An unauthorized transaction should be reported to the bank, card issuer, or payment platform that handled it. Contacting the merchant may help, but it does not replace notice to the financial institution or platform.

For U.S. consumer accounts, credit-card billing errors generally use the Fair Credit Billing Act (FCBA). Debit-card, ATM, ACH, and many online bank transfers generally use the Electronic Fund Transfer Act and Regulation E. The deadline and possible liability depend on the payment method. Report the transaction as soon as you notice it, even if you think a deadline has passed.

Do this first

1. Secure the account. Lock the card or account, change passwords and PINs, turn on multifactor authentication, and remove unfamiliar devices. Ask whether the card should be replaced or the deposit account number changed.
2. Contact the correct provider. Use the phone number on the back of the card, on a statement, or in the provider's official app. Do not use a number from a suspicious text or email.
3. Describe the event accurately. Say that you are reporting an unauthorized transaction and provide the amount, date, merchant descriptor, recipient, or transaction ID. Explain whether you still had the physical card or phone and whether anyone had permission to use the account.
4. Get a record. Ask for the case number, the date the provider received your notice, the expected response date, and whether written confirmation is required.
5. Save documents and monitor the account. Keep statements, screenshots, letters, secure messages, upload receipts, call notes, and follow-up emails. Watch for additional transactions and for any provisional credit or final decision.

Do not wait for a police report or a merchant response before notifying the bank or issuer. Those documents may help, but prompt notice matters more.

Which rule controls the transaction?

The payment rail determines the main dispute process.

Regulation E generally applies to consumer accounts, not most business accounts. A payment app's dispute policy is also different from a federal credit-card or electronic-transfer right. Check the account agreement for company deadlines and additional protections.

Is it unauthorized, a scam, or a merchant error?

Use an accurate description of what happened. The available protections can change depending on whether you authorized the payment.

• Unauthorized transaction: Another person initiates a transfer or uses the account without your actual authority.
• Scam or deception: You personally approve or send a payment after a fraudster impersonates a bank, relative, employer, or merchant. The provider may still help, but the payment may not qualify as an unauthorized electronic fund transfer under Regulation E.
• Merchant or billing error: You authorized the purchase, but the charge is duplicated, the amount is wrong, or goods or services were not delivered. On a credit card, these may be FCBA billing errors.
• Recurring debit after cancellation: A merchant continues taking money after you revoked authorization. Notify both the merchant and the bank, and ask the bank how to stop future debits.

A stolen debit-card number used by someone else is different from a payment you sent to a fake investment adviser after being persuaded to do so. Tell the bank what you did, what the other person did, and what permission, if any, you gave. Do not call an authorized payment "unauthorized" simply because it turned out to be a scam.

Deadlines and liability

The commonly cited 60-day rule does not apply in exactly the same way to every payment type.

Credit cards

For a credit-card billing error, send written notice so that it reaches the issuer within 60 days after the first statement with the error was sent to you. Use the billing-inquiries or billing-dispute address on the statement, which may be different from the payment address.

Federal law generally limits liability for unauthorized credit-card use to $50 when the applicable conditions are met. Many issuers offer zero-liability policies, but those are company policies with their own exclusions and reporting requirements.

If the statement went to an old address, full FCBA protection can depend on whether the issuer received your written change-of-address notice at least 20 days before the billing period ended.

After receiving a written billing complaint, the issuer generally must:

• Acknowledge the complaint in writing within 30 days, unless the problem has already been resolved.
• Investigate and resolve the dispute within two complete billing cycles, but no later than 90 days after receiving the letter.
• Avoid requiring payment of the disputed amount and related finance charges while the investigation is pending.

Continue paying amounts that you do not dispute, including any required minimum payment on the undisputed balance. The FTC's guidance on disputing credit-card charges includes a sample letter and explains the written-notice process.

Debit cards and electronic fund transfers

Regulation E generally covers unauthorized electronic fund transfers from a consumer deposit account, including many debit-card, ATM, ACH, and online-banking transactions.

If your debit card or other access device was lost or stolen, reporting the loss within two business days after learning about it can limit liability to as much as $50. Reporting later but within 60 days after the statement showing the transaction can allow liability of up to $500. After that 60-day period, you may be responsible for unauthorized transfers made after the period and before you notify the bank.

These are potential liability limits, not automatic refunds. The bank will examine whether the transfer was unauthorized and whether your notice was timely. If you had a reason for the delay or did not receive the relevant statement, explain that in writing.

