If a charge, withdrawal, or transfer on your account isn't yours, contact the bank, card issuer, or payment provider through a verified channel immediately. Lock or restrict the payment method, protect your login, save evidence, and ask which dispute process applies.

The remedy depends on the payment method. A credit-card billing dispute follows different rules from an unauthorized ACH debit, a payment-app transfer, or a wire. The familiar 60-day credit-card deadline isn't universal.

Start by confirming what happened

An unfamiliar entry isn't always fraud. Before you dispute it, check:

• Merchant descriptors. A statement may show a parent company, processor, or abbreviated store name.
• Pending activity. A temporary authorization can appear before the final amount posts.
• Subscriptions, free trials, delivery services, and digital wallets.
• Purchases made by another authorized person in your household.
• Receipts, order histories, and email confirmations.

If you still can't verify the transaction, or you see several small charges followed by a larger one, treat it as suspicious. Don't postpone reporting while trying to identify an obviously fraudulent payment.

An unauthorized transaction is one made without your permission. An authorized scam payment is different: you may have entered a password, approved a one-time code, or sent money yourself after being deceived. Report the facts honestly because the provider may apply different rules to a transfer you approved than to an account takeover.

Payment method determines the remedy

These are general U.S. consumer guidelines. Business accounts, commercial cards, international transfers, and some payment apps can have different contracts and protections.

First-hour actions

1. Use an official contact method

Call the number on the back of your card, use the bank's official app, or type the institution's web address yourself. Avoid phone numbers and links in suspicious texts, emails, or social media messages.

Tell the representative that you see a transaction you didn't authorize. Get a fraud case number and record the date, time, department, and instructions you receive.

2. Stop additional payments

Lock the card in the app if that option is available. Ask whether the issuer should cancel and replace the card rather than simply unlock it later.

For a bank-account debit, ask whether the bank can place an ACH block, stop-payment order, or other restriction on future withdrawals. A restriction may not stop a transaction that's already pending, and it doesn't automatically resolve an earlier debit.

For a wire, ask for the wire-fraud department and request an immediate hold or recall. Don't wait for the recipient to respond.

3. Secure the account

From a device you trust:

• Change the financial-account password and any reused password.
• If you suspect email compromise, change the email password associated with the account first.
• Sign out of other sessions and remove unfamiliar devices or third-party apps.
• Turn on an authenticator app or security key when available.
• Ask your mobile carrier to add or confirm an account PIN and a port-out or number-transfer lock.
• Never share a one-time passcode, remote-access code, or password with someone who contacted you unexpectedly.

If your phone suddenly loses service or you receive a notice about a SIM or number change you didn't request, contact the carrier immediately, then notify every financial provider connected to that number.

4. Preserve evidence

Save the statement, alert, transaction ID, merchant details, emails, text messages, caller information, and screenshots. Note the last time you knew the account was secure and the last authorized transaction.

Don't edit screenshots. Store copies somewhere the suspected attacker can't access. Never send your password, full card number, or one-time code as evidence.

5. Monitor for related activity

Review all recent transactions, not just the one that triggered the alert. Check linked accounts, digital wallets, newly added payees, password-reset notices, and account-recovery settings.

A credit freeze can help prevent new accounts from being opened in your name, but it won't stop charges on an existing card or withdrawals from a current bank account.

Disputing an unauthorized credit-card charge

Credit cards generally use the Fair Credit Billing Act billing-error process. That process is separate from a merchant's voluntary refund policy or a card-network chargeback.

1. Call the issuer immediately. Ask whether the card should be blocked and replaced. Calling creates a prompt record, but a phone call alone may not preserve every formal right.
2. Send a written dispute. The notice should reach the issuer within 60 days after the first statement containing the error was sent. Use the billing-dispute address listed on the statement or the issuer's instructions; that address may differ from the payment address.
3. Identify the transaction clearly. Include your name, account details requested by the issuer, transaction date, amount, merchant descriptor, and a short statement that you didn't authorize the charge.
4. Keep proof of delivery and a copy. Save the letter, online submission confirmation, and case number.
5. Pay the undisputed balance. Under the billing-error process, you generally don't have to pay the disputed amount or related finance charges while the issuer investigates, but missing payment on unrelated charges can create a separate problem.

