1. What to Do in the Next Ten Minutes

The single most important thing you can do right now is call the number printed on the physical card, or the number shown inside your card issuer’s official app. Not a number from a search engine result, a text message, or a call you just received — the one printed on the card itself, or found by logging into the app you already have installed.

Report every charge you don’t recognize, not just the large ones. A small, unfamiliar charge is often the first sign that your card number has been compromised — thieves frequently test a stolen number with a tiny purchase before attempting anything larger. Reporting it and asking for a new card number stops that pattern before it grows, rather than waiting to see if something bigger shows up.

Ask that the card be closed and reissued so the exposed number stops working immediately. This is different from closing the account entirely — a reissued card keeps your account, credit history, and any rewards intact while retiring only the compromised card number. If you’re weighing whether to close the underlying account altogether, that decision affects your credit history in ways worth understanding first — see How to Cancel a Credit Card Without Hurting Your Credit.

Write down three things before you hang up: the date and time, the name of the person you spoke with, and the claim or reference number they give you. If you need to escalate later, these details are what make that possible.

2. Two Different Federal Rules Apply

The liability rule

Truth in Lending Act’s implementing regulation, Regulation Z, limits what a credit cardholder can be made to pay for unauthorized use of a credit card to the lesser of $50 or the amount actually taken before the issuer is notified (12 CFR §1026.12(b)). Notably, this notice can be given orally or in writing, and federal guidance is explicit that there’s no fixed deadline attached to it — reporting late doesn’t forfeit this protection, though reporting promptly is still what stops the number from being used further.

The billing-error rule

Regulation Z also contains a separate mechanism: the billing-error resolution procedure (12 CFR §1026.13). To use it, you must send the issuer written notice no later than 60 days after the statement showing the disputed charge was sent. Once that notice arrives, the issuer must acknowledge it within 30 days and resolve it within two complete billing cycles, but no later than 90 days. While it’s pending, you don’t have to pay the disputed amount or related charges, and the issuer can’t report you delinquent on that portion of the bill.

How they interact

Missing the 60-day billing-error deadline does not automatically make you liable for a charge you never made. It means you lose access to that specific formal process — the guaranteed acknowledgment window, the guaranteed resolution timeline, the guaranteed hold on the disputed amount. The separate $50 liability cap on unauthorized use is untouched by that deadline; it operates independently. Many consumer explainers, and even some automated tools, collapse these into one rule and get this backward. They’re not the same mechanism, and the difference matters most for anyone who’s discovering an old charge late.

A phone call is the right first action — it’s what starts stopping the card. A written notice is the right second one, because it’s what the 60-day billing-error procedure actually requires; a phone call alone may not preserve those specific rights. Keep a record of every date, name, and reference number, and keep copies of anything you send.

This is separate from a disagreement with a merchant you chose to do business with — goods that never arrived, or a service not as described. That’s a different process with its own rights and deadlines; see How to Dispute a Credit Card Charge and Get Your Money Back for that situation specifically.

3. Credit Cards: What You Can Actually Be Held To

Under Regulation Z, a credit cardholder’s liability for unauthorized use of a credit card cannot exceed the lesser of $50 or the amount obtained before the issuer is notified (12 CFR §1026.12(b)(1)(ii)). If only your account number was stolen and the physical card never left your possession, federal guidance is clear that you generally have no liability at all for the resulting charges. And if the card issuer never actually issued you an “accepted” card in the first place — for example, an unsolicited card you never activated or used — the liability provisions don’t attach to begin with.

Zero-liability policies are not the law. Most major card networks and issuers voluntarily promise to waive even the $50 statutory minimum, which is why many cardholders never pay anything for unauthorized use. But that promise is a network or issuer policy, not a federal statute — and policies can carry their own conditions, such as reporting promptly or keeping the account in good standing. Ask your issuer what its specific policy requires; the $50 federal floor is what you’re guaranteed no matter what.

