Start with the payment rail
Start with the payment rail, not the bank's name. A credit-card charge follows a different process from a debit transaction, ACH entry, app payment, or wire.
Report the payment promptly and save the record before anything changes. The bank's name comes later.
Your first notice should identify the transaction, say clearly that you did not authorize it, state when you found it, and record when you notified the provider. That gives the reviewer a timeline to check.
The word "chargeback" covers too much ground. A credit-card billing dispute, a Regulation E error claim, and an in-app payment dispute can have different procedures.
This is general information for U.S. consumer accounts, not legal advice.
What counts as an unauthorized transaction?
In everyday terms, an unauthorized transaction is a payment or transfer you did not initiate or approve. An unfamiliar merchant descriptor is only a clue, not proof.
| What you see | What it may mean | What to do |
|---|---|---|
| An unfamiliar merchant name | The descriptor may not match the store or service name | Compare the amount and date with receipts, subscription records, email, and household spending |
| A charge from a known merchant | It may be a duplicate, renewal, or account takeover | Check the order history and ask whether anyone had permission to use the account |
| A missing card, phone, or access device | Someone else may have obtained access | Lock the account, replace the card or device, and report the transaction |
| You entered a code after a scammer gave instructions | You may have approved a payment under deception | Describe the instructions and exactly what you clicked or entered |
| An unexpected ACH debit or account transfer | Account or payment details may have been misused | Save the statement and contact the financial institution immediately |
Turns out, a quick comparison with receipts and recurring charges often explains a strange descriptor. Do that check quickly, but don't wait for perfect certainty before reporting a real concern.
Deadlines depend on the type of payment
No single deadline covers every payment. The rail and the event you learned about both matter.
| Payment type | Main rule or process | Timing that matters |
|---|---|---|
| Credit card | FCBA billing-error process through the card issuer | Send written notice to the billing-inquiries address on the statement within 60 days after the statement first shows the charge |
| Debit card, ATM, or eligible ACH | Regulation E error and liability rules | Report promptly. The two-business-day rule concerns learning that an access device was lost or stolen, while a statement can trigger a separate 60-day error-notice period |
| PayPal, Venmo, or another payment app | The provider's dispute terms plus the funding source's rules | Report in the app and to the linked bank or card issuer when appropriate. There is no single deadline for every app transaction |
| Wire transfer | The bank's wire agreement and fraud procedures | Call the bank immediately and ask whether a recall or another recovery step is still possible |
Many quick explanations make the two-business-day rule sound universal. It isn't. Under 12 CFR 1005.6, that rule concerns notice after learning that an access device was lost or stolen.
If notice comes within two business days of learning about the loss or theft, liability for transfers made before notice is generally limited to the lesser of $50 or those transfers. Missing that window can raise the limit to as much as $500 under the rule's formula.
There is another timing rule. After the statement-based 60-day period, later transfers can create additional exposure if the institution establishes that timely notice would have prevented them.
Regulation E also has a separate error-notice rule tied to the statement that first reflects the transfer. An institution may accept oral notice, but it can require written confirmation in some situations. Written notice leaves a better trail.
Credit-card billing disputes follow a different path. Send the dispute to the billing-inquiries address printed on the statement, not merely the address used for payments, and keep paying the undisputed part of the bill while the issuer reviews the charge.
Build an evidence file that answers five questions
Strong evidence lets a person unfamiliar with the incident follow the sequence without guessing. Begin with the original statement, then add records showing what happened before and after discovery.
| Question | Useful evidence | Why it helps |
|---|---|---|
| What transaction are you disputing? | Statement PDF, date, amount, merchant descriptor, transaction ID, and account ending in the last four digits | Identifies the exact charge |
| When did you discover and report it? | Alert, statement date, call timestamp, secure message, email, and case number | Shows the timeline and prompt notice |
| Could someone else access the account? | Login alerts, password-reset notices, device history, 2FA messages, and card-possession details | Provides context about possible account takeover |
| Did the merchant or app provide anything? | Order history, delivery record, refund request, chat, and response | Helps separate fraud from a billing or service dispute |
| What did you do to stop more losses? | Card replacement, account lock, password change, and new 2FA confirmation | Shows the steps taken after discovery |
Save original PDFs, not just cropped screenshots. Keep a copy outside the affected account.
Thing is, technical evidence is easy to overread. An IP mismatch can support your explanation, but VPNs, mobile networks, shared Wi-Fi, and inaccurate geolocation can weaken it. A successful 2FA event shows that a credential or device was used; it doesn't always show who was behind it.
What to do in the first hour
Work in this order:
- Secure access. Lock the card or account, call the official fraud number, change compromised passwords, and enable 2FA. If the device may be compromised, use a different trusted device when possible.
- Check the transaction details. Confirm the date, amount, descriptor, funding source, and transaction reference. Look for related charges, but don't delay the report.
