How Do Banks Investigate Unauthorized Transactions: Timing and Rights

When you report an unauthorized charge, the bank’s fraud team pulls the digital records tied to the transaction, requests data from the merchant’s payment processor, and compares what it finds against your account history. So the short answer to how banks investigate unauthorized transactions is that they build a picture from three sources — your patterns, the transaction’s technical fingerprints, and the merchant’s evidence — and they have to do it inside deadlines set by federal law. For debit cards and other electronic transfers, the Electronic Fund Transfer Act and Regulation E require the bank to resolve the dispute in 10 to 45 business days, with a longer window in a few specific situations.¹

What the Bank Actually Examines

The fraud team starts with the digital footprint of the disputed transaction. For online purchases, investigators look at the IP address used to place the order and compare it against your usual login patterns. For in-person transactions, they review geolocation data from the card terminal to see whether the purchase happened near where you were. Device identifiers — the unique signatures tied to your phone or computer — tell them whether the transaction came from hardware you have used before.

From there, the investigation moves to the merchant’s payment processor, the acquiring bank. Your bank requests transaction-level detail: whether the card’s security code matched at checkout, whether the billing address passed the address verification check, and whether a PIN or signature was captured at the point of sale. A mismatch on any of those points supports the claim that someone else used the card.

That request usually becomes a chargeback claim against the merchant, who then gets a chance to answer with its own evidence. A merchant might submit delivery confirmation showing the package arrived at your address, login records showing you have used the same account before, or a signed receipt. The fraud team weighs the bank’s internal data against what the merchant produces and looks for inconsistencies.

For disputed ATM withdrawals, the bank can also pull security camera footage from the machine. Banks generally retain those recordings for at least six months, so investigators have time to check whether the person at the ATM matches you.

Starting the Dispute

To trigger a formal investigation, you have to give the bank enough to work with. Federal law requires you to provide your name and account number, a description of why you believe an error occurred, and — to the extent you can — the type, date, and amount of the transaction.¹ Pulling this from your monthly statement before you call helps avoid delays.

You can report by phone or in writing. Be aware, though, that many banks will ask you to follow up an oral report with written confirmation within 10 business days. If the bank tells you it requires that written confirmation and you do not send it in time, the bank is not obligated to provisionally credit your account while it investigates.² Ask on the call whether written confirmation is needed, and get the address or portal link before you hang up.

The 60-day clock for reporting starts when the bank sends you the statement that first shows the transaction, not when you open it.¹ Missing that window does not end your right to file a dispute, but it can sharply increase what you personally owe.

Filing a report with local law enforcement and giving your bank a copy can also help.³

Provisional Credit and the Investigation Clock

If the bank cannot finish its investigation within 10 business days, it has to provisionally credit your account for the full disputed amount, including any interest that would have accrued.¹ That temporary deposit lets you keep paying bills while the review continues, which matters most in debit card disputes, where the missing money came straight out of your checking balance.

The credit is conditional. If the bank later decides the transaction was authorized, it can pull the money back. During the extended review, the bank has up to 45 days from the date it received your dispute to reach a final decision. That stretches to 90 days in three situations: the transfer was international, it was a point-of-sale debit card transaction, or the account had been open for 30 days or less.¹

New accounts get one more accommodation. When the disputed transfer occurred within 30 days of your first deposit, the bank has 20 business days instead of 10 to issue the provisional credit.⁴

How the Bank Reports Its Findings

Once the investigation is done, the bank has three business days to report its decision to you.¹ If it confirms an error, it has to fix the problem — crediting your account and reversing any related fees or lost interest — within one business day of that determination.² Any provisional credit becomes permanent at that point.

If the bank decides no error occurred, or that the error was different from what you described, it has to send you a written explanation of its findings. That explanation must describe what the bank relied on and tell you that you can request copies of the documents used in the investigation.¹ Ask for those documents if you plan to push back.

If the Bank Denies Your Claim

When the bank denies a debit card or electronic transfer dispute, it will reverse any provisional credit it issued. Before doing so, it must notify you of the date and dollar amount it is removing.⁴ For five business days after that notice, the bank must honor checks and preauthorized payments from your account without charging overdraft fees.⁵ Use that buffer to move funds in and keep payments from bouncing.

If you think the bank got it wrong, request the investigation documents and review them for factual errors or evidence that was missed. You can then file a complaint with the Consumer Financial Protection Bureau, which forwards it to the bank and requires a response, typically within 15 days, though some cases take up to 60.⁶ If your bank is a national bank or federal savings association, you can also file with the Office of the Comptroller of the Currency, which runs its own appeals process.⁷

How Fast You Report Changes What You Owe

For debit cards and other electronic transfers, federal law ties your maximum out-of-pocket loss to how quickly you tell the bank after you discover the unauthorized activity.

Report within 2 business days of learning about the loss or theft and your liability caps at $50, or the amount of the unauthorized transfers before you notified the bank, whichever is less.⁸
Report after 2 business days but within 60 days of your statement and your liability can rise to $500, covering transfers the bank could have prevented if you had reported sooner.⁸
Wait more than 60 days from your statement and you can face unlimited liability for transfers that occur after that window, if the bank shows it could have stopped them.⁹

These limits apply only when the bank has given you the required disclosures about your rights and a way to identify you as the authorized cardholder.⁹ Without those disclosures, the bank generally cannot hold you liable at all.

Credit Card Charges Follow a Different Law

If the unauthorized charge is on a credit card rather than a debit card, the process above does not govern it. Under the Truth in Lending Act, your liability for unauthorized credit card charges caps at $50 regardless of when you report, and once you notify the issuer, you owe nothing for charges made after that.¹⁰ A credit card issuer must acknowledge your dispute in writing within 30 days of receiving your notice and resolve the investigation within two complete billing cycles, but no longer than 90 days total.¹¹

1
eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
2
GovInfo. 15 USC 1693f – Error Resolution
3
Office of the Comptroller of the Currency. Credit Card and Debit Card Fraud
4
eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
5
Consumer Financial Protection Bureau. 12 CFR 1005.11 – Procedures for Resolving Errors
6
Consumer Financial Protection Bureau. Submit a Complaint
7
Office of the Comptroller of the Currency. File a Complaint
8
Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
9
eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
10
Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
11
Consumer Financial Protection Bureau. 12 CFR 1026.13 – Billing Error Resolution