Unauthorized charges don't wait for you to feel ready. Report the charge to the bank, card issuer, or payment app as soon as you spot it. The rules that protect you depend on the payment rail. A credit card dispute follows one path. A debit card, ACH debit, or electronic transfer follows another. PayPal adds its own contract on top.
These rules apply to U.S. consumer accounts. This is practical information, not legal advice.
What counts as an unauthorized transaction?
An unauthorized transaction is a charge or transfer you did not approve. That sounds clean. Credentials make it messy.
Handing someone your card and regretting it later is usually not fraud. A family member who uses your saved card without permission can still create a hard claim. The bank may call it a household matter or ask for a police report. A forgotten subscription renewal is a merchant billing issue, not unauthorized use.
Merchant problems are separate. If a package never arrives, a hotel adds a resort fee, or a service was not as described, use a merchant dispute or a credit card billing dispute. Being unhappy with a purchase does not turn the charge into fraud.
Credit cards: FCBA gives you a written dispute route
For credit cards, the Fair Credit Billing Act controls billing errors. The FTC guidance on disputing charges says to write to the issuer. Send the letter so it reaches the issuer within 60 days after the first bill with the error was sent to you. Keep a copy.
The issuer must acknowledge your complaint in writing within 30 days unless it already fixed the problem. It generally has 90 days to resolve the dispute.
While the investigation is open, you can withhold payment on the disputed amount. The issuer should not charge interest on that amount or report you as delinquent for not paying it. You still owe the undisputed part of the bill.
Unauthorized credit card liability is usually friendly. If your card is lost or stolen, the FCBA caps your liability at $50. If only the card number was stolen and you still have the card, you are not liable for unauthorized charges. Many issuers advertise $0 liability. That $0 promise is card policy, not the legal floor. Check your cardholder agreement to see which promise applies.
Debit, ACH, and Reg E: the two-day and 60-day clocks
Debit cards and ACH debits do not run on the FCBA. Regulation E covers electronic fund transfers. That includes many debit card transactions, ATM withdrawals, and unauthorized ACH debits. The CFPB's Regulation E liability rule sets caps for a lost or stolen access device. An access device is the card, code, or app credential used to move money.
Notify your bank within two business days after learning of the loss or theft. Your liability is capped at the lesser of $50 or the unauthorized transfers that happened before you gave notice. Miss that two-day window but notify within 60 days after the statement that first showed the transfer. The cap can rise to $500.
After the 60-day statement window, the rule can get harsher. You may owe unauthorized transfers that happened after the 60 days and before you told the bank, if the bank can show timely notice would have stopped them. Waiting to see if a charge clears is a bad idea.
Thing is, those caps are written around a lost or stolen access device. A plain unauthorized ACH debit may not fit that exact fact pattern. The bank still has to follow Regulation E error-resolution rules. Ask it to identify the rule it is applying. The CFPB's error-resolution rule says the bank generally has 10 business days to investigate. Some cases allow longer. The bank must provisionally credit your account in many situations when it cannot finish within 10 business days.
| Rail | Main rule | Key deadline | Practical note |
|---|---|---|---|
| Credit card | FCBA | Written dispute within 60 days of first bill with error | Issuer must acknowledge in 30 days, resolve in 90 days |
| Debit card or lost access device | Reg E | Notify within 2 business days for $50 cap; 60 days for $500 cap | Provisional credit often in 10 business days |
| ACH debit | Reg E | Report as soon as possible; error notice within 60 days of statement | Ask bank which liability tier applies |
| PayPal or payment app | Platform agreement plus underlying rail | Check Resolution Center deadline | If funded by card or bank, card or Reg E rights may also matter |
What to do, in order
- Lock the account. Freeze the card in your bank or card app. Disable the affected account. Change passwords, and change any reused password elsewhere.
- Call the fraud line and report the transaction. Ask for a confirmation number. Write down the date, time, and representative's name.
