Published
August 11, 2026
The right deadline depends on whether the account is debit or credit, whether the physical card was lost and when the transaction appeared. Reporting promptly protects more options and can stop a thief from trying again.
Start with three immediate steps
- Lock the card and contact the issuer. Use the verified banking app, the number on the card or a recent statement—not a link in an unexpected fraud alert.
- Identify every suspicious transaction. Look for small test charges, digital-wallet tokens, transfers and changes to contact information.
- Save the evidence. Download the statement, screenshot the transaction and record when you discovered and reported it.
Ask whether the issuer will replace the card number, remove it from digital wallets and block recurring tokens. Changing only the visible card number may not stop every merchant credential or compromised login.
Credit-card deadlines and protections
For a billing error on a credit-card statement, contact the issuer promptly. To preserve federal billing-error rights, send the written notice required by the issuer within 60 calendar days after the charge first appeared on the statement. The billing-disputes address may be different from the payment address, so follow the statement's instructions.The issuer generally must acknowledge a qualifying written billing-error notice within 30 days unless it resolves the dispute sooner, and generally must complete the investigation within two billing cycles, subject to the federal limit. Continue paying undisputed amounts on time.
If only the credit-card account number was stolen and used without authorization, CFPB guidance says you generally are not responsible for those unauthorized charges. When a physical credit card is lost or stolen, federal liability can be up to $50, though issuer policies may be more protective.
Debit-card deadlines can be much shorter
Debit-card rules focus heavily on how quickly the loss is reported because the money leaves a deposit account. If the physical card or PIN is lost or stolen, notifying the financial institution within two business days after learning of the loss can generally cap liability at $50. Waiting longer can increase potential liability, depending on when the report is made.If the card is still in your possession and an unauthorized electronic transfer appears on a periodic statement, report it no later than 60 days after the institution sent the statement. Waiting beyond that point can expose later transfers to much greater risk if timely notice would have prevented them.
Report immediately even when you are still investigating. The institution can explain whether it needs a written confirmation and what information to provide.
What to include in the dispute
- Your name and the account identifier the issuer requests—avoid putting a full account number in an insecure message.
- The transaction date, merchant description and amount.
- A clear statement that you did not authorize the transaction.
- The date you discovered it and the date you first reported it.
- Relevant evidence, such as proof the card remained with you, a cancellation confirmation or correspondence with the merchant.
- The correction you are requesting.
Keep a copy and proof of delivery when a written notice is required. Do not alter screenshots or discard the statement after a provisional credit appears.
What happens during the investigation?
For a debit-card or other electronic-fund-transfer error, the institution generally investigates within 10 business days. When it needs longer, it may provisionally credit the account and continue investigating, subject to the applicable rules and account type. Some investigations can run 45 days or, in specific circumstances, up to 90 days.A provisional credit is not always final. Read follow-up messages, respond to reasonable evidence requests and avoid assuming the matter is closed until the institution confirms the result. If the claim is denied, request the explanation and the information the institution relied on, then use the provider's appeal or complaint process.
Unauthorized, merchant dispute or subscription charge?
“Unauthorized” usually means you did not give the person or merchant authority to make the transaction. A charge can instead be a merchant dispute when you authorized a purchase but disagree about quality, delivery, price or refund terms. A subscription charge after cancellation may turn on whether the cancellation was effective and whether the merchant had continuing authority.Describe the facts accurately rather than choosing the label that sounds strongest. For recurring billing after cancellation, use our post-cancellation subscription charge guide. For suspected scams, consider an FTC report after taking the immediate payment-recovery steps.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
Frequently Asked Questions
How long do I have to dispute an unauthorized credit card charge?
Contact the issuer immediately. To preserve federal billing-error rights, send the required written notice within 60 calendar days after the charge first appeared on the statement. Follow the issuer’s billing-dispute instructions.
How long do I have to report an unauthorized debit card charge?
Report immediately. A lost or stolen card or PIN can trigger a two-business-day rule, while an unauthorized transfer shown on a statement generally must be reported within 60 days after the statement was sent.
Can a bank take back provisional credit?
Yes. Provisional credit may be temporary while the institution completes its investigation. Review the final decision and respond to evidence requests.
Should I contact the merchant before disputing a charge?
For a recognizable merchant error, contacting the merchant can sometimes resolve it quickly. For suspected fraud or continuing account access, notify the issuer immediately rather than waiting for the merchant.
Is a charge after cancellation automatically unauthorized?
Not always. The result can depend on when and how you canceled, the billing terms and whether the merchant retained authority. Preserve the cancellation confirmation and describe the facts accurately to the issuer.
Sources
• CFPB — Watch Accounts Closely When Card Data Is Hacked• CFPB — Get Money Back After an Unauthorized Transaction
• CFPB — Dispute a Credit Card Charge
• CFPB — Fix Mistakes in a Credit Card Bill
• CFPB — Regulation E Error-Resolution Rules
About This Page
OpenClassActions.com is a consumer information site, not a law firm or financial adviser. This page provides general educational information and is not legal or financial advice. Liability, deadlines and procedures depend on the payment method, facts and account agreement; confirm current instructions with the issuer and seek qualified help when needed.
For more class actions keep scrolling below.
