An unfamiliar transaction does not require a dramatic packet of paperwork. For a U.S. consumer, the practical sequence is simpler: report it promptly, identify the payment rail, and send facts the bank or platform can verify.
An account statement proves the transaction posted. It does not, by itself, prove who authorized it. There is no universal affidavit, police-report rule, or honest 70-90% success guarantee. This is general information, not legal advice.
People use "chargeback" for several different processes. A credit-card dispute, a Regulation E error claim for an ACH debit, and a wallet account-takeover claim are not the same case.
Start by identifying the payment rail
The payment type determines which rules and deadlines may apply. Start there.
| Transaction type | Main dispute route | First action |
|---|---|---|
| Debit card, ATM, or other electronic fund transfer | Regulation E may apply, along with the bank's fraud process | Report an unauthorized EFT to the account-holding institution |
| ACH debit | Regulation E may apply to a consumer account | Give the bank the ACH company name, amount, date, and trace information |
| Credit card | Issuer fraud and billing-error process | Use the issuer's reporting channel and follow its written instructions |
| Wire transfer | Bank wire-fraud and recovery process | Request an immediate recall and fraud review |
| PayPal or another payment app | Platform rules plus the underlying bank or card rail | Report the account activity to the platform and the funding institution |
| Cryptocurrency transfer | Exchange terms and account-security process | Secure the exchange account and provide the transaction hash and access records |
Regulation E is a consumer-account rule. Business accounts, commercial products, and some types of transfers may fall outside it. Ask the institution which rule and account classification it is applying.
What evidence helps an unauthorized transaction dispute
Proof works best as a clear timeline, not a pile of unrelated screenshots. The bank needs to see what happened, when you noticed it, and why the transaction was outside your authority.
| Evidence | What it can show | Important limit |
|---|---|---|
| Bank statement or transaction record | Date, amount, merchant descriptor, and reference number | It identifies the transaction but does not alone prove nonauthorization |
| Personal timeline | Last legitimate use, discovery date, card possession, and report date | Stick to facts and mark anything you do not know |
| Bank or app alerts | Login, device, password-reset, card-lock, or two-factor events | Save the original notification and timestamp |
| Card or device details | Whether the card or device was lost, stolen, replaced, or still with you | Explain who could access it |
| Bank and merchant correspondence | Case number, refund response, and communication dates | Keep emails, secure messages, and call notes |
| Signed personal statement | A consistent first-person account of the dispute | A notarized affidavit is not automatically required |
| Police or identity-theft report | An independent record of theft or identity misuse | Helpful in some cases, but not a universal condition of a Regulation E claim |
Your bank may review IP addresses, device information, card-present data, or location. You may not receive every internal record. Thing is, a foreign IP address is supporting context, not a verdict; mobile networks, VPNs, and shared devices can make location data messy.
Keep original PDFs and emails. Screenshots are useful, but do not crop away dates, merchant names, or reference numbers.
Your first 24 hours
Do not wait for perfect evidence before reporting the transaction.
- Secure the account. Lock the card, change exposed passwords, sign out unknown devices, and ask whether related accounts need protection. Save alerts before deleting anything.
- Contact the institution that holds the funds. Say that you are reporting an unauthorized transaction or electronic fund transfer, if that is accurate. Give the date, amount, and merchant or recipient.
- Ask for a case number. Write down the representative's name, the reporting time, and the promised next step.
- Send written notice. Use the bank's secure message system, dispute form, or the address it provides. List each disputed transaction separately.
- Preserve the file. Save the statement, timeline, alerts, correspondence, and any merchant response in one folder.
- Monitor for related activity. Report additional unauthorized transactions promptly instead of assuming the first report covers everything.
A phone call may start the process. Under Regulation E, the institution may require written confirmation within 10 business days after an oral notice, so send the follow-up promptly if requested. Do not email passwords, full card numbers, or security codes.
A factual statement you can adapt
Some institutions use an affidavit or cardholder declaration. You can begin with a plain statement instead:
Statement of unauthorized transaction
I, [full name], dispute the [debit card, ACH, or EFT] transaction dated [date] for [amount] to [merchant or recipient].
I did not authorize this transaction. To the best of my knowledge, no person I authorized made it.
I discovered the transaction on [date] and reported it to [institution] on [date] through [phone, app, branch, or other channel]. My case number is [number].
At the time, the card or device was [in my possession, lost, stolen, or other accurate description].
Please investigate this transaction and tell me what additional information or written confirmation you need.
