If a transaction isn't yours, call your bank, card issuer, or payment app now. Use the number on the back of the card or an official app or website, not a number in an unexpected text or email. Lock the affected payment method, protect your logins, save the records, and ask for a claim or fraud-investigation number.

A merchant may help explain an unfamiliar descriptor, but don't wait for the merchant or recipient before notifying the financial institution. The deadline and refund process depend on how the money moved.

These steps are for U.S. consumer accounts. Business accounts and transactions in other countries can follow different rules.

Identify the payment rail

An unfamiliar merchant name isn't automatically fraud. It may be a parent company, processor, subscription renewal, hotel deposit, fuel-station hold, or a purchase made by an authorized user. Check the descriptor and ask household members before filing a claim if you can do so without delaying notice.

If you recognize the purchase but the amount, delivery, quality, or cancellation is wrong, describe it as a billing or merchant dispute. Don't call an ordinary purchase problem unauthorized.

What to do as soon as you notice the transaction

1. Check its status. Save a screenshot showing whether it is pending or posted, along with the date, amount, merchant or recipient, and transaction details. A pending authorization may disappear, but it can also post later.
2. Use an official contact channel. Call the number on the card, sign in through the institution's official app, or type the institution's web address yourself. Tell the representative you are reporting an unauthorized transaction.
3. Stop more payments. Ask the bank or issuer to block the card or account, replace the card, and determine whether the underlying account number also needs to change. Locking a card won't necessarily stop an ACH debit or an online transfer.
4. Explain what happened plainly. Give the date, amount, merchant or recipient, and whether you still have the card, phone, or other access device. If someone entered your account without permission, say that. If you personally approved a payment after being deceived, say that instead.
5. Secure connected accounts. From a trusted device, change the bank, payment-app, email, and mobile-carrier passwords. Sign out of other sessions, remove unfamiliar devices, revoke unknown app access, and use an authenticator app or security key where available.
6. Deal with recurring debits. Contact the merchant to revoke the authorization and ask the bank how it blocks future debits. Keep an eye out for a small test charge or another debit.
7. Save the paper trail. Keep statements, alerts, emails, chats, login notices, device information, transaction IDs, wallet addresses, and a timeline of your calls.
8. Get the next deadline. Ask for the claim number, whether a form or written statement is required, when provisional credit might be issued, and when the investigation result is due.
9. Review related accounts. Check other cards, bank accounts, payment apps, email accounts, and credit reports for activity you don't recognize.
10. Report other wrongdoing when appropriate. An FTC identity-theft report or police report can document the incident, but neither replaces prompt notice to the bank. Internet-enabled theft and crypto scams can also be reported through the FBI's Internet Crime Complaint Center.

A simple call script

You can say:

"I am reporting an unauthorized transaction on my consumer account. It is for [amount] on [date] from [merchant or recipient]. I did not authorize it. Please block further transactions, open an investigation, give me the claim number, and tell me what written confirmation you need."

If that statement isn't accurate because you approved the payment after a scam, describe the deception and the steps you took. Accuracy matters: an account takeover and an authorized scam payment may be handled under different rules.

Don't share a one-time passcode with anyone who calls you. A caller who knows your name, account details, or recent transactions may still be a scammer.

Debit cards, ACH, and Regulation E

Regulation E covers many consumer electronic fund transfers, including qualifying debit-card transactions, ATM withdrawals, ACH debits, and transfers initiated through online banking. The NCUA's Regulation E guide summarizes the federal framework.

The often-repeated "two-business-day rule" isn't a universal deadline that automatically destroys every later claim. It mainly affects potential liability after a lost or stolen access device:

• If you notify the institution within two business days after learning that the access device was lost or stolen, liability is generally limited to the lesser of $50 or the amount transferred before notice.
• If you wait longer, liability can rise to the lesser of $500 or $50 plus qualifying transfers made after the two-business-day period and before notice.
• If an unauthorized transfer appears on a statement and you don't report it within 60 days after the statement was sent, you may be responsible for later transfers that the institution establishes could have been prevented by earlier notice.

These are federal liability rules, not a promise that every disputed payment will be refunded. The account agreement may provide stronger protection, and the result depends on the payment and the facts. Report the transaction when you see it, even if you're still trying to understand the merchant name.

