This is a U.S. reporting-and-investigation problem. It is not a new 2026 statute.
Prompt notice to your bank, credit union, or card issuer is the first controlling step after you find an unauthorized charge or withdrawal in the United States. The institution that holds the account is who you tell.
The Consumer Financial Protection Bureau page on unauthorized bank and credit-union transfers was last reviewed August 28, 2026. That date is a review stamp only. No new federal deadline, Discover Card rule, or 2026 law change follows from that stamp.
Did you mean Discover the card brand, or discover as in you just spotted a bad charge? Both searches still start the same way: tell the institution that holds the account. Unofficial how-to pages describe Discover app taps, phone scripts, and provisional-credit timing. Those clicks are not stated here as fact. No official Discover help page, cardmember agreement, or portal steps are in the sources used for this guide.
What actually happens after you find an unauthorized transaction
Prompt reporting is the action federal notice rules actually reward. Those rules sit on the bank or credit-union side first. They're narrower than marketing copy makes them look.
Thing is, according to the Consumer Financial Protection Bureau, a bank or credit union generally has 10 business days to investigate after you notify it of an unauthorized transaction. Unauthorized means you did not make or allow the charge.
The same page counts a 60-day notice window from when the institution sends the statement showing the unauthorized transaction. That clock starts when the statement is sent.
Calendar the request if it asks for written follow-up. You have 10 business days to send it. Miss that window and temporary credit during the investigation is not required.
Issuer "zero liability" marketing, merchant chargeback reason codes, and unofficial Discover how-to pages do not set that federal clock. They also do not guarantee you a refund.
Call or write the institution that sent the statement, name the transaction, and say you did not authorize it before you wait on a merchant, even if the store is the call you want to make first. Get the notice in.
If the unauthorized transaction used a debit card or other electronic fund transfer, additional federal protections may apply, though that line does not convert a credit-card billing dispute into an EFT claim, and secondary pages recycle extra dollar caps and issuer timing claims that are not used as rules here.
An investigation is not a prepaid refund. Temporary credit, when the institution offers it, still depends on the written follow-up it may request.
Decide whether this is unauthorized use or a charge you made
Mislabeling is not a strategy. It is a delay.
Unauthorized use means someone used the account without your permission. A purchase you made is a different claim, even when the statement looks wrong.
The label you pick can route the file into the wrong workflow. Institutions do not treat every unhappy charge as fraud.
Use this split before you call or write:
- Unauthorized use: the account was used without your permission.
- A charge you made: wrong amount, duplicate posting, goods not received, or a merchant refund you still need on a purchase you actually authorized.
Wrong-amount and duplicate claims are not the same as a stranger using the number. The same charge can be unauthorized use if someone else used the account without permission, or a billing problem if you made the purchase and the amount is wrong, or the charge is a duplicate, or the goods never arrived, or you already asked the merchant for a refund, and picking the first label when you mean the second can send the claim down the wrong path.
Choose the process that matches the account
Search terms do not pick the process. Match the claim to the rail the money moved on.
Look at the account printed on the statement, not at the search box you used. If the money left a bank or credit-union account by debit, ATM, or another electronic fund transfer, the CFPB unauthorized-transfer investigation path is the process that fits. Notice still goes to that bank or credit union. The 60-day window is an EFT notice window on that rail.
Eligibility is simple on paper. The EFT path is for unauthorized electronic transfers on a bank or credit-union account. The credit-card path is for unrecognized charges on a credit account, including a Discover credit card if that is what you hold.
Credit cards are a different process. The Federal Trade Commission tells you to open monthly statements promptly and report unrecognized charges as soon as you discover them. If the account is a Discover credit card, that reporting advice still applies. You're still on the credit-card side of this split. Issuer policy may add a "zero liability" overlay. Official Discover portal steps are not in the CFPB and FTC material used here, so they are not treated as rules.
People mash the rails together because one brand can issue both products. To be honest, debit is not credit. The clocks are not interchangeable.
