Disputing a fraudulent transaction

Every payment channel in U.S. retail banking comes with its own consumer-protection framework, with its own notice deadlines, its own liability caps, and its own resolution timeline. The same dispute — a charge the consumer did not authorize, or a payment to a fraudster — produces very different recovery outcomes depending on the channel through which the payment moved. This article is a practical guide by channel: what the law says, what the consumer must do, and what to expect.

The principal regulatory anchors are the Truth in Lending Act for credit-card disputes, Regulation E for debit-card and ACH disputes, the Uniform Commercial Code Article 4A for wire-transfer disputes (with Regulation E Subpart B for international consumer remittances), and Reg CC plus state UCC Articles 3 and 4 for check disputes. Each framework is described in its own page; this one walks through the practical use of each.

Credit-card disputes (Regulation Z)

The Fair Credit Billing Act amendments to TILA, implemented through Regulation Z, give credit-card holders two principal dispute rights:

Billing-error dispute: For unauthorized charges, incorrect amounts, charges for goods or services not received, and similar errors, the consumer must notify the issuer in writing within 60 days of the statement that contains the error. The issuer must investigate and either correct the error or provide a written explanation within two billing cycles (no more than 90 days). Interest cannot be charged on the disputed amount during the investigation. If the issuer concludes no error occurred, the consumer has a right to be told what evidence the issuer relied on and to dispute the conclusion further.

Claims and defenses against the merchant: Under §170 of TILA, a credit-card holder may assert against the issuer any claim or defense the cardholder has against the merchant, provided the cardholder has made a good-faith attempt to resolve the dispute with the merchant, the transaction was for more than $50, and (technically) occurred within the cardholder's home state or 100 miles of the billing address. The geographic and dollar limits are weakened or eliminated for affiliated transactions and are operationally not enforced by issuers in most cases.

The network-level chargeback machinery (Visa, Mastercard, Discover, American Express) operationalizes these statutory rights through detailed dispute-reason codes and a structured dispute-investigation process. In practice, the chargeback machinery handles the bulk of credit-card disputes, with the underlying TILA rights as the legal backstop.

Practical steps:

1. Call the issuer's dispute number on the back of the card immediately on discovering the unauthorized or disputed charge.
2. Submit a written dispute within 60 days of the statement that first contained the disputed charge, through the issuer's online portal or by certified mail.
3. Keep the original statement, the disputed charge details, and any merchant communications.
4. If the issuer denies the dispute, request the documentation it relied on and consider escalating to the CFPB and the state attorney general.

Debit-card disputes (Regulation E)

For unauthorized debit-card transactions, the framework is Regulation E, described in detail at Regulation E: electronic transfers and fraud. The consumer's liability is capped at $50 if reported within two business days, $500 within 60 days of the statement, unlimited beyond that for subsequent transactions. The bank must investigate within 10 business days or provide provisional credit and extend to 45 days.

The chargeback machinery operates similarly to credit cards, but the underlying statutory framework is narrower. Merchant-dispute claims (wrong item, undelivered goods) are weaker under Reg E than under Reg Z; the network dispute rules provide some recourse but without the §170 statutory backbone.

Practical steps:

1. Notify the bank by phone or online dispute submission immediately upon discovering the unauthorized transaction. The two-business-day clock has begun running on the day the transaction appeared in your account or you otherwise learned of it.
2. Follow up with written notice. The bank may require written confirmation within 10 business days; provide it.
3. Expect provisional credit within 10 business days if the investigation will take longer.
4. Document the unauthorized nature of the transaction: where you were when the disputed transaction occurred, the location of your card, any unusual circumstances. The bank's investigation may include comparing the disputed transaction to your normal pattern.

ACH dispute (Regulation E)

For unauthorized ACH debits from a consumer account, Regulation E applies with the same timeline and liability rules as debit-card transactions: 60 days from the statement to dispute, 10-business-day investigation, provisional credit if extended. The Nacha Operating Rules provide the operational mechanism through which the bank initiates a return to the originating bank, with the unauthorized-debit return code R10 typically used for the consumer-claim case.

