If a transaction isn't yours, contact the bank, card issuer, or payment service through an official channel now. Ask it to block further access, open a fraud or error case, and explain how to submit a formal dispute.

This article focuses on U.S. consumer accounts. The applicable protection depends on the payment rail, the account type, and whether you authorized the payment. Fast notice can limit liability under Regulation E, but no single rule guarantees reimbursement for every scam, wire transfer, payment-app transaction, or cryptocurrency payment.

What to Do in the First 24 Hours

1. Check the details without waiting to report it. An unfamiliar merchant descriptor may be a subscription, digital-wallet charge, or purchase by an authorized user. Check those possibilities, but report the transaction if you still don't recognize it.
2. Use an official contact method. Call the number on the back of your card, on a statement, or on the institution's official website. Don't use a link or phone number from an unexpected fraud alert.
3. Secure the compromised access. Lock the card, change the banking and email passwords, sign out of other sessions, reset the PIN, and enable multifactor authentication. Ask whether the bank should replace the card or restrict the account.
4. Create a record. Save the transaction ID, amount, date, merchant descriptor, representative's name, case number, and time of your call.
5. Submit the dispute through the correct process. An unauthorized debit-card transaction, credit-card billing error, ACH debit, wire, and PayPal payment may follow different rules.
6. Keep checking the account. Review pending and posted activity, linked accounts, email, and phone alerts. Report each additional unauthorized transaction promptly.

A police or FTC report may support your claim, but it doesn't replace notice to the bank or issuer and doesn't stop the applicable dispute deadline.

Which Rule Applies to the Payment?

The payment rail matters more than the word "fraud." These protections aren't interchangeable.

Regulation E generally covers electronic fund transfers from consumer accounts. Business accounts, some wire transfers, and payments you personally authorized may fall outside the usual debit-account protections. Ask the institution to identify the payment type and the process it is applying.

Regulation E Deadlines for Debit and Bank-Account Transfers

For a personal checking, savings, or qualifying prepaid account, Regulation E's liability rules generally work as follows:

• Within two business days: If you notify the institution within two business days after learning that your debit card or other access device was lost or stolen, your liability is generally limited to the lesser of the unauthorized amount or $50.
• After two business days but within 60 days: Your potential liability can increase, generally up to $500 for transfers before notice, subject to the calculation in the rule.
• After 60 days: If you don't report an error within 60 calendar days after the statement showing it was sent, you may be responsible for later transfers that could have been prevented if you had reported the earlier error.

The two-business-day rule concerns learning that an access device was lost or stolen. If your physical card is still with you but someone used the account number, report the transaction immediately and pay close attention to the 60-day statement deadline. The Regulation E liability rule contains the detailed calculation and exceptions.

These are potential liability limits, not automatic refunds. The bank can investigate whether the transfer was actually unauthorized and whether another person had authority to use the account.

How Long the Bank Has to Investigate

Under the federal error-resolution rule, a bank generally has 10 business days after receiving notice to investigate. A new account may receive a longer initial period. If the bank can't complete the investigation within the applicable initial period, it generally must provide provisional credit for the alleged error while it continues investigating, unless an exception applies.

The usual final-investigation period is 45 calendar days, although the rule permits up to 90 days for certain transactions, including some point-of-sale debit, foreign-initiated, and new-account transactions. Provisional credit isn't necessarily final reimbursement. If the bank finds no error, it may reverse the credit after giving the required explanation and notice.

The CFPB's guidance on unauthorized transactions and its Regulation E error-resolution rule explain the notice and investigation process.

If you report the error by phone, the institution may require written confirmation within 10 business days. Send it promptly so the dispute isn't delayed.

How to File the Dispute

Debit card, ACH, or other bank-account transfer

Use the word "unauthorized" only when another person initiated the transfer without your permission. If you approved a payment because of a scam, describe those facts instead.

You can tell the bank:

"I am reporting an unauthorized electronic fund transfer. I did not authorize this transaction, and I want to open an error investigation."

