Unauthorized Charges: Disputing Credit, Debit, and App Payments

To dispute an unauthorized charge, contact the card issuer or bank fast, put the dispute in writing, and follow the specific federal procedure that matches the payment type. Credit card charges fall under the Fair Credit Billing Act and give you 60 days from the statement date to send written notice. Debit card and payment app transfers fall under the Electronic Fund Transfer Act and Regulation E, where your liability climbs the longer you wait — $50 if you report within two business days, up to $500 after that, and potentially everything in the account if you wait past 60 days.¹ Knowing how to dispute unauthorized charges is largely a matter of matching the right procedure to the right payment method, because the rules are not interchangeable.

First Steps Before You File

Pull together the account number, the exact date and dollar amount of the charge, and the merchant name exactly as it appears on your statement. That name often differs from the store name you’d recognize, so copy it as printed. The fraud team uses those details to trace the transaction through the payment processor.²

Rule out the obvious before assuming fraud. Double charges, forgotten subscriptions, and unfamiliar billing descriptors for legitimate purchases account for a large share of what initially looks unauthorized. A quick call to the merchant can resolve those in minutes. If you make that call, write down the date, the representative’s name, and the outcome, because that record matters if you later have to escalate.

If the charge is genuine fraud tied to identity theft, file a report at IdentityTheft.gov. It takes about 15 minutes and creates a federally recognized record that gives you specific rights when dealing with banks and credit bureaus.³ Some institutions also request a police report as part of their investigation.

Disputing a Credit Card Charge

Call the card issuer’s fraud line first to freeze the card and start the fraud flag. That call alone does not preserve your rights under the Fair Credit Billing Act. You also need to send written notice to the issuer’s billing inquiry address, which is not the same as the payment address on your bill.⁴ The letter has to arrive within 60 days of the date the issuer sent the statement containing the disputed charge.

The notice needs your name, account number, the dollar amount you believe is wrong, and a brief explanation of why you think the charge is unauthorized.⁵ It doesn’t need to be notarized or drafted by a lawyer. Send it by certified mail so you have proof of the delivery date.

Once the issuer receives your notice, it must acknowledge it in writing within 30 days unless the dispute gets resolved sooner.⁵ It then has two full billing cycles, capped at 90 days, to finish investigating and either correct the error or explain in writing why it believes the charge was valid.⁴ While the investigation is open, you don’t have to pay the disputed amount, and the issuer cannot try to collect it.

Your liability is capped at $50 per card by federal law, and it drops to zero when only the card number was stolen rather than the physical card.⁶ Most issuers waive even the $50 as a matter of policy.

Disputing a Debit Card Charge

Debit card fraud is time-sensitive in a way credit card fraud is not. Under Regulation E, if you report the loss within two business days of learning about it, your liability caps at $50. Miss that window and report within 60 days of the statement, and it can climb to $500. Wait longer than 60 days after the statement was sent, and the bank is not required to reimburse anything that happened after that 60-day mark.¹

You can notify the bank by phone, online, or in writing. Oral notice is enough to start the process, though the bank can require written confirmation within 10 business days of the call, and it must tell you about that requirement during the initial conversation.²

The bank has 10 business days to investigate. If it needs more time, it can extend the investigation up to 45 days, but only if it provisionally credits your account for the disputed amount within those first 10 business days. The provisional credit must include any interest you would have earned.²

Three situations extend that window from 45 to 90 days: transactions that crossed international borders, point-of-sale debit card purchases, and transactions on accounts open less than 30 days.² When the investigation ends, the bank must send a written explanation of its findings and let you request copies of the documents it relied on.

If the bank confirms the transfer was unauthorized, it must correct the error and refund any fees or interest the fraud caused, such as overdraft fees triggered by the theft.² Routine charges like monthly maintenance fees are not part of the refund because they would have hit the account regardless.

