What payment fraud is and why it matters to you
Payment fraud is when someone uses your bank account, debit card, credit card, or payment app without your permission to move money or make purchases. It happens in two main ways: someone steals your card details or account information and uses them directly, or they trick you into sending money to them by pretending to be someone else. The money leaves your account the same way legitimate payments do — through the payment system — but you never authorized it.
Fraud matters because the money is gone from your account when ready, and getting it back takes time. Your bank has legal obligations to refund certain types of fraud, but you have to report it first and prove you didn't authorize the transaction. Until the bank investigates and refunds you, that money is not available to pay your bills or buy what you need.
Key Takeaways
- Report fraud to your bank or card issuer within 24 hours of discovering it — the faster you report, the faster the investigation starts and the more protection you have under federal law.
- Unauthorized transactions made with your debit card are refunded within one to three business days if reported quickly, but can take longer if you wait.
- Credit card fraud is usually easier to dispute because you are not spending your own money while the investigation happens — the card issuer covers the charge.
- Scams where you send money willingly to a fraudster are harder to recover from because you authorized the payment, even though you were deceived.
- Freezing your credit with the three major bureaus stops new accounts from being opened in your name, which is the fastest way to prevent identity theft from spreading.
The difference between card fraud and account takeover
Card fraud means someone has your card number or card details but not your account login. They use the card to make purchases or withdraw cash, and the charges show up on your statement. You still control your account and can see what happened. Your bank can dispute those individual charges and refund them.
Account takeover is more serious: someone has your username and password and has logged into your actual bank account. They can change your contact information, set up new payment methods, transfer money out, or lock you out of your own account. You may not notice until you try to log in or see a large transfer you did not make. Account takeover requires you to regain control of your account first — changing your password, updating your contact details, and sometimes proving your identity to the bank — before the bank can investigate the fraud.
Both types are refundable under federal law, but account takeover takes longer to resolve because the bank has to make sure you are actually you before they give you access back.
How to report fraud to your bank when ready
Call your bank's fraud line as soon as you notice an unauthorized transaction. The phone number is on the back of your card or in your online banking app. Do not use a number from a search result or email — scammers sometimes send fake fraud alerts with fake phone numbers. When you call, tell the representative the transaction date, the amount, and the merchant name. They will ask if you recognize it. Say no.
The bank will ask you to confirm recent legitimate transactions to prove you are the account holder. They may ask where you were when the fraudulent transaction happened, whether your card was ever out of your sight, or whether you have shared your PIN with anyone. Answer honestly — they are not accusing you, they are documenting the claim.
Ask the representative three things before you hang up: (1) whether they are issuing you a new card and when it will arrive, (2) whether they are refunding the fraudulent amount and when, and (3) what to do if more fraudulent charges appear while the investigation is ongoing. Write down the date, time, representative name, and confirmation number they give you.
What happens during the bank's investigation
After you report fraud, your bank has a legal important date to investigate. For debit card fraud, they must refund you within one to three business days if you reported it within two business days of discovering it. If you wait longer to report, the timeline extends to up to ten business days. For credit cards, the card issuer typically refunds the charge within two billing cycles while they investigate, and you do not have to pay that charge while they look into it.
During the investigation, the bank contacts the merchant where the fraudulent charge occurred and asks whether the transaction was legitimate. The merchant checks their records — the IP address the order came from, the shipping address, whether the card was present in person, and so on. If the merchant confirms the transaction was fraudulent, the bank refunds you. If the merchant says the transaction looks legitimate on their end, the investigation takes longer and may require you to provide additional proof that you did not make the purchase.
While the investigation is happening, your bank may temporarily refund the amount so you have access to your money. This is not the final resolution — it is a provisional credit. If the investigation concludes the transaction was actually legitimate, the bank can take the provisional credit back. This is rare, but it happens.
Scams where you send money yourself are harder to recover
If a scammer tricked you into sending money to them — through a wire transfer, a payment app, or a check — the situation is different. You authorized the payment, even though you were deceived about who you were sending it to or what it was for. Your bank cannot straightforward reverse it the way they can reverse a fraudulent card charge, because from the bank's perspective, you told them to send the money.