- File the written dispute. For a credit card, use the billing-error address or online dispute center. Keep a copy. For a debit card or ACH transfer, file the error notice your bank requires. Some banks accept app submissions. A written record still helps.
- Send supporting documents. Attach the statement page, your timeline, and any police or identity-theft report. Do not send originals.
- Track the provisional credit. Under Reg E, the bank often must provisionally credit your account within 10 business days if it cannot finish the investigation. That credit is not a final win. The bank can reverse it.
- Put the next deadline on your calendar. If the bank misses a deadline or denies the claim without a clear explanation, ask for the specific rule and the documents it relied on.
Evidence that usually matters
Turns out, a confirmation number can matter more than a receipt. You do not need a receipt for a charge you never made. Fraud claims turn on authorization, not on whether you kept a receipt. If the bank asks for a receipt anyway, ask why it needs one. You can provide a written statement instead.
| Evidence | Why it helps |
|---|---|
| Statement page with the charge | Establishes the date, amount, and merchant |
| Your written timeline | Shows when you noticed and when you reported |
| Confirmation number from the bank | Proves you gave notice before the deadline |
| Police report or identity-theft affidavit | Useful for large losses, account takeover, or when the bank asks |
| Device or login records | Can show a login from an unfamiliar location |
| Copy of your dispute letter | Proves what you sent and when |
PayPal and payment apps: platform rules come first
PayPal is not a bank in the same way Chase or Wells Fargo is. Your account is governed by PayPal's user agreement and the Resolution Center process. Start there. Look for the dispute deadline, the evidence upload steps, and the difference between an unauthorized payment and a purchase that did not arrive.
To be honest, the platform clock and the bank clock can run side by side. The funding source still matters. If PayPal pulled money from a debit card or bank account, the underlying bank may also have Regulation E duties. If it pulled from a credit card, your card issuer's billing-error process may apply. Do not assume PayPal's decision ends the bank clock. Ask the platform and the funding source what deadline applies.
If the bank denies the claim
Ask for the denial reason in writing. The letter should name the regulation or agreement section the bank relied on. Request copies of the documents it used. Send a written appeal or rebuttal with new evidence. File a CFPB complaint if the bank misses a Reg E deadline or refuses to explain its decision. For a credit card billing dispute, keep the written denial and ask the issuer for the documents it relied on.
Escalation works best with a clean timeline. One date. One confirmation number. One written notice. That package is harder to ignore.
Mistakes that cost consumers money
Waiting for a charge to post costs time. Report the moment you see it. A phone call can start the clock. A written dispute creates a paper trail. Do not mix fraud with buyer's remorse. If you authorized the purchase, use a merchant dispute. Closing the account before the investigation ends can make provisional credit and follow-up harder. Read every notice about a provisional credit reversal. Respond before the final deadline.
FAQ
Do I have to pay the disputed amount while the bank investigates? For credit cards, you can withhold the disputed amount during the FCBA investigation. You must pay the undisputed part. For debit and Reg E disputes, provisional credit rules may protect your balance. The bank can reverse the credit if it rules against you.
What if the unauthorized charge is on my debit card and I report it a week later? You may still be covered. The $50 cap may no longer apply. The $500 cap can apply if you notify within 60 days after the statement that first showed the transfer. Report immediately and get a confirmation number.
Can I dispute a PayPal payment with my bank after PayPal says no? Sometimes. It depends on the funding source. If the money came from a credit card, ask your card issuer about FCBA billing-error rights. If it came from a bank account, ask about Reg E error resolution. The bank may have its own deadline and evidence requirements.
What if the thief used my password but I never gave it to them? That can still be unauthorized. Change the password. Enable two-factor authentication. Report the transaction. The bank may investigate whether there was account takeover or whether the credentials were shared voluntarily.
Open your banking app now. Find the transaction. Report it before you do anything else. Then write down the confirmation number. Put the bank's deadline where you will see it.