What to Do If You Notice an Unauthorized Transaction on Your Bank Account?

Seeing a transaction on your bank account that you do not recognize can be alarming. It could be a legitimate payment you forgot about, a transaction processed under a different merchant name, or an unauthorized withdrawal.

The important thing is to investigate and report a suspicious transaction quickly.

Do not wait several weeks hoping that the transaction will disappear or assuming the bank will automatically detect it. For certain unauthorized electronic fund transfers, federal rules provide important consumer protections, but the timing of your notification can affect your liability.

This guide explains what to check first, how to report an unauthorized transaction, what information to keep, what happens during the bank’s investigation, and what additional steps may be necessary if your account information was compromised.

What Counts as an Unauthorized Transaction?

An unauthorized electronic fund transfer generally involves a transfer from your account initiated by someone other than you, without your actual authority, where you receive no benefit from the transaction.

Examples can include:

A debit-card purchase you did not make
An ATM withdrawal you did not authorize
An electronic payment you did not initiate
An unauthorized automatic withdrawal
A transfer made using stolen account credentials
Certain unauthorized peer-to-peer payment transactions

However, an unfamiliar transaction is not automatically fraud.

A merchant may appear under a different legal or billing name. A subscription may have renewed. A family member or authorized account user may have made the payment.

Before disputing the transaction, determine whether there is a legitimate explanation.

Step 1: Check the Transaction Details

Start by opening the transaction in your banking app or online account.

Look for:

Merchant or recipient name
Transaction date
Amount
Transaction type
Location, if available
Reference or confirmation number
Pending or completed status

Sometimes the merchant name displayed by a bank differs from the name you recognize.

For example, a transaction might show the name of a payment processor rather than the store where you made the purchase.

Also check whether the transaction is still pending. A pending transaction may change or disappear before it becomes final.

Step 2: Make Sure Someone You Authorized Did Not Make the Transaction

Think about whether another person has legitimate access to the account or payment method.

For example:

A joint account holder
An authorized debit-card user
A spouse or family member
A household member using a shared payment method
A business employee with authorized account access

Under Regulation E, certain transfers made by a person who was given access to an account by the consumer may not meet the legal definition of an “unauthorized EFT” unless the consumer has notified the financial institution that the person’s authority has ended.

If you are unsure whether another person was authorized, explain the circumstances to your bank rather than guessing about the legal classification.

Step 3: Contact Your Bank or Credit Union Quickly

If you determine that the transaction was not authorized, contact your financial institution as soon as possible.

Use an official contact method, such as:

The phone number on the back of your debit card
The bank’s official website or mobile app
A branch of the bank
The institution’s official fraud or security department

Do not use a phone number or link sent to you in a suspicious text message or email.

Tell the bank:

“I found a transaction on my account that I did not authorize and want to report it as an unauthorized transaction.”

Give them the transaction date, amount, and other identifying information.

The CFPB says a bank or credit union generally must begin an investigation after receiving notice of an unauthorized electronic fund transfer.

Step 4: Report the Problem Within the Applicable Time Limit

Timing matters.

For an unauthorized electronic fund transfer appearing on your periodic statement, Regulation E generally requires you to notify the financial institution within 60 days after the statement was sent to avoid potential liability for certain subsequent unauthorized transfers.

There is an even shorter period when your debit card or access device is lost or stolen.

If you report a lost or stolen debit card within two business days after learning about the loss or theft, your liability for unauthorized transfers can generally be limited to the lesser of the unauthorized amount or $50, subject to the regulation’s requirements. Waiting longer can increase potential liability.

Why you should not wait

Even when a legal deadline has not passed, reporting the transaction immediately gives the bank more time to:

Investigate the transaction
Protect the account
Replace a compromised debit card
Change account credentials
Stop additional unauthorized activity where possible

The safest approach is to report suspicious activity as soon as you notice it.

Step 5: Secure Your Account

If someone may have obtained your banking credentials, reporting the individual transaction may not be enough.

Ask your bank what steps it recommends to secure the account.

Depending on the circumstances, you may need to:

Change your online-banking password
Change your PIN
Replace your debit card
Review trusted devices
Remove unfamiliar payment methods
Review linked external accounts
Enable two-factor authentication
Turn on transaction alerts
Update contact information if it was changed without permission

Do not reuse a compromised password on other financial accounts.

If the same password was used elsewhere, change it on those accounts too.

Step 6: Review Recent Transactions

Do not investigate only the transaction you first noticed.

Go through recent account activity and look for other unfamiliar transactions.

Check:

Checking account
Savings account
Debit-card transactions
ATM withdrawals
Electronic transfers
Recurring payments
Online bill payments
Linked accounts

Fraud may involve more than one transaction.

Create a simple record:

Date	Amount	Transaction	Recognize it?	Reported?
Sept. 20	$85.00	Debit-card purchase	No	Yes
Sept. 21	$42.50	Online payment	No	Yes
Sept. 22	$12.00	Subscription	Yes	No

This makes it easier to explain the situation to your bank.

