Did an unfamiliar charge just hit your bank statement? Don't wait.

Your legal rights depend entirely on whether you used a credit card or pulled money directly out of checking. Federal law limits what you owe, but missing a filing deadline can wipe those safeguards out completely.

How Federal Rules Protect Credit and Debit Cards

Credit cards operate under the Truth in Lending Act and the Fair Credit Billing Act. Federal law sets your maximum liability at $50. Most card issuers publish zero-liability rules that waive that amount anyway.

To lock in your statutory rights, mail a written notice to the card issuer's billing inquiry address within 60 days of the statement date. The issuer has 30 days to acknowledge your notice. They must wrap up the investigation within two billing cycles, capped at 90 days.

Debit cards and electronic transfers run under Regulation E, which implements the Electronic Fund Transfer Act. That distinction matters. Debit transactions pull real cash immediately. What you owe depends on when you speak up.

Under Regulation E error resolution rules, banks get 10 business days to investigate an unauthorized debit. They can stretch that to 45 calendar days, but they must grant provisional credit while they work.

Turns out, waiting past that 60-day calendar mark lets the bank off the hook for any subsequent unauthorized withdrawals.

Step-by-Step Guide to Disputing Unauthorized Bank Charges

Act quickly when you spot an unauthorized line item:

1. Lock your card instantly. Open your mobile banking app and freeze the card so no pending transactions post.
2. Call the bank's fraud line. Tell the representative directly that you are reporting an unauthorized electronic transfer. Log the call time, date, and agent name.
3. Mail a formal dispute letter. Phone calls trigger internal alerts, but only written notice sent to the designated billing address preserves your federal rights. Attach copies of the statement with the bad charge highlighted.
4. Demand provisional credit. The bank must credit your account temporarily if their review runs beyond 10 business days.
5. Mark statutory deadlines on your calendar. Check back immediately if the bank fails to respond within the required 10-day or 45-day window.

Customer service representatives often record fraud as a routine merchant dispute by mistake. That misclassification delays your claim. Insist that the representative tags the file as unauthorized fraud before you hang up.

How Fraud Differs From Scams on P2P Apps

Thing is, peer-to-peer apps treat stolen credentials and trickery as two completely separate legal universes. The whole outcome comes down to who initiated the transfer.

If someone hacks your account or steals your phone to send cash, federal law shields you. That transfer is unauthorized. Under Regulation E, the bank must investigate, follow statutory timelines, and apply liability caps.

Scams run under a much harsher standard. When an imposter impersonates your bank, spins an elaborate story, and tricks you into sending money, you still pushed the button yourself. Because you authenticated the transfer, Regulation E liability caps do not force the bank to make you whole.

Certain payment networks voluntarily reimburse specific imposter scams under internal rules, but those programs are corporate policies rather than enforceable statutory rights. Report the loss to both the app and your bank immediately. Your legal leverage remains slim once you authorize a payment.

Escalation Options When a Dispute Is Denied

A denied claim is never the final word. Federal rules give you the right to examine every document, log, and record your bank used to justify turning you down.

Demand their written determination file. Comb through it for wrong IP addresses, bad geolocation tags, or mismatched merchant terminal codes.

If the bank refuses to budge, take your dispute to the agencies that oversee them:

• Consumer Financial Protection Bureau (CFPB): Submit a complaint at consumerfinance.gov. Financial institutions must reply to CFPB inquiries within 15 days.
• Primary banking regulators: National banks report to the Office of the Comptroller of the Currency (OCC). State-chartered banks answer to their state regulator or the FDIC.
• Federal Trade Commission (FTC): If an unauthorized charge stems from identity theft, file an official report at IdentityTheft.gov.
• State Attorney General: File a complaint with your state consumer protection bureau to trigger a local inquiry.

A formal CFPB complaint lands on the desk of a compliance officer, not a frontline phone agent. That often forces a serious second look.

Evidence You Need to Support Your Dispute

Solid evidence prevents a claims investigator from dismissing your case as friendly fraud. Start with your bank statements. Circle each unauthorized charge clearly.

If a physical card was run at a cash register in another state while you were sitting at your desk, gather objective location proof. Pull your employer badge swipes, timestamped office security logs, toll records, or local grocery receipts. If the unauthorized transaction is large, file a report with your local police department. A signed police report carries criminal penalties for false reporting, which signals to the fraud department that you mean business.

To be honest, the small green card from USPS Certified Mail with Return Receipt Requested is the single most valuable piece of paper you can hold. It proves your dispute letter arrived before the legal 60-day deadline expired. Keep the signed green receipt in a dedicated folder alongside your statement copies and phone logs so you can hand an airtight file to regulators if the bank pushes back.