If you see a charge or transfer you didn't make, freeze the card or account and notify the bank, card issuer, or payment app the same day. Check first whether the statement name is a parent company, a payment processor, a subscription, or a household user who had permission. Then use the dispute process that matches how the money moved.

A 60-day deadline matters for many U.S. credit-card billing errors and consumer electronic fund transfers. It is not one clock for every payment. A lost debit card can trigger a two-business-day liability limit. Wires and cryptocurrency follow other procedures.

These steps apply to personal consumer accounts in the United States. Business accounts, international transfers, and state laws may follow different rules.

What counts as an unauthorized transaction?

Unauthorized generally means another person initiated a transfer without your actual authority, and you received no benefit from it. Stolen card details used online, cash taken from a debit account, a payment-app login that someone else used to send money, or an ACH debit created without valid authorization all fit that idea.

Unfamiliar is not the same test. A statement may show a holding company, a processor, or a trading name you don't remember. A family member may have used a shared card with permission.

There's a separate problem people often mislabel: an authorized scam payment. If a scammer talked you into sending a wire or P2P payment yourself, you did initiate it, even though the story was fake. Recovery is often harder, and the bank or app may park the claim under a scam policy instead of the unauthorized-transfer process. Describe what happened. Don't pick the label that sounds most favorable.

Unauthorized transaction examples and the first response

Those rows are fact patterns, not automatic findings. The same app can be involved in an account takeover or in a payment you personally approved.

Which rule applies to each payment type?

Credit-card charges

An unauthorized credit-card charge is usually handled as a billing error. The FTC's guidance on disputing credit-card charges says to send the issuer a written dispute that reaches the issuer within 60 days after the first statement containing the error was sent.

Mail it to the billing-dispute address on the statement or card agreement. That address is often different from the payment address. Include:

• Your name and account identifier
• The transaction date, merchant, and amount
• A clear statement that you did not authorize the charge
• A request for an investigation and correction
• Copies of relevant records (keep the originals)

Unless the issuer has already fixed the problem, it generally must acknowledge the complaint within 30 days. It must resolve the dispute within two billing cycles and no later than 90 days. Pay the rest of the bill on time. For a properly submitted billing dispute, federal rules generally allow you to withhold the disputed amount while the issuer investigates.

Federal law generally limits liability for a lost or stolen physical credit card to $50. If only the account number was used and the physical card wasn't lost, federal protections may be stronger. Plenty of issuers also offer broader zero-liability policies. Report promptly anyway; those policies still depend on notice.

Debit cards and ACH withdrawals

Debit-card purchases, ATM withdrawals, and many consumer ACH debits are electronic fund transfers under Regulation E. Report them as soon as you notice them.

If a debit card or other access device was lost or stolen, reporting within two business days can generally limit potential liability to $50. Reporting later, but still within 60 days after the statement that showed the unauthorized transfer, can raise that figure to as much as $500. Wait past that 60-day mark and you may be responsible for later unauthorized transfers until you notify the bank.

Banks generally have 10 business days after receiving notice to decide whether an error occurred. If more time is needed, they generally must provide provisional credit in that window and may take up to 45 days to finish. Some point-of-sale, foreign, or similar transactions can have longer investigation periods.

A phone call can start the process. If the bank asks for written confirmation, follow that instruction. Get the case number, the date notice was recorded, and a yes-or-no on provisional credit.

PayPal, Venmo, Zelle, and other payment apps

The brand name matters less than who pressed send. A hacker who used your login is not the same as you sending money after a scammer impersonated a friend.

The CFPB has said that some P2P and pass-through payments can qualify as electronic fund transfers, with error-resolution responsibilities for the payment provider and the financial institution in appropriate circumstances. A summary of the CFPB's 2025 electronic-fund-transfer compliance aid discusses that position.

If the account was taken over:

1. Report the payment through the app's official fraud or resolution channel.
2. Notify the linked bank or credit union and say the payment was initiated without your authority.
3. Change the app, email, and banking passwords from a trusted device.
4. Remove unfamiliar devices, sessions, phone numbers, or linked accounts.
5. Ask whether the payment can still be stopped or recalled.

If you personally pressed send after being deceived, say that and ask for a scam review or reversal. Completed P2P payments often lack a credit-card-style chargeback, and no app can guarantee recovery.

If a credit card funded the payment, the issuer's billing-error process may apply to that card charge. That does not automatically unwind the app transfer. Give both companies any related case numbers so they aren't working from half the file.

Wire transfers

Don't assume the 60-day debit-card rule covers a wire. A domestic wire usually sits under the bank's agreement and wire procedures. Some international remittances have separate federal protections.

Call the sending bank's fraud department immediately and ask it to place a fraud alert on the account, request a recall or cancellation, contact the receiving institution, and preserve the transfer and authentication records.

A recall request is not a guaranteed refund. Save the invoice, email headers, phone numbers, recipient details, and messages that caused the transfer. A police or online-fraud report can support the investigation. It does not replace notifying the bank.

Cryptocurrency

A completed blockchain transfer usually can't be reversed like a card chargeback. Contact the exchange or custodian immediately if an account was compromised. The provider may lock an internal account or stop a pending withdrawal. It generally cannot reverse a completed transfer on an external chain.

Never pay an unsolicited "recovery service" that promises to retrieve cryptocurrency for an upfront fee. Secure the email account, exchange login, wallet, and recovery phrase, then report the theft to the platform and a law-enforcement channel.

How to recover money from an unauthorized transaction

Start by verifying the line item. Search the merchant name, match receipts, and look at subscriptions or household-card activity. Skip the delay if you're looking at an ATM withdrawal, a large transfer, or signs someone else is inside the account.

