An unfamiliar charge isn't automatically fraud. Check the date, amount, statement descriptor, receipts, subscriptions, and purchases by authorized users. Then contact the bank, card issuer, or payment service that handled the transaction as soon as you notice it.
Start with the details.
Turns out, the name on a statement may not match the storefront. A late report, odd location, or unfamiliar merchant descriptor can raise questions, but none of those facts proves you authorized the payment. The payment rail matters: debit cards, credit cards, ACH debits, ATM withdrawals, and payment-app transfers can follow different rules.
Start by naming the problem
Before filing anything, name the problem accurately. An unfamiliar merchant name, an unauthorized transfer, and an authorized purchase with a billing error are different claims, and they may go to different teams.
| What happened | Likely route | First move |
|---|---|---|
| The merchant name looks unfamiliar | Descriptor or legitimate-purchase check | Search receipts, subscriptions, and purchases by authorized users |
| Your card or access device was lost or stolen and then used | Unauthorized card or electronic transfer claim | Contact the bank or card issuer and secure the account |
| You authorized the purchase, but the amount is wrong, duplicated, or recurring | Billing error or merchant dispute | Contact the merchant and use the issuer's billing-dispute process |
| An ATM withdrawal, ACH debit, or other electronic withdrawal is not yours | Bank-account transaction claim | Call the bank or credit union and record the date and amount |
| A payment-app transfer is unfamiliar | App and linked-account investigation | Report it in the app and notify the linked bank promptly |
Check first, then report. Search receipts, subscription records, merchant emails, and purchases made by authorized users before calling a charge fraudulent.
If a spouse, relative, employee, or additional cardholder used the account, tell the institution. Permission can change how it evaluates the claim. Don't label a charge fraudulent just because the descriptor is unfamiliar.
The federal rule for debit and electronic transfers
For U.S. consumers, Regulation E is the starting point for many unauthorized electronic transfers from a personal bank account. It may cover some debit-card, ATM, ACH, and other account transfers. It is not a general rule for every merchant-fraud complaint.
The payment rail matters here.
Under the eCFR text for 12 CFR 1005.6, if you notify the financial institution within two business days after learning that an access device was lost or stolen, your liability generally cannot exceed the lesser of $50 or the amount of unauthorized transfers made before notice.
That clock starts when you learn the access device was lost or stolen. It isn't a deadline a merchant can simply choose.
If the access device was lost or stolen and notice comes after two business days but within 60 days after the statement showing the first unauthorized transfer, liability can be higher. The rule uses the lesser of $500 or the amount produced by its formula. After 60 days, the institution may hold you responsible for later transfers if it establishes that timely notice would have prevented them.
Report an unknown transfer immediately, even if you still have the card. Late notice can affect liability. It does not, by itself, prove authorization.
Credit cards use a separate lane. Regulation E does not cover every credit-card billing dispute, so follow the issuer's instructions instead of borrowing debit-account deadlines.
Suspicious signals are not proof
Fraud reviews use clues. Clues are not verdicts.
| Signal | What it may mean | What it cannot prove by itself |
|---|---|---|
| The report came weeks later | The consumer noticed the charge late or delayed reporting | That the consumer authorized it |
| The IP address or location differs | Travel, a VPN, a mobile network, or account takeover | Who actually used the account |
| There is no police report | The incident was not reported to police | That the transaction was legitimate |
| The explanation changes | Confusion, poor memory, or possible misrepresentation | Which version is true without other evidence |
| Several claims involve one account | Repeated fraud, a compromised account, or a pattern that needs review | That every claim is dishonest |
| Delivery or usage records exist | Someone received or accessed the goods | That the cardholder authorized the purchase |
Thing is, device and delivery records can help without answering who authorized the payment. A fraud score, delivery signature, or location mismatch should inform the review, not replace it.
Answer questions carefully. Say what you know. Say what you don't know. Don't guess who used the account.
Report the transaction without weakening your claim
Use the official number on the back of the card, on a statement, or in the institution's official app. Don't use a number supplied by an unexpected caller.
-
Secure access. Freeze or lock the card if that option is available. Change the banking password, turn on multi-factor authentication, and review recent activity. Never give a caller your PIN, password, or one-time verification code.
