You find a charge you do not recognize. The first question is who pays. Federal protections for credit card users are real, but how much you owe depends on how the account was compromised and how fast you tell your card issuer. A few early questions sort out most cases.

  1. Decide whether the charge is truly unauthorized or a billing mistake by a merchant you did use.
  2. Work out whether the physical card was lost or stolen, or whether only the account number leaked.
  3. Call your issuer to stop further activity on the account.
  4. Read your cardholder agreement for any zero-liability language and dispute instructions.
Printed monthly credit card statement and a mug on a kitchen table in soft daylight, with a person's hands partly visible at the edge of the frame.
Reading a paper statement line by line is often how an unfamiliar charge first gets noticed.

What counts as an unauthorized charge

Federal guidance draws a line between fraud and ordinary disputes. According to consumer guidance hosted by the Office of the Comptroller of the Currency, an unauthorized charge generally means someone other than the cardholder used the card. That person also had no actual, implied, or apparent authority, and the cardholder got no benefit from the use. Lend your card to a relative who spends more than you agreed, and that charge may not count as unauthorized.

A charge you made yourself but now question follows a different path. If a merchant bills the wrong amount, bills twice, or never delivers what you paid for, the bank's billing error process applies. Your monthly statement describes that process.

Account takeovers add another case. If a thief steals your account number without touching your card, the Consumer Financial Protection Bureau says you generally have no liability for unauthorized use. The card can sit in your wallet the whole time and the fraud can still happen.

How the timing of your report affects what you owe

Speed matters most when a physical card goes missing. The CFPB says that if you report a lost or stolen credit card before anyone uses it, you cannot be held responsible for unauthorized charges. After you report it, the risk of later attempts sits with the issuer.

If a thief uses the card before you report it, the CFPB says the most you will owe for unauthorized charges on that card is $50. That cap holds no matter how much the thief spent. The CFPB page does not reproduce the regulation itself. For the exact legal wording, read 12 CFR 1026.12, the special credit card provisions of Regulation Z.

Many issuers go further than the federal baseline. The CFPB notes that many cardholder agreements say you owe nothing in the lost-card situation. Your agreement is on your card company's website, and the CFPB also keeps a Credit Card Agreement Database. Check yours before you call, so you know what to ask for.

What to do in the first days

Start with the phone. Call the number printed on the back of your card, or the one on your issuer's website, and say a charge is unauthorized. If the card is lost or stolen, say that clearly, because the date of your report is what the liability rules turn on. Write down the date, the time, and the name of the person you spoke with.

Next, ask the issuer to close the compromised account number and send a replacement. Then go through the statement and mark every charge you do not recognize, not just the first one you spotted. A thief who tests a card with a small purchase often follows with larger ones. Keep a copy of the statement as it looks today.

Follow up in writing. The sources reviewed here do not lay out a step-by-step filing process, so use your issuer's instructions for the form and the address. Many people also pull their credit reports after a fraud scare to look for accounts they did not open. That is common practice, though the sources here do not address it directly.

How a billing error dispute works

When the problem is a wrong amount, a missing credit, or goods that never arrived, the billing error rules apply. These sit in 12 CFR Part 1026, known as Regulation Z, which implements the Truth in Lending Act. Section 1026.13 covers billing error resolution.

One third-party glossary describes the timeline this way. You send written notice to the creditor's billing error address within 60 days of the first statement showing the error. The creditor acknowledges within 30 days and resolves the matter within two billing cycles, no more than 90 days. The same glossary says the creditor cannot collect the disputed amount, charge interest on it, or report it as delinquent while the dispute is open. It is not a government source. Treat those deadlines as a starting point and verify them against the regulation text before you rely on them.

Do not wait for day 59. Send the notice as soon as you spot the problem, and keep proof of when you sent it.

What the sources leave open

Some questions have no clear answer in the material reviewed. It does not say whether interest builds up on a charge after an investigation ends, or what happens if the issuer decides you authorized the payment. It also does not cover state laws, which may add protection beyond the federal rules.

Debit cards are outside this article. The sources reviewed here do not address them, so check the rules for your debit card separately. If your issuer is a national bank or federal savings association, the OCC publishes credit card fraud resources worth a read.

This overview is general information. It is not legal or financial advice. For a tangled dispute, contact the CFPB, the Federal Trade Commission, or a qualified attorney.