What happens when you report an unauthorized payment

When you report an unauthorized payment to your bank, the bank opens a dispute investigation. The bank does not assume you are right or wrong—it treats the transaction as contested and begins gathering evidence from both sides. Your bank will contact the merchant, pull transaction records, and review your account activity for patterns. The investigation typically takes 10 business days, though complex cases can stretch to 45 days. During this time, your bank may provisionally credit your account while the investigation runs, but that credit is not final.

The bank's job is to determine whether the charge was truly unauthorized or whether you authorized it, even if you do not remember doing so. This matters because the outcome determines who bears the loss: you, the bank, or the merchant.

Key Takeaways

  • Report unauthorized payments to your bank within 60 days of the statement date to preserve your legal protections under federal law.
  • The bank investigates by requesting transaction logs from the merchant, reviewing your account for similar charges, and checking whether your card details were used elsewhere.
  • Your bank may provisionally credit your account during the investigation, but you are not protected from the charge until the investigation closes in your favor.
  • If the bank rules against you, you can dispute that decision by submitting new evidence or requesting escalation to the bank's compliance department.

The steps a bank takes to investigate

The bank starts by pulling your account history and the specific transaction in question. It looks at the merchant's name, the amount, the date, and the location where the charge posted. If you reported the charge as unauthorized, the bank notes the date you reported it and checks whether you reported other charges around the same time.

Next, the bank contacts the merchant or the merchant's processor. It requests the authorization record—the data the merchant collected when the charge went through. This record shows whether the merchant received your full card number, your CVV, your billing address, or other identifying information. It also shows the IP address or device used to make the purchase, the time of day, and whether the transaction was flagged as high-risk by the merchant's fraud detection system.

The bank compares this merchant data to your normal account behavior. If you live in Ohio and the charge came from a retailer in California at 3 a.m., the bank notes the geographic and temporal mismatch. If you have never shopped at that merchant before, that is noted. If the charge is for an amount you typically spend, or wildly different, the bank records that too.

How the bank determines if you authorized the payment

Authorization is not always obvious. You authorized a payment if you gave your card number, your digital wallet credentials, or permission to charge your account. But authorization can be indirect: if you set up a subscription and forgot about it, you authorized the initial charge even if you do not remember it. If you gave your card to a family member or employee, you authorized charges they made with it.

The bank looks for evidence of authorization. Did the merchant receive your correct billing address? Did the charge go to a delivery address you have used before? Was the transaction made from a device or IP address associated with your account? Did you make similar purchases from this merchant in the past? If the answer to most of these is yes, the bank will likely conclude you authorized the charge.

The bank also checks whether your card was physically present. If the merchant's record shows the card was swiped or inserted in person, and you report the charge as unauthorized, the bank will ask you whether your physical card was lost or stolen. If your card was in your possession, the bank may conclude you authorized the charge or that someone you know made it.

What happens if your card number was stolen

If multiple unauthorized charges appear on your account from different merchants, the bank investigates whether your card number was compromised. The bank checks the dates of the charges to see if they cluster around a specific event—a data breach at a retailer, a skimming device at an ATM, or a phishing email you may have responded to.

The bank may order a new card and close the old one to prevent further charges. It will also flag your account for fraud monitoring, which means the bank's system will watch for suspicious activity going forward. If the bank determines that a merchant's system was breached and your card was stolen from that breach, the bank may rule in your favor on all charges from that incident, even if some are still pending investigation.

If you believe your card number was stolen but cannot identify where, tell your bank immediately. The bank can review your recent transactions and help you pinpoint the likely source. The sooner you report it, the sooner the bank can prevent new charges.

Provisional credits and when they end

Many banks provisionally credit your account within one to three business days of your dispute report. This credit is temporary—it is not a final decision. The provisional credit is meant to give you access to your money while the investigation runs, but if the bank later determines you authorized the charge, the bank will remove the credit and you will owe the amount again.

The provisional credit stays in your account until the investigation closes. If the bank rules in your favor, the provisional credit becomes permanent and the charge is removed. If the bank rules against you, the bank removes the provisional credit and the original charge reappears on your account. You will receive written notice of the bank's decision, usually by mail or through your online banking portal.

What to do if the bank rules against you

If the bank concludes you authorized the charge or cannot find evidence of fraud, the bank will deny your dispute. You will receive a letter explaining the decision. Read it carefully—the bank must explain which evidence led to its conclusion.

You have the right to dispute the bank's decision. Gather any new evidence: emails showing you did not authorize the charge, proof that your card was stolen, statements from witnesses, or documentation that the merchant's system was breached. Send this evidence to your bank's dispute department in writing, along with a letter restating your claim. Include the transaction number, the date, and the amount.

If the bank denies your second dispute, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) or your state's banking regulator. The CFPB accepts complaints online at consumerfinance.gov. Your state banking regulator's contact information is available through your state's attorney general's office. These agencies can review the bank's investigation and force the bank to reconsider if it made an error.

Your legal protections and time limits

Federal law limits your liability for unauthorized charges. If you report an unauthorized charge within 60 days of the statement date on which it appears, your liability is capped at $50. If you report it after 60 days, you may be liable for the full amount. Some banks waive the $50 liability entirely, but you are not required to pay more than $50 if you report within the window.

The 60-day clock starts from the date your bank mailed or made available your statement, not from the date the charge posted to your account. Check your statements regularly—the sooner you report, the sooner the investigation begins and the sooner you may receive a provisional credit.

If the unauthorized charge is on a credit card, your protections are stronger. Credit card issuers must investigate disputes and typically have stricter fraud standards than debit card issuers. If the charge is on a debit card, the investigation may take longer and your protections depend more on your bank's fraud policies.

Frequently Asked Questions

How long does a bank investigation take?

Most investigations close within 10 business days. Complex cases, especially those involving multiple merchants or international transactions, can take up to 45 days. The bank must notify you of its decision in writing within this timeframe. If the bank needs more time, it will tell you and explain why.

Can I get my money back before the investigation ends?

Yes, through a provisional credit. Most banks credit your account within one to three business days of your dispute report. This credit is temporary and will be removed if the bank rules against you, but it gives you access to your money during the investigation.

What if the merchant says I authorized the charge?

The bank will weigh the merchant's evidence against yours. If the merchant's records show your correct billing address, your card was present, or the transaction came from your usual device, the bank may side with the merchant. If you have evidence you did not authorize it—such as proof you were out of the country—submit that to your bank in writing.

Do I have to pay the charge while the investigation is happening?

No. If you reported the charge as unauthorized, you should not pay it. If the bank issued a provisional credit, you do not owe anything during the investigation. If the bank did not issue a provisional credit, contact your bank and ask why—you may be may have access to to one.

What if my bank closes my dispute without investigating?

Contact your bank's compliance or dispute department in writing and ask why the dispute was closed. If the bank did not follow proper investigation steps, file a complaint with the CFPB or your state banking regulator. These agencies can force the bank to reopen the investigation.