How Does Credit Card Fraud Investigation Work: Chargebacks and Liability

A credit card fraud investigation starts when you report an unauthorized charge to your card issuer and ends when the issuer either confirms the fraud and makes the credit permanent or decides the charge was legitimate and reverses any temporary refund. In between, the bank cancels the compromised card, usually posts a provisional credit, reviews transaction data, and — if it agrees the charge was fraudulent — files a chargeback through the card network to pull the money back from the merchant’s bank. Federal law gives the issuer up to two billing cycles, and never more than 90 days, to finish that investigation once you’ve sent a written dispute.¹ Your maximum personal liability is capped at $50, and most major networks reduce that to zero.²

Step One: Reporting the Charge

Call the number on the back of your card as soon as you notice something you didn’t authorize. Timing matters, because federal liability only covers unauthorized charges that happen before you notify the issuer. Once you call, the representative will typically cancel the compromised card number, send a replacement, and open a dispute file. Have the transaction date, amount, and merchant name from your statement ready.

Ask for a claim or reference number and write down the representative’s name along with the date and time of the call. If the dispute drags on or the initial decision goes against you, that record is what you’ll point back to. Many issuers also let you flag transactions in their app, but a phone call creates the cleanest proof that you gave timely notice.

Step Two: Send a Written Dispute Within 60 Days

This is the step most people skip, and skipping it can quietly cost you your dispute rights. The phone call limits your liability. A separate written notice is what triggers the full billing-error protections under federal law, and you have 60 days from the date the issuer mails the statement containing the fraudulent charge to send it.³

The notice needs your name, your account number, the amount you believe is wrong, and a short explanation of why. Send it to the billing inquiries address on your statement, not the payment address. Some issuers accept electronic submissions through a dispute portal, but only when they’ve specifically said so in their billing rights disclosure.³ When in doubt, certified mail gives you proof of delivery.

Once that written notice arrives, two clocks start. The issuer must acknowledge your dispute in writing within 30 days, and must complete its investigation within two full billing cycles — a hard outer limit of 90 days.¹ Banks that miss those deadlines can forfeit the right to collect the disputed amount.

What the Bank Actually Does During the Investigation

Most issuers post a provisional credit to your account within a few business days of the fraud report. The credit restores your available balance while the review runs, and it can be reversed later if the bank concludes the charge was legitimate.

Inside the fraud department, investigators compare the flagged transactions against your usual spending patterns. A card-present charge at a gas station three states away while your other transactions place you at home that same afternoon is a strong signal. They also pull digital markers on online purchases: the IP address used, device fingerprinting data, and whether the transaction cleared address verification and card security code checks.

Before the issuer can reverse a provisional credit and bill you for the charge, federal rules require it to have conducted a reasonable investigation.¹ If it decides the charge was authorized, it has to explain the finding and tell you what evidence it relied on.

Your Rights While the Investigation Is Open

Once you’ve sent a proper billing-error notice, you don’t have to pay the disputed amount or any finance charges tied to it while the issuer investigates. If you have autopay set up, the issuer can’t deduct the disputed amount as long as your written notice reached them at least three business days before the scheduled payment.¹

The issuer also cannot report the disputed amount as delinquent to the credit bureaus, or threaten to, while the investigation is open.¹ That matters. A fraud charge reported as past due can drop your credit score before you’ve had a chance to fight it. The issuer can note on your statement that the amount is in dispute, and it can deduct the amount from your available credit while it looks into things, but it can’t treat you as delinquent for refusing to pay a charge you’ve formally contested. It also can’t close your account or accelerate your balance just because you used your dispute rights.

How the Chargeback Works

If the bank confirms fraud, recovery runs through a chargeback. The issuing bank sends the dispute through the card network — Visa, Mastercard, and so on — to the merchant’s bank, called the acquiring bank. The acquiring bank then debits the disputed amount from the merchant’s account and notifies them.

The merchant can push back through a process called representment, submitting evidence that the transaction was valid. That evidence usually includes proof of delivery, confirmation that the billing address matched, or verification that the correct card security code was entered. Under Visa’s rules, the merchant generally has 30 days to respond.⁴

If the merchant doesn’t respond in time or the issuing bank finds their evidence unconvincing, the chargeback stands and you keep the credit. Visa reports that most fraud-related disputes resolve in about 31 days.⁴ If the dispute escalates to network arbitration after representment, it can stretch weeks or months longer, but most consumer fraud cases never get there.