4. Debit Cards: Why Speed Decides Everything

The Electronic Fund Transfer Act’s implementing regulation, Regulation E, sets three tiers of liability tied to how quickly you notify your bank after learning your card or PIN was lost or stolen (12 CFR §1005.6(b)):

• Within two business days of learning of the loss or theft: liability is capped at the lesser of $50 or what was taken before you notified the bank.
• After two business days, but before your statement’s 60-day window closes: the cap rises to $500.
• After that 60-day window has passed without notice: the fixed caps stop applying. From that point, your liability becomes whatever was taken between the close of the 60 days and the day you finally report it — a window that keeps growing for as long as you don’t report, and can become substantial. Your bank’s own policies or state law may still limit this further, so ask.

These two-day and 60-day tiers specifically apply to the loss or theft of an “access device” — your physical card or PIN. If only your account number was used, without the card or PIN itself being lost or stolen, those tiers don’t apply at all; instead, the general 60-day statement-reporting rule governs, and reporting within that window generally means no liability.

The practical point: on a credit card, an unauthorized charge is a claim against the issuer’s money. On a debit card, it’s already gone from your account. That’s why the reporting clock matters so much more here — you’re not just protecting a liability cap, you’re protecting your actual cash flow.

Provisional credit. If your bank can’t finish investigating within 10 business days, Regulation E requires it to provisionally credit your account for the disputed amount within that same 10-business-day window in order to take up to 45 calendar days total to investigate (12 CFR §1005.11(c)). New accounts and certain foreign or point-of-sale transactions can extend that investigation period further. The bank may withhold up to $50 of that provisional credit if it has a reasonable basis to believe the transfer was unauthorized. Ask specifically whether provisional credit applies to your case and when you’ll see it.

Knock-on damage. Money missing from a debit account can cause other payments to bounce, trigger overdraft fees, or disrupt autopay. Ask your institution about reversing fees that resulted directly from the fraud, and give a heads-up to any biller with a payment coming due from that account.

5. What the Bank Must Do, and How Long It Takes

The two frameworks run on different clocks. For a credit card billing-error notice, the issuer must acknowledge your written notice within 30 days and resolve it within two complete billing cycles, no later than 90 days (12 CFR §1026.13(c)). For a debit card error notice, the bank generally has 10 business days to investigate, or up to 45 calendar days if it provisionally credits your account within that first 10-day window (12 CFR §1005.11(c)).

While a credit card dispute is pending, you’re not required to pay the disputed amount or related charges, and the issuer can’t report the account delinquent over that portion of the bill. While a debit card dispute is pending, provisional credit — when it applies — gives you use of the funds during the investigation, though the bank can reverse it if the investigation concludes the charge was valid.

Helpful evidence for either process includes a timeline of when you discovered the charge, any receipts or records showing where you actually were, and a police report if you filed one.

The fact that matters most for what comes next: if the investigation concludes against you, the institution generally must explain its finding and, on request, provide you with the documents it relied on. Few consumers know this exists — and it’s the hinge the next section turns on.

6. If the Bank Denies Your Claim

Being told no isn’t the end of the process. It’s calm and procedural from here — here’s the sequence.

1. Ask for the specific reason, in writing. You’re entitled to know why the institution concluded the charge was authorized.
2. Request the documents the decision relied on. Regulation E and Regulation Z both give you the right to ask for what the investigation was based on.
3. Submit a written response with your own evidence — a timeline, location records, receipts, or a police report if you have one.
4. Escalate within the institution if a front-line representative denied the claim; ask specifically for a supervisor or the dispute-resolution unit.
5. File a complaint with the federal consumer financial regulator if the institution still won’t budge — the Consumer Financial Protection Bureau accepts complaints, forwards them to the institution, and requires a response.
6. Consider small claims court for smaller amounts. It doesn’t require a lawyer and exists specifically for disputes of this size.
7. Know your rights on the disputed amount in the meantime — for credit cards, you generally don’t owe the disputed portion while any of this plays out.

