An unauthorized credit card charge starts as a billing-error question
For U.S. consumers it sits under CFPB Regulation Z, section 1026.13. This starts when an unauthorized credit card charge pops up. That covers credit given neither to the cardholder nor to anyone with actual, implied, or apparent authority. It's a billing-error issue.
Marketed $0 fraud liability isn't a federal promise (it's a distinct card-network or issuer rule). Worth noting once: The Truth in Lending Act (TILA) and Regulation Z run the federal billing-error process. You should call your card issuer about the unknown charge. Ask how to file a billing-error notice. Then also check which fraud-liability rule covers your account.
What Regulation Z counts as unauthorized use
Authority's what counts. A person with actual, implied, or apparent permission isn't an unauthorized user. Don't skip that difference; look it over first. But under section 1026.13(a)(1), it's a billing mistake if a periodic-statement credit extension wasn't made to you. It also wasn't given to a party with power to use your card or open-end plan.
The statement fails to name the credit extension the way sections 1026.7 and 1026.8 demand. An ID error's different. That one's about how the charge gets listed, not always who approved it (folks mix these up). Honestly, watch that. A gripe about the quality of goods or services you took is different again. Section 1026.13(a)(3) doesn't cover it.
If you're challenging that you approved a charge, name the statement entry. Then spell out the permission issue for review under section 1026.13(a)(1).
A $50 federal cap is not the same as $0 network liability
And federal law doesn't guarantee $0 liability. For U.S. credit cards, secondary sources citing TILA and 15 USC 1643 describe a $50 maximum for unauthorized charges, and it's subject to statutory conditions. Those summaries also say the issuer's got to show that you or an authorized person made the charge (it's a cap). Visa, Mastercard, American Express, and Discover make $0 liability claims, but the available sourcing doesn't establish every condition or exception. Don't assume you owe nothing; check the applicable policy, and check it for your particular card. Report the charge promptly and ask your issuer which limit applies, what evidence it'll need, and how to challenge its decision, since a conditional network policy may provide greater protection than the statutory maximum.
Call the issuer, but put the billing-error notice in writing
But phone your card company first. You'll list your name, account ID, and the contested sum. State why you figure there's a mistake (yes, put it in writing). Then you're mailing a written letter to its billing-inquiries or listed billing-error address, not the payment address.
Some recaps instead treat the statement as "received"; don't get fooled by that mixed start-date wording. It's U.S. Regulation Z. The company must get your letter within 60 days after mailing the first statement showing the error. Worth noting once: Reply is owed within 30 days unless fixed sooner. The outcome is owed within two bill cycles, no more than 90 days.
The CFPB snippet mentions section 1026.13(c)'s time windows without copying them. So don't bank on that clip alone; check the full regulation.
Do not use a quality dispute, debit rule, or chargeback clock
Don't jumble these. Follow the card issuer's billing-error notice steps for an unauthorized charge. Don't swap in a merchant return or chargeback path. Unauthorized use on U.S. credit cards isn't a quality, missing-delivery, or faulty-goods gripe. You're on a different path. Alleged 120-day quality chargebacks don't fix the federal billing-error cutoff. Those 20- to 45-day merchant or network windows don't either.
It's a distinct claims-and-defenses path. The unused-credit cap under section 1666i isn't inside the billing-error process for unauthorized charges.
Ask the issuer how you'd flag a pending suspicious charge. Debit, prepaid, ACH, and Regulation E liability bands don't run this credit-card issue. Typical pay-in-4 BNPL sits outside this rule too. Worth noting once: Pending-versus-posted handling doesn't set a federal posting cutoff. A tiny verification hold alone doesn't prove fraud.
Questions that change the next step
The limit sits at $50, tied to conditions. U.S. federal statute does not promise $0 liability for each unauthorized credit-card charge. Still not bad. Flag a lost card ahead of unauthorized use. Then liability is $0. Issuer zero-liability policies can add extra cover (review the policy, too).
The written billing-error notice window under Regulation Z ignores receipt, the buy date, or the payment due date. It relies on transmission of the first statement that displays the error.
Debit cards use other electronic-transfer rules. Skip the credit-card cap or notice framework. Buy-now-pay-later cover hangs on the product and the rules in play. Do not assume these credit-card safeguards apply. Use inside a person's actual, implied, or apparent authority does not qualify as unauthorized under federal credit-card rules. Flag suspected fraud at once, even while it sits pending. The issuer may need posting before they take a formal transaction dispute.
What controls the charge, and what to do next
TILA and Regulation Z govern this. Debit liability brackets, a quality-dispute chargeback timetable, and a zero-liability catchphrase aren't stand-ins for those safeguards. Unauthorized-use and billing-error rules settle the question on U.S. credit card charges. A store return policy by itself does not set your rights under those rules.
Reach out to the card issuer. You'll mail a written notice to the issuer's billing-error address. Retain a duplicate of that notice, too. Don't drift into other gripes when you explain the problem. Stay on the unauthorized charge or billing error. Honestly, these steps don't promise a refund, fee reversal, account closure, or any given investigation outcome.
It's useful info about the steps, not legal counsel. No citation listed here backs a 2026 rule change.