If you see a charge you didn't authorize, contact the bank, credit union, or card issuer today. Call the number on the back of your card or use the institution's official app, then put the dispute in writing so you have a record.

There is no single U.S. complaint path. Deadlines, liability caps, investigation clocks, and escalation routes all depend on how the money moved. A dispute asks the company to correct a transaction. A complaint is usually the next move after the company fails to respond or gives an explanation you believe is wrong.

Choose the right route

Step 1: Confirm the transaction and secure the account

Read the merchant descriptor, amount, and date before you treat the charge as stolen-account fraud. Parent companies, payment processors, hotel holds, subscription renewals, and free-trial conversions often post under names you won't recognize. A pending authorization may not be eligible for a formal chargeback until it posts. Still, report it immediately so the institution can try to stop further activity.

If you know the merchant but the amount or service is wrong, you may have a billing error rather than an unauthorized transaction. Contacting the merchant can help, but don't delay notifying your card issuer or bank if you believe someone used your account without permission. The FTC's sample dispute letter guidance says to report errors promptly and keep copies of your correspondence.

Lock or replace the card if more unauthorized charges could follow. Change compromised passwords from a device you trust, and sign out of other sessions. Ask whether the bank should block ACH debits, disable a payment-app connection, or restrict online transfers. Save a screenshot or statement page showing the transaction. Don't share your full account number or one-time security codes.

Call only the number on the card, statement, official app, or official website. Ignore a number that arrived in a suspicious text or email.

Step 2: Report the transaction to the correct institution

Tell the representative: "I am reporting a transaction that I did not authorize and want to open a fraud or error claim." Give the date, amount, merchant or recipient, and the date you first noticed it.

Before you hang up, get the claim or case number, the date the institution received your notice, written follow-up instructions, the billing-error address if it's a credit card, whether provisional credit may apply, and the deadline for extra documents.

Credit card transactions

Send a written billing-error notice to the address listed for billing inquiries on your statement. That address is often different from the payment address. Under the federal Fair Credit Billing Act process, the notice generally must reach the issuer within 60 days after the first statement containing the error was sent.

The issuer generally must acknowledge the notice within 30 days unless it has already resolved the issue, then resolve the dispute within two complete billing cycles and no later than 90 days. The FTC's guide to disputing credit-card billing errors walks through that timetable.

Federal law generally caps liability for unauthorized credit-card use at $50. Many issuers and card networks advertise broader zero-liability coverage, but those are policy terms. They don't replace the federal notice deadline. Keep paying the undisputed portion of the bill while the claim is pending.

Debit cards, ATM withdrawals, ACH, and other electronic transfers

Regulation E covers many unauthorized electronic fund transfers from a consumer account. Depending on how the payment was made, that can include debit-card purchases, ATM withdrawals, ACH debits, and some online or payment-app transfers. The CFPB's Regulation E liability rule and error-resolution rule set the detailed requirements.

Potential liability depends on when you report:

• If you learn that your card or access device was lost or stolen and report it within two business days, liability is generally limited to the lesser of the loss or $50.
• If you wait more than two business days but report within 60 days after the statement showing the transfer was sent, liability may be as high as $500.
• If you don't report an unauthorized transfer within 60 days after the statement was sent, you may face greater liability for later transfers the bank could have stopped.

Those are potential legal limits, not a promise that every claim will be approved. Some banks offer more generous zero-liability protection in their account agreements.

Give the bank enough information to identify the error: the account, date, amount, and why you believe the transfer was unauthorized. You can report orally, but the bank may require written confirmation within 10 business days. Sending a written notice right away is usually the safer record.

Step 3: Understand the investigation timeline

For a qualifying Regulation E error notice, the bank generally has 10 business days to investigate and decide whether an error occurred. If it needs more time, it can generally take up to 45 calendar days if it provides provisional credit within the required period. New-account, point-of-sale, or foreign-initiated transactions can have longer investigation periods under the rule.

Provisional credit is temporary. If the bank later concludes that no error occurred, it may reverse the credit after giving the required notice. Keep the money available until the investigation is final.

Credit-card disputes follow the billing-error timetable, not Regulation E's 10-business-day process. Wires and many platform disputes have their own procedures. A promised call-back date, a card-network chargeback window, or a PayPal review period doesn't change a federal notice deadline.

Step 4: Handle payment apps and wires carefully

PayPal, Zelle, and Venmo

Report suspected account access or unauthorized transfers through the app's official process and, when the money came from a linked bank or card, through that issuer too. Describe what actually happened. Don't call a payment "unauthorized" if you personally sent it, even if a scammer deceived you.

A payment you initiated after a fake invoice, impersonation call, or investment pitch may be treated as an authorized scam payment. Recovery is often harder, and the usual unauthorized-transfer protections may not apply. Report it anyway and ask about the provider's scam-recovery process.

PayPal's Buyer Protection terms set eligibility rules and deadlines for covered purchases. Purchase Protection for an undelivered or misdescribed item is not the same as reporting that someone accessed your account. If you file with both PayPal and the funding bank, tell each institution about the other claim and don't accept duplicate reimbursement.

