What happens when you report an unauthorized payment

When you report an unauthorized payment to your bank, the bank opens an investigation and freezes the disputed amount in your account while they work. They do not when ready return the money—they first gather evidence to determine whether the transaction was genuinely unauthorized or whether you authorized it and later changed your mind. The investigation typically takes 10 business days for debit card disputes and up to 30 calendar days for other payment types, though some banks complete them faster.

The bank's job is to figure out three things: whether you actually made the payment, whether someone else had access to your account or card, and whether the merchant can prove you authorized it. They are not trying to help you win—they are trying to determine what actually happened. Understanding how they investigate makes it clearer what evidence helps your case and what does not.

Key Takeaways

  • Banks investigate by requesting transaction records from the merchant, checking your device and location history, and reviewing whether your PIN or password was used correctly.
  • You must report the unauthorized payment within a specific window—typically 60 days for credit cards and debit cards, though some banks enforce shorter important date.
  • The bank will ask you detailed questions about where you were, what devices you use, and whether anyone else had access to your card or login information.
  • Merchants can often prove you authorized a payment by showing a correct PIN, matching IP address, or a shipping address you have used before, which can end the dispute in their favor.
  • If the bank rules against you, you can escalate to your state's banking regulator or file a complaint with the Consumer Financial Protection Bureau, though reversing the decision is difficult.

The evidence the bank collects during investigation

The bank starts by pulling the full transaction record from the merchant's system. This includes the IP address where the order was placed, the device type (phone, computer, tablet), the timestamp, the shipping address, and whether a PIN or security code was entered correctly. If the IP address matches your home or work network and the device matches one you normally use, that weighs heavily toward the conclusion that you authorized it, even if you claim you did not.

The bank also reviews your account activity around the time of the dispute. They look for patterns: Did you make other purchases that day? Did you log in to your account? Did you change your password recently? They check whether your account shows signs of compromise—multiple failed login attempts, a new device added, a new payee set up. If the unauthorized payment sits alone in a sea of normal activity, it raises questions about your story.

For card-present transactions (swiped or inserted in person), the bank requests the merchant's security footage if available. For online transactions, they ask the merchant whether the shipping address matches addresses on file with you, whether the billing address matches your known address, and whether the payment method matches your usual patterns. A purchase shipped to your home address using your regular card is much harder to dispute than one shipped to an unfamiliar location.

What the bank asks you during the investigation

The bank will contact you—usually by phone, email, or through your online account—and ask you to describe the unauthorized transaction in detail. They want to know: When did you first notice it? What made you realize it was unauthorized? Where were you when it happened? Do you recognize the merchant? Have you ever done business with them before?

They will also ask about your security practices. Did you share your PIN with anyone? Did you write down your password? Did you use the same password on multiple websites? Did you receive a phishing email or text message around that time? Did you click a suspicious link? Have you noticed any other unauthorized activity on your accounts? These questions are not accusations—they are trying to understand whether someone compromised your security or whether you made the transaction yourself.

Be specific in your answers. "I have no idea how this happened" is weaker than "I was at work that day and my card was in my wallet the whole time" or "I have never heard of this merchant and I do not recognize the shipping address." The more details you provide that the bank can verify, the stronger your case becomes.

How merchants defend themselves against your dispute

The merchant has the right to respond to your dispute and provide their own evidence. They will submit proof that you authorized the transaction. For online purchases, this usually means showing that the correct billing address, shipping address, and card security code were entered. If the shipping address matches your known address and the security code was correct, the merchant has strong evidence you authorized it—because that information is not visible on a stolen card.

Merchants also submit proof of delivery. If they can show the package was delivered to your address and signed for, or delivered to an address you have used before, that is evidence you received the goods. They may also show your account history with them—previous purchases, account logins, reviews you posted—to demonstrate you are a repeat customer, not a one-time fraud victim.

For card-not-present transactions, merchants often rely on velocity checks and device fingerprinting. If the transaction came from a device you have used before, from an IP address in your city, and at a time when you were typically online, the merchant can argue the evidence points to you, not a thief.