How Much You Could Owe

Federal law caps your maximum liability for unauthorized credit card charges at $50, and that cap only applies if the issuer notified you of the limit, gave you a way to report loss or theft, and had a way to identify authorized users on the account.² Every major issuer meets those conditions, so $50 is the practical federal floor. You’re never liable for charges that occur after you notify the issuer.⁵ And if your card number was stolen without the physical card, federal rules drop your liability to zero, because no card was presented for the issuer to identify.

Visa and Mastercard both go further with their own zero-liability policies, meaning you owe nothing on confirmed unauthorized charges — in-store, online, by phone, or on a mobile device — as long as you used reasonable care and reported the problem promptly.⁶⁷ Both carve out commercial cards and unregistered prepaid cards like gift cards, and Visa reserves the right to withhold provisional funds if its investigation flags gross negligence or cardholder fraud. For ordinary consumer credit cards, you’ll almost always pay $0.

Debit Cards Are a Different System

Everything above is credit card law. Debit card fraud runs under the Electronic Fund Transfer Act, and the protections are considerably weaker. Your liability for unauthorized debit transfers depends on how fast you report:

Within 2 business days of learning of the theft: liability capped at $50.
After 2 business days but within 60 days of the statement: up to $500.
After 60 days from the statement date: potentially the full amount of unauthorized transfers made after the 60-day window closes.⁸

For debit disputes, the bank must investigate and resolve the claim within 10 business days, extendable to 45 days only if it provisionally credits the account within those first 10.⁹ The practical difference is that debit fraud drains real cash from your checking account while you wait for a provisional credit. Credit card fraud only touches a line of credit you haven’t paid yet.

Where Law Enforcement Fits In

Banks handle the financial side. Criminal prosecution is a separate track, and filing a police report usually isn’t a requirement for the bank to process your dispute, though some issuers ask for one on identity theft cases or large losses.

Federal agencies like the FBI and Secret Service don’t investigate individual stolen card numbers. They work from aggregated data that banks and payment networks feed them to go after large-scale fraud rings. If your card was swept up in a data breach affecting thousands of accounts, your case becomes one data point in a broader investigation.

Two federal consumer reporting channels exist. For credit card fraud tied to identity theft, IdentityTheft.gov generates a recovery plan with pre-filled letters and checklists.¹⁰ For internet-based card fraud, the FBI’s Internet Crime Complaint Center accepts reports that include your contact information, financial loss details, and a description of how the fraud happened.¹¹ Neither filing is required for your bank dispute, but each feeds the databases investigators use to spot patterns.

The Deadlines That Matter Most

Report the fraud to your issuer as soon as you spot it. You’re only liable for charges that occur before notification.
Send a written dispute notice within 60 days of the statement containing the charge.³
The issuer must acknowledge your written dispute within 30 days.¹
The issuer must resolve the investigation within two billing cycles, capped at 90 days.¹
Debit card theft: report within 2 business days to hold liability to $50.⁸

The 60-day written notice is the one that burns people. It’s easy to call the bank, feel like the matter is handled, and lose the right to dispute months later because nothing was ever put in writing. Treat the phone call and the written notice as two separate requirements, because under federal law, that’s exactly what they are.

1
eCFR. 12 CFR 1026.13 – Billing Error Resolution
2
Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
3
Consumer Financial Protection Bureau. 12 CFR 1026.13 – Billing Error Resolution
4
Visa. Visa Claims Resolution
5
eCFR. 12 CFR 1026.12 – Liability of Cardholder for Unauthorized Use
6
Visa. Visa Zero Liability Policy
7
Mastercard. Zero Liability Protection Policy
8
Consumer Financial Protection Bureau. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
9
Consumer Financial Protection Bureau. 12 CFR 1005.11 – Procedures for Resolving Errors
10
Federal Trade Commission. Report Identity Theft
11
Internet Crime Complaint Center. IC3 Complaint Form