If a data breach is followed by an unfamiliar charge, withdrawal, account, collection, or credit inquiry, contact the institution that controls that item. Don't wait for the breached company to investigate the fraud for you.

For U.S. consumers, these are separate processes:

What happened Contact first Process that usually applies
Unauthorized credit-card charge Card issuer Fair Credit Billing Act billing-error process
Unauthorized debit-card transaction, ATM withdrawal, or ACH transfer Bank or credit union Electronic Fund Transfer Act and Regulation E, when applicable
Fraudulent account, collection, inquiry, balance, or payment history on a credit report Each bureau reporting it and the business that supplied the information Fair Credit Reporting Act dispute process
Expenses or losses covered by a breach settlement Breached company or settlement administrator The breach notice and settlement terms

A breach notice supports your account of what happened, but it doesn't prove that a particular transaction came from the breach. State what you know: your information was exposed, and you didn't make or authorize the transaction or open the account.

First steps after finding suspicious activity

Contact the financial institution

Use the phone number on your card or statement, or sign in through the institution's official app. Avoid phone numbers and links in unexpected breach or fraud messages.

Tell the representative which transaction or account you don't recognize. Ask whether the institution should:

Write down the representative's name, the date, and the case number. Take screenshots before an entry disappears or changes from pending to posted.

Next, change the affected account's password. Change it anywhere else you reused the same password, turn on two-factor authentication, and sign out of unfamiliar devices or sessions.

Freeze your credit

A credit freeze can make it harder for someone to open new credit in your name. It's free, remains in place until you lift it, and must be requested separately from Equifax, Experian, and TransUnion.

A fraud alert is different. It asks lenders to take additional steps to verify your identity. An initial alert generally lasts one year. An extended alert can last seven years if you meet the identity-theft documentation requirements. You can contact one bureau to start a fraud alert; that bureau should notify the other two.

The FTC's credit freeze and fraud alert guidance has current instructions for contacting the bureaus.

Neither measure reverses a charge. A freeze also won't remove an existing fraudulent account or prevent misuse of an account that has already been taken over.

Review and save your credit reports

Get your reports through AnnualCreditReport.com or the bureaus' official websites. Check each report for:

Save the reports before filing disputes. Mark the exact entry and record which bureau is displaying it; the same item may not appear on all three reports.

Create an identity-theft report

File at IdentityTheft.gov if someone used your identity. The FTC report creates a recovery plan and can help document disputes with banks, creditors, debt collectors, and credit bureaus.

It doesn't automatically produce a refund or delete a credit-report entry. You still have to notify each institution handling the transaction or reporting the information.

Disputing an unauthorized credit-card charge

Call the issuer immediately to report the charge and replace the card if necessary. Then consider using the written billing-error procedure described in the FTC's credit-card dispute guidance.

A telephone report may open a fraud investigation, but it isn't a substitute for written notice when you want the protections of the Fair Credit Billing Act process.

Meet the 60-day written-notice deadline

Your written dispute must reach the issuer within 60 days after it sent the first statement containing the error. Use the billing-dispute address listed on the statement or in the issuer's billing-error instructions. That may not be the address where you send payments.

Include:

Keep the original documents and a copy of the complete dispute. Trackable mail can establish when the issuer received it. If the issuer offers a secure document portal, save the upload confirmation.

What happens after the issuer receives it

Under the FTC's description of the billing-error process, the issuer generally must acknowledge the complaint in writing within 30 days unless it resolves the matter sooner. It generally must finish within two billing cycles and no later than 90 days after receiving the complaint.

Continue paying the undisputed portion of the bill. Don't stop unrelated payments while the charge is under review.

Credit-card dispute letter

[Your name]
[Your mailing address]
[Date]

[Card issuer's billing-dispute address]

Re: Billing-error dispute for account ending in [last four digits]

I dispute the following transaction:

Merchant: [merchant name]
Transaction date: [date]
Amount: [$ amount]

I did not make or authorize this transaction. My account information may have been exposed in the [company] data breach reported on [date], but I am disputing this specific charge because it is unauthorized.