Payment Apps: Zelle, Venmo, and Cash App

The Consumer Financial Protection Bureau has confirmed that P2P payment providers holding consumer accounts or issuing access devices are financial institutions under Regulation E, and the same liability protections and error resolution rules apply.⁷ If someone hacks into your Venmo account and sends money out, that’s an unauthorized transfer, and the provider has to follow the dispute process described above.

The gap is scams. If someone tricks you into sending money yourself, you technically authorized the transfer even though you were deceived, and banks and payment apps are not required to reimburse you for transactions you initiated. Some providers voluntarily reimburse narrow categories of scam victims, but those policies are discretionary and limited. Once you tap “send,” the federal safety net largely disappears.

What Actually Counts as “Unauthorized”

An unauthorized electronic fund transfer means someone initiated a transfer from your account without your permission and you received no benefit from it.⁸ A stranger who steals your debit card and goes shopping qualifies. So does someone who breaks into your online banking and wires money out.

One carve-out trips up a lot of disputes: if you voluntarily handed your card or PIN to someone and they misuse it, the transfer is not considered unauthorized unless you had already told the bank to revoke that person’s access.⁸ Disputes involving family members, roommates, and ex-partners frequently fail on this point. If an adult child has been using your card with permission for months and then charges things you didn’t approve, the bank will likely deny the claim unless you can show you previously notified them to cut off access.

Fees, Interest, and Your Credit Score

While a credit card dispute is open, federal law prohibits the issuer from reporting the disputed amount as delinquent to any credit bureau.⁵ The issuer also cannot accelerate the debt, restrict your account, or threaten adverse credit reporting because you exercised your right to dispute. If the dispute is resolved in your favor, the issuer must also credit any finance charges that accumulated on the disputed amount.⁴ Check your next statement to make sure those corrections actually posted.

Debit fraud does not directly hit your credit report because debit transactions do not involve credit. The indirect risk is real, though. If a fraudulent withdrawal overdraws the account and the bank sends the negative balance to collections, the collections account can end up on your credit report. Getting the provisional credit during the investigation is what prevents that chain reaction, which is another reason fast reporting on debit matters.

If Your Bank Denies the Claim

A denial is not the end. The bank must tell you in writing why it denied the claim and give you copies of the documents it used, if you ask.² Read the explanation carefully. Banks sometimes deny disputes based on evidence that the card was physically present at the point of sale or that the transaction matched your typical spending pattern. If you can rebut that evidence, resubmit with documentation.

If the bank won’t move, file a complaint with the Consumer Financial Protection Bureau. Complaints can be submitted online in under 10 minutes or by phone at (855) 411-2372.⁹ The CFPB forwards the complaint to the financial institution, which generally responds within 15 days. The complaint and the company’s response are published in a public database. It does not guarantee a different outcome, but it creates a federal record and banks tend to look again when a regulator is watching.

For identity theft cases specifically, the FTC Identity Theft Report at IdentityTheft.gov serves as formal proof that your identity was compromised and triggers certain rights that a standard dispute does not.³ If the amounts are large enough to justify it, small claims court is another option, with filing fees that vary by jurisdiction.

Business Accounts Are Not Covered by These Rules

The protections above apply to consumer accounts. If the unauthorized charge hit a business checking account or involved a wire transfer, the consumer rules in Regulation E and the FCBA generally do not apply. Business accounts fall under the Uniform Commercial Code, which is far less forgiving: under UCC Article 4A, if the bank offered a commercially reasonable security procedure and followed it, the business bears the loss, and the business has only 90 days from receiving notice of the transfer to challenge it.¹⁰ Small business owners who assume their bank will cover fraud the same way it covers a personal debit card are often surprised.

1
Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
2
eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
3
IdentityTheft.gov. Steps to Take After Identity Theft
4
Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors
5
eCFR. 12 CFR 1026.13 – Procedures for Resolving Errors
6
Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
7
Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
8
Office of the Law Revision Counsel. 15 USC 1693a – Definitions
9
Consumer Financial Protection Bureau. Learn How the Complaint Process Works
10
Legal Information Institute. UCC Article 4A – Funds Transfer