Finding a charge you didn’t make is unsettling, but federal law gives you real protection, provided you act within specific timelines. Wait too long, and a $50 problem can become an unlimited one.

If you notify your bank within 2 business days of discovering a lost or stolen debit card, your liability is capped at $50 or the amount of unauthorized transactions, whichever is less (Consumer Financial Protection Bureau, How do I get my money back after I discover an unauthorized transaction or money missing from my bank account?). This guide walks through exactly how to file a dispute, what your bank is required to do, and how the timeline affects what you’re actually on the hook for.

What Counts as an Unauthorized Transaction

Before filing a dispute, it helps to know what actually qualifies, since the term covers more than just a stranger draining your account. For a broader overview of how banking works, see our complete guide to how banking works.

A Transaction You Genuinely Didn’t Make or Approve

This is the clearest case: a charge, withdrawal, or transfer you don’t recognize and never authorized.

Earn Bonus Cash: Earn up to a $400 cash bonus and up to a 4.00% APY when opening a checking and savings account.

A Transaction Made With a Lost or Stolen Card

If your debit card was lost or stolen and someone used it before you reported it missing, those transactions are unauthorized, even though the card itself was legitimate.

A Transaction From a Compromised Account Number

If someone obtained your account or debit card number without physically stealing the card, such as through a data breach or a skimming device, any resulting transactions are unauthorized. This differs from someone gaining access to your routing and account number to set up an unauthorized ACH debit, which follows the same reporting process but starts from a different point of compromise.

A Transaction Someone Else Made Without Your Permission, Even Someone You Know

If a family member, former partner, or roommate accessed your account without your authorization, this generally still qualifies as unauthorized, though banks may scrutinize these cases more closely.

An Incorrect Amount or Duplicate Charge From a Legitimate Transaction

If you did authorize a transaction but the amount is wrong, or the same charge appears twice, this counts as an error under Regulation E rather than a straightforward unauthorized transaction, though the dispute process is similar.

What Generally Doesn’t Qualify

A transaction you authorized but now regret, a dispute over the quality of goods or services you received, or a transaction made by someone you voluntarily gave your card or login credentials to. These situations may have other remedies, but they typically don’t carry the same unauthorized-transaction protections.

If you’re unsure whether your situation qualifies, report it anyway. Your bank will decide during its investigation, and reporting promptly protects your position regardless of the outcome.

The Liability Timeline That Determines What You Owe

Regulation E ties your maximum liability directly to how quickly you report the problem. The dollar amounts step up sharply at each threshold, which is exactly why acting fast matters more than almost anything else in this process.

When You Report	Your Maximum Liability
Within 2 business days of discovering the loss or theft	$50, or the amount of unauthorized transactions, whichever is less
After 2 business days, but within 60 days of your statement	$500
After 60 days from your statement	Unlimited liability for transactions occurring after the 60-day window

The 2-Business-Day Window Is the One That Matters Most

If you notify your financial institution within 2 business days of learning of the loss or theft of your card, your liability is capped at $50, or the amount of unauthorized transfers that occurred before you gave notice, whichever is less.

The 60-Day Clock Starts From Your Statement Date, Not the Transaction Date

This is a common point of confusion. If an unauthorized transaction happened on the 5th but appeared on a statement sent on the 28th, your 60-day window to report it and avoid unlimited liability runs from the 28th, not the 5th.

Multiple Unauthorized Transactions Can Stack in Complicated Ways

If a thief takes $600 on one day and $100 on a later day before you report anything, your maximum liability depends on exactly when each transaction occurred relative to your report. This is genuinely complex, which is one more reason to report the moment you notice something wrong rather than waiting to see if more charges appear.

Many Banks Offer Stronger Protection Voluntarily

These are the legal minimums under Regulation E, not necessarily what your specific bank will actually charge you. Many banks, particularly for debit card fraud, have adopted zero-liability policies that go beyond what the law strictly requires, though it’s still worth reporting quickly rather than relying on a voluntary policy.