Please investigate and remove or credit the disputed charge. Send me written confirmation of the result.

I have enclosed copies of [statement page, identity-theft report, breach notice, and other evidence]. I have retained the originals.

Sincerely,

[Your name]
[Phone number or email]

Don't send a full Social Security number or identity documents through ordinary email. Follow the issuer's secure-upload or mailing instructions.

Reporting debit-card, ATM, and ACH fraud

Debit-card purchases, ATM withdrawals, and unauthorized transfers from a deposit account don't use the credit-card billing-error process. Contact the bank or credit union immediately and identify the specific transaction as an unauthorized electronic fund transfer.

Regulation E covers several electronic payment methods, including ATM, point-of-sale, and ACH transactions. The NCUA's Regulation E overview provides background on covered transfers.

Ask the institution:

  1. How to provide formal notice of the error
  2. Whether written confirmation is required
  3. Whether the card or account should be replaced
  4. Whether provisional credit may apply
  5. What documents it needs
  6. When and how it will report the result

Timing can affect both consumer liability and the institution's error-resolution duties. Report the transaction even if you haven't assembled every supporting document.

Describe the facts carefully. If another person accessed your account and initiated the transfer without permission, say that. If you initiated a payment after being deceived, explain that instead. A payment you authorized after a scam may be treated differently from one made without your authorization.

Wire transfers and some payment-app transactions can follow different rules. For a suspicious wire, call the sending bank immediately, request a recall, and ask it to contact the receiving institution's fraud department. Recovery isn't guaranteed, so speed matters.

Correcting a fraudulent credit-report entry

Disputing a card charge or bank transfer won't necessarily remove related information from your credit reports. If the fraud produced an account, collection, inquiry, balance, or inaccurate payment history, file a credit-report dispute.

Contact each bureau displaying the item

You don't need to dispute an entry with a bureau that isn't reporting it. Send a separate, specific dispute to every bureau where it appears.

Also dispute the information with the furnisher: the bank, lender, collector, or other business that sent the information to the bureau. This allows both the bureau and the source of the information to review their records.

A useful dispute packet contains:

Avoid a general statement such as "my report is wrong." Identify the account or inquiry and explain whether you didn't open it, the balance is incorrect, or the payment history doesn't reflect what happened.

Credit-report disputes are generally investigated within 30 days, although limited circumstances can allow more time. Save the written result. If the entry changes, obtain an updated report or other confirmation showing the correction.

If a bureau says the information was verified, ask what information it used and how it conducted the investigation. You can submit another dispute when you have new, specific evidence and can also return to the furnisher with the bureau's response.

Ask for the identity-theft blocking procedure

The Fair Credit Reporting Act provides a separate process for requesting a block of information resulting from identity theft. This isn't the same as placing a credit freeze.

Ask the bureau for its current requirements. A blocking request commonly includes:

Follow the bureau's submission instructions and keep proof that it received the request.

Credit-report dispute letter

[Your name]
[Your address]
[Date]

[Credit bureau or furnisher]
[Dispute address]

Re: Dispute of fraudulent or inaccurate information

I dispute the following item on my credit report:

Business reporting the item: [name]
Account or inquiry number: [number]
Date reported: [date]
Reason: [I did not open this account / this inquiry is not mine / the balance or payment history is inaccurate]

I believe this information resulted from identity theft or unauthorized use. The related company reported a data breach on [date], if applicable.

Please investigate and delete or correct the item if it cannot be verified as accurate. Send me the written result and identify the information used to verify the entry.

I have enclosed copies of my identification, the relevant report page, my identity-theft report, and supporting records. I have retained the originals.