Do not paste the EFT 60-day statement rule onto a credit-card billing dispute. Do not paste credit-card billing calendars onto a bank-account EFT.
Checks and domestic wires are commonly treated as outside Regulation E. This page does not invent a substitute process for them.
A "zero liability" slogan can be company policy. It is not a reason to sit on the statement. Report unrecognized credit-card charges when you find them.
Report, document, and follow up in this order
The only numbered workflow comes from the Consumer Financial Protection Bureau and FTC guidance, not from unofficial issuer walkthroughs.
- Review the statement that shows the charge or withdrawal. Confirm the date, amount, and merchant or transfer description before you call it unauthorized.
- Report it immediately to the bank, credit union, or card issuer, and say the transaction was unauthorized if that is the claim you mean.
- Keep the account number and a record of when you noticed the loss. You'll need both if you have to put the report in writing.
- Send a letter if a card was lost, or if the institution asks for writing. The FTC's lost-or-stolen-card advice says to include the account number, the date and time you noticed the card missing, and when you first reported the loss.
- If the institution asks for written follow-up, provide it within 10 business days so temporary credit during the investigation is not required.
- Let the institution investigate. After notice, a bank or credit union generally has 10 business days to investigate. CFPB says it must resolve the issue in 45 days. Do not replace that path with unofficial Discover timing claims.
People skip the paperwork. CFPB ties that paperwork to keeping temporary credit during the investigation. Keep copies of what you sent. Note the date of every call.
Stay on this sequence. Skip merchant representment instructions and unofficial portal click-paths.
What you can still lose if you wait
Wait past 60 days after the institution sends the statement, and you could have to pay later unauthorized transfers that happen before you notify it. Turns out that later-transfer exposure is the loss the federal page actually flags.
The Consumer Financial Protection Bureau puts that limit on unauthorized bank and credit-union transfers. It is not a merchant saying no to a refund. It is not an unofficial rejection percentage.
Some unofficial pages describe later courtesy windows, including a 120-day figure. That is not the CFPB clock. Issuer goodwill can still exist. It does not replace the 60-day statement notice on an EFT.
The 60-day mark does not freeze the first unauthorized charge in a neat box. Later transfers that post after that statement window, and before you finally notify the institution, later transfers in that gap, are the ones CFPB says you could have to pay in full. If you are already past 60 days, notify anyway. That later-transfer point runs until you actually tell the institution.
Don't treat a missed federal notice window and a store refusing to unwind a purchase you made as one problem.
This is practical information, not legal advice. If the charge is still on a credit card, FTC guidance still says to report unrecognized charges as soon as you discover them. Marketing copy is not a reason to test the delay.
FAQ
What should I do first after finding an unauthorized charge?
Tell the bank, credit union, or card issuer that holds the account. Say the transaction was unauthorized if that is what you mean. A merchant conversation can wait. Official U.S. guidance starts with the institution that holds the account, not with a store credit request.
How is the 60-day EFT notice window counted?
It runs from when the institution sends the statement that shows the unauthorized transaction. Mail time does not pause it. The day you opened the app is not the CFPB starting point. Unofficial Discover pages that count from when you noticed, or from when the charge posted, are not that federal rule.
Are debit/EFT and credit-card processes the same?
No. Read the product on the statement. Bank and credit-union electronic fund transfers use the CFPB unauthorized-transfer investigation path. Credit cards use prompt unrecognized-charge reporting under FTC advice. One brand can issue both. The rails still stay separate.
Can Discover-specific dispute steps be stated from this evidence?
No. Unofficial pages describe phone, online, and mail options. They are not official Discover procedure in the CFPB and FTC material used here. Report unrecognized charges to the issuer anyway.
Does waiting, or "zero liability" marketing, change the federal clock?
A "zero liability" slogan does not rewind a late EFT notice. The EFT window is still 60 days after the statement is sent. Waiting can still leave you paying later unauthorized transfers that happen before notice. Company policy overlay is not that clock.
If you did not authorize the charge listed on the statement, report it today to the bank, credit union, or card issuer. Keep the account number and the date you noticed the loss.