The issuer generally must acknowledge a written dispute within 30 days unless it's already resolved the matter. It must resolve the dispute within two billing cycles, and no later than 90 days after receiving the notice. The FTC's guidance on using credit cards and disputing charges explains the written-notice process.

If the problem is a merchant error, such as a product you never received, describe the facts accurately. The FTC's billing-error guidance covers the same 60-day written-dispute period and investigation timetable.

Reporting an unauthorized debit or ACH withdrawal

Debit cards and ACH withdrawals usually involve an electronic fund transfer from a deposit account. Many covered consumer electronic transfers fall under Regulation E, but the details depend on the transaction, account, and provider.

Contact the bank or credit union as soon as you notice the problem. Use the words unauthorized electronic fund transfer or error. Ask the institution to record the date and time of your notice and explain how to submit any written confirmation.

Under the general Regulation E framework, prompt reporting after a lost or stolen access device can affect your liability. The statement containing the unauthorized transfer also matters, and waiting too long can affect later transactions. Don't assume that the credit-card 60-day process applies exactly the same way to an ACH debit or debit-card transaction.

The Federal Reserve's Official Staff Commentary on Regulation E is a primary reference for the regulation's definitions and error-resolution framework. Ask the bank:

• Whether it considers the transaction covered by Regulation E.
• What notice deadline applies to your transaction.
• Whether provisional credit is available.
• What documents or written statement it needs.
• When it will provide its investigation result.
• Whether the account number, debit card, or online-banking credentials should be replaced.

If a merchant has been pulling money under a recurring ACH authorization, revoke the authorization with the merchant and notify the bank. Ask about a stop-payment order or account-level block for future debits. Revoking future authorization doesn't by itself decide whether an earlier debit was unauthorized.

A bank may provide provisional credit while investigating. That credit isn't necessarily final, so keep the money available until the bank confirms the result.

Payment-app transfers

Report the transaction to the payment app and the bank or card linked to the app. Do both if the app and funding account are separate.

Describe which of these happened:

• Someone accessed your app without permission and sent the money.
• You sent the money after a scammer impersonated a bank, employer, friend, or government agency.
• You paid a legitimate merchant but didn't receive the promised product or service.
• You entered the wrong recipient or amount.

The distinction matters. A transfer sent by an attacker after an account takeover isn't the same as a transfer you approved because of a scam. The provider may investigate both, but the outcome and available protections can differ.

Ask whether the provider can freeze the recipient account, contact the receiving institution, or attempt a reversal. Save the recipient username, phone number, email address, transaction ID, messages, and any fake invoice or payment instructions.

Don't pay a person who promises to recover the money for an upfront fee. Fraud victims are often targeted again by so-called recovery agents.

Wire transfer fraud

Wire transfers can be difficult to recover once they settle, but they aren't always beyond recovery. Speed is the most useful advantage you have.

Call the sending bank's wire or fraud department and request an urgent recall or hold. Provide:

• The amount and date.
• The confirmation or reference number.
• The recipient's name and account information.
• The receiving bank and any intermediary bank details.
• Copies of the email, invoice, or message that caused the payment.
• The time you discovered the fraud.

Ask the sending bank to contact the receiving institution and confirm the recall request in writing. If the wire hasn't settled, or the funds are still in the recipient account, a return may be possible. If the money has moved through several accounts, recovery becomes less likely. A recall is a request, not a guaranteed refund.

If the wire resulted from an email-account takeover or changed payment instructions, secure the email account and notify anyone who might rely on the same instructions. Report significant fraud to local law enforcement and the FBI's Internet Crime Complaint Center. These reports document the incident and may support an investigation, but they don't automatically reverse the transfer.

Account takeover and SIM-swap warning signs

Unauthorized transactions may be only one part of a larger compromise. Look for:

• Password-reset messages you didn't request.
• A new device, payee, or recovery email in account settings.
• Unexpected loss of mobile service.
• A carrier notice about a SIM replacement or number transfer.
• Bank alerts being redirected or stopped.
• Small test transactions across several accounts.
• A caller asking you to move money to a "safe" account.

Secure the email account, mobile number, financial accounts, and payment apps as a group. Remove unknown sessions, replace compromised cards, and ask the carrier about number-transfer protections. An authenticator app or security key is generally stronger than SMS alone, but no authentication method protects you if you voluntarily disclose a code to a scammer.