Signed: [name]
Date: [date]
Use only statements you can support. If you shared a password, code, or device with someone, explain what happened accurately instead of copying a denial that does not fit.
Regulation E deadlines and investigation rules
For many unauthorized debit and ACH transactions from a consumer account, Regulation E is the key federal framework. The two dates people most often mix up are the date an access device was lost or stolen and the date the transaction first appeared on a statement.
| Situation | Rule to remember | What to do |
|---|---|---|
| You learn an access device was lost or stolen | Notice within two business days can limit liability to the lesser of $50 or the unauthorized transfers before notice | Call the institution immediately |
| An unauthorized EFT appears on a statement | Notice generally must reach the institution within 60 days after the statement showing the error was sent | Use the statement date and report promptly |
| You give oral notice | The institution may require written confirmation within 10 business days | Send secure written confirmation if requested |
| The bank needs more investigation time | The rule includes extension and provisional-credit procedures, with exceptions | Read the bank's written notice and calendar the next deadline |
The 60-day period is not a reason to wait. Late notice can increase liability for transfers that occur after the relevant notice period.
A clear error notice should identify your name, account, disputed amount, transaction date, and reason you believe the transaction is unauthorized. Read the Regulation E liability rule and the Regulation E error-resolution rule if the bank gives you an unusual deadline or says the procedure does not apply.
Credit-card disputes use a different track
Regulation E is not the blanket rule for ordinary credit-card purchases. Start with the card issuer's fraud department, then follow its written billing-dispute instructions and the address shown for billing inquiries on your statement.
Ask the issuer what documents it needs and when they must arrive. Keep paying the undisputed portion of the bill while the issuer reviews the charge, unless the issuer gives you different instructions.
Visa and Mastercard network rules guide the issuer-merchant chargeback process. They do not create one universal customer checklist or guarantee reversal. An issuer may request a declaration or police report, but neither document is automatically required for every credit-card dispute.
Do not label a recognized purchase as unauthorized simply because the product was poor, late, duplicated, or difficult to cancel. Describe the real problem. A merchant refund, subscription dispute, and account takeover may follow different paths.
ACH, payment apps, wires, and crypto
An ACH debit you never approved should be described to the bank with the company name, transaction date, amount, and trace number if available. An ACH payment you personally approved but later regretted may be a different authorization or stop-payment issue, so explain the sequence carefully.
For PayPal and other payment apps, report the activity inside the app and contact the bank or card issuer if money left that underlying account. An account takeover is different from a payment you deliberately sent after a scammer persuaded you to do so. Report both situations, but do not describe them as identical.
A cryptocurrency transaction hash proves that a transfer occurred on the network. It does not, by itself, prove who controlled the account. Send the exchange its hash, wallet addresses, login alerts, device history, and timeline. If an unauthorized debit card or bank transfer funded the exchange account, dispute that underlying transaction separately.
Wire transfers need speed. Ask the bank for a recall, contact with the receiving institution, and a fraud review as soon as possible. A recall request is not a guaranteed reversal.
If the bank denies the dispute
Read the denial closely. "Authenticated," "late notice," "not covered," and "insufficient information" point to different responses.
Appeal in writing and answer the stated reason directly. Include:
- A one-page chronology with discovery and report times
- A table of each disputed transaction and its amount
- The case number and copies of your original notice
- New evidence that was not previously reviewed
- A specific request for correction, provisional credit, or a written explanation
Ask for the documents and records the institution relied on. The error-resolution rule addresses written explanations when an institution concludes that no error occurred, so keep the request precise.
To be honest, a police report can strengthen a file, but it cannot repair a late notice or replace a clear explanation. An IP address can support your account, but it cannot settle every dispute. False or exaggerated statements can damage a legitimate claim.
If the institution ignores a properly timed notice or does not explain its decision, use the bank's complaint channel and consider a complaint to the Consumer Financial Protection Bureau. Keep your original documents. Send copies, not the only record.
Claims that weaken a dispute
Waiting for a police report is a common mistake. Report the transaction first, then add the report when it is available.
Another mistake is treating the bank statement as the entire case. It identifies the charge, but your timeline, notice records, access alerts, and account-control details give the institution something to investigate.
Ignore websites promising a universal approval rate. The official rules set notice duties, investigation procedures, and possible liability limits; they do not promise that a particular evidence bundle will win.
Download the statement today, write the timeline while the details are fresh, and report the transaction through the institution's official channel. Then send the factual statement and keep the confirmation number with every document.