Step-by-Step: How to File the Dispute

Review Your Account Immediately

As soon as you spot something unfamiliar, review your recent transaction history for any other unauthorized activity you may have missed. Banks generally want a complete picture in one report, not a series of follow-up calls.

Contact Your Bank the Same Day, if Possible

Call your bank’s fraud or customer service line, or use the dispute feature in your banking app, as soon as you notice the issue. Phone and online reporting are typically the fastest ways to start the clock on your protection.

Provide Specific Details

Be ready to identify the exact transaction, date, amount, and merchant or recipient, and explain why you believe it’s unauthorized. The more specific you are, the faster the bank can begin its investigation.

Request That Your Card Be Frozen or Replaced

If the unauthorized activity involves your debit card, ask your bank to freeze the card immediately and issue a new one. This prevents further unauthorized use while the dispute is being investigated.

Follow Up in Writing

Even after reporting by phone, send a written follow-up, whether that’s a secure message through your bank’s app, an email, or a letter. Some banks require written confirmation within a specific window, and a written record protects you if there’s ever a dispute about what you reported and when.

Get a Case or Claim Number

Ask for a reference number for your dispute and keep it somewhere easy to access. This becomes your main reference for any follow-up calls or correspondence.

Keep Copies of Everything

Save screenshots of the unauthorized transaction, any confirmation emails from your bank, and notes from phone calls, including the date, the representative’s name, and what was discussed.

What Happens After You File

Once you submit your dispute, the process shifts to your bank, which must respond within specific federal deadlines.

Under Regulation E, your bank generally has 10 business days to investigate and determine whether an error occurred. This is the standard timeline for most disputes.

If your bank can’t complete its investigation within that initial window, it must generally provide provisional credit for the disputed amount while it continues investigating, extending the process up to 45 days total. This means you typically get your money back, at least temporarily, even before the investigation concludes.

Certain circumstances, like transactions involving new accounts, point-of-sale transactions, or transfers initiated outside the U.S., may allow your bank additional time before provisional credit is required, sometimes extending the full investigation window further.

Once the investigation concludes, your bank must tell you the results in writing. If it finds the transaction was indeed unauthorized, any provisional credit becomes permanent. If it finds no error, it can reverse the provisional credit.

If your bank ultimately rules against you, it can take back the provisional credit it issued during the investigation. That is why it’s worth closely tracking your case and being prepared to respond if the bank’s initial finding doesn’t match what you reported.

If your bank determines no error occurred, you can request the documents and information it relied on to reach that conclusion. This step is useful if you believe the investigation missed something.

What to Do if the Bank Denies Your Claim

A denial isn’t necessarily the end of the process. You have several avenues to push back if you believe the decision was wrong.

Request the documentation your bank used to reach its conclusion. Under Regulation E, you’re entitled to this information, and reviewing it can reveal whether the bank considered everything relevant or missed something in its investigation.

Ask for a clear, written explanation of the denial if you haven’t already received one. Understanding the specific reasoning gives you something concrete to respond to, rather than trying to argue against a vague rejection.

Provide any additional evidence you have that supports your claim. If you have documentation you didn’t initially submit, like a receipt proving you were somewhere else when the transaction occurred, or records showing your card was in your possession, submitting it can prompt a second look.

Escalate within the bank if you’ve exhausted the standard dispute process. Many banks have a formal appeals process or an executive complaints team that handles cases the initial fraud department denied.

File a complaint with the Consumer Financial Protection Bureau if you believe your bank violated Regulation E’s requirements. The CFPB accepts complaints related to unauthorized transactions and can prompt a bank to reconsider a decision, or at minimum build a record of noncompliance.

Consider small claims court for smaller disputed amounts. If you’re confident in your case and the amount is relatively modest, small claims court doesn’t require an attorney and can be a practical option when other avenues have failed.

Consult an attorney for larger disputes or a pattern of denials. If a bank consistently mishandles disputes or a single denial involves a significant amount of money, an attorney familiar with the Electronic Fund Transfer Act can advise you on whether you have grounds for further action, including potential statutory damages.