Recurring ACH debits (autopay) can be stopped by the consumer through a stop-payment instruction to the bank, with at least three business days' advance notice for the next debit. The right to stop payment is a Regulation E protection independent of the unauthorized-transaction dispute right.

Wire-transfer disputes (UCC Article 4A and Reg E Subpart B)

Wire transfers are largely outside the consumer-protection frameworks that cover other electronic transfers. UCC Article 4A governs wire transfers generally; for international consumer remittances of $15 or more, Regulation E Subpart B (the Remittance Transfer Rule) adds limited consumer rights including pre-transfer disclosures, a 30-minute cancellation window for some transactions, and a 180-day error-resolution claim window.

For a wire that the consumer authorized but that turned out to be fraudulent (a misdirected real-estate closing wire, an invoice-fraud wire, a wire sent to a romance-scam fraudster), recovery is typically not possible through the regulatory framework. The bank executed the customer's instruction; UCC 4A allocates the loss to the sender unless the bank can be shown to have failed to use prescribed security procedures or to have acted with gross negligence. Practical recovery depends on:

• Whether the bank can recall the wire before it has left the receiving account. Speed matters — sometimes minutes.
• Whether the receiving bank can be persuaded to freeze and return the funds. Cooperation varies.
• Whether law enforcement (FBI, state attorney general) can identify and pursue the fraudster. Usually unsuccessful.

Practical steps for a wire-fraud situation:

1. Call the originating bank immediately upon discovering the fraud. Request that the wire be recalled. The window is minutes to hours; act before consulting a lawyer.
2. File a report with the FBI's Internet Crime Complaint Center at ic3.gov. The IC3 process is the principal federal channel for wire-fraud reports and can sometimes coordinate recall efforts.
3. File a local law-enforcement report. The report does not typically lead to recovery but is often a required step for insurance and for civil action.
4. For real-estate closing wire fraud specifically, contact the title company, escrow agent, and any title insurance carrier; some closing-protection coverage may apply.

Check disputes (UCC Articles 3 and 4)

Check fraud is governed primarily by state law under UCC Articles 3 and 4. Two principal claim types:

Forged drawer signature: A check on which the drawer's signature was forged is not properly payable. The drawee bank must recredit the customer's account if the customer notifies promptly. Most account agreements require notification within 30 to 60 days of receiving the statement containing the forged item; failure to notify can shift the loss to the customer.

Forged endorsement: A check that the depositary bank cashed or deposited based on a forged endorsement gives the original payee a breach-of-warranty claim. The bank that made payment without a valid endorsement bears the loss; the consumer's role is to identify the missing or forged endorsement and notify the bank.

Check 21 added a limited "expedited recredit" right for consumers who suffer a loss because of a substitute check. The recredit must be requested within 40 calendar days of the statement first reflecting the substitute check.

Authorized-fraud is mostly outside this framework

None of the frameworks described above covers authorized transactions that the consumer was deceived into making. A debit-card purchase made by the actual cardholder to a fraudulent merchant, a Zelle payment authorized by the actual account-holder to a romance scammer, a wire sent on instructions the consumer was tricked into following — these are all authorized transactions and fall outside Regulation E's unauthorized-transaction framework. The consumer's recourse is typically to the recipient (impossible if the recipient is a sophisticated fraud operation), to any voluntary reimbursement program the bank or wallet operator may offer, and to law enforcement.

The U.K. has adopted a mandatory authorized-push-payment reimbursement framework. The U.S. has not. This is the principal unaddressed gap in U.S. consumer fraud protection. For Zelle-specific fraud, the major Zelle-participating banks have introduced voluntary reimbursement programs of varying scope; verify the bank's current policy if relevant.

Limits and uncertainty

The dispute frameworks described here are stable. The most active areas of regulatory and policy attention are the authorized-fraud gap (likely federal rulemaking in the next several years), CFPB attention to bank handling of debit-card and Zelle disputes (with consent orders against several large banks for inadequate investigations), and the periodic emergence of new fraud patterns that test the existing rules' coverage. The consumer's basic rights in each channel are not changing; the practical mechanics of using them are.