Step 7: Keep Records of Your Dispute

Save documentation from the beginning.

Keep:

Transaction screenshots
Bank statements
Transaction numbers
Emails
Secure messages
Dates and times of phone calls
Names or identification numbers of representatives
Copies of written disputes
Any police or identity-theft reports you make

Write down what the bank tells you.

For example:

September 27: Reported unauthorized $250 electronic transfer.

Bank reference: 123456.

Representative: Customer service department.

Next step: Bank investigation opened.

Keeping this information can be useful if you need to follow up later.

Step 8: Ask the Bank About Its Investigation Process

Once you report the transaction, ask:

Has a formal dispute been opened?
What is the reference number?
Does the bank need anything else from me?
Do I need to provide written confirmation?
When should I expect an update?
Has my card or account access been secured?
Will my account receive temporary credit during the investigation if applicable?

The CFPB explains that a bank generally has 10 business days to investigate an alleged unauthorized electronic fund transfer, although different time periods can apply in certain circumstances. If the bank cannot complete the investigation within the applicable initial period, it generally must provide temporary credit while continuing the investigation, subject to the applicable rules and conditions.

For some situations, the investigation period can be longer, including certain transactions involving foreign countries, recently opened accounts, or point-of-sale debit-card purchases.

Step 9: Understand Temporary Credits

If the bank cannot complete its investigation within the applicable initial period, federal rules generally require temporary credit for the disputed amount, subject to specific conditions and exceptions. The CFPB notes that a bank may require written confirmation when the initial notice was provided by telephone.

This is why you should pay attention if the bank tells you to submit something in writing.

If the bank asks you to confirm the dispute in writing, follow the instructions and keep a copy.

Do not assume that receiving temporary credit means the investigation has permanently decided the transaction was unauthorized.

The bank can remove a temporary credit in certain circumstances after completing its investigation, but it must provide required notice.

Step 10: If Your Debit Card Was Stolen, Replace It

If your physical debit card was lost or stolen, ask the bank to cancel it and issue a replacement.

Don’t continue using a card that may have been compromised.

Also ask whether the bank recommends:

Changing the PIN
Closing the existing card number
Reviewing recurring card payments
Monitoring the replacement card
Updating legitimate subscriptions

If the physical card was stolen, reporting the loss promptly is particularly important because the federal liability rules can depend on how quickly you notify the bank.

Step 11: Check Whether Your Personal Information Was Also Compromised

An unauthorized bank transaction can sometimes be part of a larger identity-theft problem.

Look for signs such as:

Unknown credit accounts
Unfamiliar loan applications
Unexpected bills
Password-reset notifications you did not request
Changes to your account information
Unrecognized financial accounts
Other suspicious transactions

The FTC recommends using IdentityTheft.gov if you believe someone has stolen your personal information. The service provides a recovery plan and guidance for dealing with identity theft.

If the problem extends beyond one bank transaction, dealing with the larger identity-theft issue can be just as important as recovering the money.

Step 12: Consider a Fraud Alert if Identity Theft Is Involved

If you believe your personal information was stolen and could be used to open new credit accounts, consider whether a fraud alert is appropriate.

The FTC explains that a fraud alert can make it harder for someone to open new credit in your name and provides instructions through IdentityTheft.gov.

A fraud alert is different from disputing an unauthorized bank transaction.

You may need to handle both issues separately.

Step 13: Contact the Merchant Only When Appropriate

Sometimes the transaction is genuinely a merchant billing problem rather than an unauthorized bank transfer.

For example, you might recognize the business but believe:

You were charged twice
A subscription continued after cancellation
The amount was incorrect
A refund was promised but not received

In those situations, contacting the merchant may help resolve the billing issue.

However, a bank generally cannot require you to contact a merchant first before initiating an error investigation for an alleged unauthorized electronic fund transfer covered by Regulation E. The CFPB specifically says a financial institution must begin its investigation after receiving notice and cannot delay the investigation while waiting for the consumer to contact the merchant.

This distinction matters.

A merchant dispute and an unauthorized bank transfer are not always the same type of problem.

What If the Bank Says the Transaction Was Authorized?

If the bank determines that the transaction was authorized, ask for an explanation.

You can ask:

What information was used to make the determination?
What evidence supports the decision?
What transaction details were reviewed?
How can I request information used in the investigation?
What is the process for disputing the decision?

The CFPB states that after the bank reports its investigation findings, consumers can request information used by the institution to make its determination, and the bank must provide it promptly.

Keep your records and respond to any follow-up requests from the institution.

What If the Bank Does Not Resolve the Problem?

If you believe your bank or credit union did not properly handle an unauthorized electronic fund transfer dispute, you can ask the institution for its formal complaint or escalation process.

