Sample Letter to Dispute an Unauthorized Transaction

A phone call can freeze a card. A letter is what puts many U.S. banks on a federal timeline.

Not sure a phone claim is enough? Write the facts anyway. If you spotted a charge you didn't approve, jot the date, the amount, and the merchant, then send that in writing.

Keep a copy. Ask them to investigate and correct the account.

Which rule applies depends on the payment rail, not on how upset you are. Credit cards usually follow the Fair Credit Billing Act. Debit cards, ATM withdrawals, and many ACH pulls follow Regulation E.

Thing is, a lot of people paste one generic "FCBA/Reg E" paragraph and hope it covers every account. It doesn't. Name the account, name the transaction, and cite the rule that matches the card or transfer.

Credit, debit, and ACH follow different clocks

Use this as a map, not a promise that every bank will handle your file the same way.

What moved	Rule that usually controls	Timing that matters
Credit card charge	Fair Credit Billing Act	Written dispute within 60 days of the statement that first showed the charge
Debit card, ATM, many ACH transfers	Regulation E error resolution	Notice generally must reach the bank within 60 days after it sent the statement showing the error
Lost or stolen debit card or PIN device	Regulation E liability limits	Tell the bank as soon as you learn the device is gone; waiting more than two business days can raise what you might owe

Traditional wire transfers often sit outside that debit-card framework. Don't assume a Regulation E letter will claw a wire back. Ask the bank which process it uses for that send, and still put the objection in writing.

PayPal, Venmo, and similar apps run their own dispute tools. If they pulled an ACH from your deposit account, you may still have a bank-level Regulation E path. Open the in-app claim and write the bank if the money actually left the account.

What the letter needs to say

Banks match a note to a statement line. Vague letters stall.

Copy this onto your draft and check each line before you mail it.

[ ] Your name, mailing address, phone, and email
[ ] Account number (you can mask all but the last four on copies you keep)
[ ] Date of the letter
[ ] Each transaction: date, amount, merchant or description, and a reference number if you have one
[ ] A plain sentence that you did not authorize the transfer and did not benefit from it
[ ] When and how you noticed it
[ ] What you want: investigation, correction of the account, and a written explanation of the result
[ ] Copies of the statement page or screenshots, not your only originals

Stay factual. Skip the speech about how the bank failed you. The notice, the dates, and whether the transfer was authorized are what the file turns on.

Sample unauthorized transaction dispute letter

Turns out the strongest letters are boring. They stick to dates, amounts, and a clear line that you did not authorize the charge.

Paste this into a document and replace every bracket.

[Your name]
[Your address]
[City, State ZIP]
[Phone]
[Email]
[Date]

[Bank or card issuer name]
[Dispute or billing-inquiries address from your statement]

Re: Unauthorized transaction on account ending in [last four]

I am writing to dispute an unauthorized transaction on my account.

Date of transfer: [MM/DD/YYYY]
Amount: $[amount]
Merchant or description: [name]
Reference or transaction ID: [if known]

I did not authorize this transaction. I did not give anyone permission to use my card, account, or login for it. I ask that you investigate this as an error, correct my account, and send me a written explanation of your findings.

I noticed the charge on [date] while reviewing [statement or app].

Please confirm in writing that you received this dispute.

Copies of the relevant statement page are enclosed.

Sincerely,
[Signature]
[Printed name]

Mail it to the billing-inquiries or error-resolution address on the statement, not the payment coupon address. That mix-up still trips people up.

For a credit card, say you are disputing a billing error under the Fair Credit Billing Act. For a debit or ACH item, say you are giving notice of an error under Regulation E, including an unauthorized electronic fund transfer.

Get the notice on the clock

A portal click is useful. It is not always the same as the written notice some rules describe.

Call the number on the card or statement. Get a claim number, the agent's name, and the time of the call.
Pull the statement that first showed the charge. Circle the line. Note the statement date, not just the purchase date.
Fill the sample letter. One letter can list several unauthorized items if they sit on the same account.
Send it so you can prove the date. Certified mail with a return receipt still works. If you use a secure message, save a PDF of what you sent.
If you already called about a debit or ACH error, watch for a request to confirm the notice in writing. Under Regulation E's error procedures, the bank can require written confirmation within 10 business days of an oral notice.
Keep a folder with the letter, the mail receipt, screenshots, a police report if you filed one, and every reply.

You can't treat a deleted chat as your only proof.

If the access device was lost or stolen, say that on the first call. Don't wait for the letter to mention a missing card. The two-business-day window in Regulation E runs from when you learned of the loss or theft, and the official text even walks through how that window counts across a weekend.

What you might still owe

This is the part people get wrong, because the dollar caps move with the clock.

For many credit cards, federal law caps your loss on unauthorized use at $50, and issuers often add zero-liability policies that are stricter than the statute. Those extra policies are not the statute. You still need to send the billing-error notice on time.

Debit is harsher if you wait. Regulation E can hold you to $50 if you report a lost or stolen access device within two business days, then up to $500 if you miss that two-day mark, and then potentially the full amount of later transfers if you let 60 days pass after the bank sent the statement that first showed unauthorized activity.

Read the ladder in 12 CFR 1005.6 if the amounts are large. Don't guess from a blog table, including this one.

After a timely Regulation E error notice, the bank generally must investigate promptly and decide within 10 business days. It can take longer if it provisionally credits the disputed amount within those 10 business days. New accounts can get 20 business days instead of 10 when the transfer happened soon after the first deposit.

Provisional credit is temporary. The bank can reverse it if it later finds no error. You still want that credit. It puts money back while they look.

If the investigation goes nowhere

Write down the denial reason. Ask for the documents they relied on.

To be honest, a lot of files die because nobody follows up in writing after the first "we need more time" note. Send a short dated letter that restates the claim number, the amount, and that you still dispute authorization.

If the bank won't correct an error you already described, you can submit a complaint to the Consumer Financial Protection Bureau. Use the same dates and copies you already gathered. That process is a complaint route, not a guaranteed refund.

If someone stole your identity, not just one card number, use IdentityTheft.gov to build a recovery plan and an identity theft report you can attach later.

These are the federal U.S. rules that usually control the file. Your bank can still ask for more paperwork.

Print the sample, fill every bracket, and get it out this week if the statement is already in hand. You'll have a cleaner file if that 60-day mark is still a ways off.