Bank wires

Call the sending bank's wire or fraud department immediately and request a recall or freeze. Provide the amount, date, recipient information, confirmation number, and receiving institution. The sending bank can coordinate with the receiving bank, but a recall isn't guaranteed once the funds have moved.

Traditional bank-to-bank wires generally aren't covered by Regulation E's standard 10-day error-resolution procedure. The bank's agreement, the facts around the payment order, and applicable payment-law rules may control instead. A wire you authorized because of business-email compromise or social engineering may not be treated the same way as a wire someone sent without your permission.

For internet-enabled fraud, consider filing a report with the FBI's Internet Crime Complaint Center and local law enforcement. That won't guarantee a refund, but it creates a record and may help investigators connect related incidents.

Step 5: Send a written dispute

For a credit card, use the issuer's billing-inquiries address. For a debit account, use the bank's secure message system or the written-notice address it gives you. Keep a copy and proof of delivery.

You can adapt the FTC's sample dispute letter:

[Date]

To: [Card issuer or bank]
    [Use the billing-inquiries address for a credit card]

Re: Unauthorized transaction on account ending [last four digits]

I am writing to report and dispute a transaction of [$amount] posted on
[date] and described as [merchant or recipient]. I did not authorize this
transaction. I first noticed it on [date].

Please investigate this as [a credit-card billing error or an unauthorized
electronic fund transfer under Regulation E] and correct the account as
required. Please confirm receipt, provide the claim number, and send the
written result of your investigation. If you determine that no error
occurred, please provide the documents relied on for that finding.

Enclosures: [statement page, transaction details, and other relevant records]

Sincerely,

[Your name]
[Mailing address]
[Phone or secure contact method]

Use only the last four digits of the account number unless the institution specifically requires more through a secure channel. Stick to facts. If you gave another person permission to use the account, explain the circumstances rather than making an absolute statement that may conflict with the records.

Evidence that can strengthen the claim

Put the documents in date order. Useful records can include the statement page and full transaction details; a timeline of when you noticed the charge and when you reported it; card-lock, replacement, password-reset, or account-alert records; login alerts, device information, or messages showing an account takeover; emails with the merchant about a cancellation, return, or duplicate charge; police, FTC, or IC3 report numbers when identity theft or a scam is involved; wire confirmation records, recipient details, and the recall request; and a short signed statement that you didn't authorize the transaction.

A police report can support your explanation, but don't wait for one before notifying the bank. Don't alter screenshots, guess about facts, or submit passwords and authentication codes.

What to do if the bank denies the claim

A denial should say why. Common reasons include that the transaction was authorized, the notice was late, the issue is a merchant dispute rather than fraud, or the evidence didn't establish an error.

Respond in writing. Ask for the specific basis for the decision and for records the bank relied on that can legally be disclosed, such as transaction details or authentication evidence. Correct factual errors in the bank's timeline, add evidence that addresses the stated reason, and ask for reconsideration under the original case number. Check the account agreement for any internal appeal deadline.

For a Regulation E claim, if the bank concludes that no error occurred, it generally must provide a written explanation and, if you request them, the documents it relied on. It may withhold some security details, but it should still explain the result.

If the institution still doesn't resolve the matter, file a complaint with the Consumer Financial Protection Bureau. Include the amount, transaction date, notice date, case number, correspondence, and the outcome you want. A CFPB complaint can bring the issue to the company's attention. It doesn't replace the original dispute deadline, decide criminal liability, or guarantee a refund.

The right regulator can also depend on the institution's charter. A national bank, federal credit union, state-chartered bank, and payment company may have different complaint channels. The institution's website, account agreement, or statement should identify its regulator.

Common mistakes to avoid

Waiting for the next statement instead of reporting now is the most expensive delay. Calling only the merchant is another, if someone actually used your account. Don't mail a credit-card dispute to the payment address. Don't treat a voluntary payment to a scammer as identical to an unauthorized transfer. A temporary credit isn't final. Inconsistent stories to the bank, merchant, and payment app can sink a claim. Never share a full account number, password, or one-time code through an unverified channel. Visa or Mastercard network procedures also don't create the same rights for every debit, credit, or payment-app transaction; network rules and issuer policies can differ from federal law.

FAQ

Is the 60-day deadline measured from the transaction date?

Not always. For credit-card billing errors, the key date is generally when the first statement containing the error was sent. For Regulation E transfers, the statement date also matters, and reporting a lost or stolen access device within two business days can reduce potential liability. Report the transaction as soon as you discover it.

Do I need a police report before the bank investigates?

Usually you should report the transaction first and ask the bank what supporting records it needs. A police or identity-theft report may help, but waiting for one can jeopardize a deadline.

What if I authorized the payment because of a scam?

Report it immediately, request a recall if it was a wire, and ask the bank or payment provider about its scam process. Because you initiated the payment, the transaction may not qualify as unauthorized under the usual rules.

Can I dispute a pending charge?

A bank may wait until a transaction posts before opening a formal billing dispute. It can still lock the card, stop further transactions, or investigate account compromise while the charge is pending.

What should I do after a final denial?

Ask for the written reason and supporting documents, send a focused appeal, then consider a complaint to the appropriate regulator. Keep every statement, message, case number, and delivery record together.

Call the number on the card today, get the case number, and send the written notice to the correct address before the 60-day clock runs.