Finding a strange debit card charge or a payment app transfer you never approved can feel surreal. One minute your account looks normal, and the next you are trying to piece together where the money went, who moved it, and whether your bank or app is going to help. The good news is that federal law gives consumers important protections for many unauthorized electronic transfers, including certain debit card transactions and some peer-to-peer payment app activity linked to a bank account.
In this post you’ll learn how to dispute an unauthorized transfer step by step, what the deadlines often look like, what evidence tends to help, and when a reimbursement problem may start to look more like a legal dispute than a customer-service issue. If you want a broader overview of the rules behind these claims, this guide on how debit card and payment app disputes usually work gives helpful background before you dive into the actual dispute process.
<aside> 💡 Scroll to the bottom for every post in this series.
</aside>
Debit card fraud and payment app fraud are not always handled the same way, and that is where many consumers get tripped up. In broad terms, the legal framework often depends on how the transfer happened, whether it was truly unauthorized, which company held the account, and how quickly notice was given.
The federal rule that often matters most is Regulation E, which implements the Electronic Fund Transfer Act. The Consumer Financial Protection Bureau explains that Regulation E covers unauthorized electronic fund transfers and error resolution procedures for many consumer accounts. The CFPB has also clarified that a credit-push peer-to-peer payment can qualify as an electronic fund transfer, and that scams involving a fraudster tricking a consumer into sharing login credentials or one-time passcodes can still involve an unauthorized EFT under the rule if the transfer was initiated by someone other than the consumer without actual authority. CFPB Regulation E overview and CFPB Electronic Fund Transfers FAQs.
That distinction matters because companies sometimes frame these situations as “you participated in the transfer,” while consumers often view them as fraud. An attorney may help evaluate whether the facts fit the legal definition of an unauthorized transfer, especially where social engineering, account takeover, SIM swap fraud, or stolen credentials are involved.
Before filing anything, it helps to identify the category of transaction. That often shapes the investigation.
If the dispute involves a debit card purchase, ATM withdrawal, or card-not-present transaction, Regulation E protections may apply if the transfer was unauthorized. The CFPB notes that liability for unauthorized transfers can depend heavily on timing. CFPB § 1005.6 and LII 12 CFR § 1005.6.
If the payment app pulled funds from your bank account or debit card, Regulation E may still be relevant. In recent guidance, the CFPB stated that certain peer-to-peer credit-push payments are electronic fund transfers, and that some fraudulent app transactions can qualify as unauthorized EFTs. CFPB FAQs.
This is often the hardest category. Some disputes turn on whether the law treats the transfer as authorized because the consumer technically pressed “send,” or unauthorized because a fraudster gained access or induced the transaction through deception tied to stolen credentials. The exact facts matter. This is one reason these cases often become fact-intensive very quickly.
Speed matters in unauthorized transfer disputes. Under Regulation E, if an unauthorized transfer appears on your statement, reporting within 60 days after the financial institution sends the statement can be critical to limiting liability for later transfers. CFPB § 1005.6 and LII 12 CFR § 1005.6.
There may also be an even shorter timeline in certain lost-or-stolen card situations. Regulation E provides a tiered liability structure that can increase consumer exposure when notice is delayed after learning of a lost or stolen access device. CFPB § 1005.6.
In practical terms, many people start with three quick moves: