Call your bank, credit union, or card issuer as soon as you see a charge you didn't approve. Lock the affected card, save the transaction details, and open a formal dispute. How fast you report it can change how much of the loss you may have to absorb.
For most personal U.S. checking and savings accounts, unauthorized debit card, ATM, and ACH transfers are handled under the Electronic Fund Transfer Act and Regulation E. Credit card billing errors follow a different process. Wire transfers sit under still other rules. The two-business-day window and the 60-day statement deadline are not the same requirement, and they are not interchangeable.
Do this first
Check whether the charge is pending, a preauthorization, a recurring subscription, or a merchant name you simply don't recognize. If it still looks fraudulent, don't wait for it to post.
Use an official channel: the number on the back of the card, or the institution's own app or website. Ignore phone numbers that arrive in a text or email.
Lock the card, then ask what else needs to be frozen. A card lock may not stop ACH debits, account transfers, or peer-to-peer payments. Ask whether the account, card number, digital wallet, or online access should be replaced or restricted.
If the money went out through a peer-to-peer app, report it to both the financial institution and the payment service. From a device you trust, change your banking and email passwords, sign out of unfamiliar sessions, and remove unknown devices or linked apps. Never share a one-time verification code.
Write down the amount, date, merchant descriptor, last digits of the account, the date you found the charge, any case number, and every call or message.
Don't move money to a "safe account" because someone claiming to be from your bank told you to. That's a common impersonation tactic.
What counts as an unauthorized transaction?
Under Regulation E, an unauthorized electronic fund transfer is generally a transfer from a consumer account that someone other than the consumer started, without actual authority, and from which the consumer received no benefit. That commonly covers debit card purchases and cash withdrawals, ATM transactions, ACH debits and other electronic transfers, online banking transfers, and some payments tied to peer-to-peer services.
The rule is aimed at personal, family, or household accounts. It does not automatically cover every business account. The NCUA's overview of the Electronic Fund Transfer Act and Regulation E describes the electronic transfers the law covers.
An unfamiliar line on a statement is not automatically unauthorized. Merchants often bill under a different name. Hotels and rental companies place temporary holds. Subscriptions renew. A family member who already had permission to use the account can also change the analysis.
A payment you approved after a scammer talked you into sending money can be treated differently from a transfer a criminal started after taking over the account. Report either situation right away, and be precise about who entered the payment, approved it, or supplied the verification code.
Which rule applies to your payment?
| Payment or problem | Usually controlled by | First action |
|---|---|---|
| Debit card, ATM, or ACH transfer from a personal account | Regulation E | Notify the bank or credit union promptly |
| Account takeover involving some peer-to-peer payments | Regulation E may apply, depending on the facts | Notify the bank and payment service |
| Unauthorized credit card charge | Fair Credit Billing Act billing-error process and issuer policy | Send written notice to the billing-inquiries address |
| Wire transfer | Wire rules, bank procedures, and sometimes contract terms | Call the wire and fraud departments and request a recall |
| Approved purchase with non-delivery, overcharge, or return problem | Merchant refund, billing-error, or chargeback process | Contact the seller and use the correct dispute channel |
A merchant dispute is not an unauthorized-transaction claim. If you made the purchase yourself and the item never arrived, that is usually a billing or delivery problem. The FTC's sample dispute letter shows the kind of information to include for credit and debit card issues.
Regulation E liability deadlines
Report the problem as soon as you find it. Under Regulation E, potential liability for an unauthorized electronic transfer depends in part on when you notify the institution.
| When you report | Potential consumer liability |
|---|---|
| Within two business days after learning that an access device was lost or stolen | Generally limited to the lesser of $50 or the amount transferred before notice |
| More than two business days later but within 60 calendar days after the statement showing the transfer | Can rise under Regulation E's formula, generally up to $500 |
| More than 60 days after the statement | You may be responsible for later transfers if the bank shows timely notice could have prevented them |
The two-business-day limit is mainly about learning that a card, PIN, or other access device was lost or stolen. The 60-day clock generally runs from an unauthorized transfer shown on a periodic statement. If you are not sure which deadline applies, report the charge anyway.
These are federal liability limits, not a promise of an automatic refund. The bank may conclude that the transfer was authorized, that the account or payment type falls outside Regulation E, or that delayed notice increased the loss. Some issuers and card networks also offer broader zero-liability policies in their account terms, which is separate from the statutory cap.
How to dispute an unauthorized debit or ACH transaction
Tell the representative you are reporting an unauthorized electronic fund transfer, not just asking about a charge. Give the date, amount, merchant or recipient, and account.
Ask for a fraud or error claim number, the date the bank recorded your notice, instructions for written confirmation, a card replacement or account change if credentials were exposed, and any stop, block, or recall options still available.
A bank may take an oral report and still require written confirmation within 10 business days in some cases. Use the bank's secure message system, dispute form, or the address it gives you. Keep a copy and proof of delivery.
Include your name and contact information, the last four digits of the account, the transaction date, amount, and description, when you noticed it, a clear statement that you did not authorize it, whether the card, phone, or login was lost, stolen, or compromised, the steps you have already taken, and a request for an investigation plus any provisional credit available under Regulation E.
Don't put your full password, PIN, one-time code, or full card number in ordinary email.
A short written statement can be this direct:
I am disputing the electronic fund transfer of $___ dated ___. I did not authorize this transaction and received no benefit from it. Please investigate the error and confirm the claim number and next steps in writing.
