Online Payment Fraud: Dispute, Investigation, and Credit Freeze

To dispute an online payment fraud charge, call the number on the back of your card the moment you see it, ask the issuer to freeze the card and open a dispute, and then send written notice within the federal deadline that applies to your payment type. Speed is the single biggest factor in how much you can lose. Under the Fair Credit Billing Act, unauthorized credit card charges cap your personal liability at $50, and most issuers waive even that.¹ Debit cards and bank transfers carry steeper risks the longer you wait.

What to Do in the First 24 Hours

Every federal protection below runs on a clock that starts when the fraudulent charge appears on your statement or when you learn your card was stolen. A few extra days can push your exposure from $50 to $500, and past 60 days you can lose protection entirely for certain account types.

Do these things in order:

Call your bank or card issuer using the number on the back of the card. Ask to freeze or cancel the compromised card and report the specific transactions. Write down the representative’s name, the date, and any reference number.
Follow up in writing. A phone call starts the process, but a written notice sent within 60 days of the statement date is what preserves your legal rights under the Fair Credit Billing Act for credit cards. For debit cards, written notice strengthens your claim even though a phone call counts as valid notice under Regulation E.²
Change passwords and turn on two-factor authentication for the compromised account, your email, and anything that shared the same login.
Screenshot the fraudulent transactions, save confirmation emails, and keep a log of every call with your bank.

Credit Card Charges: Your Strongest Protection

Credit cards give you the most leverage in a fraud dispute, which is why security professionals recommend them over debit cards for online purchases. The Fair Credit Billing Act caps your liability for unauthorized charges at $50, and most major issuers voluntarily reduce that to zero.¹

To preserve your rights, your written dispute must reach the issuer within 60 days of the date the first statement containing the error was sent to you. Once the issuer receives your notice, it has 30 days to acknowledge the dispute in writing and must resolve it within two complete billing cycles, never more than 90 days.¹

While the investigation is pending, you do not have to pay the disputed amount or any related finance charges, and the issuer cannot report the disputed amount as delinquent to credit bureaus.³ With a debit card, the money is already gone from your account while the bank works through the claim. That difference is why credit cards remain the safer instrument for online shopping.

Debit Card and Bank Transfer Disputes

The Electronic Fund Transfer Act covers debit cards, ATM transactions, and direct bank transfers. Its protections are weaker than the credit card rules, and your liability depends entirely on how fast you report:

Within 2 business days of learning about the loss or theft, your liability is capped at $50, or the total amount of unauthorized transfers if that’s less.⁴
Between 2 and 60 days, your liability can climb to $500 for unauthorized transfers that occurred after the two-day window but before you notified the bank.⁴
After 60 days from your statement date, you lose federal protection for any unauthorized transfers that occur after that window. In theory a thief could drain the account and you would have no legal claim to recover those later transfers.⁴

The statute allows extensions for extenuating circumstances like hospitalization or extended travel. If something legitimately kept you from checking statements, the bank must extend the deadlines to a reasonable period.⁵

Zelle, Venmo, and Other Payment Apps

Payment apps trip up a lot of fraud victims because the rules split on how the money moved. If someone hacks your account and sends money without your knowledge or permission, that is an unauthorized electronic fund transfer, and Regulation E’s protections apply the same way they do for debit cards. The CFPB has confirmed this even when the transfer runs through a non-bank P2P provider.⁶

If a scammer tricked you into sending the money yourself, the picture is murkier. Many banks have historically argued that the transfer was “authorized” and therefore not covered. Recent CFPB guidance pushes back, clarifying that when a consumer is fraudulently induced into sharing account access information and a third party then initiates a transfer, that still qualifies as unauthorized under Regulation E.⁶ Where you personally sent the money to a scammer, coverage is less certain. Report it immediately anyway. The same liability timelines apply, and many banks have voluntarily expanded fraud policies under regulatory pressure.

How to File the Dispute

Most banks let you flag a fraudulent charge directly through the mobile app or online banking portal by selecting the transaction and choosing an unauthorized-activity option. That is the fastest route. If your bank accepts or requires a letter, send it by certified mail with a return receipt so you can prove delivery.

Before you file, gather:

The exact dollar amount, the date the charge posted, and the merchant name as it appears on your statement.
Transaction ID numbers from the banking interface or any confirmation emails tied to the fraudulent purchase.
A short written explanation of why the charge is unauthorized. Be specific but brief.
Supporting documents: screenshots, emails from the merchant, or records of any attempts to contact the merchant directly for a refund.

Keep copies of everything you submit. If your initial claim gets lost or mishandled, your copies are the only proof the dispute was filed on time.

