Banks must refund unauthorized transactions, but the timeline and your responsibility depend on how quickly you report it

Yes, your bank will refund an unauthorized transaction—but only if you report it within the window your bank allows. Under federal law, your liability for fraudulent charges depends entirely on when you notice and report the fraud. Report within two business days and you lose at most $50. Report between two and 60 calendar days and you could lose up to $500. Report after 60 days and you may lose everything, though many banks refund anyway as a courtesy.

The refund itself is not automatic. You have to file a dispute, provide evidence the transaction was not yours, and wait while your bank investigates. Most banks complete this within 10 business days for debit cards and 30 to 45 days for credit cards. During that time, the money may be unavailable to you, though many banks restore it temporarily while they investigate.

Key Takeaways

  • Report unauthorized transactions to your bank within two business days to limit your liability to $50; waiting longer increases what you could lose.
  • Your bank will refund the transaction if it confirms fraud, but you must file a dispute and provide evidence the charge was not yours.
  • Debit card disputes usually resolve in 10 business days; credit card disputes typically take 30 to 45 days.
  • If your debit card was compromised, request a new card immediately and monitor your account for additional fraudulent charges.
  • Unauthorized transactions from a stolen card number differ from account takeovers, where someone accesses your login credentials—both are refundable but require different reporting steps.

How to report unauthorized transactions to your bank

Call your bank's fraud line immediately—do not use the number on the back of a card you believe was compromised, because that card may be monitored by the fraudster. Instead, look up the bank's main customer service number on your statement or the bank's official website. Tell them which transaction is unauthorized and provide the date, amount, and merchant name.

Your bank will ask you to confirm your identity and may ask where you were when the transaction occurred and whether you recognize the merchant. Answer honestly. If you were traveling or the merchant is in a location you visited, say so—this helps the bank distinguish between fraud and legitimate charges you may have forgotten.

After the call, follow up in writing. Send an email or letter to your bank's fraud department with the transaction details, the date you reported it by phone, and a statement that the charge is unauthorized. Keep a copy. This creates a paper trail and protects you if the bank later claims you did not report it.

What happens during the investigation

Your bank will contact the merchant and the payment processor to determine whether the transaction was legitimate. They will review the IP address, device information, and location data associated with the charge. If the merchant processed the transaction through a payment processor like Stripe or Square, the bank may request records from that processor as well.

During this time, the bank may temporarily credit your account while the investigation continues. This is not a final refund—if the bank later determines the transaction was legitimate, it will reverse the credit and you will owe the money back. The bank will notify you in writing of the outcome, usually within 10 business days for debit cards and 30 to 45 days for credit cards.

If the bank rules in your favor, the refund is permanent. If it rules against you, you have the right to dispute that decision by requesting a second review, though this is rarely successful.

Debit cards versus credit cards: different timelines and protections

Debit card fraud is treated more urgently because the money is already gone from your account. Federal law requires banks to resolve debit card disputes within 10 business days, though many resolve faster. During those 10 days, your bank should restore the funds temporarily so you can access them.

Credit card fraud moves slower. Credit card companies have up to 45 days to investigate, and they are not required to restore the funds while they investigate. However, most credit card companies do restore the funds within a few days as a courtesy. Your liability is also lower: federal law caps your loss at $50 for credit cards, and many issuers waive that $50 entirely.

If you used a debit card and the fraud was extensive, consider asking your bank to close the account and open a new one. Fraudsters who have your debit card number often have other information too—your PIN, your address, or your Social Security number. A fresh account eliminates the risk that they will make additional charges.

What to do if your bank denies the refund

If your bank rules that the transaction was authorized and refuses to refund it, you have options. First, request a second review in writing, explaining why you believe the charge is fraudulent. Include any evidence: screenshots of your account, statements showing you were elsewhere when the charge occurred, or communications with the merchant showing they refused to cancel the order.

If the bank still refuses, file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB can compel the bank to review the case again. You can also file a complaint with your state's banking regulator, usually the state attorney general's office or a state banking authority.

If the charge was made with a credit card, you can also dispute it through the credit card company's chargeback process, which is separate from the bank's fraud investigation. Contact the credit card issuer directly and request a chargeback. The merchant then has the opportunity to respond, but if the card issuer agrees the charge was unauthorized, you will receive a refund.

Protecting yourself after fraud

Once you have reported the unauthorized transaction, take steps to prevent future fraud. Change your passwords for any accounts that share the same password as your bank account. Check your credit report at annualcreditreport.com for accounts you did not open. If you find fraudulent accounts, place a fraud alert with the three major credit bureaus: Equifax, Experian, and TransUnion.

Monitor your bank and credit card statements weekly for the next three months. Fraudsters often make small test charges first to see if they will go undetected before making larger purchases. Catch these early and report them immediately.

If the fraud involved a stolen card number, your bank will issue a new card with a new number. Activate it as soon as it arrives and update any recurring charges (subscriptions, utilities, insurance) to the new number. Destroy the old card by cutting it in half.

Account takeovers: when someone logs in as you

An account takeover is different from a stolen card number. In a takeover, someone uses your username and password to log into your account and transfer money or make purchases. This is still fraud, and your bank will refund it, but the investigation may take longer because the bank has to determine whether the login was truly unauthorized.

If you suspect an account takeover, change your password immediately from a different device (not the computer or phone you normally use). Then call your bank and report it. The bank will review the login history and IP addresses to confirm the access was unauthorized. If confirmed, the bank will refund any transfers or charges made during the takeover period.

After an account takeover, enable two-factor authentication on your bank account if it is available. This requires you to enter a code sent to your phone or email whenever you log in from a new device, making it much harder for fraudsters to access your account even if they have your password.

Frequently Asked Questions

How long does it take to get my money back?

Debit card disputes usually resolve within 10 business days, though your bank may restore the funds temporarily within a few days. Credit card disputes take 30 to 45 days. If your bank rules in your favor, the refund is permanent. If it rules against you, you can request a second review or file a complaint with the CFPB.

What if I reported the fraud late, after 60 days?

You may lose the entire amount under federal law, but many banks refund late reports anyway as a courtesy. Call your bank and explain the situation. If they refuse, file a complaint with the CFPB or your state banking regulator. Some states have stronger consumer protections than federal law.

Can I dispute a transaction if I authorized it but the merchant never delivered?

That is a billing dispute, not fraud, and it is handled differently. Contact the merchant first and ask for a refund. If they refuse, file a dispute with your bank or credit card company. The bank will contact the merchant and ask for proof of delivery. If the merchant cannot provide it, you will receive a refund.

What if the fraudster used my debit card at an ATM?

ATM withdrawals are treated as unauthorized transactions and are refundable. Report it to your bank immediately. The bank will review the ATM location and camera footage if available. If the withdrawal was not made by you, the bank will refund it within 10 business days.

Do I have to pay the disputed amount while the investigation is happening?

No. Your bank cannot require you to pay a disputed amount while it investigates. If the bank temporarily credits your account, you can use that money. If the bank later rules against you, it will reverse the credit and you will owe the amount back.