Include:

• the account number or last four digits;
• the transaction date, amount, and description;
• when you discovered it;
• whether your card, PIN, phone, or login was lost, stolen, or compromised;
• whether you recognize the merchant or recipient;
• the steps you took to secure the account; and
• the preferred way to contact you.

Use the bank's dispute form, secure-message system, or written-notice address if available. Keep a copy and proof of submission. A phone call is useful for speed, but written follow-up creates a clearer record.

For an ACH debit that has already posted, ask the bank whether it can return or recover the payment. For a recurring preauthorized debit, request a stop-payment order for future transfers at least three business days before the scheduled date. A stop-payment order doesn't by itself resolve an earlier transaction.

Credit-card charge

Credit-card disputes follow a different process. Send a written notice to the billing-error address shown on the statement, not simply the payment address. State the amount, date, account number, and why the charge is unauthorized. Send it early enough that the issuer receives it within 60 days after the statement containing the charge was sent.

The issuer generally must acknowledge the notice within 30 days unless it resolves the issue sooner, and it generally must correct the account or explain the result within two billing cycles, no later than 90 days. Continue paying undisputed charges and follow the issuer's instructions about the minimum payment while the investigation is pending.

A card-network "chargeback" is a separate processing route. Network deadlines and issuer procedures can vary, so don't assume a network window replaces the federal 60-day billing-error deadline.

Pending transactions

A pending authorization may disappear, post for a different amount, or become a completed charge. Lock the card and call the issuer when you see it. If the issuer won't accept a formal billing dispute until the charge posts, ask how to document the report and follow up as soon as it appears on the account.

PayPal and Other Payment Apps

Report an unrecognized PayPal payment through your PayPal account or Resolution Center immediately. Then contact the bank or card issuer that funded the payment. Changing the PayPal password, removing unfamiliar devices, and enabling two-step verification can help prevent additional activity.

PayPal's Purchase Protection terms are a company policy, not a replacement for Regulation E or the Fair Credit Billing Act. The published terms generally list a 180-day period from the payment date. Some order-related disputes use the earlier of 30 days from delivery or fulfillment and 180 days from payment. Eligibility and exclusions depend on the transaction type. PayPal's dispute-process information also explains that a dispute and a later claim can involve different steps.

Don't describe a payment as unauthorized if you personally sent it but later learned that the recipient was a scammer. Explain exactly what happened. A transfer made by a fraudster after an account takeover may be treated differently from a payment you approved under false pretenses, and the provider or bank will evaluate the facts. If a debit or credit card funded the payment, that card issuer's process may also apply.

Wire Transfers and Cryptocurrency

If an unauthorized wire was sent

Contact the sending bank's wire-fraud department immediately. Ask it to:

• issue a recall or hold request;
• contact the receiving bank;
• preserve the wire reference and authentication records; and
• tell you whether law enforcement must send a request to freeze the recipient account.

Provide the amount, date, beneficiary details, wire reference number, messages, email addresses, and any account-login information involved. A recall isn't guaranteed, especially after the recipient withdraws or moves the funds.

An ordinary wire that you instructed the bank to send after an impersonator persuaded you may not receive the same treatment as a transfer initiated by someone who took over your account. Describe the event accurately and ask the bank which rule and internal procedure it is applying.

For an internet-enabled crime, file a report with the FBI's Internet Crime Complaint Center. A report can help investigators connect related fraud, but it isn't a promise of recovery.

If cryptocurrency was transferred

Contact the exchange or custodial wallet immediately. Supply the transaction hash, wallet addresses, amount, timestamps, login alerts, and screenshots. Ask whether the account can be frozen and whether the exchange has a law-enforcement contact process.

A self-custody wallet generally can't reverse a confirmed blockchain transaction. Don't pay a person or company that promises guaranteed crypto recovery, and don't send additional crypto to "unlock" a refund. Report the fraud to the FTC's fraud-reporting service. If personal information was stolen, use the FTC's identity-theft recovery service, and report the incident to IC3 when appropriate.

