How to Report an Unauthorized Transaction: Bank, FTC, Deadlines

To report an unauthorized transaction, call your bank’s fraud department the same day you spot the charge, follow up with a written dispute, and file an Identity Theft Report at IdentityTheft.gov if the fraud goes beyond a single charge. Two deadlines drive everything else: for a debit card, your maximum loss climbs from $50 to $500 to unlimited depending on how fast you notify the bank¹²³

The Deadlines That Decide How Much You Get Back

Federal law treats debit and credit cards very differently. With a debit card, the money has already left your account, and how much the bank has to reimburse depends on when you speak up.

Notify the bank within 2 business days of learning about the loss: your maximum loss is $50, or the amount of the unauthorized transfers, whichever is less.
Notify after 2 business days but within 60 calendar days of the statement showing the transfer: liability can rise to $500 for transfers that happened after the two-day window and before you gave notice.
Notify after 60 calendar days: unlimited liability for any unauthorized transfers that occur after the 60-day period closes and before you finally report. The bank does not have to reimburse those losses.⁴

Credit cards work more simply. Federal law caps liability for unauthorized charges at $50 regardless of when you report.²⁵⁶ The separate 60-day written-notice deadline still matters: within that window the issuer cannot try to collect the disputed amount or report it as delinquent, and the issuer’s formal investigation obligations kick in.⁷

What to Have Ready Before You Call

Five minutes of prep keeps the call short. Pull up your statement and note each of the following:

The exact transaction date and dollar amount, including cents, as they appear on the statement.
The merchant name shown on the statement, which is often a shortened or coded version of the actual business name.
A transaction or reference ID if your online portal shows one. It lets the fraud team locate the entry instantly.
Your account number, in front of you rather than in the bank’s hands to look up.
A one-sentence explanation of why the charge is unauthorized. “I did not make this purchase and do not recognize the merchant” is enough.

Screenshot or print the statement page. If there is more than one bad charge, list each one separately with its own date and amount. Vague descriptions slow the process because the bank has to match every dispute to a specific entry.⁸

Call the Bank First

Do not wait until you have drafted a letter. For debit card disputes, Regulation E accepts oral or written notice, and a phone call to the fraud department is valid notification that starts the bank’s investigation clock.⁸ Call the number on the back of the card, ask for fraud, and walk through the details you gathered. Write down the representative’s name, the date and time of the call, and the case or reference number.

The bank can ask you to follow up in writing within 10 business days. Skip that follow-up and the bank gets more time to investigate and may hold back provisional credit. Treat the phone call as step one, not the only step.

Send the Written Follow-Up

For debit card disputes, send written confirmation through the channel your bank designates for error notices. Most banks now accept it through their online dispute portal or secure messaging, which is faster than mail and creates a timestamped record. Include your name, account number, the transaction details, and a clear statement that the charge was unauthorized.

For credit card disputes, written notice is not optional. Regulation Z requires a written billing error notice, sent within 60 days of the statement, to the address the issuer designates for billing inquiries. That address is often different from the payment address, so check the statement or the issuer’s website.³ If you mail it, use certified mail with return receipt so you can prove when the issuer received it. Many issuers also offer online dispute forms that satisfy the requirement and are much quicker.

Keep copies of everything you send. If the dispute gets complicated later, your own records of what you submitted and when make a real difference.

File an FTC Identity Theft Report

A report at IdentityTheft.gov generates an official FTC Identity Theft Report that carries legal weight beyond a bank dispute alone.⁹ The site walks you through questions and produces a personalized recovery plan along with the report, which functions as a sworn statement that the transactions were not authorized and enters the FTC’s Consumer Sentinel database used by law enforcement.

The report also unlocks specific rights under the Fair Credit Reporting Act. With it, you can require businesses to give you copies of transaction records tied to the fraud, such as applications or account statements opened in your name, free of charge within 30 days of your written request.¹⁰ Those records sometimes surface information about the thief that a bank investigation would miss.

A local police report adds another formal layer. Banks sometimes ask for a police report number to verify a claim, especially on large disputes, and the report helps if the fraud later spawns new accounts or debts you need to challenge with creditors or credit bureaus.