Sincerely,

[Your name]
[Phone number or email]

Send only the identifying information the recipient requires. Use a secure portal or tracked mail rather than unencrypted email for sensitive documents.

Build a dispute file that someone else can follow

Keep one folder for the matter, with separate sections for the card issuer, bank, bureaus, furnishers, and any settlement administrator. Include:

Your records should distinguish evidence from suspicion. It's reasonable to say that your data was exposed and an account or transaction isn't yours. Don't claim to know how the fraudster obtained the information unless you have evidence.

If the dispute isn't resolved

Escalate after using the institution's own dispute process. A clear file showing what you reported, when the company received it, and how it responded is more useful than starting over with a general fraud complaint.

Submit a CFPB complaint

For an unresolved issue involving a bank, card issuer, lender, credit reporting company, or furnisher, use the CFPB complaint portal.

Attach a concise timeline and the most relevant records. State the correction or refund you requested and what remains unresolved.

A CFPB complaint may prompt a company response, but it doesn't replace a required billing dispute or extend a deadline you missed.

Use the FTC recovery process

An IdentityTheft.gov report can support your disputes and provide a recovery plan. It doesn't replace direct notice to the institution that transferred the money or reported the account.

A police report may also be appropriate, particularly if a creditor or bureau asks for one. For substantial losses, continuing fraud, or repeated failure to address a documented dispute, consider contacting a consumer-law attorney or legal-aid organization. The available rights and remedies can depend on the payment method, the facts, and state law.

Deadlines and expected timing

Action Timing
Written credit-card billing dispute Must reach the issuer within 60 days after it sent the first statement containing the error
Issuer's acknowledgment Generally within 30 days, unless the matter is resolved sooner
Credit-card investigation Generally within two billing cycles and no more than 90 days
Credit-report dispute Generally investigated within 30 days, subject to limited extensions
Initial fraud alert One year
Extended fraud alert Seven years if eligibility and documentation requirements are met
Credit freeze Free and stays in place until you lift it
Debit, ATM, or ACH error Report promptly and ask which Regulation E deadlines apply

Report fraud even if you believe a deadline has passed. An issuer may still review the matter under its fraud policy or another procedure, but don't assume the same statutory protections remain available.

Breach settlements are a separate claim

A card issuer or bank may reimburse an unauthorized transaction through its fraud or error-resolution process. A breached company or settlement administrator may separately offer credit monitoring, reimbursement for documented expenses, or another remedy.

Read the breach notice for:

There isn't a universal refund for everyone affected by a breach. Filing a settlement claim doesn't replace a bank dispute. Likewise, receiving a bank credit doesn't automatically establish eligibility for a separate settlement payment; the settlement terms control that question.

Don't pay an upfront recovery service or give account credentials to someone who contacts you unexpectedly.

Common questions

Does freezing my credit remove a fraudulent account?

No. A freeze restricts access to your credit file for many new applications. It doesn't delete existing entries. Dispute the account with each bureau reporting it and ask whether the identity-theft blocking process applies.

Do I contact the bank or the credit bureau first?

Contact the institution that moved the money as soon as you find the transaction. If the fraud also created an account, collection, inquiry, or inaccurate history on a credit report, dispute that entry with the relevant bureaus and the furnisher.

What if I found a credit-card charge after the 60-day period?

Notify the issuer immediately and ask it to investigate. It may have a separate fraud or card-network procedure, but using the Fair Credit Billing Act's written billing-error protections can be harder after the deadline.

Does an FTC identity-theft report guarantee reimbursement?

No. It documents the identity-theft claim and supports your requests. The bank, issuer, or bureau still follows the process applicable to the transaction or report entry.

Can the breached company correct my credit report?

Usually, the bureau and the business that furnished the entry control the correction. Notify the breached company if its own records are wrong, but don't wait for it before disputing a fraudulent account or transaction.

Call the institution handling the money first, save the case number, and calendar the applicable written-dispute deadline before working through the remaining recovery steps.