Unauthorised charges on your card or bank account

How the law usually works

The legal rules depend on the type of payment and where you live. Credit cards, debit cards, bank transfers, direct debits, and automatic payments can have different protections and deadlines.

A bank or card provider commonly investigates whether the transaction was authorised. It may ask when you noticed it, whether your card or device was lost, whether you shared security details, and whether you received any scam warnings. The provider may give temporary credit while investigating, although this is not universal.

Common issues include:

• Credit-card purchases: You generally dispute the transaction with the card issuer. In many places, your liability is limited if you promptly report a lost or stolen card or an unauthorised transaction.
• Debit-card transactions and cash withdrawals: The account provider may investigate under electronic-payment rules. Your potential loss can increase if you delay reporting the problem or gave away security information.
• Unauthorised bank transfers: A transfer made through online banking, telephone banking, or a payment app may be treated differently from a card payment. Scam payments that you personally approved can have less protection than transactions made entirely without your approval.
• Direct debits: Some systems provide a refund or guarantee for payments collected without proper authority, but the procedure and limits vary.
• Merchant disputes: A transaction may be authorised but still disputed because goods were not delivered, were defective, or were billed incorrectly. That is usually a different process from reporting fraud.

A provider may deny a claim if it concludes that you authorised the payment, acted fraudulently, or failed to protect payment credentials. A disagreement does not automatically mean the provider is correct. You can usually ask for the reasons and use a complaint or financial-ombudsman process.

Common processes

1. Review and identify the transaction. People commonly check the statement, transaction date, amount, merchant name, recurring-payment history, and whether a family member or authorised user made the payment. Merchant names on statements can differ from trading names.

1. Contact the bank or card provider through a trusted channel. People commonly use the number on the card, the provider’s official website, or a branch. They report the transaction as unauthorised and ask what dispute procedure applies. They generally avoid using a telephone number or link supplied in a suspicious message.

1. Secure the account. Common measures include freezing or replacing the card, changing online-banking and email passwords, cancelling digital-wallet access, blocking a compromised direct debit, and asking the provider to monitor or restrict the account. If identity documents or a phone were compromised, people may also contact the relevant identity or mobile provider.

1. Give a clear written dispute. A written message usually identifies each transaction, states that you did not authorise it, explains when you noticed it, and asks for confirmation of the investigation and any temporary credit. Keeping a copy and the case number can help.

1. Continue checking statements. People commonly look for additional charges, new payees, changed contact details, or recurring payments. They may report each new transaction promptly rather than assuming the first report covers everything.

1. Respond to investigation questions. The provider may request a declaration, police or fraud-report number, device information, or details about how the account was used. People commonly answer accurately and keep records of calls, dates, names, and documents sent.

1. Escalate if the response is unsatisfactory. A person may use the provider’s internal complaint process, request a final written response, and then contact the applicable ombudsman, regulator, or consumer-protection agency. Court action is generally a later option and may involve filing fees and evidence requirements.

Deadlines and time limits

Deadlines differ substantially. Typical rules or provider procedures may include:

• Reporting a lost or stolen card or unauthorised electronic transaction within a short period, such as two business days, can affect potential liability in some United States situations.
• Credit-card billing-error disputes in the United States commonly use a written-notice period of about 60 days after the statement was sent.
• Some electronic-transfer rules use longer outside limits, often up to 12 months after a statement, but shorter reporting periods can change the amount you may have to pay.
• In England and Wales, unauthorised-payment claims are commonly expected to be raised without undue delay and generally no later than 13 months after the payment date under the Payment Services Regulations, subject to the detailed rules.
• Canadian and Australian rules often emphasise notifying the institution promptly. Card-network rules, account agreements, and the Australian ePayments Code may provide specific time limits.

These are typical ranges, not a deadline calculation for your situation. Confirm the applicable deadline with the bank, card provider, court, or a licensed attorney where you live.

Documents that usually matter

Useful records commonly include:

• Account or card statements showing the disputed transaction
• Receipts, order confirmations, and merchant correspondence
• The date and method used to report the transaction
• Complaint reference numbers and written responses
• Screenshots of suspicious messages, websites, or payment instructions
• Evidence that you cancelled a card, changed credentials, or blocked an account
• Police, fraud-reporting, or identity-theft report numbers, where relevant
• The account agreement, card terms, direct-debit authority, and privacy or security notices
• Records showing whether you authorised an individual as a joint holder or additional cardholder

People commonly redact unrelated account numbers and sensitive information before sending documents, while leaving enough information for the provider to identify the account.

How it differs by jurisdiction

United States. Credit-card billing errors are generally governed by the Fair Credit Billing Act and related Regulation Z rules. Electronic transfers and many debit-card transactions are generally covered by the Electronic Fund Transfer Act and Regulation E. State law, card-network rules, and the account agreement can add protections. A person may also report identity theft or scams to the Federal Trade Commission or relevant state authorities.

England and Wales. The Payment Services Regulations 2017 contain rules for unauthorised payment transactions, including refund principles and customer responsibilities. Direct debits commonly operate under the Direct Debit Guarantee administered through the banking system. Complaints may proceed to the Financial Ombudsman Service after the firm’s complaint process. Scotland and Northern Ireland share many financial-service rules but have different court systems and some different legal procedures.

Canada. Protections can depend on whether the account is with a federally regulated bank, a credit union, and whether the payment was made by credit card, debit card, pre-authorised debit, or online transfer. The Canadian Code of Practice for Consumer Debit Card Services is important for debit-card practices, while federal and provincial rules may also apply. Provincial complaint and limitation rules can differ.

Australia. The ASIC ePayments Code covers many electronic payments, including unauthorised transactions, and is mandatory for subscribers in its scope. The Banking Code of Practice and account terms may also matter. State and territory laws, including limitation and court rules, can affect a later claim. Disputes commonly go through the provider and then the Australian Financial Complaints Authority.

When people consult a lawyer

Legal advice may be especially useful when:

• The bank says you authorised the transaction or acted fraudulently.
• A large amount is involved, or several accounts were affected.
• The transaction involved a scam, identity theft, coercion, or a joint account.
• The provider has denied the claim or missed its investigation obligations.
• A debt collector, court claim, or credit-report entry is involved.
• The applicable deadline may have expired.
• The bank, merchant, payment app, or insurer gives conflicting explanations.
• You need to pursue a civil claim or respond to one.

For immediate account danger, contact the provider’s fraud department and local emergency or law-enforcement services when appropriate.