Unauthorized Transactions That Work Differently

Not every type of unauthorized transaction falls under Regulation E. Checks, wire transfers, and credit cards each follow their own rules, and the differences matter.

Checks are governed primarily by state adoption of the Uniform Commercial Code rather than Regulation E. If someone forges your signature or alters a check you wrote, you generally have recourse, but the process and timelines run through your bank’s check-specific policies and state law rather than the federal EFT framework covered in this guide. This differs from writing a bad check yourself, which involves your own account rather than fraud committed against you.

Wire transfers offer the weakest consumer protection of the 3. Since wires aren’t covered by Regulation E, there’s no equivalent statutory liability cap or guaranteed investigation timeline. Recovery depends heavily on how quickly you report the issue and whether the receiving bank can and will intervene before the funds are fully disbursed, which is far from guaranteed. Our guide comparing ACH transfers vs. wire transfers covers this difference in more detail.

Credit cards are governed by the Truth in Lending Act and the Fair Credit Billing Act, not Regulation E. Under these laws, your liability for unauthorized credit card charges is capped at $50, and most major card issuers voluntarily waive this entirely through zero-liability policies. If your credit card number was stolen but the physical card wasn’t lost, your liability is generally $0 by law, regardless of when you report it.

ACH debits from your bank account do fall under Regulation E, using the same liability tiers and investigation timelines as debit card transactions. An unauthorized recurring charge pulled directly from your checking account follows the same process outlined earlier in this guide.

If you’re not sure which category your situation falls into, report it to your bank regardless. Identifying the correct framework is part of what the bank’s fraud department will help sort out, and reporting promptly protects your position under whichever rules ultimately apply.

How to Protect Yourself Going Forward

A few habits meaningfully reduce both the odds of unauthorized activity and how much damage it can do if it happens anyway.

Review your account activity regularly rather than waiting for your monthly statement. Checking your transactions weekly, or even more often through your banking app, means you’re likely to catch something unusual well within the 2-business-day window that caps your liability at its lowest level.

Set up transaction alerts through your bank’s app. Many banks let you receive a notification for every purchase, every transaction above a certain amount, or any international transaction, giving you a real-time way to spot something wrong the moment it happens rather than days later.

Use strong, unique passwords and enable multi-factor authentication on your banking accounts. Credential theft is one of the most common ways unauthorized transactions happen, and these basic security steps meaningfully reduce that risk.

Be cautious about where you use your debit card. Since debit card fraud carries real liability risk under Regulation E, some people choose to reserve their debit card for trusted, familiar merchants and rely on a credit card, with its stronger built-in protections, for online purchases or less familiar vendors. Our guide comparing debit cards vs. credit cards covers this tradeoff in more depth.

Know your bank’s specific policies before you need them. Some banks offer zero-liability protection that goes beyond the legal minimum. Understanding your bank’s actual policy, rather than assuming the federal minimum is all you’re entitled to, helps you know exactly where you stand if something happens.

Keep your contact information updated with your bank. Fraud alerts and account notifications only work if your bank has your current phone number and email on file, so it’s worth confirming this periodically.

Report anything suspicious immediately, even if you’re not fully certain it’s unauthorized. A false alarm costs little. The cost of waiting on something that turns out to be real can be significant.

The Bottom Line

The most important takeaway from this guide is timing. Reporting an unauthorized transaction within 2 business days caps your liability at $50. Waiting even a little longer raises that ceiling to $500, and waiting past 60 days can leave you exposed entirely.

Once you’ve reported it, the process is largely out of your hands, but it isn’t a black box. Your bank has real deadlines to investigate, real obligations to provide provisional credit in many cases, and real requirements to explain its findings if it denies your claim. Knowing those obligations means you can push back effectively if things don’t go the way they should.

Whatever type of transaction you’re dealing with, debit card, ACH, wire, or check, the same basic instinct applies: report it the moment you notice it, put it in writing, and keep records of everything. That combination puts you in the strongest possible position, regardless of which specific rules end up governing your case.