Unauthorized charge — first 24 hours playbook

Last updated: 2026-05-01

Four actions in the first 24 hours determine how much money you get back from an unauthorized charge: lock the card within 30 minutes, file the formal dispute within 2 hours, get provisional credit posted, and document everything. The reason timing matters this much is Regulation E for debit cards — your maximum liability is $50 if you report within 2 business days, $500 if within 60 days, and unlimited if later. For credit cards, the Fair Credit Billing Act caps liability at $50 regardless of timing, but the same urgency applies because faster reporting means faster refund.

Quick answer (the four steps that matter most)

1. Lock the card through your banking app — minute 0. Don't cancel yet; just lock.
2. Document the disputed charge — screenshot it from the bank app or website. Get the exact amount, date, and merchant string.
3. Open the formal dispute through your bank within 2 hours. Phone is fastest; the in-app dispute flow is the second-best option.
4. Confirm provisional credit timeline with the bank — most issuers post provisional credit within 1-10 business days for cards in good standing.

Steps 1-3 should take under 30 minutes total. Step 4 is a single confirmation question on the same call.

Minute 0-30: Lock and document

Lock the card first, don't cancel. Locking is reversible and immediate; cancellation is permanent and stops legitimate auto-pays you may need (rent, utilities, your phone bill). Every major US bank app has a one-tap card lock. Use it. The lock prevents new charges but doesn't affect already-posted ones — those need the formal dispute.

Document the charge before doing anything else. Screenshot it from your banking app or website. Capture: the exact dollar amount, the post date, the merchant descriptor string (the cryptic "AMZN MKTP US" or "FID BKG SVC LLC" line), and any reference number the bank shows. If your bank lists multiple suspicious charges, screenshot all of them. Don't rely on remembering — bank fraud reps will ask for these specific data points and getting them right speeds the call.

If you don't recognize the merchant string, search it before calling — sometimes a charge that looks like fraud is just a legitimate company billing under a different name. The descriptor lookup covers most of the common ones. If it's still unfamiliar after lookup, treat it as fraud and proceed.

Hour 1-2: File the formal dispute

Phone is fastest. Call the number on the back of the card. The fraud line is usually a different option from general customer service; choose "fraud" or "report unauthorized charge." Have your card number, the disputed amount, the post date, and the merchant string ready before the call. The first script the agent will go through is verifying your identity and confirming you're physically holding the card. Stay on the call.

Tell them this:

"I have an unauthorized charge of $[amount] from [merchant string] on [date]. I did not authorize this transaction and the card has been in my possession. I'd like to dispute the charge and request a new card."

Three things this script does: (1) names the unauthorized framing — that triggers the bank's fraud-investigation flow, not the merchant-dispute flow, (2) asserts physical possession — that's the line that protects you under Reg E for debit cards, (3) requests the new card in the same call so a separate one isn't needed.

The agent will ask if you want provisional credit. Say yes. Provisional credit puts the disputed amount back into your account while the bank investigates — for debit cards the bank is required by Regulation E to provide it within 10 business days if their investigation will take longer than that.

Get a case reference number before hanging up. Write it down. You'll need it for any follow-up call and any escalation.

Hour 2-24: Provisional credit and follow-through

Within a day, log back into the bank app and confirm the dispute is on file. Most major banks show "disputed transaction" status on the charge in question. If you don't see it within 24 hours, call back with your case number and ask for confirmation.

Provisional credit timing varies:

• Major credit cards (Chase, Citi, Capital One, Amex): often immediate, within 1-3 business days
• Major debit cards: within 10 business days under Reg E §1005.11(c)
• Smaller banks and credit unions: sometimes longer; up to 45 days for new accounts
• Prepaid cards: Reg E protections vary; check the card's terms

If provisional credit doesn't post within the regulatory window, that itself is a violation worth escalating. Call again, ask specifically: "Why hasn't provisional credit posted within the Reg E window?" The phrasing triggers escalation to a supervisor; most front-line agents don't know Reg E timing rules off-hand.

