Banks investigate unauthorized transactions by pulling the digital footprint of the disputed charge, comparing it against your account history, and requesting transaction data from the merchant’s payment processor, all under federal deadlines that force a decision in a set number of days. For debit cards and other electronic transfers, the Electronic Fund Transfer Act and Regulation E govern the process and typically require resolution within 10 to 45 business days.1eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors What the bank looks at, how long it takes, and how much of the money you get back depends on the type of transaction and how quickly you reported it.
What the Bank Actually Reviews
Once you file a claim, the bank’s fraud team starts with the digital details attached to the transaction. For online purchases, that means the IP address used to place the order and how it compares to your usual login patterns. For in-person purchases, they look at geolocation data from the card terminal to see whether the charge happened somewhere you could plausibly have been. Device identifiers, the unique signatures tied to your phone or computer, tell investigators whether the transaction came from a device you have used before.
Investigators also check the security details captured at checkout. Did the card’s security code match? Did the billing address pass verification? Was a PIN or signature captured at the point of sale? A mismatch on any of these strengthens the case that someone else made the purchase.
Contacting the Merchant’s Payment Processor
The bank does not investigate in isolation. It contacts the merchant’s payment processor, known as the acquiring bank, and requests transaction-level records. That exchange usually turns into a chargeback request to the merchant, who then has a chance to push back with its own evidence: delivery confirmation to your address, login records showing prior activity on the same account, or a signed receipt.
The fraud team weighs the bank’s own data against what the merchant produces and looks for inconsistencies that suggest someone else used your card or credentials. If the merchant cannot document that you authorized or received the purchase, the charge is more likely to be reversed in your favor.
ATM Withdrawals and Camera Footage
For disputed ATM withdrawals, the bank can pull security camera footage from the machine. Banks generally retain ATM recordings for at least six months, which gives investigators time to review the footage and compare the person at the machine to the account holder.
The Timeline the Bank Has to Follow
Under Regulation E, the bank has 10 business days from the date it receives your notice to investigate and reach a decision on a debit card or electronic fund transfer dispute. If it cannot finish in that window, it has to provisionally credit your account for the full disputed amount, including any interest that would have accrued, so you are not left short while the review continues.1eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
With provisional credit issued, the bank then has up to 45 days from the date it received your dispute to make a final decision. That stretches to 90 days in three specific situations: the transfer was international, it was a point-of-sale debit card transaction, or the account had been open for 30 days or less.1eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
New accounts get one other accommodation. If the disputed transfer happened within 30 days of your first deposit, the bank has 20 business days rather than 10 to issue any provisional credit.2eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors Expect a somewhat longer wait if the account is brand new.
How the Bank Reports Its Findings
When the investigation ends, the bank has three business days to tell you the outcome.1eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors If it agrees an error occurred, it has to correct the account, reverse related fees, and restore lost interest within one business day of that determination.3GovInfo. 15 USC 1693f – Error Resolution Any provisional credit already sitting in your account becomes permanent.
If the bank concludes no error occurred, or that the error was different from what you described, it must send you a written explanation of its findings, describe the evidence it relied on, and tell you that you have the right to request copies of the documents used during the investigation.1eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors Requesting those documents is the natural first step if you plan to challenge the outcome.
How Fast You Report Changes What You Can Lose
For debit cards and other electronic transfers, federal law ties your maximum personal loss directly to how quickly you notify the bank after noticing the unauthorized activity.
- Report within 2 business days of learning about the loss or theft, and your liability caps at $50, or the amount of the unauthorized transfers before you notified the bank, whichever is less.4Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
- Report after 2 business days but within 60 days of the statement showing the transaction, and your liability can rise to $500 for transfers the bank could have prevented had you reported sooner.4Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
- Report more than 60 days after the statement was sent, and you can face unlimited liability for transfers that occur after the 60-day window, as long as the bank can show it could have stopped them if you had reported on time.5eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
The 60-day clock starts when the bank sends the statement that first shows the unauthorized transaction, not when you get around to opening it.1eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors These limits also only apply if the bank has given you the required disclosures about your rights and a way to identify you as the authorized cardholder.5eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers Without those disclosures, the bank generally cannot hold you liable for unauthorized transfers at all. If something outside your control, such as a hospital stay or extended travel, kept you from reporting on time, the bank must extend these deadlines to a reasonable period given the circumstances.4Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
How to File the Dispute So the Investigation Starts Cleanly
To open a formal investigation, you have to give the bank enough information to identify the problem: your name and account number, a description of why you believe an error occurred, and, to the extent possible, the type, date, and amount of the transaction.1eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors Pulling this off your monthly statement before you call avoids processing delays.
You can report by phone or in writing. Many banks will ask you to follow an oral report with written confirmation within 10 business days. If the bank tells you written confirmation is required and you do not send it in time, the bank is not obligated to provisionally credit your account during the investigation.3GovInfo. 15 USC 1693f – Error Resolution Ask when you call, and get the correct address or portal link before hanging up.
Beyond the bank’s paperwork, filing a police report and giving your bank a copy can help.6Office of the Comptroller of the Currency. Credit Card and Debit Card Fraud If your broader personal information was stolen rather than a single card number, filing an identity theft report at IdentityTheft.gov produces a recovery plan and pre-filled letters you can send to banks and credit bureaus.
If the Bank Denies Your Claim
When a bank denies a debit card or electronic transfer dispute, it will reverse any provisional credit it issued. Before doing that, it must tell you the date and dollar amount it is removing.2eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors For five business days after that notice, the bank has to honor checks and preauthorized payments from your account without charging overdraft fees, giving you a window to move funds and avoid bounced payments.7Consumer Financial Protection Bureau. 12 CFR 1005.11 – Procedures for Resolving Errors
If you think the bank got it wrong, start by requesting the investigation documents and reviewing them for factual errors or evidence the bank did not consider. From there, you can submit a complaint to the Consumer Financial Protection Bureau, which forwards it to the bank and requires a response, typically within 15 days and up to 60 days in more complex cases.8Consumer Financial Protection Bureau. Submit a Complaint If your bank is a national bank or federal savings association, you can also file with the Office of the Comptroller of the Currency, which runs its own appeals process.9Office of the Comptroller of the Currency. File a Complaint
Credit Card Charges Are a Different System
If the unauthorized charge is on a credit card rather than a debit card or bank account, a separate law applies. Under the Truth in Lending Act, your liability for unauthorized credit card charges caps at $50 regardless of when you report, and once you notify the issuer that the card was lost, stolen, or used without permission, you owe nothing for charges made after that notification.10Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card The issuer must acknowledge a written dispute within 30 days and resolve it within two complete billing cycles, but no more than 90 days total.11Consumer Financial Protection Bureau. 12 CFR 1026.13 – Billing Error Resolution The practical difference matters: debit card fraud drains money out of your checking account while you wait, while a disputed credit card charge only sits against your credit line.