An unauthorized transaction can feel confusing if you did not tap, swipe, or click “buy.” The line may use a name you have never seen. The money may already have left checking.
Many surprise lines are still real charges you or a household user made. Some are not. This guide explains how to dispute an unauthorized transaction under official U.S. card and bank rules, and what to do in the first hour.
Table of Contents
How to dispute an unauthorized transaction
Call the number on the back of the card or in your bank app first. Say you are reporting unauthorized use. Ask them to freeze or replace the card. Official FTC lost-or-stolen-card advice is to report as soon as you can, then follow up in writing.
Unauthorized use on a credit card, in Regulation Z language, is use by someone who is not you and who had no authority, when you got no benefit.
A spouse or household user you allowed on the account is generally not “unauthorized” in that legal sense.
A store billing error is a different path. A scam you approved, such as a Zelle send you typed yourself, is usually not the same as a stolen-card swipe.
Write down the date and time you called, the agent’s name or case number, and every amount you flagged. Official CFPB and FTC pages both tell you to keep that file.
Credit card versus debit card versus bank transfer
The account type changes the clock and the cap.
| Account type | Main federal rules | Typical first move |
|---|---|---|
| Credit card | Truth in Lending Act and Fair Credit Billing Act | Call, then written billing-error notice within 60 days after the statement with the charge was sent |
| Debit card or ATM card | Electronic Fund Transfer Act and Regulation E | Call at once, especially if the card is missing, then a timely error notice |
| ACH or app pull from checking | Often Regulation E if it is an electronic fund transfer | Report to the bank that holds the deposit account |
| P2P you approved (Zelle, many friend sends) | Usually weaker than card chargebacks | Still tell the bank the same day. Do not assume a full reversal |
Federal law caps credit-card liability for unauthorized use at $50, and only if the issuer met notice conditions.
CFPB consumer pages also say you generally owe nothing if only the account number was stolen and the plastic card was not.
Many issuers advertise $0 liability. That extra $0 is a company policy, not a reason to wait.
Debit-card and other electronic-transfer liability depends on speed. CFPB Regulation E materials describe three tiers when an access device is lost or stolen:
- Report within two business days after you learn the card is missing, and liability is generally limited to $50 (or the amount taken before notice, if smaller).
- Miss that two-day window, and the cap can rise to $500 for transfers the bank shows would not have happened if you had called sooner.
- Miss 60 days after the statement showing the first unauthorized transfer was sent, and you can face unlimited liability for later transfers the bank shows it could have stopped.
If the plastic debit card was not lost, CFPB still tells you to report an unauthorized transfer that appears on a statement within 60 days after that statement is available. Waiting can leave you paying transfers that happen after those 60 days.
What to do in the first hour
- Open the live transaction list, not last month’s PDF only.
- Call the issuer or bank using the number on the card or official app.
- Ask them to block the card or login and list every bad amount.
- Change online-banking and email passwords on a device you trust.
- Ask how to send the written notice and which address to use.
FTC advice is to send a letter that includes your account number, when you noticed the card missing or the charge, and when you first reported it.
CFPB credit-card guidance says to write even after you call, so the Fair Credit Billing Act clock starts.
Use the billing-inquiries address on the statement, not the payment address. FTC suggests certified mail and a return receipt. Send copies of receipts, not originals.
CFPB’s credit-card dispute steps say the letter should include your name, address, account number, and a clear explanation of what is wrong.
FTC’s sample dispute letter also asks for the dollar amount and date, and lists “you didn’t authorize the transaction” as a valid reason.
If you suspect identity theft, use IdentityTheft.gov. Report scams at ReportFraud.ftc.gov. Those sites do not replace the call to your bank.
Pro Tip: Photograph the statement line and the written dispute address before you mail anything. Issuers sometimes print a different P.O. box for billing errors than for payments.
Written notice and investigation clocks
For credit-card billing errors, including unauthorized charges that appear on a statement, federal rules generally require your written notice to arrive within 60 days after the issuer sent the first statement that shows the error.
