How to Dispute an Unauthorized Card Transaction

Quick answer: If you see a card purchase or withdrawal you did not authorise, immediately contact the card issuer using the phone number on your card or official website, secure the account, identify the exact disputed transactions and obtain a case reference. Follow the issuer’s formal dispute procedure and preserve evidence. Reporting deadlines and liability limits differ for debit cards, credit cards, payment systems and countries; do not assume that cancelling your card automatically files a dispute.

Your result: A dated, documented fraud report with a case number, relevant amounts, written follow-up where required, and a plan for checking the investigation and correcting related fees. A transaction you initiated after being tricked is not always classified as an unauthorised card transaction; ask the bank to assess scam reimbursement rights separately.

First distinguish fraud from a confusing descriptor

A transaction may appear under a parent company’s name rather than the shop’s brand, or be a delayed hotel or petrol-station authorisation. Compare the date, amount, merchant descriptor and receipt without delaying an urgent report when an unknown payment may be fraudulent. A pending authorisation is not always a settled charge; banks may still be able to block the card and record a security concern. Do not post your card number or full statement in public forums. Never send card details to someone who calls claiming to be bank security—hang up and contact the real bank yourself.

If you approved a payment but the merchandise never arrived, that may be a goods-and-services dispute under different rules. If a fraudster used your stolen credentials to initiate a payment without your authority, describe that accurately. If you personally authorised a transfer under deception, tell the provider exactly what happened rather than incorrectly declaring you did not initiate it.

What to prepare

Use a safe device and verified phone number. Gather your card’s last four digits (not its full number for public sharing), the exact posted or pending status, merchant name, date, currency, amount, statement issue date, your recent authorised activity, and any notifications. Write a chronological account of when you discovered the activity, whether a card/device/PIN was lost, and whom you contacted. Preserve receipts and relevant messages, but do not forward passwords or one-time authentication codes.

Step by step: take action

1. Report immediately and take appropriate security steps

Call the bank/card issuer’s fraud line or use an authenticated card-lock/report-fraud feature in the verified app if the issuer provides one. Ask whether it will freeze the card, issue new credentials and restrict further payments. Report unfamiliar recurring card tokens or digital wallets so the issuer can advise whether those must be reissued or disabled separately. Secure your email and banking passwords if compromise is suspected and enable stronger authentication. Ask whether existing bill payments will be affected before assuming replacement-card details update everywhere automatically.

2. List each transaction separately

Give the issuer individual transaction dates, amounts, currencies, merchants and status. Suppose an imaginary statement shows unauthorised items of $89.40, $26.10 and $14.50. The total disputed posted spending is $130.00. That calculation is only a documentation aid, not a prediction of the refund or consumer liability. Flag any associated fees or interest separately and explain which disputed transaction triggered them. If more transactions appear, notify the provider again with the additional entries.

3. Capture a case number and deadline

Ask when the bank considers your report received, how its dispute team will correspond, whether a written notice is required, and when to expect an update. Keep a log with the date/time, channel, representative or team, reference number and what was promised. United States — debit/electronic transfers: Regulation E loss/stolen-access-device rules can limit exposure to $50 when reported within two business days after learning of the loss, while a longer delay can increase risk. An unauthorised EFT on a periodic statement must generally be reported within 60 days after the statement was sent to protect against possible liability for later transfers. These are different rules, and cases with no lost access device have different liability treatment. Report promptly rather than trying to calculate the latest permissible date.

4. Use the correct US credit-card written-dispute route

For US credit-card billing errors, CFPB advises reporting by phone and sending a written billing-error notice within 60 calendar days after the statement containing the error was sent to preserve statutory rights. Send it to the billing-inquiries address, often different from the payment address, using the statement’s instructions; keep a copy and proof of delivery. Describe that the charge was unauthorised, include your identifying account details in the secure notice and specify the disputed amount. Continue paying undisputed charges on time. Do not assume an email to customer service satisfies the formal written-notice requirement under the applicable US billing-error rules. Credit-card fraud protections and billing-error procedures should not be pasted into the debit-card timeline.

5. Monitor temporary credit and a final decision

US Regulation E generally requires an institution to investigate a qualifying EFT error within 10 business days, with additional time possible under statutory conditions if it gives provisional credit; it must report results and correct a verified error as required. US credit-card billing-error rules instead have their own acknowledgement and resolution time frames, including an acknowledgement typically within 30 days and investigation within two billing cycles, not exceeding 90 days, in applicable cases. Do not tell readers a bank must always refund every card claim within ten days. If temporary credit is later reversed after an adverse decision, ask for written reasoning and records supporting the result.