A Regulation E notice can generally begin by phone. The bank may require written confirmation within 10 business days. The bank generally has 10 business days to investigate an error notice. If it needs more time, it generally must provide provisional credit within 10 business days and may take up to 45 days to complete the investigation. Some new-account, foreign-transfer, or point-of-sale situations can have longer investigation periods.

The CFPB's electronic fund transfer FAQs describe the Regulation E process.

Visa and Mastercard rules

Visa and Mastercard have network rules, reason codes, and processing windows for issuers and merchants. Those rules support the card issuer's chargeback workflow, but they do not replace the FCBA or Regulation E. There is no single Visa or Mastercard consumer deadline that applies to every unauthorized transaction.

Follow the issuer's written instructions and any earlier deadline in the account agreement. The issuer normally reviews and decides the consumer's card dispute, although the merchant may provide information during the process.

Build a clear dispute record

What to tell the provider

Give the representative or secure dispute form:

• Your name and the account's last four digits.
• The transaction date, amount, merchant descriptor, recipient, and transaction ID.
• The date you first noticed the transaction.
• Whether you still had the physical card, phone, or other access device.
• Whether anyone else had access to the account, card, PIN, or login.
• Any steps you have already taken, such as locking the card or changing a password.

Ask whether the bank can restrict further transfers while it investigates. If the provider asks for a written statement, submit it through the secure channel or by the method specified in its instructions.

Send written notice when required

For a credit-card claim, send the letter to the billing-inquiries address shown on the statement. Include only as much account information as necessary, preferably the last four digits. Keep a copy and proof of delivery.

For a debit or ACH claim, use the bank's secure message or dispute form and follow up in writing if requested. Record when you first gave oral notice. A phone call is better than waiting, but written documentation creates a clearer record.

Gather focused evidence

Useful documents include:

• The statement or transaction screen showing the charge.
• The amount, date, merchant descriptor, recipient, and transaction ID.
• A short timeline showing when you noticed the transaction and when you reported it.
• Receipts, travel records, work records, or other facts that explain why you could not have made the purchase.
• Messages, emails, phone numbers, or websites used by a scammer.
• Device, login, IP, or account-alert information available to you.
• Correspondence with the merchant or payment platform.
• A police or incident report, if one was made.

A police report can support a claim, but do not delay the initial notice while trying to obtain one. Redact passwords, one-time codes, and unnecessary portions of your account number before sharing documents.

Monitor the investigation

Check the account for additional transactions and watch for the provider's written decision. A provisional credit is not always final. Avoid spending a temporary credit until the dispute is closed because the bank may reverse it.

If the issuer asks questions, answer by the deadline and keep the response factual. Explain whether the card was present, whether a wallet or device was lost, and whether you gave anyone permission to use the account.

Sample credit-card dispute letter

Adapt this letter to the facts and send it to the billing-inquiries address on the statement. The FTC's billing-error guidance also provides a sample format.

[Your name]
[Your address]
[City, State ZIP]
[Date]

[Card issuer]
[Billing-dispute address]
[City, State ZIP]

Re: Billing error on account ending in [last four digits]

Dear Sir or Madam:

I am disputing a billing error on my credit-card account. The statement
sent on [statement date] lists a charge of [$amount] from [merchant] dated
[transaction date]. I did not authorize this charge.

Please investigate this charge under the Fair Credit Billing Act and send
me written acknowledgment and the results of your investigation. I have
enclosed a copy of the statement and the following supporting documents:
[list documents].

I am paying the amounts on the account that I do not dispute.

Sincerely,

[Your name]
[Phone number or email]

Use the statement date and transaction details accurately. If you authorized a payment but received nothing, describe that as a delivery or billing problem rather than claiming the charge was unauthorized.

Sample debit-card or ACH notice

A Regulation E notice can generally begin by phone, but the bank may require written confirmation. Use the bank's secure channel when possible.

[Your name]
[Your address]
[City, State ZIP]
[Date]

[Bank name]
[Fraud or electronic-transfer dispute address]
[City, State ZIP]

Re: Unauthorized electronic fund transfer on account ending in [last four digits]

Dear Sir or Madam:

I am reporting an error involving an electronic fund transfer from my
account. The transaction was [$amount] to [merchant or recipient] on
[date]. I did not authorize this transfer. I noticed it on [date] and
first notified the bank on [date and method].

Please investigate this error under the Electronic Fund Transfer Act and
Regulation E. Please confirm whether you need any additional written
information and tell me the case number and expected response date.