The bank's investigation

A bank or credit union generally has 10 business days to investigate an alleged error. If it needs more time, it may have to provide provisional credit while it continues the investigation, subject to the rule's conditions. Regulation E generally allows up to 45 calendar days, with longer periods for some point-of-sale, foreign, or new-account transactions.

The institution should tell you its decision. If it says there was no error, request the explanation and the records it relied on. Provisional credit can be reversed if the investigation finds no covered error, so read the notice and meet any follow-up deadline.

You may be able to report the error orally, but the institution can require written confirmation within a specified period. Ask whether it needs a form or letter and keep proof that you submitted it.

Credit card fraud and the FCBA

Credit card billing disputes use a different process from debit-account claims. Under the Fair Credit Billing Act, an unauthorized charge can be a billing error. The FTC's guidance on disputing credit card charges says the written notice must reach the issuer's billing-dispute address within 60 days after the first statement containing the error was sent.

Take these steps:

1. Call the issuer immediately to block the card and report the charge.
2. Find the billing-dispute address on the statement. It may not be the address used for payments.
3. Send a letter with your name, account number, transaction date, amount, merchant, and a short statement that the charge was unauthorized.
4. Include copies of useful evidence and keep the originals.
5. Send the letter in a way that gives you delivery confirmation. Keep a copy of the letter and delivery record.
6. Pay the undisputed part of the bill on time unless the issuer gives you different written instructions.

The issuer generally must acknowledge the written dispute within 30 days unless it has already resolved the matter. It must investigate and resolve the dispute within two billing cycles, and no later than 90 days.

Federal law generally limits liability for unauthorized credit card use to $50. Many issuers offer broader zero-liability policies, but those policies can have their own conditions. Check the terms for the specific card.

Debit card and ACH claims need separate attention

Debit fraud can involve both the card and the deposit account behind it. A card lock may stop new card purchases while leaving an unauthorized ACH debit or online transfer unaffected.

When you report the claim, tell the bank:

• Which transactions are unauthorized, listing each one separately
• Whether your physical card, phone, login credentials, checks, or account number were lost or exposed
• Whether you still have the card or device
• Whether the transaction was a recurring debit
• Whether any other unfamiliar transfer appeared afterward

Ask whether the bank recommends a replacement card, a new account number, a password reset, or restrictions on outgoing transfers. Submit any required claim form or written statement quickly.

An ACH debit may appear under a processor or company name you don't recognize. Verify the descriptor if possible, but don't let that search delay notice when the money clearly wasn't authorized.

For a recurring payment, contact both the merchant and the bank. The merchant may be able to cancel future debits, while the bank can explain its own blocking procedure.

Wire transfers: request a recall immediately

A traditional domestic wire generally doesn't receive the same Regulation E liability and provisional-credit treatment as a debit-card or ACH transfer. The sending bank's wire agreement and applicable law usually control.

Call the sending bank's wire or fraud department immediately. Request a recall or cancellation and provide:

• The wire reference number
• Amount and date
• Beneficiary and receiving-bank details
• The reason for the request
• Any evidence of impersonation, malware, or account compromise

A recall is a request, not a guaranteed reversal. The recipient may already have withdrawn the money, and the receiving institution may need the sender's cooperation. Ask whether the bank contacted the beneficiary bank and whether it needs a written statement.

If the wire involved an impersonator, compromised email account, malware, or another online crime, report it to law enforcement and the FBI's IC3 complaint system. A report creates a record but doesn't ensure recovery.

International remittance transfers can have separate federal protections and cancellation procedures. Tell the provider that it was a remittance transfer and ask which rules apply.

P2P payments: account takeover or scam?

Report an unauthorized Venmo, PayPal, Zelle, Cash App, or similar payment through the service's official app or website. Then notify the bank or card that funded the payment. Do both even if only one account appears to have been hacked.

Use the description that matches what happened:

• Account takeover: Someone accessed your app or bank account and sent the payment without your knowledge or permission.
• Authorized scam payment: You personally entered or approved the payment after a scammer deceived or pressured you.
• Merchant or purchase dispute: You authorized a purchase but received the wrong amount, a duplicate charge, or no service.

Some P2P payments may involve an electronic fund transfer from a consumer account, but no single refund rule covers every app, funding method, and fact pattern. The app's policy, the linked bank or card, and the way the payment was initiated all matter.

Don't describe an authorized scam as an account takeover just to fit a stronger category. Give the provider the exact sequence: who contacted you, what they claimed, what information you provided, and whether you entered or approved the payment.