6. Follow up on denied or incomplete disputes

If your issuer finds the charge authorised but you disagree, request the evidence and the official complaint/reconsideration procedure; keep your timeline and any documentation. Check for duplicate entries, outstanding disputed interest and fees, and new fraudulent activity. If the institution’s internal process does not resolve the issue, consider the appropriate jurisdictional complaint or ombudsman mechanism. Filing a police or fraud report can be useful when requested or when identity theft is involved, but don’t delay contacting your card issuer while preparing it.

Worked paperwork example: separate amounts and outcomes

In the fictional $130 dispute, suppose the bank later grants an imaginary $115.50 credit and asks for further evidence on the $14.50 item. The unresolved amount is $130.00 − $115.50 = $14.50. Do not mark the entire dispute resolved merely because one credit arrived. A provisional credit is not necessarily final reimbursement. If the bank has also charged an illustrative $5 fee because of the disputed transaction, record that separately, not as another unauthorised card purchase.

Important country differences — verified 27 October 2026

United States: Report unauthorized debit/EFT quickly under Regulation E; stolen-device prompt notice and the 60-day statement rule address different potential liability. Credit-card billing-error protections require timely written notice to the designated address. Liability depends on facts and the specific statute; do not promise zero liability. United Kingdom: FCA guidance last updated 15 May 2026 says consumers should report an unauthorised payment immediately and generally notify the bank within 13 months. It also describes usual next-business-day refund rules with exceptions for authorised payments, fraud or serious failures to protect credentials. Do not confuse this with UK authorised push payment (APP) scam reimbursement, which has a separate eligibility regime for qualifying payments. Canada: FCAC directs immediate reporting; federally regulated institutions must investigate, and deposit account disputes commonly have agreement-based deadlines (often 30 days after a statement, but confirm your issuer’s terms). Canadian credit-card unauthorised-transaction rules differ from US credit-card dispute procedure. Australia: ASIC Moneysmart advises contacting the provider immediately, reporting unknown transactions and escalating through complaint processes. The ePayments Code, scheme rules and account terms may affect the investigation.

Troubleshooting

The merchant says you must contact them first: for a genuinely unauthorised bank EFT, report to your bank immediately; a merchant inquiry does not replace mandatory dispute rights. The card is still physically in my wallet: stolen credentials can be used without the plastic. The bank says a PIN proves consent: authentication alone does not necessarily settle an unauthorised-transaction question; in Canada FCAC explicitly requires examination of all relevant evidence. I paid a fraudster knowingly but was deceived: state the facts and ask the bank about separate scam-reimbursement channels. A charge is pending: report the security concern; formal settled-charge handling may differ. I missed a reporting deadline: still report at once and request an investigation; liability depends on law, timing, exceptions and evidence.

Alternatives and exceptions

Disputed delivery quality, a duplicate charge, a cancelled subscription that kept billing, a mistaken transfer and a genuinely unauthorised card payment are not the same claim. Ask which process applies, and never make a false ‘fraud’ statement to speed a legitimate merchant refund. For joint accounts and authorised users, details of who had authority matter. If a phone or wallet is stolen, disable access through official channels while preserving records. For cross-border card charges, currency conversion can complicate the statement value; use the posted account-currency amount for your ledger and retain the original receipt currency as evidence.

Frequently asked questions

Should I wait for a transaction to post? No, report suspicious use and secure the card now; the issuer can explain handling of the pending item.

Is locking the card enough? No. It may help prevent new use, but you still need to report and formally dispute previous unauthorised activity.

Will I definitely receive a refund? No. Rights depend on facts, reporting, applicable law and card/issuer schemes. Prompt and accurate reporting helps preserve options.

Can I use the same deadline for debit and credit? No. They are regulated differently, particularly in the US.

Can I stop paying my entire credit-card bill? Do not assume so; continue paying undisputed amounts as required while your dispute is investigated.

Final checklist

• I used a verified bank contact channel and secured compromised credentials.
• I identified every charge, amount, date and transaction status.
• I saved the reference number, complaint date and all correspondence.
• I checked the correct debit/EFT or credit-card formal notice rules.
• I reviewed whether a credit is temporary or final and followed up on remaining items.
• I kept unrelated account data, passwords and full card numbers private.

Sources & Further Reading

• CFPB — How to recover from unauthorised bank-account transactions.
• CFPB — Regulation E section 1005.6.
• CFPB — Electronic fund transfer FAQs.
• CFPB — Disputing a credit-card bill.
• FCA — Fraudulent payments (updated May 2026).
• FCAC — Resolve unauthorised transactions.
• FCAC — Consumer protections and responsibilities.
• ASIC Moneysmart — Bank transaction problems.

Last researched: 27 October 2026. This is general consumer education, not personalised legal advice. Fictional disputed amounts are arithmetic illustrations.