An unauthorized transaction is a payment or withdrawal you didn't make or approve, and you should contact the bank, card issuer, or payment app immediately. Then use that payment type's dispute process.
If you think your login or device may be compromised, secure it before another transaction clears on the same account. Did a charge appear that you never approved?
A payment you approved after a scam is a different event, and the provider may use a different review process. Report the facts as they happened.
These steps are for U.S. consumers and provide general information, not legal advice.
Start with the first hour
You don't need to spend hours trying to identify the person behind the transaction when the useful work is stopping further activity and opening a record. Use official contact details only.
- Check the transaction once. Confirm the date, amount, merchant or payee, and whether it is pending. Turns out, a familiar merchant name may belong to a subscription, digital wallet, or household purchase.
- Call the provider using the number on your card, statement, or official app. Say you don't recognize the transaction and want to report possible fraud.
- Ask what can still be stopped. You can request a card block, removal of an unfamiliar payee, a hold on a pending transfer, or a wire recall request.
- Change exposed passwords from a device you trust. Start with your email account, bank account, payment app, and phone-carrier account.
- Write down the time of the call, the representative's name, the case number, and the next deadline.
Don't use a phone number or link supplied in a suspicious message.
Match the payment rail to the dispute process
A credit card charge, ACH debit, ATM withdrawal, and wire transfer should not be reported as if they were the same event. The payment method controls much of the response.
| Payment type | Contact first | Ask for | Keep |
|---|---|---|---|
| Credit card | Card issuer | Fraud review and written billing-error instructions | Statement, transaction details, and dispute copy |
| Debit card | Bank or credit union | Card block and electronic-transfer error process | Account record, call notes, and case number |
| ACH or recurring debit | Bank and merchant | Stop or block future debits and review the posted item | Authorization details and cancellation confirmation |
| Prepaid card | Card program provider | Account lock and unauthorized-transaction review | Card number details and provider correspondence |
| Peer-to-peer payment | Payment app and linked bank or card | In-app fraud report and linked-account review | Transaction ID, screenshots, and support case |
| Wire transfer | Sending bank, then receiving bank if known | Recall request and action on pending transfers | Wire confirmation, recipient details, and call records |
| ATM cash withdrawal | Bank or card issuer | Card block and investigation of the cash withdrawal | ATM location, time, amount, and receipt |
A merchant refund, a bank investigation, and a government fraud report are separate tracks. Starting one does not automatically complete the others.
How to dispute an unauthorized credit card charge
Send written notice so it reaches the issuer within 60 days after the first bill containing the error was sent, per the FTC's guidance on disputing credit card charges. Credit card billing errors follow that federal process.
Your letter needs the transaction date, amount, merchant name, and a clear statement that you did not authorize the charge. Use the issuer's billing-error address. Or follow the issuer's written instructions, not a random address from an email.
Call the issuer as soon as you see the charge, because a phone call can alert the fraud team even though written notice protects the billing-error record. Keep a copy of everything you send.
The FTC says the issuer must acknowledge the complaint in writing within 30 days, unless it has already resolved the issue. It generally has no more than 90 days to investigate and resolve the dispute.
These timeframes apply to credit card billing errors. They do not cover every payment.
You can contact the merchant too, especially if the charge might be a mistaken subscription rather than a stranger's purchase. Don't pause the issuer dispute while you wait.
Debit, ACH, prepaid, and P2P payments
Do not assume the 60-day credit card deadline is the correct deadline for debit cards, ACH debits, prepaid cards, or peer-to-peer payments. Those products use different provider procedures.
Tell the bank exactly what happened, including whether it was a card purchase, cash withdrawal, ACH debit, recurring payment, or payment-app transfer, because those labels matter and the institution may route each item to a different team even when you think you already explained the whole mess. Ask whether the bank requires a written notice, a signed statement, or additional information.
Ask what happens while the investigation is open. Ask how to report another unauthorized item if one appears.
A recurring debit deserves two calls. Contact the merchant to cancel the recurring arrangement, then ask your bank how to block or stop future debits. Keep both confirmations on file.
Open the payment app yourself rather than following a text-message link to report an unauthorized transfer. Use official support or the in-app dispute flow. Notify the linked bank or card issuer as well.
Wire transfers need a faster response
Call the sending bank's fraud department immediately if a wire is pending or has already been sent, and give the amount, date, recipient information, and confirmation number. Request a recall of the funds. Ask whether the bank can stop any pending transfer.
Notify the receiving institution through an official channel if you already know which bank that is. It may need the sending bank's reference information before it can review or freeze funds.
The receiving account may have moved the money, and the bank's ability to recover it depends on the circumstances. Thing is, a recall request isn't a guaranteed refund.
