If you see a charge, withdrawal, or transfer you didn't authorize, act now. Call the bank, card issuer, or payment service through an official channel, then send any written notice required for that payment type. The deadline and refund process depend on the payment rail: credit cards, debit cards, ACH transfers, peer-to-peer payments, and wires don't follow the same rules.

This information is for U.S. consumers using personal accounts. Business accounts, state law, account agreements, and platform policies may produce different results. It isn't legal advice.

A phone call can stop additional loss, but it may not replace the written notice required for a credit-card billing dispute.

Start with these steps

1. Make sure the transaction is actually unfamiliar. Check the full merchant descriptor, receipts, subscriptions, and purchases made by authorized household users. If you still can't identify it, treat it as suspicious.
2. Use an official contact method. Call the number on the back of the card, a statement, or the institution's official app or website. Don't use a number from an unexpected text, email, or phone call.
3. Describe what happened accurately. If true, say, "I did not make or authorize this transaction." Ask for the claim number, the address for a written dispute, and the deadline for submitting documents.
4. Limit further access. Freeze or replace the card, remove unfamiliar devices, and ask whether the bank should close or renumber the affected account. Change email and financial-account passwords from a trusted device, and turn on multifactor authentication.
5. Put the dispute in writing when required. Credit-card disputes go to the billing-inquiries address on the statement. Debit and ACH claims should follow the bank's Regulation E notice instructions.
6. Save a record. Keep statements, screenshots, messages, claim numbers, and a short timeline. Monitor the account closely until it is secure.
7. Report the scam if appropriate. You can use the FTC's ReportFraud.gov service and report internet crime to the FBI's Internet Crime Complaint Center. These reports document the incident; they don't replace a dispute with the financial institution.

Don't wait for a police report before notifying the bank or card issuer. The institution may request one, but it isn't always needed to open a claim.

Match the payment to the right process

The NCUA's Regulation E overview describes coverage for many electronic fund transfers, including ATM, point-of-sale, and ACH transactions. The current Regulation E text controls when the rule applies.

Three situations that look alike

• Unauthorized use: Another person used your card, account credentials, or payment access without permission.
• An authorized payment caused by a scam: You personally entered or approved the payment after an impostor or other fraudster deceived you. A bank or platform may classify this differently from a transfer initiated by someone else.
• A merchant or billing error: You authorized the purchase but were charged twice, charged the wrong amount, billed after cancellation, or didn't receive what you ordered. That may still be disputable, particularly on a credit card, without being fraud.

Use the most accurate description you can. Calling an authorized payment "unauthorized" can send the investigation in the wrong direction and damage your credibility.

Credit-card charges

The Fair Credit Billing Act provides a formal billing-error process for qualifying credit-card disputes. Call the issuer as soon as you notice the charge, but follow up with a letter.

1. Find the issuer's billing-inquiries address on the statement. It may not be the address used for payments.
2. Identify the transaction, state that you didn't authorize it, and request an investigation.
3. Make sure the letter reaches the issuer within 60 days after the first statement containing the error was sent.
4. Keep a copy of the letter, enclosures, and proof of delivery.
5. Pay the rest of the bill by the due date.

The issuer generally must acknowledge a written dispute within 30 days, unless it has already resolved the matter. It generally must resolve the dispute within two billing cycles and no later than 90 days. The FTC's credit-card dispute guidance includes the federal process and a sample letter.

After you properly dispute a qualifying billing error, you generally don't have to pay the disputed amount or related finance charges while the issuer investigates. Keep paying amounts that aren't in dispute.

Federal law generally limits liability for unauthorized credit-card use to $50 in qualifying circumstances. Some issuers and card networks offer broader zero-liability policies, but those policies don't remove the need to report the transaction or follow the issuer's instructions.

A Visa or Mastercard chargeback is part of the card industry's operating system. It doesn't replace the FCBA's written-notice requirement, and it doesn't give a debit card the same federal protections as a credit card.

Debit-card and ACH transactions

Regulation E generally covers unauthorized electronic fund transfers from personal checking, savings, and some other consumer accounts. Examples include debit-card purchases, ATM withdrawals, and ACH debits.

The notice deadlines that affect liability

If your physical card or another access device was lost or stolen, notify the bank within two business days after learning of the loss. Delay can increase your potential liability:

• Within two business days: Liability may be limited to $50.
• After two business days but within 60 days after the statement showing the transfer was sent: Liability may rise to as much as $500.
• More than 60 days after the statement was sent: You may be responsible for later unauthorized transfers, depending on the facts and applicable exceptions.

