If a transaction isn't yours, call the bank, card issuer, or payment provider now. Lock the card or account, ask what can be blocked or reversed, and put the dispute in writing. For U.S. consumers, the deadline and possible liability depend on the payment rail and on whether someone else initiated the payment or you approved it after being deceived.

Use accurate words when you report it. An account takeover, in which another person accessed your account and sent the payment, is different from a scam that persuaded you to send the money yourself. Both deserve a prompt report, but the legal and contractual rules may not be the same.

What to do in the first hour

1. Stop more losses. Lock the card or account, end suspicious sessions, and stop communicating with the scammer. Don't give anyone a password, one-time code, private key, or crypto seed phrase.
2. Call through an official channel. Use the number on the card, account statement, or provider's official website. A number in a suspicious text or email may belong to the scammer.
3. Describe the transaction precisely. Give the date, amount, merchant or recipient, and transaction number if available. Say that you're reporting an unauthorized transaction or account takeover, and ask for a reference number.
4. Secure access. Change the account and email passwords, replace the PIN, turn on multifactor authentication, and ask whether the card, account number, or online-access credentials should be replaced.
5. Send the required written notice. A phone call is useful for speed, but a written dispute preserves a record. Credit-card billing-error rights specifically require written notice sent to the billing-inquiries address.
6. Keep the file together. Save statements, screenshots, emails, call logs, claim numbers, and copies of everything you send.

Don't wait for an FTC, police, or IC3 report before notifying the financial institution. Those reports can support your file, but they don't start the bank's dispute deadline or guarantee a refund.

Identify the payment rail before you dispute

The fastest route is not the same for every payment.

These categories can overlap. A payment-app transaction funded from a debit account may raise both a platform claim and a Regulation E issue. A credit-card-funded transaction may involve the card issuer's FCBA process. Ask the bank or issuer which rule it is applying instead of accepting a vague response that all payments are final.

A transaction is not necessarily "unauthorized" just because you regret it or don't recognize the merchant name. The institution may ask whether someone else initiated it, whether you still had the card or access device, whether a joint owner or authorized user was involved, and whether you approved the transfer after a scammer misled you.

Regulation E: debit cards, ACH, and other EFTs

For a qualifying consumer account, the Regulation E liability rule has two important clocks.

• Within two business days: If you notify the institution within two business days after learning that a card or other access device was lost or stolen, liability is generally limited to the lesser of $50 or the amount of unauthorized transfers made before notice.
• After two business days but within 60 days: Liability can rise to the lesser of $500 or $50 plus the unauthorized transfers made after the two-business-day period and before notice.
• After 60 days: If an unauthorized transfer appeared on a statement and you don't report it within 60 days, the institution may hold you responsible for later transfers that could have been prevented by timely notice.

The 60-day rule doesn't automatically erase every claim about the first transaction. It creates particular risk for later losses after you could have alerted the institution.

A "business day" is generally a day when the financial institution is open for substantially all of its banking functions. It isn't automatically a 48-hour period, and a weekend or holiday may not count. Report the problem as soon as you find it and ask the institution to record the date and time of your notice.

The two-business-day rule is tied especially to the loss or theft of an access device. If only account information was exposed and you still had the card or device, the statement-based notice rule may be the more relevant deadline. The institution should evaluate the facts under the applicable rule.

What happens after you report an EFT

Under the Regulation E error-resolution rule, the institution generally has 10 business days to investigate after receiving notice. If it needs more time, the rule generally permits a longer investigation when the institution provides required provisional credit, subject to the rule's conditions and exceptions.

The investigation can generally take up to 45 calendar days. A longer period may apply to certain point-of-sale debit transactions, transactions outside the United States, and new accounts. New accounts can also have a longer period before provisional credit is required.

The bank may ask for written confirmation, an affidavit, or supporting records. Return requested information promptly and keep proof of delivery. If the institution decides there was no error, request the written explanation and the documents it relied on. A login record, familiar device, or one-time code may be relevant, but none of those facts alone explains who authorized the payment or how the account was accessed.

Provisional credit is not always final. The bank may reverse it if the investigation finds no error, but it should provide the notice required by the applicable rule. Don't spend the credit until the claim is resolved.

Credit-card charges and the 60-day notice

Credit-card charges are generally handled under the Fair Credit Billing Act's billing-error process, not Regulation E. The FTC's credit-card dispute guidance says to send written notice so that it reaches the issuer within 60 days after the first statement containing the error was sent.

Send the letter to the address listed for billing inquiries or billing disputes. That address may be different from the payment address. Include:

• Your name and account number, or only the last four digits when appropriate
• The transaction date, merchant, and amount
• A clear statement that you did not authorize the charge
• The date you discovered it and the date you first reported it
• Copies of the relevant statement and other evidence

The issuer generally must acknowledge the dispute in writing within 30 days unless it has already resolved the issue. It generally must resolve the dispute within two complete billing cycles and no later than 90 days.