Evidence That Makes a Dispute Easier to Review

Create a simple timeline while the details are fresh. Include:

• the date and time you noticed the transaction;
• the statement, alert, or screenshot showing it;
• the transaction ID, merchant descriptor, recipient, or wallet address;
• device, login, IP, or authentication alerts available to you;
• whether you had the physical card or phone;
• names of authorized users and anyone who may have had access;
• emails, text messages, call records, and scam instructions;
• the date and method of your bank or platform report;
• the case number and any provisional credit; and
• police, FTC, or IC3 report numbers.

Keep the original files and don't alter screenshots. Never send a password, one-time verification code, or full Social Security number through ordinary email. Use the institution's secure upload or messaging system.

If you shared a code, approved a login, or installed remote-access software, say so. Accurate facts help the investigator distinguish an account takeover from a payment you authorized after being deceived.

What to Do If the Bank Denies the Claim

Ask for the decision in writing and request the documents or information the institution relied on. For a Regulation E claim, the bank's explanation should identify why it found no error. Authentication data can be relevant, but a login or one-time code doesn't by itself explain every circumstance surrounding a disputed transfer.

Then:

1. Escalate internally. Ask for a supervisor or formal reconsideration and attach new evidence.
2. Check the institution's regulator. Submit a complaint to the CFPB for many consumer financial products. The FDIC consumer complaint process may be appropriate for an FDIC-supervised bank or may refer the issue to the correct agency. The FDIC says its Consumer Response Unit generally responds within 14 days; that's an agency-response target, not a promise of reimbursement.
3. Protect your identity. If personal information was exposed, use IdentityTheft.gov's recovery steps and consider a credit freeze with each nationwide credit bureau.
4. Review further options. Check the account agreement for arbitration or court procedures and any applicable deadlines before pursuing a legal claim.

A regulator complaint can prompt a response, but it doesn't replace the bank's dispute process or automatically reverse a decision.

Preventing Another Unauthorized Transaction

• Turn on transaction alerts for every card and account.
• Use unique passwords for banking, email, and payment apps.
• Protect the email account and phone number linked to financial accounts.
• Use multifactor authentication and review logged-in devices regularly.
• Keep a list of subscriptions and recurring ACH payments.
• Verify wire instructions through a trusted phone number, especially after an email change.
• Don't click links in unexpected "fraud alert" texts. Open the official app or call the number on your card.
• Review statements even when alerts are enabled; an alert can be missed or delayed.

Unauthorized Transaction FAQ

How long do I have to report an unauthorized bank transaction?

Report it immediately. For many Regulation E transfers, notification within two business days after learning of a lost or stolen access device can preserve the $50 liability limit. You should also report the error within 60 days after the statement showing it was sent to protect against liability for later transfers.

If your physical card is still in your possession, the two-business-day lost-or-stolen rule may not describe the situation. The 60-day statement deadline can still matter, so don't wait to contact the bank.

Will the bank refund the money while it investigates?

It generally must provide provisional credit if it needs more time than the initial Regulation E investigation period, subject to exceptions. The credit isn't always final and can be reversed if the bank concludes that no error occurred. Ask when the credit will appear and what notice the bank will send if it reverses it.

Is a credit-card dispute the same as a debit-card dispute?

No. A credit-card billing error generally requires written notice to the billing-error address within 60 days of the statement. A debit-card or ACH claim generally follows Regulation E's electronic-transfer error process. Use the procedure for the account that was actually charged.

Does replacing my card recover the unauthorized charge?

No. Replacement blocks or reduces future card use, but you still need to dispute the posted transaction. Ask whether the issuer can block the merchant or update recurring-payment controls when appropriate.

Can I recover money from a wire or crypto transfer?

Act immediately and request a wire recall or exchange freeze, but neither is guaranteed. Ordinary wires and blockchain transfers don't have the same automatic dispute process as many debit- or credit-card transactions.

What if I approved a payment because of a scam?

Tell the bank or platform exactly what you did and what the scammer told you. A payment personally approved after deception may be treated differently from a transfer made by someone who took over your account. The applicable protection depends on the payment rail, provider policy, account type, and investigation findings. Save the messages and report the payment through the provider's process even if you aren't sure it qualifies for reimbursement.