You can file a complaint about a card issuer or bank through the Consumer Financial Protection Bureau’s public complaint process: consumerfinance.gov/complaint.

7. Charges That Aren’t Actually Unauthorized

Not every unfamiliar charge is fraud. A real cluster of charges people report as “unauthorized” turn out to be something else entirely — and knowing the difference saves you a process you don’t need.

A family member used it

If you gave a family member the physical card or the account number, a purchase they made is generally treated as authorized use — even one you didn’t specifically approve — because you gave them actual or implied authority to use it. This isn’t a judgment on the situation, just how the liability rules work.

My child made purchases in an app or game

The same logic applies to in-app and console purchases by a child who had access to the device, the card, or a saved payment method. It’s generally not “unauthorized use” in the legal sense, even though it doesn’t feel authorized to you in the moment.

Reporting it as fraud can have real consequences, including the platform or merchant closing your account entirely. The better route is the platform’s own refund process, plus checking its parental-control settings going forward. If the amount involves a broader billing disagreement, see How to Dispute a Credit Card Charge and Get Your Money Back.

A subscription I forgot about

A very common cause of an “I don’t recognize this” moment is a recurring subscription you signed up for and forgot. Before reporting anything, match the amount and date against your known subscriptions and ask your household — someone else may have signed up for something on a shared card.

A charge with a billing name I don’t recognize

Merchants frequently bill under a corporate or parent-company name that doesn’t match the storefront you actually bought from. Look up the descriptor before assuming it’s fraudulent; many banking apps include a lookup tool for exactly this.

A very small charge I don’t recognize

This is the opposite case: a tiny, unfamiliar charge can be an early signal that your card number is compromised, since thieves sometimes test a stolen number with a small purchase before attempting something larger. Report it and ask for the card to be reissued — don’t dismiss it just because the dollar amount is trivial.

8. Is That “Fraud Alert” Text Real?

Impersonation of a card issuer’s fraud department is a well-documented pattern in consumer fraud. A legitimate institution will never ask you to move money, install software, or read back a one-time code from a text message — those requests are the tell, regardless of how official the message looks or how urgent it sounds.

The single rule that resolves every version of this: end the contact, and call the number printed on your card or shown inside your official banking app. Don’t call a number the message gives you, don’t click a link in it, and don’t reply to it. If it was real, calling the number on your card will connect you to the same institution; if it wasn’t, you’ve just avoided the scam entirely.

This is also why searching online for a bank’s fraud-department number carries its own risk — search results can be manipulated to surface fraudulent numbers. The card-back rule sidesteps that risk completely, which is why it’s worth remembering as an absolute, not a suggestion.

9. Locking Everything Down Afterward

Once you’ve reported the charge, spend a few more minutes protecting your broader financial identity — this is where current demand is moving fastest, and where most guides stop short.

What a freeze does not do is worth stating precisely, since it’s often oversold: it does not stop soft inquiries like pre-qualified offers, it does not stop creditors you already have accounts with from monitoring those accounts, and it does not stop fraud on accounts that are already open. A freeze specifically blocks new accounts from being opened using your credit file — that’s its job, and it does that job well.

Beyond the three nationwide credit bureaus, additional specialty consumer reporting agencies exist that cover things like checking-account history or other consumer decisions, and a standard freeze at the three nationwide bureaus doesn’t reach them. Consumers have the same basic rights with these agencies — including the ability to freeze a file and dispute inaccurate information. The Consumer Financial Protection Bureau publishes an official list of these specialty agencies; it’s worth a search if your situation involves more than a single card.

An official identity theft report, filed through the FTC’s IdentityTheft.gov, can unlock additional rights when the fraud extends beyond a single charge — including the ability to have information resulting from identity theft blocked from appearing on your consumer report.

