How Does Credit Card Fraud Investigation Work: Deadlines, Liability

A credit card fraud investigation begins the moment you tell your issuer about an unauthorized charge: the bank cancels the card, usually posts a provisional credit within a few business days, and opens an internal review that compares the disputed transaction against your spending patterns and digital fingerprints. If the review confirms fraud, the issuer pushes a chargeback through the card network to the merchant’s bank, which pulls the money from the merchant. The whole thing can wrap up in a couple of weeks or stretch to 90 days, and federal rules set hard deadlines on both sides.

The catch is that your protections aren’t automatic. Some of them only lock in when you follow the phone call with a written notice inside a 60-day window. Miss that step and you can lose the right to dispute the charge no matter how obvious the fraud looks.

What Happens Right After You Report the Charge

Call the number on the back of your card as soon as you spot the charge. Your federal liability only covers unauthorized transactions that happen before you notify the issuer, so the sooner you call, the smaller the potential exposure.¹ The issuer will typically cancel the compromised card, order a replacement, and open a claim. Get the claim number, the representative’s name, and the date and time of the call in writing somewhere. That record matters if the dispute drags out.

Most issuers post a provisional credit to your account within a few business days. It restores your available balance and stops interest from accruing on the disputed amount while the investigation runs. The credit is temporary and can be reversed if the bank decides against you, but in practice it means you’re not paying for the fraud while the bank works.

Behind the scenes, the fraud team compares the flagged charges against your usual patterns. A gas station purchase two states away at the same time your other transactions place you at home is a strong signal. Investigators also pull digital markers: the IP address for online purchases, device fingerprinting, and whether the transaction passed address verification or the card security code check.

Not every disputed charge counts as unauthorized under the legal definition. If a family member had prior permission to use the card and went beyond what you intended, that’s not “unauthorized” for federal purposes, which requires that the person had no actual, implied, or apparent authority and that you received no benefit from the transaction.² Cases like that get denied, and the provisional credit gets reversed.

Why the Written Notice Matters

The phone call limits your liability. A separate written notice triggers a stronger set of protections under the federal billing error rules, and you have 60 days from the date your issuer sends the statement containing the fraudulent charge to submit it.³ Miss the window and you can lose the right to dispute the charge entirely.

The notice needs your name, your account number, the amount you believe is wrong, and a brief explanation of why. Send it to the billing inquiries address on your statement, not the payment address. Some issuers accept electronic submissions through their dispute portal, but only if they’ve said so in their billing rights disclosure.³ When in doubt, send a letter by certified mail so you have proof it arrived.

Treat the phone call and the written notice as two separate requirements. Under federal law, they are.

The Deadlines the Bank Has to Meet

Once your written notice arrives, two clocks start. The issuer must acknowledge the dispute within 30 days, and must complete its investigation within two full billing cycles, never more than 90 days total.⁴ These aren’t guidelines. Banks that blow past them can forfeit the right to collect the disputed amount.

While the investigation is open, you have real leverage. You don’t have to pay the disputed amount or any related finance charges. If you have autopay running, the issuer can’t pull the disputed amount as long as your notice arrived at least three business days before the scheduled payment.⁴

The issuer also cannot report the disputed amount as delinquent to credit bureaus, cannot threaten to do so, and cannot close your account or accelerate your debt because you disputed the charge. It can note on the statement that the amount is disputed and deduct it from your available credit, but it can’t treat you as past due. Before denying your claim, the issuer must have conducted a reasonable investigation.⁴

What You Actually Owe

Federal law caps your liability for unauthorized credit card charges at $50, and only for charges made before you notified the issuer.¹ The cap only applies if the issuer notified you of the limit, gave you a way to report loss or theft, and had a way to identify authorized users. Every major issuer meets those conditions, so $50 is the federal floor.

If someone stole your card number without taking the physical card, your liability drops to zero under federal rules because no card was presented for identification.²

Visa and Mastercard both go beyond the federal floor with zero-liability policies covering in-store, online, phone, and mobile transactions, provided you used reasonable care and reported the problem promptly.⁵⁶ For a typical consumer card and a confirmed unauthorized charge, you pay nothing.

The Chargeback Stage

If the bank confirms fraud, it initiates a chargeback to pull the funds back from the merchant’s side. The issuing bank sends the dispute through the card network to the merchant’s bank, called the acquiring bank. The acquiring bank debits the merchant’s account and notifies the merchant of the dispute.

The merchant can push back through representment, submitting evidence that the transaction was legitimate: proof of delivery, address verification match, correct card security code. Under Visa’s rules, the merchant generally has 30 days to respond. If the merchant doesn’t respond or the issuing bank finds the evidence unconvincing, the chargeback stands and you keep the credit. Visa’s data indicates most fraud-related disputes resolve within about 31 days.⁷ Either side can escalate to network arbitration if they still disagree, but consumer fraud cases rarely reach that stage.

Debit Cards Are Not the Same

The protections above are for credit cards. Debit card fraud runs under the Electronic Fund Transfer Act, with far less generous rules, and your liability depends on how fast you report:

Within 2 business days of learning of the theft: liability capped at $50.
After 2 business days but within 60 days of your statement: up to $500.
After 60 days from the statement date: potentially the entire amount of unauthorized transfers after that window.⁸

The investigation timeline is different too. For debit disputes, the bank must resolve the issue within 10 business days, or extend to 45 days only if it provisionally credits your account within those first 10.⁹ The practical difference is that debit fraud drains cash you already have. Credit card fraud affects a line of credit you haven’t paid yet.

Do You Need to File a Police Report?

A police report usually isn’t required for the bank to process your dispute, though some issuers ask for one in identity theft cases or when the dollar amounts are large. Federal agencies like the FBI and Secret Service don’t investigate individual stolen card numbers; they focus on large-scale fraud rings using aggregated data from banks and payment networks.

Two federal reporting channels are worth knowing. If the fraud is part of broader identity theft, file at IdentityTheft.gov, which generates a recovery plan with pre-filled letters and checklists.¹⁰ For internet-based credit card fraud, the FBI’s Internet Crime Complaint Center accepts reports with your contact info, the financial loss, and how the fraud occurred.¹¹ Neither filing is a prerequisite for your bank dispute, but both feed the databases law enforcement uses to build cases against organized fraud operations.

Key Deadlines at a Glance

Report the fraud to your issuer as soon as possible. You’re only liable for charges that occur before notification.
Send a written dispute notice within 60 days of the statement containing the fraudulent charge.³
The issuer must acknowledge your dispute within 30 days of receiving your written notice.⁴
The issuer must resolve the investigation within two billing cycles, never more than 90 days.⁴
For debit card fraud, report within 2 business days to keep liability at $50; waiting longer can cost you up to $500 or more.⁸

The 60-day written notice is the deadline that burns people most often. You call the bank on day one, feel like the problem is handled, and then discover months later that you never triggered the full set of federal protections because the letter never went out. Send it.

1
Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
2
eCFR. 12 CFR 1026.12 – Liability of Cardholder for Unauthorized Use
3
Consumer Financial Protection Bureau. 12 CFR 1026.13 – Billing Error Resolution
4
eCFR. 12 CFR 1026.13 – Billing Error Resolution
5
Visa. Visa Zero Liability Policy
6
Mastercard. Zero Liability Protection Policy
7
Visa. Visa Claims Resolution
8
Consumer Financial Protection Bureau. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
9
Consumer Financial Protection Bureau. 12 CFR 1005.11 – Procedures for Resolving Errors
10
Federal Trade Commission. Report Identity Theft
11
Internet Crime Complaint Center. IC3 Complaint Form