An unusual activity alert is an automated message from your bank or card issuer warning that a transaction on your account looked suspicious to its fraud-detection system. The alert asks you to confirm the transaction was yours or flag it as fraud, and your answer decides what happens next: full account access is restored, or the card is killed and a dispute is opened. Respond quickly and through a channel you trust, because the clock on your liability for real fraud starts running as soon as you learn something is wrong.
Confirm Through a Channel You Trust
A legitimate alert asks one thing: was this transaction yours, yes or no. You reply with a confirmation code by text, or you tap confirm or deny inside your bank’s app. A real alert will never ask for your full account number, password, PIN, or Social Security number in a reply, and it will not send you to a link to “verify your identity” or “secure your account.”
Scammers copy bank branding closely, so treat every unexpected message as suspect until you’ve checked it. The FTC warns that fraudulent texts and emails often claim there’s suspicious activity or a payment problem, then push you to a spoofed site that captures your login.1Federal Trade Commission. How to Recognize and Report Spam Text Messages Warning signs include urgent threats (your account will be closed, a fee is coming), links whose URL doesn’t exactly match your bank’s domain, and awkward grammar or formatting.
When anything feels off, ignore the message and call the number printed on the back of your card. Never call a phone number included in the alert itself.
What May Be Frozen While You Wait
Once the system flags a transaction, the bank may freeze part or all of your account to stop further losses. A purchase can be declined at checkout even though your balance is fine. Online transfers and changes to your contact information are often locked down too.
The freeze can also block pre-authorized recurring payments. Automatic bill payments, subscription charges, and other scheduled withdrawals may bounce during the hold, which can trigger late fees or service interruptions. If a freeze lasts more than a day, contact any biller that pulls from the affected account.
If You Recognize the Transaction
Clearing a legitimate alert is usually fast. Reply with the confirmation code your bank sent, or tap confirm in the app. Full account access typically comes back within minutes.
For alerts that require a phone call, you’ll have to verify your identity before a representative can lift the hold. Have the last four digits of your Social Security number or your account PIN ready, along with the flagged transaction’s dollar amount, merchant name, and approximate time. Once those line up with the bank’s records, the hold comes off and you’ll get a confirmation message.
If the original transaction was declined, you’ll need to run the card again. Merchants can’t retroactively push through a declined charge. A short synchronization delay is possible but rarely lasts more than a few minutes.
If You Don’t Recognize the Transaction
The next 48 hours matter more than anything else in limiting your losses.
Call the Bank Immediately
Use the number on the back of your card. Tell them the transaction is unauthorized. The bank will cancel the compromised card, issue a replacement, and open a dispute investigation. Ask for a case number and written confirmation that the dispute is on file. Standard replacement cards typically arrive in seven to ten business days at no charge; expedited replacements are available from most banks for roughly $10 to $25.
File an Identity Theft Report If the Damage Goes Beyond One Charge
If new accounts have been opened in your name, or you’re seeing multiple unauthorized transactions, file an identity theft report with the FTC at IdentityTheft.gov.2Federal Trade Commission. Report Identity Theft The site generates an Identity Theft Affidavit that documents your case. Print it right away; the FTC warns it isn’t retrievable once you leave the page. Combined with a local police report, the affidavit becomes a formal Identity Theft Report, which gives you specific legal rights when disputing fraudulent accounts with creditors.
Freeze or Flag Your Credit
Place a fraud alert or a credit freeze with the three major credit bureaus. A fraud alert is free, lasts one year, and requires lenders to verify your identity before opening new credit. A credit freeze is also free and blocks new accounts entirely until you lift it. Either step reduces the risk that a thief with your card number also has enough personal information to open new lines of credit.
Why Timing Matters: Debit vs. Credit
How much you can lose depends on which kind of account was hit, and the gap is wider than most people realize.
For credit cards, federal law caps your liability for unauthorized charges at $50, and that cap only applies if the issuer met certain notice conditions.3Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card Most major card networks go further with zero-liability policies, so you’ll rarely owe anything for charges you didn’t make.
Debit cards fall under the Electronic Fund Transfer Act, and the money leaves your checking account right away. Your maximum loss depends on how fast you report:
- Within 2 business days: maximum loss $50.
- Between 2 and 60 days: maximum loss $500.
- After 60 days: no cap on unauthorized transfers made after the 60-day window.
Those deadlines run from the date you learn about the loss or theft of your card, or from the date the bank sends a statement showing the unauthorized transfer.4Consumer Financial Protection Bureau. Regulation E – 1005.6 Liability of Consumer for Unauthorized Transfers Letting a debit card alert sit for weeks can move you into a tier that’s much harder to recover from than a disputed credit card charge.
What Usually Triggers These Alerts
Banks compare every transaction against your spending history, and anything that breaks the pattern can trip the alarm. Common triggers include a large charge at a retailer you’ve never used, a swipe in a foreign country or distant city shortly after a local purchase (suggesting the card number was copied), and rapid small charges at gas stations or convenience stores, which criminals use to test whether a stolen card number still works before a bigger buy. Large or unusual transfers draw scrutiny too, especially wires to an account you’ve never sent money to or transfers linked to a cryptocurrency exchange or digital wallet. Card-not-present purchases at unfamiliar online merchants, particularly with shipping addresses that don’t match your billing address, are another frequent trigger. Cash movements over $10,000 must be reported by banks, and patterns of transactions just under that threshold also draw attention because they suggest someone is trying to avoid the reporting rule.
A single dramatic red flag isn’t required. Sometimes a combination of smaller signals pushes the transaction past the bank’s risk threshold.
Keep Your Contact Information Current
Speed matters, so banks send alerts through whichever channel reaches you fastest: text message, push notification from the banking app, automated phone call, or email. Which method the bank uses depends on the contact preferences you set when you opened the account. If your phone number or email is outdated, the alert may never reach you, and a fraudulent transaction can sit unchallenged long enough to push you into a worse liability tier. Updating your contact information with the bank is one of the simplest fraud-prevention steps you can take, and it’s worth doing before you ever need it.