If money has left your bank account or a card shows an unapproved charge, call the provider today. Start by securing access. Then report the transaction and send a written dispute.

For U.S. consumers, the payment rail usually controls which protections apply. Regulation E often covers certain electronic fund transfers, while the Fair Credit Billing Act covers credit-card billing errors. Wires, crypto transfers, and payment apps can follow different rules.

A stolen card and a transfer you approved after a scam are different claims.

Do these things first

Move fast after a wire or account takeover. Do the damage-control steps before arguing about who must pay.

1. Call through an official channel. Use the number on your card or statement, or a verified app. Say that you're reporting an unauthorized transaction and ask for a case number.
2. Lock down access. Freeze the card, change your online-banking and email passwords, sign out of other sessions, and turn on multifactor authentication. Ask whether the bank should freeze or replace the account.
3. Request a wire recall immediately if a wire is involved. The sending bank may contact the receiving institution. A recall is a request, not a refund promise.
4. Preserve the record. Keep statements, screenshots, texts, emails, transaction IDs, recipient details, and the date of each call.
5. Send formal notice. Follow the bank's or issuer's instructions for a written dispute, even if an employee already took your report by phone.

Don't hand a supposed helper your password, one-time code, private key, or seed phrase. Legitimate providers don't need those secrets.

Find the payment rule before you dispute

Work out how the money moved before choosing a dispute path. One app might process a bank-account transfer, a debit-card payment, a credit-card charge, or a stored-balance payment, and each route can have different protections.

The app's name does not decide the law. A debit card isn't a credit card for FCBA purposes, even when both use the same network logo.

Some international remittance transfers have separate federal requirements. A rule for a domestic debit transfer doesn't automatically govern every wire.

What counts as an unauthorized transaction

Regulation E generally treats an electronic fund transfer as unauthorized when someone other than the consumer initiated it without actual authority and the consumer received no benefit. Stolen account credentials are a straightforward example.

Scam transfers are harder to classify. If a scammer deceived you into entering a code or approving a transfer, the bank may treat the payment as authorized. The person who initiated it, the scammer's statements, and whether you received any benefit can affect the analysis.

The sequence can get messy: you clicked a text, called a convincing number, read out a code, and then watched the balance change. Write it down in that order anyway, even if some details feel embarrassing or incomplete.

Thing is, an incorrect price, duplicate charge, or missing product isn't automatically an unauthorized transaction. Those problems may call for a merchant refund request or another billing-error process, so don't label a purchase fraud just because the merchant dispute is frustrating.

Regulation E liability limits

Regulation E has two separate clocks. People often blend them together.

The first generally starts when you learn that an access device, such as a card or access code, was lost or stolen. The second generally runs from the statement that first shows the unauthorized transfer.

These are federal maximums, not a promise that the bank will charge you. Many banks and card networks offer zero-liability policies, but those company terms have their own conditions and exclusions.

Report both a missing access device and the suspicious transfer. The notices are related, but their deadlines aren't identical. Read the CFPB's Regulation E liability rule.

How the bank investigates

Give the bank enough information to locate the error: your name, account number, transaction date, dollar amount, and why you believe an error occurred. An oral report may start the process, but written notice gives you a stronger record.

For a reported Regulation E error, the bank generally has 10 business days to investigate. If it can't finish within that time, it generally must provide provisional credit and may take up to 45 calendar days to complete the investigation. Certain transaction types and new accounts can allow longer periods.

The bank must tell you the result. If it says there was no error, ask for the explanation and supporting documents.

Don't spend provisional credit. The bank may reverse it if the claim is denied.

Turns out, a phone call is useful, but a written trail is easier to prove. The Regulation E text contains the notice and investigation framework.

Send a dispute the provider can follow

Make the notice easy to match to the account. State the amount, date, account ending, and the date you discovered the problem.

