An unfamiliar transaction needs a quick check, not an automatic fraud label. Match it to the payment method, look for an ordinary explanation, and call the bank, issuer, or app through a trusted official channel if it still isn't yours.
Speed matters. Small test charges, new-login notices, changed contact details, ACH debits, and wallet transfers can signal trouble. The payment rail determines the next step, and reporting speed can affect your protection.
The rules below apply to U.S. consumers. Wires, business-account payments, and some platform transactions may follow different rules or agreements.
What rule applies to the transaction?
Find the payment rail before you file a claim. A debit-card purchase, ACH debit, credit-card charge, app transfer, and crypto transfer do not share one process.
| Payment type | Main rule or process | Timing to watch | First contact |
|---|---|---|---|
| Debit card, ATM, ACH, or other consumer electronic transfer | Regulation E liability and error rules | Two business days after learning an access device was lost or stolen; 60 days after a statement showing an unauthorized transfer | Bank or credit union |
| Credit card | Fair Credit Billing Act billing-error process | Written dispute must reach the issuer within 60 days after the first bill showing the error | Card issuer |
| P2P payment app | App terms plus the linked bank's procedures | Report immediately; the outcome depends on whether you approved the transfer | App and linked bank |
| Crypto wallet or exchange | Provider security process and blockchain transaction status | Act immediately; confirmed transfers may be difficult to reverse | Exchange or wallet provider |
Regulation E is the main federal consumer rule for many electronic fund transfers. Read the CFPB's liability rule or the eCFR text for 12 CFR 1005.6.
Credit-card billing errors use a different process. The Federal Trade Commission describes the written-dispute steps.
Some wires, business-account payments, and platform transactions can follow different rules or agreements.
Red flags of unauthorized transactions
Start with the transaction details, then look for a pattern. One unfamiliar city or descriptor can be a billing quirk; several signals together merit a faster call.
- A $0, $0.99, or $1-$5 charge you did not make, especially when several appear together.
- Repeated declined purchases followed by an approved transaction.
- A merchant descriptor, country, or city that has no connection to your activity.
- A password reset, new-device login, or security alert you did not request.
- A new phone number, email address, payee, external account, or two-factor setting on your profile.
- An unexpected ACH debit, ATM withdrawal, or transfer to an unfamiliar account.
- A balance change that does not match any transaction you can find.
- A P2P payment, wallet approval, or crypto transfer to an address you do not recognize.
One odd line isn't proof of fraud. Hotels, rental counters, and gas stations may place temporary holds. A subscription may appear under a parent company's name, and an authorized user may have made the purchase.
Search the exact merchant descriptor. Compare receipts and subscriptions, and ask household members. Use a trusted browser for that check, not a link in a text or email.
Thing is, don't let a plausible explanation slow you down when several flags appear. If your banking app offers a card lock, use it while you verify.
What to do in the first hour
Treat suspected fraud as an account-control problem first. Move quickly, and choose the contact route yourself.
- Pause new activity. Lock the card in your banking app if that option is available. Stop using a card that may be compromised.
- Call the institution directly. Use the number on the card, statement, or official website. Ignore the number in a suspicious alert.
- Describe the transaction precisely. Give the date, amount, merchant descriptor, and whether it is pending or posted. Say that you don't recognize or authorize it.
- Ask how to secure the account. The bank may recommend replacing a card, changing an account number, blocking future debits, or taking another step.
- Secure online access. On a clean device, change the password, review signed-in devices, check recovery details, and restore two-factor authentication if needed.
- Submit the dispute through the required channel. Ask whether the bank needs a form, written notice, an in-app report, or another record.
- Report P2P and crypto activity separately. Contact the platform, linked bank, and exchange if one is involved. Ask whether the transfer or account can still be frozen.
- Record the case details. Write down the representative's name, case number, date, instructions, and promised follow-up.
Don't give an unexpected contact your password, one-time code, or wallet recovery phrase.
ACH and bank withdrawals need precise labels
Turns out, the label in your transaction history can change the conversation. A company name may belong to a processor or parent company, while an unapproved recurring ACH debit or a transfer to a new external account calls for prompt attention.