The issuer generally must acknowledge that notice within 30 days, unless it already fixed the bill. It generally must resolve the error within two billing cycles, not more than 90 days.
During a timely written credit-card billing-error dispute, the issuer generally cannot treat the disputed amount as delinquent for credit reporting while it investigates. You usually still pay the rest of the bill that is not in dispute.
For debit cards and other covered electronic transfers, Regulation E generally gives the bank 10 business days to investigate after it gets your error notice.
If it needs more time, it may take up to 45 days if it provisionally credits your account within those 10 business days (it may hold back up to $50 in some unauthorized-transfer cases).
Point-of-sale debit and some out-of-state transfers can allow a longer 90-day investigation window. New accounts can use 20 business days instead of 10.
The bank generally must tell you the result within three business days after it finishes, and correct an error within one business day after it finds one.
These are bank-to-customer rules. They are not a promise that every claim wins.
Authorized scams and family users
If you typed the amount and hit send because a caller claimed to be your bank, that is often an authorized payment in the app’s records.
Federal unauthorized-use language focuses on use without your permission. Tell the bank anyway. Ask whether any network “impostor” policy applies. Do not count on the same $50 credit-card cap.
A child or roommate with a second card on your account may have authority you forgot you gave. Review authorized users in the issuer app. Removing them does not always erase charges they already made.
Goods you ordered that never arrived are a billing-error or claims-and-defenses issue on a credit card, not always “unauthorized.” FTC and CFPB still want you to write within 60 days when the statement is wrong.
Common Mistakes: Waiting for the next statement before you call about a missing debit card. Paying a “refund desk” that texts a new routing number. Disputing only in a chat and never sending the written notice the statement lists.
After you file
Watch the account every day until the replacement card arrives. Update autopay that used the old number. CFPB notes that a new card number will miss those pulls until you change them.
If the bank says no, ask for the denial in writing. You can submit a CFPB complaint at consumerfinance.gov/complaint or call (855) 411-2372. That complaint is not a second investigation clock by itself. It creates a record.
Do not post the full card number in email or on social media. Official support will not ask you to buy gift cards or crypto to “verify” the dispute.
FAQs: How to Dispute an Unauthorized Transaction
Q. How fast do I need to dispute an unauthorized transaction?
A. Call the same day you see it. For credit-card billing-error rights, official CFPB and FTC guidance says to get a written notice to the issuer within 60 days after the statement with the charge was sent. For a lost debit card, Regulation E’s lower $50 cap generally needs notice within two business days after you learn the card is gone.
Q. Do I owe $50 or $0 on a stolen credit card?
A. Federal law caps unauthorized credit-card use at $50 when the issuer can charge you at all. CFPB also describes $0 when only the number was stolen and the physical card was not. Many issuers waive the $50. Report anyway so new charges stop.
Q. Is a Venmo or Zelle send I approved an unauthorized transaction?
A. Usually not under the stolen-card definition, because you sent it. Still call the bank and the app. Ask about any unauthorized login. Person-to-person payments you confirm often cannot be pulled back the way a credit-card swipe can.
Q. What if the bank will not reverse the unauthorized transaction?
A. Get the decision in writing. Check that your notice met the 60-day written path for cards or the Regulation E error path for debit. Then use consumerfinance.gov/complaint and IdentityTheft.gov if the account was taken over. Keep paying undisputed amounts so the rest of the account stays current.
Conclusion
How to dispute an unauthorized transaction starts with a same-day call to the issuer or bank, a card freeze, and a written notice that meets official 60-day statement rules. Credit cards generally cap unauthorized use at $50 and use the Fair Credit Billing Act timeline.
Debit and other electronic transfers follow Regulation E, where waiting can raise what you may owe. Keep copies, and use CFPB and FTC reporting if the first answer is no.
Disclaimer: This article is for general information only. It is not financial, legal, or tax advice. Unauthorized-use definitions, liability caps, and investigation deadlines vary by account type, issuer, and the facts of the claim. Verify questions with your bank or card issuer and consider a licensed attorney for a large loss.
Meet the Author