For a Regulation E claim, use wording like this only when it accurately describes what happened:

I am reporting an unauthorized electronic fund transfer of $[amount] on [date] from the account ending in [last four digits]. I discovered it on [date]. I did not authorize this transfer and received no benefit from it. Please investigate it as an error and tell me in writing whether provisional credit applies.

For a credit card, describe the charge as a billing error and send the written notice to the issuer's billing-inquiries address. That address may differ from the payment address.

Don't rely on a merchant, app agent, or scammer to forward your notice. Send it to the financial institution whose legal or contractual process you're using.

Credit card charges follow a different process

Credit-card disputes use the FCBA rather than the ordinary debit-account process. Unauthorized use is one type of billing error.

Federal law generally limits liability for unauthorized credit-card use to $50. Many issuers and networks voluntarily promise $0 liability, but that policy is separate from the statutory limit.

Send written notice within 60 days after the statement first showed the charge if you want to preserve the FCBA process. Include your name, account number, charge date, amount, and explanation. Keep a copy and proof of delivery.

The issuer generally must acknowledge the dispute within 30 days and resolve it within two complete billing cycles, but no later than 90 days. Pay the undisputed part of the bill while the investigation continues. A merchant refund request doesn't replace the issuer notice when the deadline is near.

ACH, Venmo, PayPal, and other payment apps

Report an ACH debit to the bank holding the account. Ask whether it can return the debit and stop future debits.

For a recurring debit, revoke the authorization with the merchant. Then ask the bank about its stop-payment process and required lead time.

The 60-day statement deadline can matter for an unauthorized ACH debit. Save the exact statement date and the date you first notified the bank.

With an app payment, report the transaction inside the app and to the bank or card that funded it. Include the app username, transaction ID, recipient, amount, screenshots, and suspicious login alerts.

Venmo, PayPal, and similar services don't promise identical outcomes. A payment from a compromised account differs from one you approved and sent to a scammer, so describe that difference plainly. A platform's voluntary refund policy is separate from a bank's error-resolution duties.

Wires and crypto need a different playbook

Call the sending bank immediately about wire fraud. Ask it to request a recall and contact the receiving institution. You can also report serious theft to law enforcement.

Many ordinary bank wires don't use the same Regulation E process as debit-card and ACH disputes. The wire agreement and the facts will control much of the analysis. To be honest, recovery may become harder after the recipient moves the money.

Crypto transfers are often difficult to reverse after confirmation. Contact the exchange at once, secure the account, and save the transaction hash, wallet addresses, amount, and support ticket. If a bank account or card funded the crypto purchase, assess that funding transaction separately.

For a trading, futures, or other commodity-related platform, the CFTC's fraud-response guidance explains what records to keep and where complaints involving registered firms may go. It doesn't promise a crypto refund.

Build evidence and escalate carefully

Create a one-page timeline. Put the transaction date, discovery date, notice date, and each later contact in order.

• Statements or account records showing the transaction.
• Screenshots, emails, texts, caller details, and login alerts.
• The transfer ID, merchant or recipient information, and amount.
• Copies of dispute letters and proof that the provider received them.
• Case numbers, names, dates, and the bank's written decision.

If the provider denies the claim, request the decision in writing and ask what evidence supported it. Correct missing facts instead of sending the same complaint again.

You can file a complaint with the Consumer Financial Protection Bureau about many banks, card issuers, and payment companies. A complaint may prompt another review, but it doesn't guarantee a refund or extend the transaction-notice deadlines. For a credit union, bank, or other institution, the appropriate federal or state regulator may depend on its charter.

Court deadlines vary by claim and state. A dispute letter doesn't necessarily preserve every legal claim, so consider local legal help if the amount is substantial or a deadline is close.

Mistakes that weaken a recovery claim

Delays and vague descriptions make the file harder to review.

Before you close the case

Check later statements for additional transfers. Confirm that the card, account, email, and phone number are secure, then read the final investigation letter carefully.

If the provider hasn't responded, follow up in writing with the case number and original notice date. Call the official number, record the case number, and send the written dispute today.