A data breach notice is not a dispute. You still have to tell the bank, the card issuer, or the credit bureaus what to fix.
U.S. law does not hand you one official "breach letter." It gives you older tools, and you have to pick among unauthorized electronic transfer claims, credit-card billing-error notices, and credit-report disputes that can include an identity-theft block.
Which sample should you copy? Match the account that got hit, then mail a specific letter with copies of your proof.
Match the problem to the right desk
Thing is, a polished template sent to the wrong address rarely moves a charge.
Use this as the fork in the road, then copy the sample that fits.
| What you are fighting | Who should get the letter | What actually controls the dispute |
|---|---|---|
| Debit, ATM, or ACH withdrawal you did not authorize | Your bank or credit union fraud or error-resolution team | Regulation E unauthorized transfer liability |
| A charge on a credit card you did not make | The card issuer, at the billing-inquiries address on the statement | Regulation Z billing-error rules |
| A fake account or fraud item on your credit report | Equifax, Experian, TransUnion, and the creditor that reported it | Fair Credit Reporting Act dispute plus the identity theft block |
You can still write the company that lost the data. Ask for monitoring if they offer it. That letter does not replace the bank or bureau step.
Keep the payment rail straight in the text. Debit facts do not belong in a credit-card billing-error notice.
Sample letters you can copy and mail
These are practical samples. They are not court forms. They are not legal advice. Fill every bracket and cut anything you cannot support.
Send copies. Use certified mail with a return receipt so you have a date, and keep a full duplicate of whatever went in the envelope.
Here's the checking and debit version.
[Your name]
[Your mailing address]
[City, State ZIP]
[Phone]
[Email]
[Date]
[Bank name]
[Fraud or error-resolution department]
[Address from your statement or the bank's official dispute instructions]
Re: Unauthorized transfers after a data breach - account ending [last 4]
I am writing to report unauthorized electronic transfers on the account above.
I did not make or authorize these transfers:
- [Date], [merchant or description], $[amount]
- [Date], [merchant or description], $[amount]
Total disputed: $[amount]
I learned of this activity on [date]. I believe it is connected to a data breach notice I received from [company], dated [date]. I did not give anyone permission to use this account.
Please investigate these as unauthorized transfers, reverse them if they are unauthorized, and send me the results in writing. I can be reached at the phone and email above.
Enclosures (copies only):
- Photo ID
- Account statement with the transfers marked
- Data breach notice (if I have one)
- Identity theft report (if I have filed one)
Sincerely,
[Signature]
[Printed name]Here's the credit card version. Use the inquiries address on the statement, not a social media inbox.
[Your name]
[Your mailing address]
[City, State ZIP]
[Phone]
[Email]
[Date]
[Card issuer name]
[Billing inquiries address printed on your statement]
Re: Billing error - unauthorized charges - account ending [last 4]
I am writing to give written notice of a billing error on the account above.
The following charges were not made by me and were not authorized by me:
- [Transaction or statement date], [merchant], $[amount]
I first saw these charges on the statement dated [date]. I believe they followed a data breach involving [company].
Please investigate, correct the account if the charges are unauthorized, and send a written explanation of the outcome.
I will keep paying any undisputed balance on time.
Enclosures (copies only):
- Marked copy of the statement
- Photo ID
- Breach notice, if available
- Identity theft report, if filed
Sincerely,
[Signature]
[Printed name]Here's the credit bureau version for a fake account or a fraud tradeline.
[Your name]
[Your mailing address]
[City, State ZIP]
[Phone]
[Email]
[Date]
[Credit bureau name]
[Dispute mail address listed on your credit report or the bureau's site]
Re: Dispute and identity-theft block request - [your full name], SSN last 4 [XXXX]
I am disputing the following information. It is not my information and does not relate to any transaction I made:
- [Creditor name], account [masked number], opened [date], balance $[amount]
I am an identity theft victim. I believe this activity is connected to a data breach notice from [company] dated [date].