The Office of the Comptroller of the Currency's wire-fraud guidance advises consumers to ask the bank about steps such as closing an account or stopping pending transfers. Follow the bank's instructions and keep every reference number.
File a detailed report with the Internet Crime Complaint Center promptly if the fraud began online. A report will not replace the bank's recovery request. It gives investigators a record to use.
Signs of account takeover
An unfamiliar payee may be the visible part of a larger problem. Warning signs include a password-reset message you did not request, a changed phone number or email address, an unknown device, a new transfer rule, or a one-time code request from someone claiming to be support.
The IC3 account takeover guidance describes phishing pages, fake bank or support representatives, fraudulent search ads, and social engineering used to obtain login details or one-time passcodes.
Sometimes the fraud starts with a fake delivery text, sometimes with a search ad, and sometimes with a convincing call that keeps you busy while someone else changes the account settings, and you only catch it when a payee you never added is already sitting there. The entry point is not the same. The response is much the same.
Change the bank and email passwords from a clean device. Sign out of other sessions, and if the provider allows it, reset multifactor authentication after you remove unknown devices and revoke unfamiliar app access. Ask the bank to remove unknown payees, trusted contacts, and transfer rules.
Contact your mobile carrier if the phone suddenly loses service or the number changes without permission. Tell the bank about the possible phone-account compromise too.
Build a clean record
Your evidence should create a simple timeline. Keep the original messages, even when they are unpleasant or embarrassing.
- [ ] Transaction date, amount, merchant or recipient, and pending or posted status
- [ ] Screenshots of the account entry, alerts, emails, and suspicious login notices
- [ ] Names of representatives, call times, case numbers, and promised follow-up dates
- [ ] Copies of written disputes, cancellation requests, and bank responses
- [ ] For online scams, the sender address, phone number, website address, and a short timeline
Store copies somewhere the suspected attacker cannot change. Do not include passwords, one-time codes, or full account numbers in ordinary email.
Report the fraud through the right channel
The transaction dispute belongs at the bank or payment provider. Outside reporting channels matter when identity information or online crime is involved.
File a report with the FTC's identity theft recovery service if someone used your personal information to open an account, obtain employment benefits, or commit another form of identity theft. The FTC says you receive a free personal recovery plan with recommended next steps.
Submit a complaint to IC3 for an internet-enabled crime. Include the transaction details and the steps you already took with the financial institution.
The FBI's information on common frauds and scams covers phishing, spoofing, and skimming. It describes skimming as the use of illegal devices on ATMs, point-of-sale terminals, or fuel pumps to capture card data or PINs. Stop using an ATM or card reader that appears tampered with, and tell the bank where and when you saw it.
The OCC's HelpWithMyBank resources may explain the appropriate banking contact if your bank is a national bank or federal savings association and the issue remains unresolved. Check your account disclosures for the institution's regulator before escalating.
What does not control the dispute
A bank's fraud review is not the same as a merchant's refund policy. The FTC report and IC3 complaint document identity theft or internet crime, but they do not substitute for notifying the financial institution.
The credit card billing-error timeline is not a universal deadline. Ask the provider for the rule that applies to the actual payment rail, since debit, ACH, prepaid, P2P, and wire transactions can have different procedures.
A transaction you approved after being deceived also needs an honest description. Explain the impersonation, instructions, codes shared, and payment steps rather than labeling it as a transaction you never authorized.
Avoid common mistakes
Leave the suspected scammer's messages unanswered, and don't click a second link that claims you need to "verify" the account. Don't keep the chat going.
Do not delete messages or reset a device before saving useful evidence. Do not pay a stranger who promises a guaranteed recovery of your money.
To be honest, the first report may feel repetitive because the bank, payment app, and investigators ask for similar details. Give each one the same timeline. Then check case numbers and correct errors quickly.
Questions people ask
What if the transaction is still pending?
Call now. Ask whether the provider can block, stop, or flag it before it posts.
If it later posts, report it again as a completed transaction and keep the original case number.
What if I shared a one-time passcode?
Report that fact. Sharing a code can affect how the provider reviews the event, but it does not make account security steps optional.
Change passwords and end active sessions. Ask the bank to review every recent account change.
Can a wire transfer be reversed?
Ask the sending bank for a recall immediately. Recovery is possible in some cases, but no bank can promise that a completed wire will be returned.
Should I contact the FTC or IC3 first?
Contact the bank or payment provider first so it can try to stop further loss. Then use the FTC for identity theft and IC3 for internet-enabled crime when those situations apply.
Your next move
Write down the transaction details, open the provider's official app or website, and call its fraud department now. Ask for the case number before ending the call.
Then secure your email and bank access from a trusted device.