The timeline and what happens to your money during investigation

For debit card disputes, federal law requires the bank to return your money within 10 business days if they cannot verify the transaction, though they can extend this to 45 days if they need more time to investigate. For credit card disputes, the bank must acknowledge your complaint within 30 days and resolve it within 60 days. During this time, the money is typically held in a dispute account—not in your available balance, but not yet returned to the merchant either.

Some banks will provisionally credit you the disputed amount while they investigate, meaning you can use the money, but they can take it back if the investigation rules against you. Other banks hold the money and do not credit you until the investigation closes. Ask your bank which approach they use when you file the dispute.

The investigation does not always take the full time allowed. If the merchant responds quickly with clear evidence that you authorized the transaction, the bank may close the dispute in 5 to 10 days. If the merchant does not respond or provides weak evidence, the bank may rule in your favor sooner.

What happens if the bank rules against you

If the bank concludes you authorized the transaction or that the merchant has sufficient evidence you did, they will deny your dispute and the money goes back to the merchant. You will receive a written explanation of their decision, which should reference the specific evidence they relied on—the correct PIN, the matching address, the device fingerprint, the delivery confirmation.

At this point, you have limited options. You can contact the merchant directly and try to negotiate a refund, though they have no obligation to give you one. You can ask your bank to escalate the dispute to their dispute resolution department or ombudsman, though this rarely overturns the initial decision. You can file a complaint with your state's banking regulator or with the Consumer Financial Protection Bureau, which will investigate whether the bank followed proper procedures—but this does not automatically reverse the decision.

If you believe the bank made a procedural error—for example, they did not investigate properly or they ignored evidence you provided—the regulator complaint is your path forward. If you straightforward disagree with their conclusion, reversing it is very difficult.

How to strengthen your dispute from the start

When you report the unauthorized payment, provide as much detail as possible when ready. Tell the bank exactly when you discovered it, what you were doing at the time, and why you are certain you did not authorize it. If you have evidence—a receipt showing you were somewhere else, a witness who can confirm your location, a screenshot of a phishing email you received—submit it with your initial report.

Document your security practices. If you have never shared your PIN, never written down your password, and never clicked suspicious links, say so. If you have a strong password and two-factor authentication enabled, mention it. If you noticed the unauthorized transaction quickly and reported it when ready, that matters—it shows you monitor your account carefully.

For online disputes, check your email for any confirmation messages from the merchant. If you did not receive a confirmation email but the transaction went through, that is evidence you did not authorize it. If the shipping address is unfamiliar, take a screenshot. If you have never heard of the merchant, search for them and document what you find.

Keep copies of everything you submit to the bank. Follow up in writing—email is best because it creates a record. Do not rely on phone calls alone, because the bank may not document what you said accurately.

Frequently Asked Questions

How long does a bank investigation actually take?

Debit card disputes must be resolved within 10 business days if the bank cannot verify the transaction, or up to 45 days if they need more time. Credit card disputes have a 60-day window. Many banks finish faster if the evidence is clear, but some take the full time allowed. Ask your bank for a specific timeline when you file.

Can the bank force me to pay back money they provisionally credited?

Yes. If the bank provisionally credits you while investigating and then rules against you, they can debit the money back from your account. This can overdraft you if your balance is low. Some banks will waive overdraft fees in this situation, but you should ask before accepting a provisional credit.

What if I do not remember authorizing the transaction?

Not remembering is not the same as not authorizing. The bank will look at whether the evidence—correct PIN, matching address, familiar device—suggests you did it anyway. If you genuinely cannot recall, tell the bank that, but also explain why you believe it was unauthorized. Vague memory is weaker evidence than a specific reason to believe fraud occurred.

Can I dispute a transaction if I authorized it but changed my mind?

No. Disputes are for unauthorized transactions only. If you authorized a purchase and now regret it, you need to contact the merchant and request a refund. The bank will not help you reverse a transaction you actually made, even if you are unhappy with it.

What should I do if the bank investigates but I think they got it wrong?

Request a written explanation of their decision and the evidence they relied on. If you believe they made an error or ignored evidence you provided, file a complaint with your state's banking regulator or the Consumer Financial Protection Bureau. These agencies can investigate whether the bank followed proper procedures, though they cannot force a reversal if the bank's conclusion was reasonable.