To dispute an unauthorized charge, notify your card issuer or bank as quickly as possible, follow up in writing, and keep proof of when you reported it. Federal law caps what you can be forced to pay and forces the company to investigate on a fixed timeline, but the protections split along two lines: credit cards fall under the Fair Credit Billing Act, and debit cards and bank accounts fall under the Electronic Fund Transfer Act and Regulation E. The deadlines, the dollar caps, and even whether you can report by phone differ between the two.1Office of the Law Revision Counsel. 15 U.S. Code 1693 – Congressional Findings and Declaration of Purpose Speed is the single biggest factor in limiting your loss.
How Much You Could Owe
Credit card holders have the strongest protection. Your liability for unauthorized use is capped at $50 by statute, and that cap only applies if the issuer gave you notice of potential liability, a way to report loss or theft, and a method to identify authorized users. If the issuer failed any of those conditions, you owe nothing under the law.2Office of the Law Revision Counsel. 15 U.S. Code 1643 – Liability of Holder of Credit Card Most major card networks go further. Visa’s zero-liability policy, for example, covers both credit and debit cards and requires the issuer to replace stolen funds within five business days of notification; it excludes commercial cards and anonymous prepaid cards.3Visa. Visa Zero Liability Policy
Debit cards are harsher, and timing controls everything. Regulation E sets three tiers:
- Report within 2 business days of learning of the loss or theft, and your liability caps at $50 or the amount taken before you notified the bank, whichever is less.4eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
- Report after 2 business days but within 60 days of the statement showing the fraud, and your liability rises to $500. The bank must prove the extra losses would not have happened if you had reported sooner.4eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
- Report after 60 days from that statement, and you can lose everything taken after the 60-day window with no cap. The bank only has to show it could have stopped the transfers if you had spoken up.5Office of the Law Revision Counsel. 15 U.S. Code 1693g – Consumer Liability
The 2-business-day clock starts when you learn of the loss or theft, not when the fraudulent charge posts. If extenuating circumstances like hospitalization or extended travel kept you from reporting on time, the bank must extend the deadlines to a reasonable period.4eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers Raise that provision if a bank tries to hold you to a deadline you could not realistically meet.
Disputing a Credit Card Charge
The Fair Credit Billing Act requires a written notice sent to the address your issuer designates for billing inquiries. That is not the same as the payment address; check the back of your statement or the issuer’s website. Your notice must arrive within 60 days after the issuer sent the statement containing the error.6Office of the Law Revision Counsel. 15 U.S. Code 1666 – Correction of Billing Errors
Include three things: information identifying you and your account, a statement that you believe there is a billing error and the dollar amount, and the reasons you believe the charge is wrong.6Office of the Law Revision Counsel. 15 U.S. Code 1666 – Correction of Billing Errors Send it by certified mail with return receipt. Most issuers also let you open a dispute through their app or online portal, which is faster, but the certified-mail record protects you if the issuer later claims nothing arrived.
Two deadlines then run against the issuer. It must acknowledge your notice in writing within 30 days unless it resolves the dispute entirely in that window. It must complete the investigation and either correct the charge or send a written explanation within two complete billing cycles, and never more than 90 days.7Office of the Law Revision Counsel. 15 U.S. Code 1666 – Correction of Billing Errors While the investigation is open, the issuer cannot try to collect the disputed amount or report it as delinquent.
Disputing a Debit Card or Bank Account Charge
Debit disputes move faster on both sides. You can notify your bank orally or in writing within 60 days after the bank sent the statement showing the unauthorized transfer. Your notice must identify your account, describe the error and its amount, and explain why you believe it is wrong.8Office of the Law Revision Counsel. 15 U.S. Code 1693f – Error Resolution
If you report by phone, the bank can require written confirmation within 10 business days. It has to tell you about that requirement during the call and give you the mailing address. Miss the 10-day written follow-up and the bank does not have to provide provisional credit while it investigates.8Office of the Law Revision Counsel. 15 U.S. Code 1693f – Error Resolution So even though you can start with a phone call, send the written follow-up to protect your right to get your money back quickly.