What doesn't control the dispute

Several common actions help with documentation but don't replace the correct notice:

• A merchant conversation: useful for a mistaken descriptor or legitimate refund, but it doesn't replace notifying the card issuer or bank about suspected fraud.
• A credit freeze: helps with new-account identity theft, not an existing card charge or bank withdrawal.
• A police or FTC report: creates a record and may support enforcement, but it isn't itself a refund order.
• A pending-charge alert: a pending amount may disappear, change, or post. Continue monitoring it.
• A provisional credit: temporary funds may be taken back after the investigation.
• A virtual card: it can reduce exposure of the primary card number, but it won't stop account takeover or an authorized scam.
• The credit-card 60-day rule: it doesn't automatically govern ACH, payment-app, or wire disputes.

Prevention checklist

Use these habits before a fraud event:

• Turn on transaction alerts, including low-dollar alerts when possible.
• Review statements and linked accounts regularly.
• Use a unique password for each financial account and store it in a reputable password manager.
• Prefer an authenticator app or security key over SMS when the provider supports it.
• Add a carrier PIN and number-transfer lock.
• Remove old devices and unused payment apps from account access.
• Keep only the payment methods you need saved in shopping accounts.
• Use card-lock, spending-limit, and merchant-control features when available.
• Check the web address before signing in from an email or text.
• Don't approve a login or payment you didn't initiate.
• Verify unusual payment instructions using a trusted phone number, not the contact details in the message.
• Keep your mailing address and email current so you receive statements and fraud notices.
• Keep a secure list of each institution's official fraud number and your account-recovery steps.

If the bank or issuer denies the claim

Request the decision in writing. Ask what transaction information or authorization evidence the institution relied on, what deadline applies to an appeal, and how to submit additional evidence.

Send a concise timeline:

1. When you last authorized a payment.
2. When you noticed the transaction.
3. When you contacted the institution.
4. What account or security changes you made.
5. Which documents support your account.

For a credit card, confirm that your written notice went to the correct billing-dispute address. For a debit or ACH issue, ask specifically whether the bank treated your report as a Regulation E error notice.

If the response remains unsatisfactory, use the institution's formal complaint process. Depending on the provider, a complaint to the Consumer Financial Protection Bureau or the appropriate federal or state financial regulator may create another review channel. It doesn't guarantee a refund.

For identity theft, keep the FTC identity-theft report and any police report with your records. For wire fraud, preserve the bank's recall confirmation and any FBI or law-enforcement report number. If the loss is substantial or the institution alleges that you authorized the transaction, consider obtaining advice from a qualified professional in your state.

Frequently asked questions

Should I wait for the statement before reporting a fraud charge?

No. Report it as soon as you see it. A credit-card written-dispute deadline may run from the first statement containing the error, but quicker notice can prevent additional charges. Debit, ACH, payment-app, and wire timelines work differently.

Is every charge I don't recognize unauthorized?

No. Check the merchant descriptor, pending authorizations, subscriptions, digital wallets, and authorized users. If you can't verify the transaction, report it promptly rather than guessing.

Can my bank reverse a wire transfer?

The bank can request a recall or hold, and recovery may be possible if the wire hasn't settled or the funds remain available. There's no automatic refund, especially after the money has moved.

What if I approved the payment because of a scam?

Tell the provider exactly what you did and how you were deceived. A payment you personally approved may be reviewed differently from an unauthorized account takeover, but fast reporting still gives the provider the best chance to act.

Does filing an FTC or police report get my money back?

It can document the incident and help investigators connect related fraud, but it doesn't replace notifying the financial institution and doesn't itself order a refund.

Are credit cards safer than bank transfers for disputes?

Credit cards generally offer a more defined billing-error process for qualifying disputes. Bank transfers and wires can have different protections and may be harder to reverse. The payment rail and facts matter more than the word fraud in the complaint.

What should I do today if I already reported the transaction?

Follow the institution's written instructions, keep paying any undisputed balance, monitor linked accounts, and save every case number and message. If the transaction was a wire or an account takeover, confirm that the recall and security changes were actually submitted. If you haven't yet contacted the provider, make that official call before doing anything else.