How to Fill Out Account Takeover Forms: Deadlines, Liability, and Denials

To fill out account takeover forms, start at IdentityTheft.gov to create a federal Identity Theft Report, then complete your bank or card issuer’s unauthorized-transaction dispute form using that report number, your account details, and an itemized list of transactions you didn’t authorize. Two different laws control the process depending on whether the fraud hit a debit account or a credit card, and how fast you file directly controls how much of the loss you have to eat. A fraudulent debit card charge reported within two business days caps your liability at $50; wait longer and it can climb to $500 or become unlimited.

File the Identity Theft Report First

Before you touch the bank’s form, go to IdentityTheft.gov and file with the Federal Trade Commission. The site asks a series of questions about what happened and generates two documents: an Identity Theft Report and a personalized recovery plan with pre-filled letters and forms you can send to creditors, credit bureaus, and debt collectors.¹ The report is signed under penalty of perjury, which is what gives it legal weight with banks and credit bureaus.²

Create an account on the site so you can update your plan and track progress. If you skip the account, print the report and plan before you leave the page. You won’t be able to retrieve them later.

Information the Form Will Ask For

Have all of this in front of you before you start typing. Missing details are the main reason claims stall.

Your full legal name, Social Security number, date of birth, and current contact information.
The exact account number, account type (checking, savings, credit card), and the approximate balance or credit limit before the breach.
Dates, amounts, and descriptions of every transaction you didn’t authorize. Include any changes to your contact information, PINs, passwords, or authorized users that you didn’t make.
The reference number from your IdentityTheft.gov filing.
A police report number and copy if you filed one. It isn’t always required, but some institutions request it.
Screenshots of suspicious emails or texts, records of calls from the impersonator, and any bank correspondence about account changes you didn’t request.

Be specific about the unauthorized activity. Vague descriptions like “several charges I don’t recognize” force investigators to spend time just identifying which transactions are in dispute.

Filling Out the Bank’s Dispute Form

Most banks have their own proprietary fraud or unauthorized-transaction form, available through the online banking portal, at a branch, or by phone through the fraud department. The FBI recommends contacting your financial institution as soon as you recognize the fraud to request a recall or reversal and to ask for a Hold Harmless Letter or Letter of Indemnity.³

The single most important thing to get right on the form is matching your dispute to the correct account type, because two entirely different laws govern from there.

Debit Cards, Checking, and Savings

Unauthorized transactions on debit cards, checking, savings, and other electronic fund transfers fall under Regulation E (12 CFR Part 1005). You can report the error orally or in writing, but the bank may require written confirmation within 10 business days of the oral report. If you don’t send the written follow-up when asked, the bank can decline to provisionally credit your account during the investigation.⁴ Many claims stall here. A phone call feels like enough, but without the written follow-up you lose leverage.

Your notice must include your name, account number, an explanation of why you believe an error occurred, and, to the extent possible, the type, date, and amount of each disputed transaction.⁴

Credit Cards

Unauthorized credit card charges are governed by the Fair Credit Billing Act (15 U.S.C. § 1666). Send a written notice of the billing error to the creditor’s designated billing-error address within 60 days of the date the statement containing the error was sent to you.⁵ The notice needs your name, account number, the amount you believe is wrong, and your reason for believing the statement contains an error. Don’t put the dispute on a payment stub. Use a separate letter or the issuer’s dedicated dispute form, and note that the billing-error address is usually different from the payment address printed on your statement.

How to Submit It

For credit card billing disputes, certified mail with a return receipt is the safest option. The Fair Credit Billing Act requires written notice, and the creditor’s response clock starts when they receive it. The return receipt proves the exact delivery date.

For debit card and electronic transfer disputes, most banks let you start with a phone call and then submit the written follow-up through their secure online portal. If you upload documents, save the confirmation or reference number. Attach the Identity Theft Report and any supporting documents in a single submission where possible; partial uploads cause processing delays.

Whichever route you use, keep copies of everything you send, including the forms themselves, your Identity Theft Report, any police report, and your proof of delivery.

Deadlines That Control Your Liability

How fast you file the paperwork is not paperwork housekeeping. It sets the ceiling on what you’ll owe.

Credit Cards

Federal law caps your liability for unauthorized credit card charges at $50, and once you’ve reported the card lost or stolen, you owe nothing on charges made after the report.⁶ Most major issuers waive even the $50 through their own zero-liability policies.

Debit Cards and Electronic Transfers

Regulation E creates a tiered system in which delay increases your exposure:

Report within 2 business days: liability capped at $50, or the amount of unauthorized transfers that occurred before you notified the bank, whichever is less.⁷
Report after 2 business days but within 60 days of your statement: liability can reach $500.⁷
Report more than 60 days after your statement: unlimited liability for unauthorized transfers that occur after the 60-day window closes and before you finally notify the bank.⁸

The two-business-day clock starts when you learn of the loss or theft of your access device, not when the unauthorized transaction posts. Those two days are measured in 24-hour periods regardless of the bank’s business hours, and they don’t include the day you discovered the problem.⁷

What the Bank Has to Do After You File

Debit and Electronic Transfer Investigations

The bank has 10 business days from receiving your error notice to investigate and determine whether an error occurred. It must report results to you within three business days of finishing the investigation and correct any error within one business day of confirming it.⁹

If the bank needs more time, it can extend the investigation to 45 days, but only if it provisionally credits your account for the disputed amount within those first 10 business days. It may withhold up to $50 of that provisional credit if it has a reasonable basis to believe an unauthorized transfer occurred. The bank must tell you within two business days of the crediting what amount was credited and when, and give you full use of those funds during the investigation.⁹

Credit Card Investigations

A creditor must acknowledge your written billing-error notice within 30 days of receiving it. It then has two complete billing cycles, capped at 90 days, to either correct the error or send you a written explanation of why it believes the statement was accurate.⁵ During this period, the creditor cannot try to collect the disputed amount or report it as delinquent.

If the Bank Denies Your Claim

The bank must send you a written explanation of its findings. Read it carefully. Sometimes a denial rests on a narrow technicality, such as a missed written-confirmation deadline, that you can address by refiling with additional documentation.

If you believe the decision is wrong, you can file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov/complaint. The process takes roughly 10 minutes. Include key facts, dates, amounts, and attach supporting documents (up to 50 pages). The CFPB forwards the complaint to the bank and asks for a response.¹⁰ For FDIC-insured banks and national banks, complaints can also go to the FDIC or the Office of the Comptroller of the Currency; confirm which agency supervises your bank before filing.

Business Accounts Are Different

Regulation E only covers accounts established for personal, family, or household purposes.¹¹ If a business checking or savings account is taken over, the liability tiers and investigation timelines above do not apply. Business accounts generally fall under Article 4A of the Uniform Commercial Code, which allows a bank to shift liability for unauthorized wire transfers onto the account holder if the bank used a commercially reasonable security procedure to verify the transaction. Businesses face a harder path to recovering stolen funds and should treat internal controls, such as dual authorization for wires and prompt account monitoring, as the primary protection.

1
Federal Trade Commission. Identity Theft: A Recovery Plan
2
Federal Trade Commission. New Identity Theft Report Helps You Spot ID Theft
3
Federal Bureau of Investigation. Account Takeover Fraud via Impersonation of Financial Institution Support
4
eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
5
Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors
6
Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
7
Consumer Financial Protection Bureau. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
8
eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
9
eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
10
Consumer Financial Protection Bureau. Submit a Complaint
11
Consumer Financial Protection Bureau. 12 CFR 1005.2 – Definitions