Investigation Timelines and Provisional Credit
For debit disputes, the bank must investigate and report its findings within 10 business days of receiving your notice. If it cannot finish in that window, it can take up to 45 days, but only if it provisionally credits your account within those first 10 business days. The bank may withhold up to $50 from the provisional credit if it has a reasonable basis to believe the transfer was unauthorized and you reported within the required timeframe.9Consumer Financial Protection Bureau. 12 CFR 1005.11 – Procedures for Resolving Errors
The 45-day window extends to 90 days in three situations: the transfer originated outside the country, it resulted from a point-of-sale debit card transaction, or it occurred within 30 days of the first deposit to a new account. For a new account, the initial investigation period also stretches from 10 to 20 business days.9Consumer Financial Protection Bureau. 12 CFR 1005.11 – Procedures for Resolving Errors These extensions are common with travel-related fraud or a new checking account compromised right away.
Once the bank finishes investigating, it must report results to you within three business days. If it finds an error, it has one business day to correct it. If the provisional credit was issued and the bank confirms fraud, that credit becomes permanent. If the bank concludes no error occurred, it will reverse the provisional credit and explain why in writing.9Consumer Financial Protection Bureau. 12 CFR 1005.11 – Procedures for Resolving Errors
Stopping Recurring Charges You Can’t Cancel
Canceled subscriptions that keep billing have their own rules. For charges hitting a bank account or debit card, you can stop a preauthorized recurring transfer by notifying your bank at least three business days before the next scheduled payment. The notice can be oral or written.10Office of the Law Revision Counsel. 15 U.S. Code 1693e – Preauthorized Transfers
If you call, the bank can require written confirmation within 14 days. It has to tell you about that requirement during the conversation and give you the address. Missing the written follow-up does not undo your stop-payment request, but it can weaken your position if a charge goes through anyway and you need to dispute it later.10Office of the Law Revision Counsel. 15 U.S. Code 1693e – Preauthorized Transfers
For a recurring credit card charge, cancel with the merchant first and then notify your issuer if charges keep posting. Anything that posts after you canceled is a strong billing-error dispute under the Fair Credit Billing Act.
If the Dispute Is Denied
A denial is not the end. For a credit card dispute, you can appeal within the payment period the issuer set or 10 days after receiving the explanation, whichever is later. Write back and state that you still dispute the charge and refuse to pay. The issuer can then begin collection, but if it reports you to a credit bureau the report must note that you are still disputing the charge.11Federal Trade Commission. Using Credit Cards and Disputing Charges
If the bank or issuer still will not move, file a complaint with the Consumer Financial Protection Bureau. You can submit online at consumerfinance.gov or call (855) 411-2372. The CFPB forwards the complaint to the company, which generally responds within 15 days and can take up to 60 days in complex cases.12Consumer Financial Protection Bureau. Submit a Complaint A CFPB complaint does not guarantee you win, but companies tend to take the response seriously when a federal regulator is tracking it.
When These Protections Don’t Apply
Two common gaps catch people off guard. Business and commercial bank accounts are not covered by Regulation E, which protects accounts established primarily for personal, family, or household purposes.13Consumer Financial Protection Bureau. 12 CFR 1005.2 – Definitions If fraud hits a small business checking account, the liability caps and investigation deadlines above do not apply; your protection depends on the account agreement and state commercial code.
Unregistered prepaid cards get limited protection too. Regulation E’s liability limits and error-resolution procedures only apply to prepaid accounts where the financial institution has verified your identity. An anonymous prepaid card loaded with cash and never registered leaves the issuer with no legal obligation to investigate or cap your losses.9Consumer Financial Protection Bureau. 12 CFR 1005.11 – Procedures for Resolving Errors Registering a prepaid card takes a few minutes and activates the same federal protections that apply to a standard debit card.
One more line to be clear about: a transaction is not “unauthorized” just because you regret it or because someone you handed your card to used it in a way you did not expect. The debit card statute defines an unauthorized transfer as one initiated by someone other than you, without actual authority, from which you received no benefit. If you gave someone access and want future charges treated as unauthorized, you have to tell your bank that access is revoked first.14Office of the Law Revision Counsel. 15 U.S. Code 1693a – Definitions
When the Fraud Is Bigger Than One Charge
If unauthorized charges are part of broader identity theft, filing a report builds a paper trail that strengthens your position with banks, creditors, and credit bureaus. The Federal Trade Commission runs IdentityTheft.gov, where you can create a recovery plan and generate an official FTC Identity Theft Report.15Federal Trade Commission. Report Identity Theft
That FTC report is the legal trigger for an identity theft block on your credit file. Once a credit bureau receives a valid report, it must block the fraudulent account information within four business days. A local police report can also help, especially with creditors who will not remove disputed accounts without one. You do not necessarily need both, but the FTC report is what unlocks the credit bureau block, and a police report can push reluctant creditors to cooperate.