Did a charge you don't recognize just hit your statement?
Call the fraud or disputes number printed on the card or on the statement, and ignore any number that arrived by text, email, or a browser pop-up that claims your account is frozen. Those callbacks are how people get drained twice.
Keep the date, amount, and merchant on paper.
Read the facts. Don't ad-lib a timeline.
Here's a clean opener you can say almost word for word:
- "Hi, I need to report an unauthorized transaction on the account or card ending in [last four]. I did not make this charge and I did not authorize anyone to make it."
- "The charge is [amount] on [date] to [merchant]. Please open a fraud or billing-error claim, block the card if it is at risk, and give me a reference number."
- "What is your name or agent ID, and what is the timeline for a decision or a provisional credit?"
Give them that, then pause so they can verify you. You're notifying the bank. You're not trying to win a debate.
Credit cards, debit cards, and ACH are different claims
Thing is, the phone script barely changes. The rule behind it does. Credit card billing errors sit mainly under the Fair Credit Billing Act. Debit cards, ATM withdrawals, and many ACH debits sit under Regulation E, the federal electronic fund transfer rules.
| How you paid | Main federal track | Usual outer window | What the call does |
|---|---|---|---|
| Credit card | Fair Credit Billing Act, plus Truth in Lending unauthorized-use rules | Written billing-error notice generally within 60 days of the statement that first showed the charge | Opens a claim; still send written notice to protect billing-error rights |
| Debit card | Regulation E | If the card was lost or stolen, extra-tight windows start when you learn of the loss; many error claims still must reach the bank within 60 days of the statement | Oral notice can count |
| ACH or other electronic debit | Regulation E | Often the same 60-day statement window for error claims | Oral notice can count; follow up on paper |
CFPB rules on liability for unauthorized transfers set loss caps that shrink if you report a lost or stolen debit card fast. Notify the bank within two business days after you learn the card was lost or stolen, and liability for unauthorized transfers before that notice is generally capped at $50, or the smaller amount actually taken. Miss that two-business-day mark and the cap can rise to $500. Miss the longer window after the statement goes out, and later transfers can land on you.
The two-business-day clock follows your bank's business days. Saturday sometimes counts. Sunday usually does not.
If the plastic is still in your wallet, say so. The lost-card clock is not the one that matters then. The 60-day statement window still does.
Credit cards are a different stack. Federal law commonly limits your loss on unauthorized credit card use to $50, and many issuers add a zero-liability policy on top of that. You don't have to recite a statute to get the policy. Ask them to apply it, then still send the written billing-error notice if the charge is on a credit statement.
A merchant's no-refund rule doesn't block a fraud dispute. Neither does a digital-wallet receipt.
Have this within reach
You want a short, boring call. Prep is what makes it boring.
- Last four digits of the card or account
- The statement or screenshot with the charge
- Date, amount, and merchant exactly as printed
- The day you first saw the charge
- Whether the physical card is still with you
- A blank line for the agent's name and the claim number
That is the whole briefcase. Don't hunt for old emails while you're on hold.
Use the number on the card. If you record the conversation, say so at the start. Some states require every party to agree.
How the rest of the call tends to go
They will verify you. Name, address, date of birth, last four of your Social Security number. Answer those when asked. Don't read off a one-time passcode that arrives by text during the call.
Keep the facts this flat: "The charge is $214.09 on April 11 to [merchant name]. I have never shopped there. My card is still in my wallet." Then ask them to mark it unauthorized, replace the card if they think it is compromised, and tell you whether a provisional credit will post during the investigation.
If they ask whether you shared a PIN, a code, or a remote-access link, tell the truth in one sentence. A guess that you "might have" clicked something becomes part of their file.
If they start walking you through whether you maybe forgot a subscription, a family card user, a tip adjustment, or a merchant name that looks nothing like the store you remember, slow the call down and put the same four facts back on the table, the amount, the date, the merchant, and that you did not authorize it, because once you drift into "I guess it's possible" you have handed them a story you did not mean to tell and it is hard to unsay.
Ask for email or app confirmation before you hang up.
If they will not reverse it on the spot
Turns out many front-line agents are allowed to take the report and nothing else. An investigation without an instant credit can still be a real claim. Get the reference number. Ask what written documents they want. Ask which deadline they are applying.
If they refuse to open any claim, ask for a supervisor. Stay polite and repeat that the charge was unauthorized. You don't need courtroom language for the claim to exist. You can say you are reporting an unauthorized electronic transfer or a credit card billing error.
If they say online checkout or Apple Pay makes you responsible, don't treat that as the end. Wallet charges usually still belong to the underlying card or bank account. Use that issuer's dispute path.
Skip lawsuit talk on the first call. It doesn't speed a credit.
PayPal, wallets, and recurring bank pulls
PayPal isn't a substitute for your bank. Open their dispute in the Resolution Center if the charge ran there. Also call the card or bank that funded it.
Platform policies and federal card or EFT rules can overlap. They don't cancel each other.
Apple Pay and Google Pay are usually a stand-in for the card. Tell the issuer it posted through the wallet. Then use the same script.
For an ACH debit you didn't authorize, say you want the transfer treated as unauthorized and ask whether they can block that originator. Recurring pulls can keep hitting if you only argue with the merchant.
Put the same words on paper the same day
To be honest, the call is what you'll remember and the letter is what you can prove later. For a credit card, send written notice to the billing-inquiries address on the statement, not the payment address. Say you are disputing a billing error, identify the charge, and state that you did not authorize it.
Keep paying the rest of the bill.
A debit or ACH claim can start on the phone under Regulation E. Send a secure message or letter anyway. Send the same facts, same amount, same date, same merchant, and the line that you did not authorize it, even if it feels repetitive, because the phone notes and the letter need to match. Add the claim number. Keep copies.
Ask about provisional credit while they investigate. Don't spend money you have not actually received back.
If the bank denies the claim
Ask for the denial in writing. Read the reason. If you have new evidence, a screenshot, a merchant email, a police identity-theft report, send it and ask them to reopen.
You can submit a complaint to the CFPB. The Bureau takes complaints on credit cards, checking and savings accounts, money transfers, and related products. Companies generally respond in 15 days. You'll be able to review that response, and you'll have 60 days to give feedback.
Bring your claim number, call dates, and copies of letters. A complaint isn't a guaranteed reversal. It is the clean escalation path when the file is stuck.
Circle the charge tonight. Call the number on the card. Write down the reference number. Then send the same facts in writing before you go to bed.