What happens when you report a transaction you didn't make
When you report an unauthorized transaction, your bank doesn't when ready refund you and move on. Instead, they open an investigation that typically lasts 10 business days, though it can extend to 45 days depending on the type of transaction and what they find. During this time, the bank contacts the merchant, reviews your account activity, checks security logs, and may ask you for written details about what happened.
The bank's job is to determine whether the transaction was genuinely unauthorized, whether you bear any responsibility for it, and whether they need to involve law enforcement or payment networks like Visa or Mastercard. This process protects both you and the bank — it prevents fraud but also prevents people from falsely claiming legitimate purchases were stolen.
Key Takeaways
- Banks have 10 to 45 business days to investigate, depending on the transaction type and whether it crosses state lines.
- You must report the transaction in writing (not just by phone) within a specific window — usually 60 days for debit cards and longer for credit cards — or you may lose protection.
- The bank will contact the merchant directly and review your account's login history, device information, and spending patterns to determine if the charge was authorized.
- If the bank finds you were negligent — such as sharing your PIN or writing your password down — they may deny your dispute or limit your refund.
- Transactions made with a stolen physical card are investigated differently than online purchases, which are investigated differently than wire transfers.
The first step: your written report
Calling your bank to report fraud is important, but it is not enough. You must also send a written dispute — by email, find message through your online banking portal, or certified mail. The bank needs this in writing because it creates a record with a timestamp, and federal law requires them to have your formal complaint before they can begin the official investigation clock.
When you write your report, include the transaction date, the amount, the merchant name, and a brief description of why you did not authorize it. If you know when you discovered the fraud (for example, you noticed it three days after it posted), include that too. The bank will use this timeline to understand how the fraudster gained access and whether your account showed other signs of compromise around that date.
The important date matters. For debit cards, you typically have 60 days from the statement date to report the fraud. For credit cards, the window is usually 120 days. If you miss the important date, the bank may refuse to investigate at all, and you lose the legal protection that requires them to refund you.
How the bank examines your account and device
Once your written report arrives, the bank's fraud team pulls your account history for the 30 to 90 days before the unauthorized transaction. They are looking for a pattern: Did someone else log in from a new device or location? Did the transaction fit your normal spending habits, or was it wildly different? Did multiple fraudulent charges happen in a short window, suggesting account takeover rather than a single stolen card number?
The bank also reviews the technical details of the transaction itself. For online purchases, they check the IP address (the computer's location), the device fingerprint (a digital signature of your phone or computer), and whether cookies or login tokens were used. If you always shop from home in Chicago and suddenly someone in Nigeria logs in and buys a plane ticket, that mismatch is evidence of fraud. If someone logs in from your home IP address using your saved password, it looks more like an authorized transaction — even if you claim you didn't do it.
For card-present transactions (someone physically swiped or inserted your card), the bank checks whether the card was actually in the merchant's possession. They also look at whether the card had been reported lost or stolen before the transaction, and whether the merchant's location matches where you normally shop.
The bank contacts the merchant and payment network
The bank does not investigate in isolation. They contact the merchant — the store, website, or service that processed the charge — and ask for proof that the transaction was authorized. The merchant provides a record of what was purchased, the shipping address, the billing address, and sometimes a signature or PIN verification.
If the merchant is a large company like Amazon or Target, they have their own fraud detection systems and can tell the bank whether the transaction matched the account's normal behavior. If it was a small online retailer, they may have less detailed records.
The bank also contacts the payment network — Visa, Mastercard, American Express, or Discover — if the transaction crossed state lines or involved a merchant in another country. The payment network has its own fraud data and can tell the bank whether this merchant has a history of disputes or chargebacks.
What the bank looks for to deny your dispute
Banks are required to refund unauthorized transactions, but there are exceptions. If the bank finds evidence that you authorized the transaction — even if you later regret it — they can deny your dispute. This includes situations where you gave someone your card number, PIN, or password, even if you did not intend for them to use it fraudulently.
The bank also looks for negligence on your part. If you wrote your PIN on your card, left your card unattended at a restaurant, or used the same password for your bank account and a website that was later hacked, the bank may argue that you were negligent. Depending on the circumstances and your bank's policies, they may deny the dispute entirely or refund only part of the amount.
If you had already reported the card lost or stolen before the transaction occurred, the bank will almost certainly deny the dispute — you had already notified them that the card was compromised, so any transaction after that point is your responsibility to report when ready.
