conditions. The FTC's guidance on disputing credit card billing errors explains the written-notice process.
Debit cards, ATMs, and ACH under Regulation E
Regulation E covers many electronic fund transfers from consumer accounts. Debit purchases can fall under it. ATM withdrawals can too. Unauthorized ACH debits belong there as well.
The two-business-day rule is a $50 liability ceiling. It's not a federal promise of zero liability.
| When you notify the institution | Possible federal liability |
|---|---|
| Within two business days after learning that a card or access device was lost or stolen | No more than $50 |
| After two business days but within 60 days after the statement showing the transfer was sent | No more than $500 |
| More than 60 days after that statement | You may lose protection for later transfers if the institution shows it could have stopped them |
These are maximum-liability rules, not automatic refund deadlines. A bank or card network may offer stronger zero-liability protection. If the card stayed in your wallet but someone accessed the account, report the activity anyway. The bank will need to understand how the access occurred.
You can usually start notice by phone. The institution may require written confirmation within 10 business days. Send a written record even after a call.
Include the account, transaction, amount, date, and reason you believe an error occurred.
The bank normally must investigate promptly and determine whether an error occurred within 10 business days. If it needs longer, it generally must provide provisional credit while investigating, subject to regulatory exceptions. The investigation period can reach 45 calendar days in ordinary cases. Certain point-of-sale, foreign, or new-account investigations can reach 90 days.
If the bank finds no error, it must explain the result. It must provide supporting documents if you request them. The current Regulation E text contains the detailed notice, provisional-credit, and error-resolution rules.
ACH deserves extra care. Revoke a recurring authorization with the company in writing. Notify your bank, and ask how to block future debits. Keep both confirmations.
A practical dispute workflow
Speed helps, but a messy story does not. Record dates as you go. Turns out, a clean record helps more than a dramatic explanation.
-
Secure the account. Lock or cancel the card and change the banking password. Sign out of unfamiliar sessions. Preserve alerts and screenshots before they disappear. A card lock protects future use, but it usually doesn't replace a formal dispute.
-
Contact the right institution. Call the number on the card, bank statement, or official app. Tell a credit card issuer about an unauthorized billing charge. Tell the bank or credit union about a debit or ACH error. For a wire, ask the fraud department to send a recall request immediately.
-
Create written notice. State, "I did not authorize this transaction," then give the date, amount, merchant or ACH originator, and the date you noticed it. Use the billing-inquiries address for a credit card. Keep proof of delivery too.
-
Gather focused evidence. Save the statement, fraud alerts, login notices, relevant messages, and any identity-theft or police report you already made. Don't wait for a report before you notify the institution. If a deadline is approaching, notify first. Never send a PIN or password.
-
Track the investigation. Record the representative's name, case number, notice date, and promised response date. Ask whether provisional credit applies and whether the institution needs a signed affidavit. Treat temporary credit as temporary.
-
Respond to the decision. If the claim is denied, request the written explanation and documents supporting the conclusion. Answer with specific facts. Use the institution's appeal process or file a complaint with the appropriate regulator.
When a transaction may not be "unauthorized"
The institution may treat a charge as authorized if you handed a spouse, relative, employee, or friend the card, the PIN, the login, or another access device, which is a hard result when you never meant for that person to run up this particular bill. That permission issue changes the analysis.
For electronic transfers, tell the institution when that person's permission has ended. Under Regulation E, protection may not apply to transfers made by someone you gave an access device to until you notify the institution and it has a reasonable chance to act. That notice has to come from you.
If you personally approved a payment because someone lied to you, report the fraud immediately. Don't describe that payment as an attacker-initiated transfer if that isn't what happened.
An unfamiliar merchant name isn't proof of fraud by itself. Statements sometimes show a parent company or payment processor instead of the store name.
Duplicate charges, wrong amounts, missing credits, and non-delivery can still be disputable. They simply use a different billing-error or merchant-dispute reason.
PayPal and payment apps need two reports
PayPal and similar services have their own reporting channels and transaction-protection terms, separate from the federal rules for the bank account or card that funded the payment. Spot the activity, then use the platform's unauthorized-transaction process.
Notify the linked bank or card issuer separately. A platform case does not necessarily preserve the notice deadline for the funding institution.
Thing is, the key fact is how the payment happened. Explain whether someone accessed your account without permission or whether you approved the transfer after being deceived. Check the current platform terms for the applicable filing window. Don't rely on an old deadline copied online.
If the bank denies your claim
Write down when you noticed the charge, called, sent written notice, changed credentials, received provisional credit, and got the decision. Keep that timeline as you go.
A denial should tell you what the institution believes happened. Ask for the exact reason. Ask what records it relied on, and how you request reconsideration.
For a Regulation E claim, request the documents supporting the finding that no error occurred. For a credit card billing dispute, respond in writing with any new evidence.
Keep paying the undisputed balance.
A complaint to the Consumer Financial Protection Bureau may create another review record. It doesn't guarantee a refund. Check the regulator identified in the bank's response. For a large loss, consider getting advice about court deadlines, arbitration terms, and other legal options.
Keep the deadlines separate
Three clocks can run at once. The federal notice deadline belongs to the payment rail, such as the 60-day credit card window or the Regulation E statement window. A card-network or platform deadline is a second clock. It comes from operating rules or a user agreement. A lawsuit can have a third deadline.
That period depends on the legal claim and the jurisdiction. A chargeback window is not a safe substitute for checking it. An issuer or platform may give you more time than federal law requires. Don't assume a longer internal window extends every legal protection.
Common questions
Is it legal to dispute a charge I do not recognize?
Yes. Treat it as a suspected unauthorized transaction and let the issuer investigate. Check first whether the statement uses a different merchant name. Another authorized user may have made the purchase.
Does Regulation E give me zero liability for a debit card charge?
Not automatically. If you report within two business days, federal liability generally tops out at $50. A bank or network may still provide broader zero-liability protection.
Can I dispute a payment I was tricked into sending?
You can report it. The legal analysis may differ from an unauthorized transfer someone else initiated. Give the bank a truthful account. Ask about its fraud or scam process.
Should I contact the merchant first?
You may, especially if a refund is possible. Notify the card issuer or bank promptly anyway. A merchant conversation may not count as formal notice under the applicable federal process.
Official sources
The FTC credit card guidance covers written billing-error notices, acknowledgments, and investigation deadlines. For electronic transfers, the NCUA overview of the Electronic Fund Transfer Act and Regulation E walks through the federal framework.
Open the statement now if you have it. Record the date you first noticed the transaction. Call the issuer or bank today, then follow up in writing.