If you still have the card or access device and discover an unfamiliar electronic transfer, notify the bank promptly and generally no later than 60 days after the statement showing the error was sent. The 60-day period isn't a reason to wait.

You can usually give notice orally. A bank may require written confirmation within 10 business days after an oral notice, particularly when provisional credit is involved. If it asks for that confirmation, send it immediately using the method it specifies.

Investigation and provisional credit

A bank generally must investigate and determine whether an error occurred within 10 business days after receiving a notice of error. If it needs more time, it can generally extend the investigation by providing provisional credit and meeting Regulation E's other requirements.

The standard extended period can be up to 45 days. Certain point-of-sale debit transactions, foreign-initiated transactions, and transfers involving a new account can have longer periods, sometimes up to 90 days. Provisional credit isn't necessarily final. The bank may remove it after completing the investigation, but it must provide the required written explanation.

If the bank decides that no unauthorized transfer occurred, request the written findings and the documents supporting that decision.

Extra steps for an ACH debit

Give the bank:

• The exact amount and date
• The company name shown on the transaction
• The transaction or trace number
• The reason you believe the debit was unauthorized

Then ask whether it can return the debit, place a stop-payment order, or contact the receiving institution. If the debit is recurring, revoke the authorization with the merchant and separately ask the bank how to stop future debits.

Ask which ACH return deadline and bank form apply. The operational ACH return window may not be the same as the consumer's Regulation E notice deadline. A bank also may not be able to recover money that has already been withdrawn and moved through several accounts.

Regulation E generally concerns consumer accounts. A business checking account may not have the same federal error-resolution protections.

PayPal, Venmo, and Zelle

Use two tracks when applicable: open a case through the payment service, and notify the bank or card issuer that funded the payment. One report doesn't automatically replace the other.

If someone entered your account and initiated the transfer, report an account takeover or unauthorized electronic transfer. If you sent the money yourself after an impostor deceived you, describe it as a scam payment and ask whether the provider or bank can reverse it. The distinction may affect how the claim is handled.

For a P2P claim:

• Open the case through the service's official app or website.
• Notify the bank or credit-card issuer if a linked account or card funded the payment.
• Record the transaction ID, recipient details, date, amount, messages, and the exact explanation you gave support.
• Ask about the service's current unauthorized-account, purchase-protection, or reimbursement process.
• Report the payment immediately rather than relying on a deadline from an old article. PayPal, Venmo, Zelle, and participating banks have different procedures.
• Don't send more money to anyone promising to recover the first payment.

A platform dispute may not preserve a separate written-notice deadline for a credit-card billing error. If a P2P payment was funded by a credit card, contact the card issuer and follow the FCBA process too.

Wire transfers and international remittances

Call the sending bank's wire-fraud department immediately. Ask it to:

1. Place a fraud hold or another available restriction on the account.
2. Send a recall or cancellation request.
3. Contact the receiving institution and ask that the funds be frozen.
4. Give you the recall reference number and written instructions.
5. Secure your online-banking credentials and review other recent transfers.

A recall isn't a guaranteed refund, especially if the recipient has withdrawn or moved the money. Don't wait for a police, FTC, or IC3 report before contacting the bank.

An ordinary domestic wire doesn't automatically receive the same 60-day notice, provisional-credit, and investigation process that may apply to a debit-card or ACH error. Some international consumer remittance transfers are covered by specific Regulation E rules. Ask the provider which remittance error process applies to your transfer.

If email or online-account access was involved, preserve the original emails and headers when possible. You can also report the incident to the Internet Crime Complaint Center.

Evidence for the dispute

A short, orderly timeline is usually more useful than a folder full of unrelated screenshots. Gather:

• The statement page showing the transaction, with unrelated account details covered
• The date, amount, merchant or recipient name, transaction ID, and card or account ending in the last four digits
• When you first noticed the transaction and when you reported it
• Whether you still had the physical card or access device
• Login alerts, device notifications, password-reset messages, and authentication records
• Emails, texts, invoices, phone numbers, or social-media messages connected to the fraud
• Call records, secure messages, case numbers, and representative names or departments
• A police, FTC, or IC3 report number, if you filed one
• Any response from the merchant or payment platform

Send documents through a secure channel. Never send a password, one-time authentication code, full card number, or account login to someone who contacted you unexpectedly.