The bank may ask whether you still had the card, who had access, whether you entered a code, and when you last used the account. Answer accurately. Using a PIN or device does not by itself settle the question, but leaving out relevant facts can slow the review. A police report can support your file in a theft or identity-fraud case. It does not replace notice to the bank.
For a typical Regulation E claim, the bank generally must investigate and decide whether an error occurred within 10 business days. That initial period can be longer for a new account. If more time is needed, Regulation E generally allows an extended investigation of up to 45 days. Some point-of-sale debit transactions, foreign-initiated transfers, and new-account cases may run up to 90 days. When the bank uses an extended timetable, it generally must provide provisional credit within the applicable initial period, subject to the rule's conditions.
Provisional credit is temporary. It can be reversed if the bank later finds no error. If you can, leave that amount alone until the claim is final.
After the investigation, the bank generally must tell you the result within three business days. If it finds an error, it generally must correct the account promptly. If it finds no error, ask for the written explanation and the documents it relied on.
Credit card charges use a different dispute process
Credit card charges are not handled under Regulation E's debit-card liability formula. For a billing error, including an unauthorized charge, the Fair Credit Billing Act generally requires written notice within 60 days after the statement first showed the error.
Send that notice to the issuer's billing-inquiries address, which may differ from the payment address. Include the transaction details and a statement that you dispute the charge. The issuer generally must acknowledge the notice within 30 days and resolve it within two billing cycles, with a maximum of 90 days.
Follow the issuer's instructions and pay the portion of the bill you don't dispute. A phone call alone may not protect you if the issuer requires writing.
Peer-to-peer payments, recurring debits, and wire transfers
If a criminal used your bank account and started a peer-to-peer payment without permission, say that it was an unauthorized transfer and report it to both the bank and the payment service. If you sent the payment yourself after an impersonator tricked you, the bank or platform may treat it as authorized. Still ask for a fraud review, ask whether the transfer can be recalled, and keep the messages and account details.
When a merchant keeps debiting after you revoked authorization, contact the merchant and the bank. Ask about the bank's stop-payment or ACH-blocking procedure. Stopping future payments does not automatically unwind an earlier unauthorized debit, so dispute those charges separately.
Wire transfers generally are not covered by Regulation E's debit and ACH error-resolution procedure. Call the bank's wire or fraud department immediately and ask for a recall or cancellation. The sooner the sending bank contacts the receiving institution, the more useful that request may be. Recovery is not guaranteed.
How to spot fraud earlier
Review the account even when alerts are on. Watch for small charges that look like card testing, cash withdrawals you don't recognize, new payees or external transfers, changes to password, email, phone number, or mailing address, logins from unfamiliar devices, repeated charges under slightly different merchant names, and payments that don't match your location or routine.
Merchant names can be abbreviated or run through a payment company. Check the receipt and subscription history before disputing a purchase you actually made. If the charge is still unexplained, contact the issuer instead of waiting for the next statement.
Ways to reduce future losses
Use a unique password for banking and email, preferably in a password manager. Turn on alerts for transactions, low balances, logins, new payees, and profile changes where those exist. Prefer an authenticator app, passkey, or security key when offered; those options can be more resistant to SIM-swap attacks than text messages.
Add a PIN or port-out lock to your mobile account. Open the bank's official app or type the website address yourself rather than following unexpected links. Never give a one-time code to a caller, merchant, or supposed fraud investigator.
Review connected apps, digital wallets, and authorized users from time to time, and keep your contact information current so the bank can reach you. If your Social Security number or other identity information was exposed, consider a credit freeze. A freeze will not reverse an account transfer, but it can help block new-account identity theft.
If the bank denies your claim
Ask for the decision and reason in writing, plus the records the bank relied on. Check whether it evaluated the correct payment rail and account type. Then send a concise reconsideration request with your timeline, statements, screenshots, and any evidence of account takeover or card theft.
If that still goes nowhere, escalate. For a bank complaint, the FDIC's consumer complaint process says to contact the institution first and provide a written description with dates, amounts, names, and relevant documents. The FDIC may refer the issue to the agency that supervises the institution. Credit union customers can contact the NCUA Consumer Assistance Center. The Consumer Financial Protection Bureau may also accept complaints about covered consumer financial companies.
You can report scams to the FTC and serious theft to local law enforcement. Those reports help document what happened. They do not replace the bank's dispute process or guarantee reimbursement.
Frequently asked questions
Does a bank have to refund every transaction I don't recognize?
No. The bank has to follow the error-resolution rules that apply, but an unfamiliar charge may be legitimate, authorized, outside Regulation E, or reported too late. A prompt, well-documented claim is still the strongest position you can put yourself in.
Is the two-business-day deadline the only deadline?
No. That limit mainly affects loss or theft of an access device. The statement-based 60-day deadline also matters for many Regulation E claims. Report the issue as soon as you see it rather than trying to calculate which clock is running.
Is a peer-to-peer payment scam always covered by Regulation E?
No. Coverage depends on how the payment was started and on the account and service involved. An account takeover in which a criminal initiated the transfer may be treated differently from a payment you personally approved after being deceived.
What should I do if provisional credit is taken back?
Read the final explanation, request the supporting records, and submit a written reconsideration with any missing evidence. If the bank still will not correct a qualifying error, escalate to the appropriate regulator and consider professional advice if the loss is substantial.
If you have not already done so, call the number on the back of the card now, write down the claim number and the date notice was recorded, and send the written follow-up the same day.