Keep paying amounts that aren't part of the dispute. Don't stop paying the entire account just because one charge is under review. Follow the issuer's instructions for payments while the billing error is pending.

A card issuer's network chargeback deadline is not the same as the FCBA deadline. Visa and Mastercard procedures can vary by dispute type and issuer, so don't rely on a blanket "120-day" rule.

Federal law generally limits liability for unauthorized credit-card use to $50, and many issuers offer zero-liability policies. Zero-liability protection is a company policy, not a reason to delay reporting, and it may have exceptions.

How to dispute an unauthorized ACH debit

An ACH debit that you didn't authorize from a consumer bank account may qualify as an electronic fund transfer under Regulation E. Call the bank's fraud department and identify the exact debit, including the company name shown on the statement and the trace or transaction number.

Then:

1. Ask the bank to investigate the debit and explain how it will be returned or credited.
2. Ask how to block future debits from the same company.
3. Revoke the authorization with the company in writing if an ongoing authorization exists.
4. Keep copies of the revocation, bank notice, and confirmation numbers.
5. Watch the account for smaller test debits or replacement transactions.

A stop-payment request can help prevent a future scheduled debit, but it doesn't by itself resolve an earlier unauthorized debit. Use the bank's required procedure rather than relying only on a promise from the merchant.

If you authorized the original ACH payment but now dispute the amount, quality of service, or a later recurring debit, explain that distinction. It may be a billing or authorization dispute rather than an unauthorized-transfer claim.

Payment apps: PayPal, Venmo, Zelle, and similar services

Report the transaction to the app and to the bank or card issuer that funded it. These are separate processes. Tell each provider whether the other has opened, denied, or refunded a claim so the records are accurate.

The way the payment was initiated matters:

• If someone accessed your account and sent the payment without your permission, describe the account takeover, unfamiliar device or login, security alerts, password changes, and other relevant facts.
• If a scammer persuaded you to approve the payment, say exactly what happened. The provider may classify it as an authorized payment or scam, which can make recovery more difficult.
• If you don't recognize a merchant transaction but someone in your household may have made it, investigate before calling it fraud. A joint owner or authorized user may have permission to transact under the account agreement.

When a payment-app transaction was funded from a debit account, ask the bank to evaluate the underlying transfer under the applicable Regulation E rules. When it was funded by a credit card, contact the card issuer under its billing-error process as well as reporting it to the app.

PayPal's Purchase Protection terms include a 180-day window for qualifying purchase disputes. That's a platform policy, not a replacement for the shorter FCBA or Regulation E deadlines. Eligibility depends on the claim and transaction details.

Don't assume that every Venmo, Zelle, or other payment-app claim has a universal 120-day deadline. Check the app's current terms, but notify the bank or card issuer under the shortest potentially applicable deadline.

Wire transfer fraud

Call the sending bank's wire-fraud department immediately and ask for a recall, reversal, or hold request. Give the bank the wire confirmation, amount, receiving bank, beneficiary information, and the time you discovered the fraud. Ask whether it can contact the receiving institution.

A wire that you personally approved after receiving false instructions isn't automatically treated like a stolen debit-card transaction. The account agreement, the facts surrounding the payment order, applicable state law, and sometimes federal electronic-transfer law can affect the result. UCC Article 4A funds-transfer rules often matter in wire disputes, particularly commercial ones.

Don't assume the $50 or $500 Regulation E limits apply to every wire. Report internet-enabled fraud to the FBI's Internet Crime Complaint Center promptly, but treat the report as an investigative aid, not a guaranteed recovery method.

Cryptocurrency transactions

Contact the exchange or custodian immediately if an account was hacked or a withdrawal was made without permission. Request an account freeze, preserve the transaction hash and destination wallet address, and secure the email account and device before changing the exchange password.

A confirmed blockchain transfer often can't be reversed by the exchange. If you bought cryptocurrency with a credit or debit card, you can still report an unauthorized card transaction to the issuer. The issuer may distinguish an unauthorized purchase from a purchase you approved and later lost through a scam.

Never pay an upfront "recovery agent" who promises to retrieve cryptocurrency. Don't share a seed phrase or private key. Report internet-related theft to IC3 and consider reporting identity theft through IdentityTheft.gov.