You can still report it as fraud and ask your bank to try to recover the money, but the process is slower. The bank will contact the receiving bank and ask them to freeze the account where the money landed. If the money is still there and has not been moved again, the receiving bank may be able to hold it. But if the scammer has already withdrawn the cash or transferred it elsewhere, recovery becomes much harder.
Wire transfers and peer-to-peer payment apps (like Venmo or Cash App) are especially difficult to reverse because they are designed to be fast and final. Before you send money through these methods, verify the recipient's identity through a separate channel — call them on a phone number you know is theirs, or ask them to confirm in person. If someone is pressuring you to send money quickly, that is a warning sign.
Protecting yourself after fraud happens
After you report fraud, take three steps to prevent it from spreading. First, change your password for your bank account and any other accounts that use the same password. Make the new password unique and at least 12 characters long. Second, check your credit report for accounts you did not open. You can view your credit report for free once per year at annualcreditreport.com. Third, consider placing a credit freeze with Equifax, Experian, and TransUnion — the three major credit bureaus. A freeze stops new accounts from being opened in your name without your permission.
If your Social Security number was compromised, you may also want to place a fraud alert with the credit bureaus. A fraud alert tells lenders to contact you before opening new accounts in your name. It lasts one year and is free to place.
Monitor your bank and credit card statements regularly after fraud occurs. Set up account alerts through your bank's app so you get notified of large transactions or withdrawals. Many banks let you set a threshold — for example, alert me if any transaction over $100 happens. These alerts catch fraud faster than waiting for your monthly statement.
What to do if your account is taken over
If someone has logged into your account and changed your password or contact information, you may not be able to log in yourself. Call your bank's customer service line when ready — use the number on your card or a statement, not a number from an email. Tell them you cannot access your account and suspect fraud. They will verify your identity using information only you would know — your Social Security number, your mother's maiden name, or recent transactions.
Once the bank confirms you are the real account holder, they will reset your password and lock out the fraudster. They may also temporarily freeze your account to prevent further unauthorized transfers while they investigate. Ask them to review all recent activity and flag any transfers or changes you did not make. Some banks will reverse unauthorized transfers when ready; others wait for the investigation to conclude.
After your account is secured, change your password again and enable two-factor authentication if your bank offers it. Two-factor authentication requires a second form of verification — usually a code sent to your phone — before anyone can log in, even if they have your password.
Frequently Asked Questions
How long does it take to get my money back after I report fraud?
Debit card fraud refunds within one to three business days if you report within two days of discovering it. Credit card fraud refunds within two billing cycles. Account takeover and wire transfer scams can take two to four weeks or longer because the bank has to investigate and sometimes contact other banks. The faster you report, the faster the process starts.
What if the bank says the fraud was my fault?
Banks sometimes deny fraud claims if they believe you were negligent — for example, if you wrote your PIN on your card or shared your password. You can dispute the denial by writing to the bank's fraud department and explaining why you believe the transaction was unauthorized. If the bank still refuses, you can file a complaint with the Consumer Financial Protection Bureau, which investigates disputes between consumers and banks.
Can I be held responsible for fraudulent charges on my credit card?
No. Federal law limits your liability for unauthorized credit card charges to $50, and most card issuers waive even that if you report the fraud. Debit card liability is higher if you wait to report — up to $500 if you report more than 60 days after your statement — which is why reporting quickly matters more for debit cards.
What if I gave my card information to a website and it was stolen from there?
Report the fraud to your card issuer the same way you would for any other unauthorized charge. The card issuer refunds you regardless of how the fraudster got your information. You can also report the website to the Federal Trade Commission at reportfraud.ftc.gov so they can investigate whether the site had inadequate security.
Should I close my account after fraud?
Not when ready. Closing the account before the investigation is complete can slow down the refund process. Wait until the bank confirms the refund and you have received your new card. Then you can close the old account if you want to. Closing an old account does not hurt your credit score the way closing a credit card does.