Ask the bank to identify the entry as an ACH debit, debit-card purchase, ATM withdrawal, wire, P2P payment, or internal transfer. Note the originator name. Ask whether a trace or reference number is available. Don't assume a merchant dispute form handles an ACH dispute.
If you once authorized a payment but now regret it, the bank may handle it differently from a debit nobody authorized. Explain what happened in plain terms. Don't guess at the legal label.
Deadlines that can affect a bank claim
Regulation E deadlines get confused easily. They address liability for certain consumer electronic transfers, but they don't promise a refund in every case.
| Situation | Federal rule point | Practical move |
|---|---|---|
| You learn that an access device was lost or stolen and report it within two business days | Liability cannot exceed the lesser of $50 or the unauthorized transfers made before notice | Report the loss and any transactions immediately |
| You report after two business days but within 60 days after the statement showing the transfer | Liability can be higher, with a $500 ceiling under the rule's formula | Do not wait for the next statement |
| You wait beyond 60 days after the statement showing the transfer | Later transfers may create additional exposure if the institution establishes that timely notice would have prevented them | Report even if the deadline has passed |
Neither figure is an automatic refund. The facts and timing still matter.
The rule separates learning that an access device was lost or stolen from spotting an unauthorized transfer on a statement. The CFPB's official interpretation explains how to count the two-business-day period. If your timing is close, report the problem now.
Credit card charges require a written dispute
Credit cards have their own billing-error route. Call the issuer first if the card may be compromised, then send the formal dispute in writing.
The FTC says your dispute must reach the issuer within 60 days after the first bill containing the error was sent. Include the transaction date, amount, merchant description, and a clear explanation of why you believe the charge was unauthorized. Use the billing-dispute address or process the issuer specifies, and keep a copy.
The issuer generally must acknowledge the complaint within 30 days unless it has already resolved the issue. It generally must resolve the dispute within 90 days.
Follow the issuer's instructions about the rest of the bill while the investigation is open. A merchant's promise to investigate does not replace notice to the card issuer when your deadline is approaching.
Digital wallets, P2P payments, and crypto
Digital wallets and crypto services don't share one universal refund rule. Platform terms, the funding method, and whether you approved the transfer all affect the review.
To be honest, "I don't recognize it" isn't enough detail for a wallet case. Tell the provider whether someone accessed your account, whether you never approved the payment, or whether a scammer persuaded you to approve it. Those facts can change the review.
Report the transaction inside the app and to the linked bank immediately. If the email account may be involved, secure it first. Change passwords, sign out other sessions, and review recovery settings. Never send a recovery phrase or one-time code to supposed support staff.
For crypto, save the wallet address, transaction hash, timestamp, and screenshots. A confirmed blockchain transfer may be difficult or impossible to reverse through a bank, but the exchange or platform may still be able to secure an account or investigate activity. Don't pay anyone who promises to recover the funds for an upfront fee.
Keep an evidence file
Build the evidence file before deleting messages or changing settings. A simple timeline makes the call easier.
- [ ] Statement or screenshot showing the date, amount, descriptor, and pending or posted status
- [ ] Login alerts, password-reset notices, device information, and account-setting changes
- [ ] Merchant receipts, subscription details, emails, texts, and support chats
- [ ] Call dates, representative names, case numbers, and instructions
- [ ] Copies of written disputes and proof that they were submitted
- [ ] For P2P or crypto activity, recipient username, wallet address, transaction hash, and platform ticket
Keep the original files when possible. Cropped screenshots can hide useful timestamps or account details.
If the institution denies the claim
Ask for the decision in writing. Request the reason, the date the institution says you gave notice, the transaction classification, the evidence it relied on, and the process for reconsideration or appeal.
Read every notice for a response deadline. If the institution says you authorized the payment, explain the sequence clearly and attach records that support your account.
If the loss is substantial or the payment type is unclear, consider qualified consumer-law advice.
Open the account now and review the newest transactions. Save the suspicious entry, call the number on the back of the card or official statement, and record the case number before you close the app.