Freeze the card in the official app if that control exists. Then call the number on the back of the card or on a statement you already had, not a number from a text or a caller who reached you first. Ask whether the bank should replace the card or account number, block ACH debits, disable online access, remove an unfamiliar payee or linked device, and add extra verification.

Change reused passwords, especially the email inbox used for account recovery. If the phone suddenly loses service or you suspect a SIM swap, contact the mobile carrier and add or reset the carrier account PIN.

Give formal notice next: payment type, date, amount, and why you believe it was unauthorized. Ask for written confirmation or a case number.

A useful notice can say:

I am reporting a transaction that I did not authorize. The transaction was [type] for [amount] on [date] and appears as [merchant or recipient]. I did not initiate or approve it. Please open an error or fraud investigation, secure the account, and confirm the case number and next steps in writing.

If you were tricked into sending the payment yourself, change that wording so it describes the deception. Don't claim a payment was unauthorized if you sent it.

For a credit-card billing error, the written notice still has to arrive at the billing-inquiries address within the 60-day period. Keep a copy of the letter, delivery proof, statement, and attachments. Calling first can get the card blocked faster, but a phone call alone may not preserve the formal written-dispute process.

Hold onto the original statement and transaction details; screenshots of alerts, login history, and app activity; emails, texts, call logs, and fake invoices; proof you still had the physical card, when that matters; the dates you contacted the bank, app, merchant, or carrier; and case numbers, provisional-credit notices, and investigation letters. Don't send passwords, full account numbers, PINs, or one-time codes in email or chat.

Watch the investigation. Provisional credit can appear and later get pulled back; it is not a final decision. If the institution denies the claim, ask for the reason, the records behind that conclusion, the date and method of the alleged authorization, and the path for reconsideration. For a Regulation E dispute, ask for the written explanation and supporting documentation if the bank says no error occurred.

If the file stalls, use the institution's formal complaint or executive-resolution channel first. A bank, credit union, card issuer, or covered payment provider that still doesn't address the issue can be the subject of a complaint to the Consumer Financial Protection Bureau or the appropriate federal or state regulator.

Identity theft is a separate track: consider a credit freeze with each major bureau and the FTC's identity-theft reporting process. Online fraud or cryptocurrency theft can also go to the Internet Crime Complaint Center. None of those reports replaces the bank's dispute deadline.

Dispute, refund, chargeback, and recall are different

The words get used as if they were the same process. They aren't.

A refund is the merchant or platform voluntarily sending money back. A billing dispute is you challenging a credit-card charge under the issuer's process. A chargeback is the issuer or payment network reversing or contesting a card transaction under applicable rules. A Regulation E investigation is a bank reviewing a reported error on a covered electronic fund transfer. A wire recall is the sending bank asking the receiving bank to return a transfer.

A merchant refund policy does not erase a timely billing dispute. A bank investigation also does not force a payment app or merchant to reverse the payment.

Scam patterns that deserve extra caution

Hang up on a caller who claims to be from the bank and then asks for a one-time code. The same goes for a fake refund that requires you to send money back, a counterfeit check followed by pressure to transfer funds, and a "safe account" instruction during a supposed fraud investigation.

Payment requests from a hacked friend or relative, urgent energy/tax/debt/delivery demands, and cryptocurrency recovery offers that want an upfront fee belong in the same high-risk pile. Verify the request through a phone number or website you found yourself. Caller ID, a familiar logo, and details about your account do not prove the contact is genuine.

Prevention checklist

Turn on alerts for card purchases, ACH debits, transfers, new payees, password changes, and logins. Unique passwords help, and the email account used for recovery needs the same protection, because that inbox is how takeovers spread. If the institution offers a passkey or authenticator app, prefer it over a text-message code.

Never share a PIN, one-time code, card security code, or crypto recovery phrase. Set transfer limits, and use extra approval for wires or new recipients when those controls exist. Review recurring ACH debits and subscriptions each month, cancel with the merchant, and keep the confirmation.

Virtual card numbers can contain online shopping if your issuer offers them. Some people also keep a separate checking account with limited funds for recurring or online payments. After a data exposure, monitor credit reports and consider a security freeze. Checking accounts between statements beats waiting for the paper bill.

Common questions

Is an unfamiliar charge automatically fraud?

Not by itself. Check the merchant descriptor, recent purchases, subscriptions, and authorized users. If you still don't recognize it, report it rather than waiting for another charge.

Does reporting within 60 days guarantee a refund?

It doesn't. That window preserves an important deadline for many credit-card and Regulation E disputes. The institution still investigates the facts and coverage. Earlier notice is safer, especially after a lost card or an account takeover.

Can a Venmo, PayPal, or Zelle payment be reversed?

Sometimes, depending on whether the account was compromised, whether the payment is still pending, the funding source, and the provider's rules. A completed payment you personally sent after a scam is not automatically treated like an unauthorized transfer.

Does a police report prove the transaction was unauthorized?

It can support your account. You still have to notify the bank, issuer, or payment provider through its dispute process.

What should I do if the bank says my password or one-time code was used?

Ask for the decision and supporting records in writing. Explain whether someone obtained the credentials through deception, whether you initiated any transfer, and what you did after you found the activity. Accurate details matter more than using a particular label.

Look at how the money moved on the statement in front of you. Call the official number on the card or statement, report the date, amount, and merchant or recipient, and get a case number. If it's a credit-card billing error, send the written dispute next, soon enough that it arrives within 60 days of the first statement that showed the charge.