I have enclosed the statement or transaction record and supporting
documents.

Sincerely,

[Your name]
[Phone number or email]

Do not sign a statement that says you never authorized anyone if the facts are more complicated. Explain what permission you gave, when it ended, and how the disputed transaction differs.

Why a bank or issuer may deny a dispute

A denial can result from:

• Notice was late, especially after a lost card or access device.
• The transaction appears consistent with prior authorized activity.
• Someone on the account or in the household had permission.
• The claim describes an authorized purchase that is actually a merchant or delivery dispute.
• The provider did not receive requested written confirmation.
• The account is a business account with different protections.
• The investigation relied on incomplete or incorrect information.

A chip read, PIN entry, device record, or login record can be evidence, but it does not by itself answer every question about authorization. If the decision is wrong, request the written reason and ask what information supports it.

Send a concise appeal with the case number, a dated timeline, and any new evidence. Point out specific errors, such as the wrong transaction date or the fact that the card was in your possession elsewhere. Ask whether the bank has an executive-resolution or second-review process.

If the bank or issuer gives a final denial or fails to respond, you can submit a complaint to the Consumer Financial Protection Bureau. Include the original notice, the provider's response, proof of delivery, and a short explanation of what remains unresolved. A complaint can prompt a company response, but it does not guarantee a refund or replace a court's decision.

For identity theft, also consider a credit freeze and a report to the appropriate fraud-reporting or law-enforcement agency. Those reports help document the incident, but they do not replace the dispute with the financial institution.

Special cases

ACH debits

Report an unauthorized ACH debit to the bank where the money was withdrawn. Ask how to stop future debits and whether you should revoke authorization with the merchant. A stop-payment request generally addresses future entries; it is not a substitute for disputing a transaction that already posted.

PayPal, Venmo, and similar apps

Report an unfamiliar login or transaction through the platform immediately. Then notify the bank or card issuer connected to the payment if money was taken from that account. Tell both providers that you made the other report, and do not accept duplicate recoveries.

Platform deadlines and definitions vary. An account takeover may be treated differently from a payment you personally sent after a scammer deceived you. Save chat records, usernames, recipient details, and account-security alerts.

Wire transfers

Contact the sending bank's wire-fraud team immediately and request a recall or freeze. Give the bank the recipient's information, amount, date, and confirmation number. A wire usually does not use the FCBA credit-card billing-error process, and recovery often depends on how quickly the receiving institution can act.

Cryptocurrency

Notify the exchange, wallet provider, and any funding institution immediately. A confirmed blockchain transfer generally cannot be reversed by changing the ledger. If a credit card funded a transaction, the card issuer may still review a dispute under applicable card rules, but an authorized crypto purchase is not automatically an unauthorized charge.

Common questions

Is 60 days the deadline for every unauthorized transaction?

No. For credit-card billing errors, the important federal notice period is generally 60 days after the statement with the error was sent, and the notice must be written so that it reaches the issuer on time. Regulation E uses different liability rules for debit cards and electronic transfers, including a two-business-day rule after learning of a lost or stolen access device. Payment-app and other provider deadlines can differ.

Can I report a debit-card transaction by phone?

You should call immediately. A bank can generally receive an initial Regulation E error notice orally, but it may require written confirmation. Ask what form it needs and send it promptly.

How long does an unauthorized transaction dispute take?

A credit-card issuer generally must acknowledge a written billing complaint within 30 days and resolve it within two billing cycles, no later than 90 days. For an electronic-transfer claim, the bank generally investigates within 10 business days or provides provisional credit if it needs more time, subject to longer periods for some transactions.

Does disputing a credit-card charge hurt my credit score?

Filing a dispute is not the same as missing a payment. Continue paying undisputed amounts and follow the issuer's instructions so the account does not become delinquent while the matter is reviewed.

What if the bank says my PIN or chip proves I authorized the transaction?

Tell the bank why the transaction was not yours and provide relevant facts, such as possession of the card, account-access alerts, or evidence of an account takeover. Authentication data may be part of the investigation, but it is not a reason to stop documenting your side of the event.

What if I noticed the transaction late?

Report it anyway and explain the reason for the delay. Late notice can affect liability, especially for electronic transfers, but a late report is better than no report. Ask the bank to consider any circumstances that prevented earlier notice.

Further reading

• FTC: Using Credit Cards and Disputing Charges
• FTC: What To Do if You're Billed for Things You Never Got, or You Get Unordered Products
• FTC: Fair Credit Billing Act