-
Contact the right institution. The bank or credit union handles a debit-card, ATM, or checking-account withdrawal claim. A credit-card charge goes to the issuer. For a payment app, report the transaction in the app and notify the linked financial institution promptly.
-
Give the facts. Provide the transaction date, amount, descriptor, and the date you noticed it. Explain whether the card was lost, whether you still had it, and whether anyone else had permission to use the account. Use the word unauthorized only if it fits what happened.
-
Ask how written notice works. The institution may direct you to a secure message, form, letter, or online claim. Follow that route and keep the claim number. The FTC's guidance on lost or stolen cards recommends prompt reporting, account monitoring, and written follow-up.
-
Keep a contact log. Note the date, time, number called, representative's name, requested documents, and any deadline. Save confirmation emails and secure messages.
-
Watch the account again. Review transactions after the first report. Report additional activity, and tell the institution if you later recognize a charge as legitimate.
Don't wait until you can explain exactly how the transaction happened. Report the facts you have; the institution can investigate the rest.
Build a timeline, not a theory
Write down what you saw. Just what you saw. A timeline keeps the report anchored to events instead of a theory about who used the account.
| Time or event | What to record |
|---|---|
| Before the transaction | Last purchase or withdrawal you recognize and who had access |
| Discovery | When you saw the charge, withdrawal, or alert |
| First notice | When you called, sent a message, or filed the claim |
| Security response | Card lock, password change, device removal, or other steps |
| After notice | New attempts, additional transactions, or contact from the institution |
Save the statement page showing the transaction, account alerts, receipts, merchant emails, call logs, and relevant security notices. Keep the original files when possible.
Use a secure channel for documents. Redact information that is not needed, especially passwords, PINs, and one-time codes.
If the bank or issuer denies the claim
A denial can have several explanations. The institution may think notice was late, conclude that the transaction was authorized, need a missing document, or have placed the complaint in another category.
Read the denial closely.
Ask which transaction the institution reviewed and how it classified your complaint. If it treated an unauthorized-transfer report as a merchant dispute, say that in a short written response and attach your timeline.
Chip use, a passcode, a familiar device, delivery records, and account history may all matter. None necessarily answers who authorized the transaction. Ask what information the institution considered and whether it offers reconsideration or an appeal.
Credit-card disputes should follow the issuer's separate billing-error procedure. A purchase that was authorized but never delivered, arrived damaged, or continued after cancellation may need a different claim from an unauthorized charge.
To be honest, a concise correction usually works better than an angry reply. Don't exaggerate, guess, or accuse a family member without evidence.
Escalate a stalled response
Use the bank's formal complaint or reconsideration channel first. Include the claim number, a short chronology, copies of notices, and the result you want reviewed.
If the institution still does not resolve the issue, you can use the CFPB complaint portal. The CFPB accepts complaints about checking and savings accounts, credit cards, money transfers, and other financial products.
The CFPB says companies generally respond within 15 days. You can review the response and provide feedback within 60 days.
A CFPB complaint is an escalation route. It does not replace prompt notice to the bank or issuer.
Common questions
Is a late unauthorized-transaction report automatically fraudulent?
No. People miss transactions on statements, lose access to email, travel, or discover account problems later.
Delay can affect the liability analysis, especially for covered electronic transfers. It is not proof that the consumer authorized the transaction.
Does the absence of a police report defeat a claim?
Not by itself. A police report may document a theft, but it does not decide the financial claim. The institution may ask for other supporting information, so follow its document requirements and describe the facts accurately.
What if I recognize the merchant after filing?
Tell the bank or issuer promptly. Explain that you now recognize the transaction and ask how to correct or withdraw the claim.
What if the merchant says its IP or delivery record proves I authorized the purchase?
Those records may be relevant. An IP address or delivery confirmation does not automatically identify the person who authorized the payment, so ask the issuer to weigh the full timeline, account security, and your explanation.
Official references
For the governing debit and electronic-transfer liability rule, read 12 CFR 1005.6 at the CFPB and the current eCFR text. The FTC card-loss guidance covers prompt reporting and account monitoring.
Before ending the call, mark every transaction you recognize on the latest statement, report the rest to the correct bank or issuer, and save the claim number.