What Happens During the Investigation

For debit card and bank transfer disputes, the bank generally has 10 business days to investigate after receiving your notice. It can extend that to 45 calendar days, but only if it provisionally credits your account within the initial 10 business days.⁷ That provisional credit restores your balance while the bank works through the claim.

The 45-day window stretches to 90 days in three situations: the transfer crossed international borders, it was a point-of-sale debit card transaction, or it occurred within 30 days of your first deposit into the account.⁷ New accounts also get 20 business days instead of 10 for the provisional credit deadline.

Credit card disputes run on a different clock. The issuer has 30 days to acknowledge your complaint and two full billing cycles, never more than 90 days, to complete the investigation and either correct the error or explain why it believes the charge was valid.¹

If the bank rules in your favor, any provisional credit becomes permanent or the charge is removed from your balance. If it rules against you, it must send a written explanation and tell you that you have the right to request copies of every document it relied on.⁷ Request those documents. They sometimes reveal that the investigation was thinner than you would expect.

If the Bank Denies Your Dispute

A denial is not the end of the road. Request the investigation documents, review them for errors, and then consider these escalations:

File a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov/complaint or (855) 411-2372. The CFPB forwards your complaint directly to the financial institution, which generally responds within 15 days. Complex cases can take up to 60 days. The CFPB publishes complaint data publicly, which creates meaningful pressure on banks to resolve disputes fairly.⁸
Ask the bank to reopen the case if you have documentation that was not part of the original claim.
Consider small claims court. Maximum claim amounts vary by state, typically ranging from around $6,000 to $20,000. This is most practical when the disputed amount justifies the filing fee and your time.

Reporting the Fraud to Federal Authorities

Disputing the charge with your bank gets your money back. Reporting to federal agencies helps stop the people responsible and creates an official record you may need for insurance claims or later credit disputes.

The FBI’s Internet Crime Complaint Center is the central hub for reporting cybercrime, including online payment fraud. Submit a detailed narrative through ic3.gov and hold onto the complaint number, which can be useful when working with insurers or credit bureaus.⁹

The FTC operates two relevant portals. ReportFraud.ftc.gov is for reporting scams and fraud generally; the FTC uses these reports to build cases against fraud operations but does not resolve individual complaints.¹⁰ If your personal information was stolen as part of the fraud, use IdentityTheft.gov instead. That portal generates a personalized recovery plan and an official Identity Theft Affidavit, which serves as proof of the crime when you deal with creditors, credit bureaus, or other institutions.¹¹

Locking Down Your Credit

Getting the fraudulent charge reversed solves the immediate problem. If the fraudster has your personal information, they can keep opening accounts in your name for months or years. Two tools from the Fair Credit Reporting Act help prevent that.

Credit Freeze

A credit freeze blocks new creditors from accessing your credit report entirely, which stops most identity thieves from opening accounts in your name. Federal law makes freezes free to place, lift, and remove. You need to freeze your file separately at each of the three major bureaus: Equifax, Experian, and TransUnion. You can temporarily lift the freeze when you need to apply for credit yourself.¹²

Fraud Alert

A fraud alert is less restrictive. It requires creditors to take extra steps to verify your identity before opening new accounts, but does not block access to your report. An initial fraud alert lasts one year, and you only need to contact one bureau, which is then required to notify the other two. If you file an identity theft report such as the FTC affidavit from IdentityTheft.gov, you can place an extended fraud alert that lasts seven years.¹³

A freeze is the stronger protection. If you are not planning to apply for new credit soon, freezing is the safer default.

One Note on Taxes

Most online payment fraud victims cannot deduct their losses on a federal tax return. Since 2018, personal theft losses have only been deductible if they stem from a federally declared disaster, which does not cover payment fraud.¹⁴ A narrow exception exists for losses from transactions entered into for profit, such as investment scams, reported on IRS Form 4684.¹⁵ For ordinary consumer fraud, do not count on a deduction as part of your recovery.

1
Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors
2
Federal Trade Commission. Sample Letter for Disputing Credit and Debit Card Charges
3
eCFR. 12 CFR 1026.13 – Billing Error Resolution
4
Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
5
eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
6
Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
7
Consumer Financial Protection Bureau. 12 CFR 1005.11 – Procedures for Resolving Errors
8
Consumer Financial Protection Bureau. Submit a Complaint
9
Internet Crime Complaint Center. Internet Crime Complaint Center
10
Federal Trade Commission. ReportFraud.ftc.gov
11
Federal Trade Commission. IdentityTheft.gov
12
Federal Trade Commission. Free Credit Freezes Are Here
13
Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
14
Internal Revenue Service. Topic No. 515, Casualty, Disaster, and Theft Losses
15
Internal Revenue Service. Instructions for Form 4684