How to Respond to an Unauthorized Bank or Credit Card Charge
An unfamiliar charge can result from fraud, a billing mistake, a forgotten subscription, or a merchant name that appears differently on a statement. Regardless of the cause, respond promptly. Federal protections often depend on the payment method and how quickly the problem is reported.
This article provides general U.S. information, not individualized legal or financial advice. State laws and account agreements may provide additional protections.
Confirm That the Charge Is Unfamiliar
Check the transaction date, amount, location, and merchant descriptor. A parent company or payment processor may appear instead of the business name you recognize.
Also consider whether the charge could involve:
A free trial that converted to a paid subscription
A recurring membership
A purchase made by another authorized cardholder
A restaurant, hotel, or rental-car hold
A split shipment
A digital-wallet or app-store purchase
A tip added after authorization
Contact the merchant when the transaction may be a mistake or unclear subscription. However, do not let a slow merchant response cause you to miss a bank or card-issuer dispute deadline.
Secure the Account Immediately
If you still do not recognize the charge:
Lock the card through the issuer’s app if that option is available.
Call the number on the card or official statement.
Report the transaction as unauthorized.
Request a replacement card or account number when appropriate.
Change the account password and enable multifactor authentication.
Remove unfamiliar devices and digital wallets from the account.
Review recent transactions for additional fraud.
Avoid telephone numbers or links contained in an unexpected text or email. A fraudster may send a fake alert hoping to obtain login credentials or a verification code.
Record the date, time, representative’s name, case number, and instructions provided by the financial institution.
Credit Cards Have a Formal Billing-Error Process
Call the credit card issuer as soon as possible. To preserve your rights under the Fair Credit Billing Act, also send a written billing-error notice within 60 calendar days after the issuer sent the first statement containing the charge.
Use the billing-dispute address shown on the statement, which may differ from the payment address. Include:
Your name and account number
The amount and date of the disputed charge
The merchant name shown
An explanation that you did not authorize the transaction
Copies of supporting records
Keep a copy and proof of delivery.
The issuer generally must acknowledge the written dispute within 30 days unless it has already resolved the issue. It must complete the investigation within two billing cycles and no more than 90 days.
During the investigation, you generally do not have to pay the disputed amount or related finance charges. Continue paying the undisputed portion of the bill on time.
Federal law generally limits liability for unauthorized credit card use to $50. If only the account number was stolen and the physical card was not lost, the consumer generally has no liability for unauthorized charges. Many issuers voluntarily provide broader zero-liability policies.
Debit Cards and Bank Transfers Have Different Deadlines
Debit card and other electronic fund transfer protections fall under the Electronic Fund Transfer Act and Regulation E. Because the money leaves a bank account directly, acting quickly is particularly important.
If a debit card is lost or stolen, potential liability generally depends on when the loss is reported:
Before unauthorized use: $0
Within two business days after discovering the loss or theft: up to $50
More than two business days later but within 60 calendar days after the statement was sent: potentially up to $500
More than 60 days after the statement: potentially all unauthorized transfers occurring after that period, including money taken from linked accounts
When the physical card was not lost but an unauthorized transaction appears on the statement, report it no later than 60 calendar days after the statement was sent. Reporting sooner is safer.
These liability limits depend on the particular facts and whether the transaction legally qualifies as unauthorized.
What the Bank Must Do
After receiving notice of an unauthorized electronic transaction, a bank or credit union generally has 10 business days to investigate. The period is generally 20 business days for certain newly opened accounts.
If the institution needs more time, it may generally take up to 45 days—and up to 90 days for certain transactions—if it provides provisional credit as required. The bank may ask for written confirmation of a telephone report. Submit it within 10 business days because failure to do so can affect the right to provisional credit.
If the bank finds an error, it generally must correct it within one business day and report its findings within three business days after completing the investigation.
A provisional credit is temporary. The institution may remove it after giving notice if its investigation concludes that the transaction was authorized.
Unauthorized Transactions and Scams Are Not Always the Same
A transaction made by a fraudster who obtained account credentials and transferred money without actual authority may qualify as an unauthorized electronic fund transfer.
The situation can be different when the account holder personally initiates a payment after being deceived—for example, sending money to someone impersonating a bank employee or government official. The institution may treat that as an authorized payment even though it resulted from a scam.
Report either situation immediately and describe exactly what happened. Do not change the facts or describe a personally approved payment as account takeover fraud. Ask the institution about fraud recovery, recalls, payment-network remedies, or other assistance even if statutory reimbursement is uncertain.
If the Claim Is Denied
Request the decision in writing and ask for the documents the institution relied upon. Review whether it considered:
Device and login records
Transaction location
Authentication method
Previous account activity
Merchant records
Your timeline and supporting documents
Submit a written appeal or reconsideration request if relevant information was overlooked. Clearly explain why the transaction was not authorized and attach any new evidence.
If the issue remains unresolved, complaints may be submitted to the Consumer Financial Protection Bureau and the financial institution’s federal or state regulator. Fraud and identity theft can also be reported through IdentityTheft.gov.
A substantial loss, repeated denial despite strong evidence, or approaching legal deadline may justify consulting a consumer-law attorney.
Continue Monitoring Every Account
One unauthorized charge may indicate broader identity theft. Review other bank and card accounts, change reused passwords, and check credit reports for unfamiliar accounts.
Keep the dispute decision and confirm that:
The unauthorized charge was removed
Related interest and fees were reversed
Provisional credit became permanent
The replacement card is secure
No recurring merchant token remains active
Fast reporting, a written follow-up, and organized records provide the strongest protection when an unauthorized transaction occurs.
