What to do if…
your bank confirms unauthorised payments but says the investigation will take weeks

What to do now

1. Lock the payment routes that can be reused.

   • Freeze or lock the card in the bank app, or call the official number on your card or statement.
   • Ask for a new card number if card details were exposed, not only a new physical card.
   • Change your online banking password and your email password from a device you trust.
   • Turn on multi-factor authentication and sign out of all other sessions if the account lets you.

2. Get the bank’s record of your report in writing.

   • Ask: “What date and time did you record as my notice of error or fraud report?”
   • Ask: “Which transactions are included in this report?”
   • Ask: “Is this being handled as a debit, ACH, ATM, bank-account, or other electronic fund transfer issue, or as a credit card billing-error issue?”
   • Ask: “Do you require written confirmation of my oral report? If yes, where exactly should I send it, and by what date?”

3. If money left a checking, debit, ATM, ACH, or similar bank account, ask about Regulation E timing.

   • Say: “Please confirm the Regulation E investigation deadline for this report.”
   • Ask whether the bank expects to decide within the initial period, often 10 business days, or 20 business days for some new accounts.
   • If the bank says the investigation may take weeks, ask whether it is using a 45-day or 90-day investigation period, and ask why that longer period applies.
   • If the bank needs longer, ask whether provisional credit applies while it continues the investigation.
   • If they say provisional credit does not apply, ask for the reason in writing, including whether they are waiting for written confirmation from you.

4. If the charge is on a credit card, send the written billing-error notice.

   • Send it to the billing-error or billing-inquiries address shown by the card issuer, usually on the statement or in the billing-rights notice.
   • Make sure the issuer receives it no later than 60 days after the issuer sent the first statement where the disputed charge appeared.
   • