If you don't recognize a transaction, contact the bank, card issuer, or payment provider now through its official app, website, or phone number. Lock down the account, save the transaction details, and describe what happened accurately. The process depends on the payment method: a credit-card charge is not handled like an ACH debit, wire, cryptocurrency transfer, or wallet payment.

This checklist is for U.S. consumers using personal accounts. Business accounts, international transfers, and platform-specific claims may follow different rules. Acting quickly can protect your rights and improve the chance of stopping or recalling funds, but a prompt report does not guarantee a refund.

Check the transaction before calling it fraud

An unfamiliar merchant name is not always an unauthorized transaction. Check whether it is:

• A pending authorization that may disappear
• A recurring subscription or free-trial renewal
• A purchase made by an authorized user
• A shortened or unfamiliar billing descriptor
• A payment you approved after a scammer misled you
• A transaction made without your permission by someone who obtained your card or account details

Don't call a payment unauthorized if you actually approved it. Explain the facts instead. A bank or app may treat a payment that you personally initiated after a scam as an authorized transaction, even if the recipient deceived you.

If the transaction is still pending, ask the issuer or provider to block further activity and replace the compromised card or account. Some issuers won't open a formal billing dispute until the transaction posts.

What to do in the first few minutes

1. Save the details. Record the amount, date, merchant or recipient, status, reference number, and related text messages or emails. Take screenshots. Never share passwords, PINs, one-time codes, or wallet seed phrases.
2. Secure the account. Lock the card, change the password from a trusted device, enable multifactor authentication, sign out of unfamiliar sessions, and remove unknown linked devices or payment methods.
3. Report it through an official channel. Use the number on the back of the card or the provider's official app or website. Ask for the fraud department, a claim number, and instructions for written notice.
4. Ask about replacement or an account block. Card-number theft may require only a replacement card. An account takeover or unauthorized ACH activity may require a new account or other account changes.
5. Follow up in writing. Identify the transaction, explain why you believe it was unauthorized, and state when you first noticed it. Keep proof that the institution received your notice.
6. Monitor related accounts. Review recent and new statements, alerts, linked accounts, and credit reports. Report additional transactions separately if the provider requires separate claims.

Don't wait for a police report, a merchant response, or a payment-app investigation before notifying the bank. A police or cybercrime report may support a claim, but it doesn't replace timely notice to the institution that handled the payment.

Match the payment to the controlling rule

A card network's internal chargeback window is not automatically the same as a federal consumer deadline. An account agreement may provide more time or stronger protection, but don't rely on a general deadline found online.

Credit-card unauthorized charge disputes

Credit-card disputes usually involve the Fair Credit Billing Act and Regulation Z, not Regulation E.

Steps to take

1. Call the issuer's fraud number and ask whether the card should be closed and replaced.
2. Send a written billing-error notice to the issuer's billing inquiries address. It may be different from the payment address.
3. Make sure the notice reaches the issuer within 60 days after the first statement containing the error was sent.
4. Identify the transaction precisely and state whether you made or authorized it.
5. Pay the part of the bill that isn't disputed while the investigation is pending. Follow the issuer's instructions about the disputed amount.
6. Keep the letter, attachments, delivery record, case number, and follow-up messages.

The Federal Trade Commission's credit-card dispute guidance includes a sample letter and explains the written-notice process. Under that process, the issuer generally must acknowledge the complaint within 30 days unless it has already resolved it. It generally must resolve the dispute within two billing cycles and no later than 90 days.

Federal law generally limits liability for unauthorized credit-card use to $50, subject to the facts and statutory conditions. Many issuers offer zero-liability policies, but those are issuer or network policies and may have conditions. Report the charge even if you expect the issuer to waive the balance.

Visa and Mastercard are payment networks, not usually the place where a consumer starts a claim. Contact the bank or company that issued the card. The issuer handles the network process and tells you what evidence it needs.

Debit-card and ACH disputes under Regulation E

Regulation E generally covers unauthorized electronic fund transfers from a consumer account, including many debit-card, ATM, and ACH transactions. It doesn't automatically cover every payment made through a mobile app, and it generally isn't the rule for an ordinary credit-card purchase.

The two liability clocks

Two deadlines are often confused:

• Lost or stolen card or access device: If you notify the financial institution within two business days after learning of the loss or theft, liability is generally limited to no more than $50.
• Notice after two business days: If you wait longer, liability can increase and may reach as much as $500 for transfers before notice, depending on the statutory formula and the facts.
• Statement notice: If an unauthorized transfer appears on a statement, notify the institution no later than 60 days after the statement was sent. Waiting beyond that period can cause you to lose protection for later transfers.

These are liability rules, not permission to wait. Call the bank the same day you notice an unauthorized debit or ACH withdrawal.

How the Regulation E investigation works

Give the bank enough information to identify your account, the amount and date of the transaction, and why you believe it is an error. Notice can generally be oral. The bank may require written confirmation within 10 business days after an oral report, so send it promptly if requested.

The bank generally must investigate and determine whether an error occurred within 10 business days. For a new account, the initial period can be 20 business days. If more time is needed, the bank can generally take up to 45 calendar days, or up to 90 days for certain point-of-sale debit, foreign-transaction, and new-account cases, provided it gives provisional credit within the applicable initial period and meets the other notice requirements.

Provisional credit is not necessarily a final refund. If the bank concludes that no error occurred, it must give a written explanation and can generally reverse the provisional credit after notifying you. You can request the documents the bank relied on.

The Federal Reserve's Official Staff Commentary on Regulation E provides regulatory interpretation and examples. The bank's current error-resolution notice and account agreement may also contain important instructions.

Recurring ACH debits

If you no longer authorize recurring ACH withdrawals, revoke the authorization with the company and tell your bank. Ask the bank about a stop-payment order or an account change for future transactions. A stop-payment request usually addresses future debits; it doesn't automatically reverse an ACH debit that has already posted. Dispute earlier unauthorized withdrawals separately.

PayPal, Venmo, and other digital wallets

A wallet claim can involve two separate processes:

1. The payment app's unauthorized-transaction or purchase-protection process
2. The rules applying to the bank account, debit card, or credit card used to fund the payment

Report the transaction inside the app through its current security, resolution, or unauthorized-payment feature. Then contact the funding bank or card issuer separately. An app investigation doesn't necessarily satisfy a bank's deadline, and a bank dispute doesn't automatically open an app case.

Deadlines and eligibility can differ for:

• Payments from a wallet balance
• Bank-funded transfers
• Debit-card-funded payments
• Credit-card-funded payments
• Goods or services purchases
• Friends-and-family or person-to-person payments
• Account takeovers
• Payments that the account holder personally approved

Don't rely on a generic 180-day rule. Check the provider's current user agreement and the deadline shown in its claim process. Purchase protection for an item that wasn't delivered is different from a claim that someone accessed the account without permission.

When reporting, explain whether you made any part of the payment yourself, whether someone obtained your login or verification code, and whether the payment was funded by a bank account or card. Attach the app confirmation, recipient information, messages with the scammer, and the linked account statement.

Unauthorized bank wires and wire fraud

A bank wire often follows different rules from a debit or ACH transaction. The sending bank's wire agreement and applicable law may control, and a domestic wire is not automatically covered by Regulation E. International remittance transfers can have separate rules.

Call the sending bank immediately and ask for:

• A fraud case and wire recall request
• Contact with the receiving bank
• A hold or return request if funds remain
• The wire trace or reference number
• Written instructions for any required affidavit or confirmation

Provide the amount, date, recipient, account information, instructions you received, and the point at which you realized the fraud. If you personally approved the wire after receiving spoofed instructions, say so clearly. The bank may classify it differently from a transfer initiated by an intruder, but speed can still improve the chance of a recall.

For cyber-enabled fraud, submit a report to the FBI's Internet Crime Complaint Center. IC3 collects and shares reports with law enforcement partners, but it doesn't guarantee a freeze or refund and isn't a replacement for an immediate bank call. Contact local law enforcement if there is an immediate safety issue or a known suspect.

Unauthorized cryptocurrency withdrawals

Cryptocurrency transfers are often irreversible once confirmed on a blockchain. An exchange may be able to freeze an account or cooperate with an investigation, but it may not be able to reverse a completed transaction or reimburse the loss.

If an exchange account was compromised:

1. Contact the exchange through its official support channel and report the withdrawal.
2. Ask the exchange to lock the account, disable API keys if available, revoke active sessions, and review the destination address.
3. Change the password and secure the email account and phone number connected to the exchange.
4. Record the transaction hash, network, destination address, amount, timestamps, and support case number.
5. If a self-custody wallet's private key or seed phrase was exposed, don't share it with anyone. If it is safe to do so, move remaining assets to a new wallet with a new recovery phrase.
6. Report cyber-enabled theft to IC3 and local law enforcement.

If your debit or credit card was used without permission to buy cryptocurrency, dispute that funding transaction with the card issuer or bank. That is different from claiming that a cryptocurrency purchase you authorized should be reversed. Be wary of recovery scammers who promise guaranteed funds or demand an upfront payment in cryptocurrency.

Evidence that makes a claim easier to review

A clear timeline is often more useful than a long explanation. Gather:

• The statement or account screen showing the transaction
• A screenshot of the merchant descriptor, recipient, or transaction ID
• The date and time you noticed the activity
• When you last had the card, phone, or account under your control
• Fraud alerts, login notifications, password-reset messages, and device records
• Emails, texts, invoices, or messages connected to the transaction
• Your call log, dispute confirmation, and case number
• A police, identity-theft, or IC3 report when relevant
• A copy of any affidavit or declaration submitted to the provider

Redact unrelated account numbers, Social Security numbers, passwords, and authentication codes. Send documents only through the bank's secure upload, official app, or verified mailing address. Never send a wallet seed phrase.

Describe the facts without guessing who committed the transaction. If you still had the card, say that. If an authorized household member had access, disclose it. A precise account of what you know is stronger than an unsupported accusation.

Copy-and-paste dispute letter

Use the following template only when the transaction truly was not made or authorized by you or an authorized user. If you personally approved a payment after a scam, describe the deception instead and ask the provider which dispute category applies.

For a credit-card dispute, send the letter to the billing inquiries address and make sure it arrives within the applicable 60-day period. For a debit or ACH dispute, use the bank's designated fraud or error-resolution address and follow up if it requires a particular form.

[Your name]
[Your mailing address]
[Date]

[Bank, card issuer, or payment provider]
[Billing inquiries or fraud address]

Subject: Notice of unauthorized transaction - account ending in [last four digits]

I dispute the following transaction:

Amount: [$ amount]
Date posted: [date]
Merchant, recipient, or description: [name]
Transaction or reference ID: [number]

I did not make or authorize this transaction. [Briefly describe what happened, including when you noticed it and whether the card, phone, or account remained in your possession.]

Please investigate this transaction and provide the result in writing. If this is a credit-card billing error, please treat this letter as written notice under the Fair Credit Billing Act. If this is an electronic fund transfer, please treat it as notice of an error under Regulation E.

Please tell me if you need a written confirmation form or additional information. Enclosed are [a redacted statement page, screenshots, and other relevant documents].

Please confirm receipt and send correspondence to:

[Your mailing address or secure contact method]

Sincerely,

[Your name]
[Phone number]
[Email address]

Don't send original documents. Keep a complete copy of the letter and proof of delivery.

If the bank or provider denies the claim

A denial isn't the end of the process, but your next step should address the stated reason.

1. Request the decision in writing. Ask for the investigation result, the evidence supporting it, and the procedure for requesting documents or appealing.
2. Compare the decision with the facts. Check the transaction date, payment rail, card status, device records, merchant response, and whether the provider treated your report as an unauthorized claim or a different dispute type.
3. Submit targeted evidence. Explain what each attachment proves. Correct errors instead of sending the same statement repeatedly.
4. Ask whether the claim was filed under the wrong category. A merchant refund problem, subscription cancellation, item-not-received dispute, scam payment, and account takeover are different issues.
5. Escalate a missed deadline or unresolved complaint. For a bank or card issuer, consider submitting a complaint through the Consumer Financial Protection Bureau's complaint portal and contacting the regulator listed for the institution. A complaint may prompt a response, but it doesn't guarantee a refund.
6. Keep monitoring the account. A denial of one transaction doesn't protect against later unauthorized activity.

Mistakes to avoid

• Waiting for the merchant or app to respond before notifying the bank
• Treating every unfamiliar descriptor as fraud without checking subscriptions and authorized users
• Assuming the 60-day rule applies in exactly the same way to credit cards, debit cards, wallets, and wires
• Assuming a payment app has a universal 180-day deadline
• Stopping all credit-card payments instead of paying undisputed amounts
• Spending provisional credit before the investigation is final
• Sending an ID, password, PIN, or recovery phrase through an unverified channel
• Filing an unauthorized-transaction claim for a purchase you actually authorized
• Giving a recovery company money or remote access to your device
• Relying on an old bank phone number found in a search result

Sources and rule checks

• Federal Trade Commission guidance on using credit cards and disputing charges
• Federal Reserve Official Staff Commentary on Regulation E
• FBI Internet Crime Complaint Center
• Consumer Financial Protection Bureau complaint portal

These are general U.S. consumer procedures, not legal advice. Use the deadline and mailing address printed on your statement, and check the current terms for the specific provider that handled the payment. If you have not reported the transaction yet, use the provider's verified fraud channel now and save the claim number.