Evidence that makes a dispute clearer

Write a one-page timeline while the details are fresh. Include:

• When the transaction occurred and when you discovered it
• How you discovered it, such as a statement, text alert, or app notification
• When and how you notified the bank, issuer, or app
• The name of each representative and every reference number
• Whether you still had the physical card or other access device
• Whether anyone else had account access or was an authorized user
• Login alerts, unfamiliar devices, password-reset messages, and location information
• Emails, texts, invoices, caller IDs, or websites used by the suspected scammer
• Police, FTC, or IC3 report numbers, if you filed a report

Screenshots should show the date, amount, transaction descriptor, and relevant account details without exposing unnecessary personal information. Don't alter messages or leave out facts that could make the transaction appear authorized.

A card-verification result, device record, or matching billing address can be relevant evidence, but none is conclusive by itself. If a scammer obtained a one-time code through impersonation, state that plainly.

Sample unauthorized-transaction dispute letter

Adapt the wording to the payment method. For a bank or debit-account dispute, send the notice through the bank's required channel and keep a copy. For a credit card, send it to the billing-inquiries address shown on the statement.

[Your name]
[Your mailing address]
[Date]

[Institution name]
[Dispute or billing-inquiries address]

Re: Notice of unauthorized transaction on account ending in [last four digits]

I am disputing the following transaction:

• Merchant or recipient: [name]
• Amount: [$ amount]
• Transaction date: [date]
• Date discovered: [date]

I did not authorize this transaction. [If accurate: I did not receive the benefit of it.] I first reported it by [phone, app, or branch] on [date and time]. The reference number is [number].

Please investigate this transaction under the applicable consumer-protection and error-resolution rules. Please provide the written result of the investigation and, if you determine that no error occurred, the documents on which you relied.

Enclosures: [statement, timeline, screenshots, report number, or other evidence].

Sincerely,
[Your name]

For a credit card, add: "This letter is a billing-error notice under the Fair Credit Billing Act." Send it to the billing-inquiries address, not the address used for payments.

An FTC identity-theft report can support the file, but it isn't a replacement for the required notice to the bank or issuer. Sign an affidavit only if every statement is accurate.

Why a bank may deny an unauthorized-transaction claim

A denial doesn't always end the matter. Common reasons include:

• The notice was late. The statement showed the transaction, but the consumer waited beyond the applicable deadline.
• The institution classified the payment as authorized. It may point to a known device, password, PIN, or verification code.
• The consumer approved the transfer after a scam. The facts may fit an authorized-payment scam rather than an unauthorized EFT.
• The evidence was incomplete. The timeline did not identify the disputed transaction, or the consumer didn't answer a written request.
• The dispute used the wrong category. A merchant-quality complaint, duplicate charge, subscription issue, or refund delay isn't automatically an unauthorized-use claim.
• Another person had authority. A joint owner or authorized user may have permission to transact, depending on the account agreement and facts.

To appeal, request the written reason for the denial, the documents used, and the reconsideration deadline. Reply with a focused timeline and explain why the transaction was not authorized. If you approved it after deception, describe the scam accurately rather than changing the facts to fit a different category.

If the financial company doesn't resolve the matter, submit a complaint through the CFPB complaint portal when the product and company fall within its scope. Attach the original dispute, denial, reference numbers, and a short chronology. A CFPB complaint requests a company response; it doesn't guarantee a refund or replace a court proceeding.

Frequently asked questions

Does the $50 or $500 limit apply to every fraud claim?

No. Those are Regulation E liability rules for qualifying unauthorized electronic fund transfers. Credit cards use the FCBA, while many wires, authorized scam payments, and cryptocurrency transfers require a separate analysis.

Is reporting to the FTC enough?

No. Report the transaction directly to the bank, issuer, or payment app. An IdentityTheft.gov report can document identity theft and provide recovery steps, but it doesn't notify the bank for you.

Can I report a debit-card fraud claim by phone?

Phone notice is useful and can be important for meeting a Regulation E deadline. Follow up in writing. For a credit card's FCBA billing-error process, send written notice to the billing-inquiries address so it reaches the issuer within 60 days.

What if I gave the scammer a verification code?

Tell the bank exactly what happened. A valid code is evidence the institution may consider, but it doesn't by itself show who obtained the code, what you were told, or whether the payment was authorized. Recovery may be harder if you personally approved the transfer.

How long can an investigation take?

A Regulation E investigation generally begins with a 10-business-day period. If the bank needs more time, provisional-credit and extended-investigation rules may apply. Credit-card issuers generally acknowledge a written billing dispute within 30 days and resolve it within two billing cycles, no later than 90 days.

Can a provisional refund be taken back?

Yes. If the investigation concludes that no error occurred, the institution may reverse provisional credit after giving the required notice. Ask for the written decision and supporting documents, then appeal within the institution's stated deadline.

This is general U.S. consumer information, not legal advice. Before ending the first call, get the reference number, ask where written notice must be sent, and confirm the shortest deadline that may apply to your transaction.