I request that you investigate this information and that you block it as information resulting from identity theft. Please send written confirmation and an updated report.
Enclosures (copies only):
- Government-issued ID
- Proof of address
- Identity theft report
- Credit report pages with the items marked
- Breach notice, if I have one
- My statement that these accounts or charges are not mine
Sincerely,
[Signature]
[Printed name]Don't put your full Social Security number in the body if the last four digits will do. If a bureau form later asks for more, answer on that form.
Use the dispute address on your current credit report or the bureau's own instructions, because those P.O. boxes change.
Build the packet first
You don't need a law-office file.
You need a kitchen-table stack that actually matches the letter: a copy of your ID, the statement or credit report with the bad lines marked, the breach notice if you still have that email, the date you first saw the charge, an identity theft report if you filed one, and a police report copy if you have it, though sitting for weeks on a detective's callback is a bad trade when the bank can start with the ID and the statement you already hold.
Stamp "copy" on what you mail.
- [ ] Right company, and the address from a statement or official dispute page
- [ ] Account last four digits, unless they asked for more
- [ ] Each charge or tradeline listed with a date and amount
- [ ] Copies of ID and proof, not originals
- [ ] Identity theft report if this is new-account fraud
- [ ] Your own photocopy or scan of the whole packet
- [ ] Certified mail receipt kept with the file
What you can owe if you wait
Debit and other consumer electronic transfers follow a liability rule that gets harsher if you stall. Under the Regulation E liability rule, some unauthorized transfers tied to a lost or stolen access device (a debit card or PIN) have a low cap if you notify the bank quickly.
Tell the bank within two business days after you learn a debit card or PIN was lost or stolen. Your liability then is the lesser of $50 or the unauthorized transfers before notice.
Miss that two-day window and, in the cases the rule describes, the cap can rise to $500. Wait more than 60 days after that first statement, and you may owe later transfers the bank shows would not have happened with earlier notice.
Saturday can count as a business day. Sunday usually does not.
Turns out a data breach is not always theft of a physical card. If nobody stole your plastic, don't assume the $50 and $500 device-loss caps are the whole map, but report the charges anyway and do it fast.
Credit card billing errors sit on a different track. The issuer's investigation starts after it gets written notice that identifies your account and the error. Use the billing-inquiries address on the statement. Keep paying any balance you do not dispute.
Identity theft on the credit report
A regular dispute asks a bureau to investigate an item. An identity-theft block is a separate ask: you want fraudulent information walled off because it is not yours.
Federal law lets you request a block of information that resulted from identity theft. The request has to identify the information. It also needs your statement that the item does not relate to any transaction you made.
Attach proof of identity and an identity theft report, because a bureau can sit on a block request that is missing those pieces. If they decline the block or later take it off, they have to notify you. Read that notice before you fire off an angry second letter.
Mistakes that waste a month
To be honest, most stalled files are boring, not tragic. People write "fraud from a breach" and never list the $47 charge dated March 3. Vague letters go to the bottom.
First-class mail vanishes into a mailroom. A certified receipt is dull and it works.
A phone call can place a freeze or a first alert, but it is a weak substitute for the written billing-error notice a card issuer needs.
Don't mail your passport. Copies only. Copies.
Waiting for the breached company to "make you whole" lets statement clocks run while their help desk reads a script.
After the letter is in the system
Do this in order, and write dates in the margin.
- Write the tracking number on your copy the day you mail it.
- Freeze your credit files if they are still open.
- Give the bank or bureau a little time to log the envelope, then call once and ask for a case number.
- When a written result arrives, check it against every line you disputed.
- If they ignore your documents, file a complaint with the Consumer Financial Protection Bureau.
- Pull a new credit report and confirm the item is actually gone.
- If a new bogus charge posts, send a new letter. One dispute does not cover future theft.
Pick the matching row in the table, fill that sample today, and get copies of your ID and statement into the envelope.