What the Bank Must Do Next

Once you have given notice on a debit card dispute, the bank is on a clock. If it cannot resolve the dispute within 10 business days, it must provisionally credit your account for the disputed amount while it keeps investigating, and it must tell you the amount and date of that credit within two business days.¹¹ You get full use of those funds during the investigation.

The standard investigation window is 45 days from the date the bank received your notice. It extends to 90 days in three situations: the transfer was a point-of-sale debit card transaction, the transfer crossed international borders, or the transfer happened within 30 days of the first deposit to a new account.⁸ Point-of-sale covers most in-store debit purchases, so the 90-day timeline applies more often than people expect.

If the investigation concludes no error occurred and the bank reverses the provisional credit, you can escalate by filing a complaint with the Consumer Financial Protection Bureau or pursuing the matter in small claims court.

Lock Down the Account Afterward

Ask for a new card with a different number on the same call. Banks typically cancel the compromised card immediately and ship a replacement within five to seven business days, and many offer a temporary digital card through their app in the meantime. Once the new card arrives, update recurring payments tied to the old number, including utilities, subscriptions, and insurance, so you don’t rack up late fees on payments that silently fail. Standard replacement is usually free; expedited shipping runs about $5 to $30.

Consider a credit freeze or fraud alert. A freeze blocks creditors from pulling your credit report, which stops most new-account fraud. All three major credit bureaus must place and remove a freeze for free, and it stays in place until you lift it.¹² An initial fraud alert is the lighter option: it lasts at least one year, requires creditors to take extra steps to verify your identity, and you only need to contact one bureau because it must notify the other two. If you filed an FTC Identity Theft Report, you qualify for an extended fraud alert that lasts seven years.

Then watch your statements. Fraudsters who succeed once often try again. Review bank and card statements at least weekly for the first few months, and turn on transaction alerts that push a notification to your phone for every charge above a threshold you pick. Those alerts are the fastest way to catch a repeat attempt before the liability tiers turn against you.

When the Standard Rules Don’t Apply

Peer-to-peer apps like Zelle and Venmo fall under the same federal protections when the transfer qualifies as an electronic fund transfer. The CFPB has confirmed that if a fraudster gains access to your account and initiates a transfer without your authorization, the bank must follow the standard error resolution and liability rules.¹³ But if you voluntarily sent money to someone who turned out to be a scammer, most banks treat that as an authorized transfer you initiated, even though you were tricked. Federal law protects you when someone else accessed your account or device without permission, not when you handed over credentials or approved the transfer under false pretenses.

Prepaid cards get the same liability limits and error resolution rights as a debit card only when you have registered the card and the issuer has verified your identity. Unregistered prepaid cards, including most gift cards, may have no fraud protections at all.¹⁴ Register any prepaid card that will carry a real balance.

Business accounts sit outside the Electronic Fund Transfer Act entirely, which covers only accounts established primarily for personal, family, or household purposes.¹⁵ Business checking accounts, corporate cards, and commercial accounts are governed by UCC Article 4A, which allocates liability based on whether the bank followed a commercially reasonable security procedure rather than fixed dollar caps.¹⁶ If the affected account is a business account, review the bank’s security procedures and any liability agreement carefully before assuming consumer protections apply.

1
Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
2
Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
3
eCFR. 12 CFR Part 226 – Truth in Lending, Regulation Z – Section 226.13 Billing Error Resolution
4
eCFR. 12 CFR 205.6 – Liability of Consumer for Unauthorized Transfers
5
Visa. Visa Zero Liability Policy
6
Mastercard. Mastercard Zero Liability Protection Policy
7
Consumer Financial Protection Bureau. 1026.13 Billing Error Resolution
8
eCFR. 12 CFR Part 1005 – Electronic Fund Transfers, Regulation E – Section 1005.11 Procedures for Resolving Errors
9
Federal Trade Commission. IdentityTheft.gov
10
Federal Trade Commission. Businesses Must Provide Victims and Law Enforcement with Transaction Records Relating to Identity Theft
11
Consumer Financial Protection Bureau. 1005.11 Procedures for Resolving Errors
12
Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
13
Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
14
eCFR. 12 CFR Part 1005 – Electronic Fund Transfers, Regulation E – Section 1005.18
15
GovInfo. 15 USC 1693a – Definitions
16
Legal Information Institute. UCC 4A-202 – Authorized and Verified Payment Orders