If a debit-card transaction isn't yours, call your bank now. Use the number on the card or a trusted banking app, ask the bank to freeze or replace the card, and report the transfer as unauthorized. Write down when you reported it. Speed matters.
For U.S. consumer accounts, Regulation E supplies the main federal rules for unauthorized electronic fund transfers and error resolution. The material here covers debit-card EFTs, not credit-card billing disputes or wire transfers. Other payment rails may follow different procedures.
Start by identifying the dispute
Begin with authorization, not the merchant name. Turns out, a strange descriptor may belong to a real purchase, while stolen card details can create an unauthorized transfer even when your physical card never left your wallet.
| What happened | What usually controls | First move |
|---|---|---|
| Your card or card details were used without permission | Regulation E's unauthorized-transfer rules | Notify the bank and secure the card |
| You still have the card, but an unfamiliar transaction appears | Regulation E may apply | Check the descriptor, then report it promptly |
| You approved the payment, but the amount, delivery, or refund is wrong | Merchant resolution, a network dispute, or another error category | Describe the actual problem instead of calling it fraud |
| The payment was an ACH, wire, credit card, or person-to-person transfer | Different rules or procedures may apply | Tell the bank exactly how the payment was made |
Facts can overlap. The charge may still be pending, a family member may have used the card months ago, or the merchant may send you back to the bank. Write down what you know, what you do not know, and what still needs checking. An honest timeline beats an inaccurate fraud label.
The U.S. deadlines that protect you
Two clocks are easy to mix up. One concerns learning that an access device was lost or stolen; the other concerns the statement that first shows the unauthorized transfer.
| Situation | What the rule means |
|---|---|
| You report a lost or stolen card within two business days after learning about the loss | Liability for unauthorized transfers before notice is limited to the lesser of $50 or the amount transferred before notice |
| You miss that two-business-day window | Liability can rise to the lesser of $500 or the Regulation E formula: up to $50 for the first period, plus later transfers before notice that the bank establishes would have been avoided by earlier notice |
| You report an unauthorized transfer within 60 days after the bank sends the statement showing it | You generally preserve federal protection for covered errors reported during that period |
| You wait beyond 60 days | You may be liable for later transfers before notice if the bank establishes they would not have happened had you reported sooner |
The two-business-day rule is narrower than it sounds. The CFPB's Regulation E liability rule ties that window to learning that an access device was lost or stolen. It isn't a universal two-day cutoff for every unfamiliar merchant descriptor.
If your card stayed in your possession, report the transfer as soon as you see it. The CFPB's consumer guidance says the latest federal notice point is generally 60 days after the bank sends the statement showing the unauthorized transaction.
What happens after you report the charge
Once the bank receives your error notice, it generally has 10 business days to investigate and decide whether an error occurred. If it can't finish within that initial period, the rule generally allows up to 45 days when the bank provisionally credits the disputed amount within those first 10 business days. Some transactions and account situations use different periods.
There's no $50 minimum claim. The $50 figure limits liability; it doesn't set a minimum amount.
A phone report can start the process. The bank may require written confirmation, and if it does, send that confirmation within 10 business days. Otherwise, the bank may not have to provide provisional credit while it investigates.
The Regulation E error-resolution rule sets out those notice and investigation steps. Provisional credit is temporary, not a final decision. If the bank finds no error, it can generally reverse the credit after giving the required written notice.
What to do today
Use this order. Keep the record as you go.
-
Check the transaction details first. Confirm the amount, date, merchant descriptor, and status. Pending entries can change, but don't delay card security if the account may be compromised.
-
Call through a trusted channel. Use the number on the card or the bank's secure app. Say that you are reporting an unauthorized electronic fund transfer. Ask for a case number and the bank's written-notice procedure.
-
Secure the account. Freeze or replace the card, change the PIN, update your online banking password, and turn on two-factor authentication if available. Never share a one-time verification code with a caller or texter.
-
Send written notice. Include the transaction date, amount, merchant descriptor, account's last four digits, statement date, and the date you first noticed the charge. State clearly whether you did not authorize the transaction or whether an authorized payment has a different problem.
-
Mark the follow-up dates. If the bank asks for written confirmation after your phone report, send it within 10 business days. Keep proof that you submitted it.
-
Watch the account. Report new unauthorized transactions separately. Ask the bank to review any overdraft or insufficient-funds fee caused by the disputed debit; don't assume the fee will be refunded automatically.
