An unknown transaction on a bank statement is usually one of three things: a merchant whose billing name doesn’t match its storefront, a subscription or renewal you forgot about, or a pending hold that hasn’t settled. A smaller share are genuinely unauthorized, and for those, federal law gives you specific rights on a tight clock. Reporting a debit card problem within two business days of discovering it can cap your liability at $50; waiting past 60 days from the statement date can leave you responsible for the full amount.
Check the Innocent Explanations First
Before you file anything, try to identify the charge. The name on your statement often doesn’t match the name on the sign. Businesses register payment processing under a legal entity or “Doing Business As” name that can look nothing like what you remember. Third-party processors like Stripe, Square, and PayPal sometimes appear in place of the actual merchant, or as a truncated abbreviation.
Forgotten subscriptions are the other usual culprit. Free trials that converted to paid plans, annual software renewals, and streaming services all generate charges that look suspicious until you search your email for the merchant name and amount. That 30-second search resolves a surprising number of “unknown” transactions.
A few other explanations worth ruling out:
- Authorized users on your account may have made a purchase without telling you.
- Gas stations, hotels, and rental car companies place pre-authorization holds that can be higher than the final charge and can linger for several business days.
- International purchases sometimes post at a slightly different amount because of exchange rates or foreign transaction fees.
If the Charge Still Looks Wrong, Act Quickly
If none of that fits, treat the charge as potentially unauthorized. Your financial exposure grows the longer you wait, so speed matters.
Lock or freeze your debit card through your bank’s mobile app. Nearly every major bank offers an instant freeze that blocks new transactions while you investigate. If you think the card number itself was stolen rather than used for one rogue charge, request a replacement with a new number. Change your online banking password and any PINs on the account at the same time. One compromised card number can lead to a string of charges over the following days, and freezing stops that chain.
Then check whether the charge is still pending or has fully posted. Some banks will let you flag a pending charge but won’t formally investigate until it posts. A posted charge is final and eligible for a full dispute under federal law.
How to File the Dispute
Under the Electronic Fund Transfer Act, your notice needs to let the bank identify your name and account, explain why you believe an error occurred, and give the approximate date and amount of the problem transaction to the extent you can. You don’t need a formal legal document. The CFPB’s official commentary confirms an error notice is effective even without your account number if the bank can identify your account another way, such as through your Social Security number.1Consumer Financial Protection Bureau. 12 CFR 1005.11 Procedures for Resolving Errors – Official Interpretations
The fastest way to file is usually the “dispute this transaction” link next to the charge in your banking app. Most banks also accept disputes by phone, and some still accept written notices by mail. Whichever route you use, get a confirmation number. It lets you track the case and creates a paper trail proving when you reported the problem.
One trap to know about: if you notify the bank by phone, the bank can require you to send written confirmation within 10 business days.2Office of the Law Revision Counsel. 15 USC 1693f – Determination of Error Miss that follow-up and the bank doesn’t have to issue provisional credit while it investigates. If you call it in, send the written confirmation the same day.
How Long the Investigation Takes
Once your bank receives the error notice, it has 10 business days to investigate and determine whether an error occurred.3eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors If it confirms an error, it must correct your account within one business day and tell you the results within three business days of finishing.
Most disputes need more time. The bank can extend the investigation to 45 days total, but only if it provisionally credits your account within those first 10 business days. That credit puts the disputed funds back in your account while the investigation continues, and you get full use of the money in the meantime. If the bank believes the transfer was unauthorized and you reported a lost or stolen card, it may withhold up to $50 from the provisional credit.
Three situations extend the maximum window from 45 days to 90 days:
- The transfer was not initiated within the United States.
- The charge was a point-of-sale debit card transaction, which covers most in-store, online, and phone-order debit card purchases (though not ATM withdrawals).
- The transaction happened within 30 days of your first deposit on a new account.
Point-of-sale debit card charges are the most common category, so many everyday disputes fall under the 90-day window. That’s worth knowing so a longer wait doesn’t alarm you.
How Fast You Report Drives What You Owe
This is the part most people miss, and it’s the part that costs the most money. For debit cards and other electronic fund transfers, federal law ties your liability directly to how quickly you report.
- Report within 2 business days of learning about the loss or theft: your maximum liability is $50, or the total unauthorized transfers before you notified the bank, whichever is less.4eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
- Report after 2 business days but within 60 days of the statement: your maximum liability jumps to $500.4eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
- Report after 60 days: you can be held responsible for the entire amount of unauthorized transfers occurring after that 60-day window closes, with no cap.5Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
The two-day clock starts when you learn of the loss or theft. The 60-day clock starts when the bank sends the statement containing the unauthorized transaction. Both run independently, and a thief who drains an account over several weeks can create liability under both timelines at once. Check statements regularly, and report anything suspicious the day you see it. Waiting even a few days can multiply your exposure.
Credit Card Charges Follow Different Rules
Everything above applies to debit cards and electronic fund transfers from a bank account. If the charge is on a credit card, it’s governed by the Fair Credit Billing Act instead, and the protections are stronger.
Your maximum liability for unauthorized credit card charges is $50 regardless of when you report, and you have zero liability for charges made after you report the card lost or stolen.6Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card In practice, virtually every major issuer waives that $50 through a zero-liability policy. For credit card billing errors, you must send written notice to the creditor within 60 days of the statement date, and the creditor cannot try to collect the disputed amount, charge interest on it, or report it as delinquent during the investigation.7Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors
If the Bank Denies Your Dispute
If the bank rules in your favor, the provisional credit becomes permanent and the case closes. If it decides no error occurred, or that the error was different from what you described, it must send you a written explanation of its findings within three business days.8eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors That explanation must tell you that you have the right to request copies of the documents the bank relied on. If you got provisional credit, the bank will reverse it, but it must notify you before doing so.
Denials happen more often than people expect, usually because the merchant provided evidence the transaction was authorized: delivery confirmations, signed receipts, IP address logs, or records of similar prior purchases on the same card. A denial isn’t necessarily the end. You can request the bank’s supporting documents, identify flaws in the merchant’s evidence, and escalate a complaint to the Consumer Financial Protection Bureau if you believe the bank violated the investigation procedures.
When It Looks Like Identity Theft
A single mystery charge might be a merchant name you didn’t recognize. Multiple unfamiliar transactions, charges from cities you’ve never visited, or new accounts opened in your name point to something more serious. The dispute process alone won’t fully protect you if you’re dealing with identity theft.
File a report at IdentityTheft.gov, the FTC’s recovery portal. The site generates a personalized recovery plan and produces an official identity theft report that carries legal weight with creditors and banks. Place a fraud alert on your credit file through any one of the three major bureaus; the bureau you contact is required to notify the other two. A fraud alert is free and lasts one year. A credit freeze goes further, blocking new accounts from being opened in your name until you lift it.
Review credit reports from all three bureaus for accounts you don’t recognize. Under federal law, you can get free weekly reports through AnnualCreditReport.com. Catching a fraudulent account early limits the damage and strengthens your position when you dispute related charges.
The Deadline Worth Circling
Every protection above hinges on one number: 60 days from the date your bank sends the statement containing the unauthorized transaction.5Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability Miss that window and the bank has no obligation to reimburse you for unauthorized transfers that happen afterward. Most fraud doesn’t start with a dramatic withdrawal; it starts with a small test charge to see whether anyone notices. Turning on transaction alerts and looking at your account weekly rather than monthly is the single most effective habit for catching that first small charge in time to act on it.