You can also review the CFPB’s consumer resources and complaint process.

Before escalating, gather:

Account statements
Transaction details
Your original dispute
Bank reference number
Dates of communication
Written responses
Supporting documents

A clear timeline makes it easier to explain what happened.

Common Mistakes to Avoid

Waiting to report the transaction

Do not wait until the end of a statement period if you already know a transaction is unauthorized.

Assuming the bank will automatically reverse it

Banks investigate disputed transactions. Reporting the transaction is your responsibility.

Calling a suspicious phone number

Use the contact information on your debit card, official bank website, or official banking app.

Sharing your verification code

A legitimate bank representative should not ask you to disclose a one-time security code to someone who contacted you unexpectedly.

If you receive a suspicious call claiming to be from your bank, hang up and contact the bank using an official number.

Ignoring other suspicious transactions

Review the rest of your recent account activity.

Failing to document your dispute

Keep reference numbers, dates, names, and copies of communications.

Treating every unfamiliar merchant name as fraud

First check whether the transaction could be a legitimate purchase under a different billing name.

How to Reduce the Risk of Unauthorized Transactions

You cannot eliminate every risk, but several habits can make suspicious activity easier to detect.

Turn on transaction alerts

Use alerts for:

Debit-card purchases
Large withdrawals
Transfers
Low balances
Online transactions

Review your account regularly

Don’t wait for a monthly statement.

A quick review every few days can help you spot unusual activity sooner.

Use strong, unique passwords

Don’t reuse your online-banking password on shopping, social-media, or other websites.

Enable multi-factor authentication

If your bank supports multi-factor authentication, consider enabling it.

Protect your debit-card PIN

Don’t write your PIN on the card or store it where someone who steals your wallet can easily find it.

Be cautious with banking links

Instead of clicking a banking link in an unexpected email or text message, open your bank’s official app or manually navigate to its official website.

Keep contact information current

Make sure your bank can reach you through your current phone number and email address so you can receive important account alerts.

A Simple Unauthorized-Transaction Action Plan

If you notice a transaction you did not authorize, use this checklist:

Immediately

Check the transaction details.
Confirm that you did not make or authorize it.
Check for other suspicious transactions.
Contact your bank through an official channel.
Report the transaction.
Ask for a dispute/reference number.
Secure or replace a compromised debit card.
Change compromised passwords or credentials.
Enable account alerts.

After reporting

Keep copies of your statements and communications.
Respond to any written requests from the bank.
Monitor the account for additional activity.
Ask about temporary credit if applicable.
Record the bank’s investigation result.
Take identity-theft steps if your personal information was compromised.

Frequently Asked Questions

How quickly should I report an unauthorized bank transaction?

You should report it as soon as you discover it. For unauthorized electronic fund transfers covered by Regulation E, reporting deadlines can affect your liability. If a lost or stolen debit card is reported within two business days, federal rules generally provide stronger liability protection than if you wait longer. Unauthorized transfers appearing on a periodic statement generally should be reported within 60 days of the statement being sent.

Can the bank require me to contact the merchant first?

For an alleged unauthorized electronic fund transfer covered by Regulation E, the CFPB says the financial institution must begin its investigation after receiving notice and cannot delay the investigation while waiting for you to contact the merchant.

A merchant dispute can still be appropriate for ordinary billing problems, such as a duplicate charge or a refund that was not processed.

Will the bank automatically refund an unauthorized transaction?

Not necessarily immediately. The bank generally investigates the reported error. Depending on the circumstances and applicable rules, temporary credit may be required while the investigation continues.

What if my debit card is still in my possession but someone used the account?

You should still notify the bank immediately. An unauthorized electronic transaction can occur even when the physical debit card has not been lost or stolen, such as when someone obtains account credentials through fraud.

What if I don’t recognize the merchant name?

Check your receipts, subscriptions, recent purchases, and the transaction details first. Some legitimate merchants use a different billing or payment-processor name. If you still cannot identify the transaction, contact your bank.

What should I do if I think my identity was stolen?

Secure the affected accounts, contact the relevant financial institutions, review your credit reports and other financial accounts, and consider reporting the identity theft through IdentityTheft.gov. The FTC provides a personalized recovery plan through that service.

Final Takeaway

An unfamiliar bank transaction should not be ignored.

First, verify the transaction details and make sure it was not a legitimate purchase or a transaction made by someone you authorized. If you determine that the transaction was unauthorized, contact your bank or credit union through an official channel as quickly as possible.

For certain electronic fund transfers, federal law provides consumer protections under Regulation E, but timely notification is important. The rules can differ depending on whether a card was lost or stolen, how the transaction occurred, and when you received the statement showing the transaction.

After reporting the transaction, secure your account, review recent activity, keep detailed records, and monitor for additional signs of fraud.

If the incident appears connected to broader identity theft, take steps to address that problem as well rather than treating the individual transaction in isolation.