Cryptocurrency withdrawal or wallet theft

Once a crypto transfer is confirmed on a blockchain, it is usually difficult or impossible to reverse. Speed still matters. An exchange may have more options while a withdrawal is pending or while the assets remain identifiable.

For an unauthorized exchange withdrawal:

1. Freeze the exchange account and contact its security team through the official site.
2. Change the email and exchange passwords, sign out other sessions, and remove unknown API keys or devices.
3. Turn on stronger two-factor authentication and review withdrawal settings.
4. Send the exchange the transaction hash, destination wallet address, time, asset, amount, and screenshots.
5. If a self-custody wallet is compromised, stop approving transactions. Contact the wallet provider or a qualified security professional before moving remaining assets.
6. Report the incident to the exchange and, for an online scam, to IC3. The FTC's cryptocurrency guidance lists additional reporting options.

If an unauthorized debit or credit card transaction funded a crypto purchase, dispute that bank or card transaction separately. Reversing the funding payment doesn't automatically reverse a crypto transfer that you authorized or sent on the blockchain.

Never pay an upfront fee to someone who promises guaranteed crypto recovery. People who lose crypto are often targeted again by supposed recovery services.

Keep evidence and follow up

A single folder and a short timeline can make the claim easier to explain. Record:

• When you noticed the transaction
• The transaction date, amount, merchant, recipient, and reference number
• Whether it was pending or posted
• When and how you notified each provider
• Representative names, claim numbers, and promised response dates
• Screenshots of statements, alerts, login activity, emails, and app messages
• Police, FTC, or IC3 report numbers, if you filed one

If the provider denies the claim, ask for the decision in writing and the transaction records or other documents used to reach it. Compare its explanation with your records, correct any factual error, and submit a concise reconsideration request through the provider's formal complaint channel.

If you need to identify the institution's regulator or complaint route, use the institution's official website or account disclosures. Don't follow links in an unexpected message.

Protect your accounts after the incident

Start with email because it can be used to reset financial passwords. Then review:

• Bank and payment-app login sessions
• Recovery phone numbers and email addresses
• Mobile-carrier security and SIM-swap protections
• Linked bank accounts, cards, and external-transfer permissions
• New payees, beneficiaries, direct deposits, and recurring debits
• Credit reports and accounts opened in your name

Consider a fraud alert or security freeze if your Social Security number or identity documents were exposed. A fraud alert asks creditors to verify your identity. A security freeze restricts access for new credit applications. Neither replaces monitoring the bank account where the original transaction occurred.

Mistakes that can weaken a fraud claim

Avoid these common problems:

• Waiting for the merchant before notifying the bank or issuer
• Treating the two-business-day or 60-day rule as permission to delay
• Calling a number supplied in a suspicious text or email
• Sharing a verification code with a caller
• Making only a phone complaint when the credit card process requires written notice
• Calling a merchant-quality problem fraud
• Leaving out the fact that you personally approved a scam payment
• Deleting messages, alerts, or transaction details
• Assuming provisional credit is permanent
• Paying a supposed recovery agent

Frequently asked questions

Do I have only two business days to report debit fraud?

No. For certain lost-or-stolen-access-device situations, notice within two business days helps preserve the lowest Regulation E liability cap. The separate 60-day statement rule can affect later transfers. Report the suspected transaction immediately.

Is a bank required to refund every unauthorized debit?

The bank must investigate a qualifying claim under the applicable rules, but the result depends on the payment type, notice, account type, evidence, and any liability limits. Ask when provisional credit may be issued and when the investigation is due.

Is a credit card dispute deadline 120 days?

The federal FCBA billing-error process generally requires written notice within 60 days after the statement containing the error was sent. A card network or issuer may provide a different chargeback window for some other disputes, but that doesn't replace the federal written-notice deadline.

What if I was tricked into sending the payment?

Report it immediately and explain exactly what you did and what the scammer said. A payment you personally approved may be treated differently from a transfer made by an account hijacker, so don't assume Regulation E or the app's unauthorized-transaction policy will produce the same result.

Can a wire or crypto transfer be reversed?

Sometimes a bank or platform can stop or recover funds that haven't yet been moved, but a wire recall and a crypto report don't guarantee recovery. For a wire, contact the sending bank's wire-fraud department; for crypto, contact the exchange or wallet provider through its official site. Save the transaction details before making the call.