-
Keep one file. Save the case number, screenshots, statements, call dates, messages, mailed letters, and any provisional-credit notice. It sounds fussy, but scattered records are harder to use later.
Evidence that makes the claim easier to review
Clear records give the bank something concrete to match against your report. You don't need a formal packet. Start with dates, amounts, and the trail showing when you notified the bank.
| Record | What to preserve |
|---|---|
| Account statement or transaction screen | Statement date, posting date, amount, descriptor, and transaction status |
| Bank communications | Case number, emails, secure messages, provisional-credit dates, and the final decision |
| Your timeline | When you noticed the charge, when you called, and when you sent written notice |
| Merchant records | Receipts, cancellation requests, refund promises, or messages showing what happened |
| Security details | Whether you had the card, received an account alert, or changed passwords after discovery |
A police report may support your claim, but don't wait for one before notifying the bank. Send copies of documents, never your PIN or online banking password.
A debit card dispute letter you can adapt
Use this sample only for a transaction you truly did not authorize. Replace the bracketed details, then check them against your records.
Subject: Notice of error - unauthorized electronic fund transfer
Date: [date]
Bank: [bank name]
Account ending: [last four digits]
I am writing to report an unauthorized electronic fund transfer under Regulation E.
Transaction date: [date]
Amount: [$ amount]
Merchant descriptor: [name shown on statement]
Statement date showing the transaction: [date]
I did not authorize this transaction, and I received no benefit from it. I first noticed it on [date]. Please investigate and send me the written result.
If you need written confirmation of a telephone report, please treat this letter as that confirmation. If the investigation cannot be completed within the initial period, please apply any provisional credit required by Regulation E.
Please also identify the documents relied on for your decision.
Sincerely,
[full name]
[contact information]
Send the letter through the bank's secure message system, dispute portal, or mailing method it specifies. Keep the submitted copy and delivery record.
If the bank denies the claim
Read the denial carefully. The bank may say that you authorized the transaction, that it found no error, or that the issue belongs in a merchant-dispute process.
Ask the bank to put these points in writing:
- Its explanation of what it found.
- Copies of the documents or evidence it relied on.
- A second review if the decision contains a factual mistake.
- The exact deadline and process for any appeal.
- Whether it handled the claim under Regulation E or a card-network dispute process.
To be honest, a CFPB complaint can be a useful escalation option when the problem is the bank's handling of the investigation. Include your timeline and the bank's response. A complaint may prompt a response, but it doesn't replace your original notice or guarantee reimbursement.
If the amount is substantial, check the account agreement for arbitration terms. Review your state's small-claims rules before filing anything. The available route depends on the bank, the contract, the amount, and the facts.
Where Visa and Mastercard chargebacks fit
Your bank may use a Visa or Mastercard chargeback process behind the scenes. That network process is separate from your federal rights under Regulation E.
Thing is, network rules can have their own evidence requirements, deadlines, and merchant-response stages. They don't create one universal deadline or approval rate for every debit transaction. Ask the issuer which process applies, what deadline controls, and whether it has already logged your Regulation E notice.
Don't rely on a blanket claim that every debit dispute has 120 days. The reason for the dispute, transaction type, card agreement, and network rules can change the procedure.
Overdraft fees and related losses
An unauthorized debit can trigger an overdraft or insufficient-funds fee. Ask the bank to review each related fee and explain its decision.
The federal rules above address the transfer, notice, investigation, and provisional-credit process. Ask separately how the bank will handle each related fee.
Questions readers often ask
Can I report an unauthorized debit card charge by phone?
Usually. An oral report can start the process. If the bank requires written confirmation, send it within 10 business days.
Does the bank have to give provisional credit?
Not on every claim. If the bank can't finish its investigation within the first 10 business days, it generally must provisionally credit the disputed amount to use the longer investigation period, subject to the rule's conditions. Some situations have different timing rules.
What if I recognize the merchant but never received the product?
Describe it as an authorized purchase with a delivery, billing, or refund problem. Contact the merchant and ask the bank whether its network dispute process or another error category fits. Use the unauthorized label only if you did not authorize the payment.
What if the bank denies my fraud claim?
Request the written explanation and supporting documents. Point out factual errors, ask about a second review, and consider a CFPB complaint if the concern is how the bank handled the claim.
Your next move
Open the statement today and write down its sent date, the transaction details, and the day you noticed the problem. Then call through a trusted channel, send written notice, and set a reminder for the 10-business-day deadline if the bank asks you to confirm the report in writing.