If the fraud already affected your credit report or score, two more resources can help you clean that up: How to Fix Your Credit Score Fast: Proven Steps That Work and How to Check Your Credit Score Free.

10. Making It Harder Next Time

None of this describes how card data gets stolen — only how to make your own accounts harder targets going forward.

• Turn on transaction alerts for every purchase. It’s the fastest way a consumer can detect something is wrong.
• Ask your issuer about virtual or single-merchant card numbers if that option is offered on your account — they limit what a single compromised number can be used for.
• Review statements line by line, including small amounts, rather than scanning for obviously large ones.
• After a data breach notice arrives, treat it as a cue to place a fraud alert and review your accounts — see §9 above for how.

To understand what all of this is actually protecting, see Credit Score Guide: Ranges, Check Free & Factors.

11. Frequently Asked Questions

What should I do first if I see a charge I didn’t make?

Call the number on the back of your card, or the number inside your issuer’s official app, and report it immediately — that single step matters more than anything else you do today.

Am I responsible for unauthorized charges on my credit card?

Federal law caps what you can be held to at $50, and most issuers waive even that through a zero-liability policy, so most cardholders end up paying nothing.

What is the $50 liability limit?

It’s the maximum a credit cardholder can be required to pay for unauthorized use under Regulation Z — never more than $50, or the amount taken before you notified the issuer, whichever is less.

Is a zero-liability policy the same as the law?

No. The $50 cap is federal law; a zero-liability policy is a voluntary promise from the network or issuer to waive even that amount, and it can come with its own conditions.

How long do I have to report an unauthorized charge?

There’s no fixed deadline for the credit card liability cap itself, but the separate written billing-error dispute procedure requires notice within 60 days of the statement showing the charge. For debit cards, reporting within two business days keeps your cap at $50, and reporting within 60 days of the statement matters even more.

What happens if I report it after the deadline?

For a credit card, missing the 60-day billing-error deadline doesn’t make you liable for the charge — it only means you lose access to that specific formal dispute process. For a debit card, missing the 60-day statement deadline can mean your liability grows for whatever was taken after that point.

Is debit card fraud treated the same as credit card fraud?

No. Debit cards are governed by a different law (the Electronic Fund Transfer Act) with tiered liability that increases with delay, and it’s your own money at stake while the investigation runs, not the issuer’s.

How long does the bank have to investigate?

For a credit card billing error, up to two billing cycles, never more than 90 days. For a debit card error, generally 10 business days, extendable to 45 calendar days if the bank provisionally credits your account first.

Will I get my money back while they investigate?

On a credit card, you’re simply not required to pay the disputed amount while it’s pending. On a debit card, provisional credit may apply, restoring use of the funds during the investigation — though it can be reversed if the claim is denied.

What can I do if my fraud claim is denied?

Ask for the reason and the supporting documents in writing, submit your own evidence, escalate within the institution, file a complaint with the federal regulator, and consider small claims court for smaller amounts.

Is a charge made by my child or spouse considered fraud?

Generally not, if you gave them access to the card, the number, or the account — even if you didn’t expect that specific purchase. Reporting it as fraud can carry consequences like account closure.

What if I don’t recognize the merchant name on a charge?

Look up the billing descriptor before assuming fraud — merchants often bill under a different registered business name than their storefront.

What does a small unfamiliar charge mean?

It can be an early sign your card number is compromised, since thieves sometimes test a stolen number with a small purchase first. Report it and ask for the card to be reissued rather than ignoring it.

How do I know if a fraud alert text is real?

A legitimate institution will never ask you to move money, install anything, or read back a one-time code. End the contact and call the number on your card to check.

What’s the difference between a fraud alert and a credit freeze?

A fraud alert adds a verification step before new credit can be opened; a freeze blocks lenders from seeing your file at all until you lift it.

Does freezing my credit stop all inquiries?

No. It stops new lenders from pulling your file, but it doesn’t stop soft inquiries, access by creditors you already have, or fraud on accounts that are already open.