Banks will refund most unauthorized transactions, but the speed and certainty depend on whether you report it quickly and what type of account or card you used

If someone uses your debit card, credit card, or bank account without permission, your bank is legally required to investigate and usually refund the money. The catch is timing: you have a narrow window to report it, and how fast you get your money back depends on the type of card, the bank's procedures, and how quickly you spot the fraud.

The law that protects you is the Electronic Funds Transfer Act (EFTA) for debit cards and the Fair Credit Billing Act (FCBA) for credit cards. Both require banks to refund unauthorized charges, but the rules about how long you have to report and how long the refund takes are different for each.

Key Takeaways

  • Report unauthorized transactions to your bank as soon as you notice them — waiting more than 60 days can reduce or eliminate your protection.
  • Debit card fraud is covered under the EFTA, and your liability is usually zero if you report within two business days, but can rise to $500 if you wait longer.
  • Credit card fraud is covered under the FCBA, and you are never liable for more than $50 per card, even if you report late.
  • Your bank must investigate within 10 business days for debit cards and 30 days for credit cards, and will usually refund the money while investigating.
  • Provisional refunds (temporary credits while the bank investigates) are common and may be removed if the bank determines the transaction was actually authorized.

Debit Card Fraud and Your EFTA Protection

Debit card fraud is covered under the Electronic Funds Transfer Act. If someone uses your debit card or PIN without permission, your bank must refund the money, but how much protection you have depends on when you report it.

If you report the fraud within two business days of discovering it, your liability is zero — the bank covers the entire loss. If you report between two business days and 60 calendar days, your liability is capped at $500. If you wait longer than 60 days, you may lose all protection and be responsible for the entire amount, depending on your bank's policies and state law.

The clock starts when you discover the unauthorized transaction, not when it happened. Many people don't notice fraud for weeks, so check your debit card statements regularly or set up transaction alerts through your bank's app or website.

Credit Card Fraud and Your FCBA Protection

Credit card fraud is covered under the Fair Credit Billing Act. Your liability for unauthorized credit card charges is capped at $50 per card, no matter when you report it or how much was charged. Many banks and card issuers waive even that $50 and refund the full amount.

You have 60 calendar days from the date the fraudulent charge appears on your statement to report it. Unlike debit cards, there is no penalty for reporting late — your protection stays the same whether you call the day after you see it or 59 days later.

Credit card fraud is generally easier to dispute than debit card fraud because the card issuer has less incentive to prove the charge was yours. They make money on the transaction, so they are motivated to resolve disputes quickly and keep you as a customer.

How to Report Unauthorized Transactions

Call your bank or card issuer when ready. Do not email or use the app first — a phone call creates a record with a timestamp, and the bank can start the investigation right away. Have your card number, the disputed transaction amount, and the date ready.

Tell the representative you want to report an unauthorized transaction and dispute it. They will ask you to confirm recent legitimate transactions to verify you recognize your own activity. Be specific about which charge is fraudulent and whether you lost the card, had it stolen, or never authorized the merchant.

After the call, follow up in writing. Send a letter or email to the address the bank provides, including your account number, the transaction details, and a statement that you did not authorize the charge. Keep a copy for your records. This creates a paper trail if you need to escalate the dispute later.

What Happens During the Investigation

Your bank will open a dispute investigation and typically issue a provisional refund — a temporary credit to your account while they investigate. This credit is not final; the bank can remove it if they determine the transaction was actually authorized.

For debit cards, the bank must complete the investigation within 10 business days. For credit cards, they have up to 30 days. During this time, the bank contacts the merchant and reviews the transaction details, including whether the card was present, whether a PIN was used, and whether the merchant has a record of your authorization.

If the merchant cannot prove you authorized the charge, the bank will make the provisional refund permanent. If the merchant provides evidence that you did authorize it — such as a signed receipt or a matching PIN — the bank may remove the credit and hold you responsible.

When the Bank Might Not Refund You

Banks can deny a dispute if they find evidence that you authorized the transaction. This happens most often with online purchases where you entered your card details yourself, or with recurring charges you forgot you signed up for.

If someone had access to your PIN or password, the bank may argue that you were negligent in protecting it, especially if you wrote it down or shared it. However, if the PIN was obtained through a data breach or skimming device at an ATM, you have stronger grounds for a refund.

Chargebacks initiated by you through a third party (like PayPal or a payment app) instead of directly through your bank can complicate the dispute. Always report fraud to your bank first, not to the merchant or a middleman.

Protecting Your Account After Fraud

Once fraud is confirmed, ask your bank to cancel the compromised card and issue a new one. The new card will have a different number, which stops the fraudster from making additional charges.

Check your credit report for accounts you did not open. You can order a free report from each of the three bureaus — Equifax, Experian, and TransUnion — at annualcreditreport.com. If an account was opened in your name without permission, place a fraud alert or credit freeze with the bureaus.

Enable transaction alerts on all your accounts. Most banks let you set alerts for any charge over a certain amount, or for all charges, so you are notified when ready when something is charged to your card.

Frequently Asked Questions

How long does it take to get my money back after I report fraud?

Most banks issue a provisional refund within one to three business days of your report. The investigation takes up to 10 days for debit cards or 30 days for credit cards. If the bank confirms the charge was unauthorized, the provisional refund becomes permanent. If the investigation is still ongoing when the provisional period ends, many banks keep the credit in your account until they finish.

What if the bank says the charge was authorized and refuses to refund it?

You can escalate the dispute to the bank's complaint department or file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB investigates complaints against banks and can pressure them to reconsider. Keep all documentation of your dispute and the bank's responses.

Do I have to pay my credit card bill while disputing a charge?

You do not have to pay the disputed amount while the investigation is ongoing. However, you should pay the rest of your bill to avoid late fees and interest. The disputed charge will not be reported as late to credit bureaus while the dispute is active.

Can I dispute a transaction if I authorized it but the merchant charged me the wrong amount?

Yes, this is a valid dispute. If you authorized a $50 charge and the merchant charged $500, report it as an unauthorized or incorrect amount. The bank will contact the merchant to verify the correct amount. This is different from fraud but follows the same dispute process.

What if someone used my debit card at an ATM and I didn't report it for three months?

You may have lost your protection. After 60 days, your liability can be unlimited depending on your bank and state law. Some banks will still refund you as a courtesy, but they are not required to. This is why early reporting is critical for debit card fraud.