Liability rules by card type — this is what timing protects

Card type	Liability cap	Reporting window for cap	Statute
Credit card	$50 regardless of timing; usually waived to $0	No statutory deadline (FCBA dispute window is 60 days from statement)	Fair Credit Billing Act, 15 U.S.C. §1643
Debit card — within 2 business days	$50 maximum	2 business days from learning of loss	Regulation E, 12 CFR §1005.6
Debit card — 3-60 days	$500 maximum	Within 60 days of statement	Regulation E, 12 CFR §1005.6
Debit card — after 60 days	Unlimited	—	Regulation E, 12 CFR §1005.6
Prepaid card	Generally same as debit; some products differ	Same as debit, with caveats	Regulation E (since 2019)
Wire transfer / ACH	Limited recovery; depends on UCC Article 4A	Promptly, ideally within hours	UCC §4A-204; bank policies

The single strongest protection in this table: credit cards. The single weakest: debit cards reported after 60 days. If you have the choice between a credit card and a debit card for online purchases, this is one of the reasons to use credit.

Unauthorized vs unrecognized vs disputed — banks treat these differently

Three terms that sound similar but route to different bank teams:

• Unauthorized — you didn't authorize it; the card was used without your consent. This is fraud. Routes to fraud-investigation team. Reg E protections fully apply.
• Unrecognized — you don't recognize the merchant but might have authorized it. Bank pushes back: "Did you make a purchase at [merchant] on [date]?" Most "unrecognized" charges turn out to be a known company billing under a different DBA name. Look up the descriptor first; if it's still unfamiliar after lookup, restate as "unauthorized."
• Disputed — you authorized it but want the charge reversed (defective product, didn't receive goods, etc.). Different process. Routes to merchant-dispute team. Subject to FCBA §1666 process for credit cards.

The framing you use determines which team handles your case and which protections apply. For genuinely unauthorized charges, use the word "unauthorized." For genuinely fraudulent charges (someone else used your card details), use the word "fraud." Don't say "I want to dispute this" if it's actually fraud — that misroutes you to a slower team with weaker protections.

Anti-misconception: what to skip

• Don't file a police report first. Police reports are useful for some cases (large-scale identity theft), but for a single unauthorized charge, the bank dispute is faster and more effective. File a police report later if the bank requests one (they sometimes do for amounts over $1,000).
• Don't email the merchant directly. If the charge is fraud, the merchant didn't intentionally bill you and probably can't help — the fraudster used your details with their store. Bank-level dispute is the only path.
• Don't close the bank account in panic. Closing the account complicates the dispute. Lock the card; let the bank process the dispute against the active account; close later if needed.
• Don't accept the bank's first denial as final. First-pass automated denials are common; supervisors and the formal Reg E dispute path resolve many of them. If the bank denies, ask for the denial in writing — that's required under Reg E §1005.11.

FAQ

What if the bank denies my dispute?

Ask for the denial in writing under Regulation E §1005.11(d) — the bank is required to provide the documentation that supports the denial. Review the merchant's evidence; if it's weak, file an appeal with the same bank citing specific holes. If the bank still denies, file a CFPB complaint at consumerfinance.gov/complaint — that often gets the bank to reopen.

Should I use credit or debit for online purchases?

Credit, when possible. The Fair Credit Billing Act caps liability at $50 for credit cards regardless of timing. Debit cards have stricter timing requirements and unlimited liability after 60 days. Credit also separates the dispute from your immediate cash.

How long does the bank's investigation take?

Under Regulation E for debit cards, the bank has 10 business days to complete the investigation, extended to 45 days for accounts open less than 30 days. For credit cards under FCBA, the bank has 30 days to acknowledge and 90 days to resolve. Provisional credit posts during the investigation in most cases.

What if my dispute is for a recurring charge that was once authorized?

That's a different case — usually a "cancelled recurring" dispute, not fraud. Cancel the recurring through the merchant first, then dispute the cycles billed after cancellation. See the forgotten-subscription guide for the right procedure.

More on fraud and unauthorized charges: full card-fraud playbook · decode an unrecognized charge first · chargeback walkthrough · file a CFPB complaint · look up an unknown merchant · start a guided dispute