Sample written notice

Use the appropriate paragraph in brackets and delete the other one. Send a credit-card letter to the billing-inquiries address, not necessarily the payment address. For a debit or ACH claim, use the address or secure-upload method the bank provides.

[Date]

[Card issuer or bank]
[Correct billing-inquiries or error-notice address]

Re: Dispute of unauthorized [charge or electronic fund transfer]
Account ending in [last four digits]

I dispute a transaction of [$ amount] posted on [date] and shown as
[merchant, company, or recipient]. I did not make or authorize this
transaction. I first noticed it on [date].

For a credit-card account, please treat this as written notice of a
billing error under the Fair Credit Billing Act. For a debit or ACH
transaction, please treat this as notice of an error under Regulation E.
Please investigate, correct the account if an error occurred, and send
me the result in writing.

If you deny the claim, please provide the reason for the decision and
the documents supporting that finding.

Enclosures: [statement page, transaction details, timeline, and other
relevant records]

Sincerely,

[Name]
[Mailing address]
[Safe phone number or secure contact method]

Keep the originals and send copies. If mailing a credit-card dispute, use tracked mail and save proof of delivery.

If the institution denies the claim

Start with the written decision. Repeating the same general explanation by phone is less useful than answering the stated reason for the denial.

1. Check the dates. Compare the institution's timeline with the statement date, your first notice, and any deadline for written confirmation.
2. Request the supporting records. For a Regulation E denial, ask for the documents used to conclude that no unauthorized transfer occurred.
3. Reply to the specific reason. Add missing evidence, such as proof that you had possession of the card or that a login came from an unfamiliar device.
4. Keep paying undisputed credit-card amounts. A pending appeal doesn't excuse the rest of the bill.
5. Complain to the appropriate regulator if the process was mishandled. The CFPB complaint form can create a record with many banks, card issuers, and payment companies. The FDIC consumer complaint process explains how to submit information about an applicable bank. A credit union may have a different regulator.
6. Keep expectations realistic. The FTC, CFPB, and other agencies can collect information or facilitate a response, but a complaint doesn't guarantee a refund or replace a court decision.

For a substantial loss, a dispute about when you gave notice, or identity theft affecting several accounts, consider a consumer-law attorney or legal-aid organization.

Reduce the chance of another unauthorized transaction

After filing the claim:

• Turn on transaction, login, and password-change alerts.
• Use unique passwords and multifactor authentication.
• Review connected apps, digital wallets, and saved payment methods.
• Ask whether the account number, card number, or online credentials should be replaced.
• Consider a credit freeze if personal identity information was exposed.
• Review every statement, including small test charges.
• Verify unexpected payment requests through a known phone number or separate channel.
• Never share a one-time code with a caller, an impersonated bank employee, or a "refund" agent.

Frequently asked questions

How long do I have to dispute an unauthorized transaction?

For a credit-card billing error, written notice generally must reach the issuer within 60 days after the first statement showing the error was sent. The issuer generally acknowledges the dispute within 30 days and resolves it within two billing cycles, with a maximum of 90 days.

For a debit or ACH error covered by Regulation E, report it promptly and generally within 60 days after the statement showing the error was sent. If a lost or stolen access device is involved, the two-business-day rule can affect liability.

What if I don't recognize the merchant name?

Check the full transaction details, receipts, subscriptions, and purchases made by authorized users. Payment processors sometimes use a descriptor different from the store's name. If you still can't identify the transaction, report it and let the issuer investigate.

Can I get money back from a Zelle, Venmo, or PayPal scam?

Possibly, but there isn't one refund guarantee for every P2P scam. An account takeover or transfer initiated by someone else may be handled differently from a payment you personally approved after being deceived. Report the scam and the account or transaction details immediately, then follow the service's current policy.

Is a police report required?

Not always. A bank or platform may request one, and it can support your records, but don't delay the bank or card-issuer notice while waiting for a report.

What if I missed the 60-day deadline?

Report the transaction anyway. For debit and ACH transfers, delay can increase liability, although the bank may consider the circumstances. For a credit card, you may lose formal FCBA protections while retaining options under the issuer's agreement. Include the statement date, the reason for the delay, and proof of any earlier contact.

If the transaction is recent, call the official number on your card or statement, get the claim number, and send the required written notice before the applicable deadline.