Timeline and what to expect during the investigation
The investigation clock starts when the bank receives your written report. For most debit card disputes, the bank must complete the investigation within 10 business days and either refund you or explain why they are denying the dispute. However, if the transaction was made at an ATM, involved a wire transfer, or crossed state lines, the bank has up to 45 days.
During the investigation, the bank may place a temporary hold on your account or freeze it entirely if they suspect account takeover. This is to prevent the fraudster from making additional charges while the investigation is underway. You will still have access to your money, but you may not be able to use the card or make transfers.
Once the investigation closes, the bank sends you a written explanation of their findings. If they found the transaction was unauthorized, they refund the amount within one to three business days. If they found you were responsible, they explain why and what evidence led to that decision. You have the right to dispute their decision, though this is rare and usually requires new evidence.
Different types of transactions, different investigations
A fraudulent debit card charge at a gas station is investigated differently than an unauthorized wire transfer or a hacked online account. Card-present fraud (someone physically used your card) is usually straightforward — either the card was stolen or it was not. The merchant has a record of who swiped it, and the bank can check whether the card was reported lost before the transaction.
Card-not-present fraud (online purchases, phone orders, or mail orders) requires more detective work. The bank has to determine whether the fraudster knew your card number, expiration date, and CVV, or whether they gained access to your account itself. If they had your account login credentials, the bank investigates whether you shared your password, whether your email was hacked, or whether you fell for a phishing scam.
Wire transfers and ACH transfers (electronic bank-to-bank transfers) are investigated most strictly because they are harder to reverse. Once the money leaves your bank, it is in another bank's account, and getting it back requires cooperation from that bank and sometimes law enforcement. The investigation focuses on whether you authorized the transfer, even if you were tricked into doing so.
What happens if the bank denies your dispute
If the bank denies your dispute, you can ask them to reconsider. Send a written request explaining why you believe their decision was wrong, and include any new evidence — for example, proof that you were out of the country when the transaction occurred, or documentation that your email was hacked. The bank will review your request, though they are not required to change their decision.
If you still disagree, you can file a complaint with your bank's regulator. For national banks, that is the Office of the Comptroller of the Currency (OCC). For state banks, it is your state's banking regulator. For credit unions, it is the National Credit Union Administration (NCUA). You can also file a complaint with the Consumer Financial Protection Bureau (CFPB), which tracks complaints and can pressure banks to change their practices.
Keep in mind that disputing a denied dispute is a lengthy process and rarely results in the bank reversing their decision unless you have strong new evidence. The best protection is to report fraud as soon as you notice it, keep detailed records of your account activity, and use strong, unique passwords for your bank account.
Frequently Asked Questions
Do I get my money back while the investigation is happening?
For debit cards, federal law requires the bank to refund you temporarily within 10 business days while they investigate, unless they have a good reason to believe the transaction was authorized. For credit cards, you are not responsible for the charge during the investigation, so it does not affect your credit. However, some banks may not refund you when ready if they suspect you authorized the transaction.
What if the fraudster used my card at multiple merchants?
Report all of the fraudulent transactions in a single written dispute. The bank will investigate them together because they likely indicate the same fraud event — either a stolen card or a hacked account. Multiple transactions in a short timeframe actually strengthen your case because it shows a pattern of unauthorized use rather than a single mistake.
Can the bank investigate if I waited two months to report the fraud?
For debit cards, you are within the 60-day window, so yes. For credit cards, you have 120 days, so you are still protected. However, the longer you wait, the harder it is for the bank to investigate because merchants delete transaction records, and the payment network's fraud data becomes less detailed. Report fraud as soon as you notice it.
What if I gave my card to someone and they used it without permission?
This is tricky. If you voluntarily gave someone your physical card or your card number, the bank may argue that you authorized the transaction, even if you did not authorize that specific purchase. However, if you can prove that the person exceeded the scope of what you allowed — for example, you gave them permission to buy groceries but they bought electronics — you may still win the dispute. Document what you authorized and what was actually purchased.
Does the investigation affect my credit score?
No. Disputing a transaction does not appear on your credit report and does not affect your credit score. The bank investigates the dispute separately from your credit history. However, if the bank denies your dispute and you do not pay the charge, that unpaid balance could eventually be reported to credit bureaus.