- Notify the right parties. Tell the bank, card issuer, or app that you're reporting an unauthorized transaction. Ask which payment rail it is investigating.
- Get a case number. Record the representative's name, call time, case number, and any deadline for follow-up documents.
- Send written notice. Include the transaction details, a clear statement that you didn't authorize it, and the date you first noticed it.
- Preserve supporting records. Download statements, save alerts and messages, and keep copies of every submission.
- Add reports when they fit. A police report or identity-theft report can support a claim involving a stolen device, account takeover, or repeated losses. It isn't automatically required for every disputed transaction.
- Monitor the account. Review later statements, watch for replacement-card activity, and follow up if the provider misses its stated response date.
A dispute letter you can adapt
For a credit-card claim, use the billing-inquiries address on the statement. For a debit or ACH claim, use the institution's stated fraud or error-reporting channel and keep proof of delivery.
Subject: Unauthorized transaction dispute for account ending in [last four digits]
I am disputing this transaction:
Date: [date]
Amount: $[amount]
Merchant or recipient: [name]
Transaction or reference number: [number]I did not authorize this transaction. [Briefly describe when and how you discovered it. Include accurate facts about card possession, account access, alerts, or suspected account takeover.]
Please investigate this transaction and confirm receipt of my dispute. Please also tell me whether you need written confirmation or additional documents.
Attached are [statement page, screenshots, alerts, messages, police report number if applicable, and other records].
[For a debit or ACH claim: Please treat this as notice of an error under the applicable Regulation E procedures.]
[For a credit-card claim: Please treat this as a billing-error notice under the applicable credit-card rules.]
Sincerely,
[Full name]
[Mailing address]
[Phone or secure contact method]
Use facts you can support. Don't say you never shared a credential, approved a prompt, or used a device unless that is true.
Chase, Bank of America, PayPal, and Venmo
| Provider or situation | Practical step | Do not assume |
|---|---|---|
| Chase or Bank of America account | Use the official app, the number on the card, or the provider's website to report the transaction and ask how to submit written evidence | An app report and a formal written error notice are always the same thing |
| PayPal or Venmo transaction | Open the dispute from the transaction record, save the transaction ID and messages, and notify the linked bank or card issuer if its account was charged | An in-app dispute automatically starts the bank's deadline |
| Shared device or family account | Explain who had access and whether anyone had permission | A familiar device proves that you personally approved the payment |
| Payment approved after a scam | Describe the instructions you received and what you clicked or entered | A tricked approval will necessarily be treated like a transfer made without your involvement |
The provider's brand doesn't replace the payment rule. Ask whether the case involves a credit card, debit card, ACH transfer, account takeover, peer-to-peer payment, or merchant purchase.
Platform terms, account settings, and funding sources can change the workflow. Use the current instructions shown in the account, and keep a copy of the submission.
If the provider denies the claim
Read the stated reason first. It may rely on device authentication, a merchant response, an alleged authorized user, a shared credential, or the transaction's classification.
Compare that explanation with your timeline. Correct factual errors, add missing records, and request a second review if the provider offers one.
Keep the appeal indexed and focused. Send the statement, notice date, case number, denial, and two or three strongest supporting items first.
| Escalation step | What to include |
|---|---|
| Internal review | Original case number, denial reason, timeline, and the specific fact you believe was missed |
| Bank or card complaint channel | Copies of the notice, statements, evidence, and response letters |
| CFPB complaint | A concise chronology, the company name, requested resolution, and supporting documents |
| Legal or local consumer help | The amount at issue, deadlines, contracts, notices, and the provider's final position |
The CFPB complaint portal accepts complaints about checking and savings accounts, credit cards, credit reports, money transfers, virtual currency, and money services. The CFPB says companies generally respond in 15 days, but a complaint doesn't guarantee reimbursement or replace the provider's dispute process.
Questions that often affect the result
Is a police report required?
No universal federal rule requires every consumer to attach one. A bank or platform may request it under its own procedure, and it can help document theft, identity fraud, or repeated account access.
Report the transaction first.
Does an IP address prove that a transaction was fraudulent?
No. An IP address can show that a login or session came from a location unlike your usual activity, but it can't identify the person with certainty. Treat it as supporting evidence.
What if I approved the payment because a scammer tricked me?
Report the sequence, not just the outcome. Explain what the scammer told you, what you clicked, what code or credential you entered, and when you realized something was wrong.
A transfer approved after deception may be reviewed differently from one made by someone who accessed the account without your involvement.
Should I stop paying a disputed credit-card balance?
Keep paying the undisputed balance and follow the issuer's written instructions. Withholding unrelated charges can create a separate payment problem.
Official rules and your next step
Read the Regulation E liability rule and the broader Regulation E text for the federal electronic-transfer framework. Those rules don't make every wire, app payment, business account, or credit-card dispute identical.
To be honest, the most useful next move is simple: download the statement, call the number on the card or official app, and write down the case number before submitting your evidence.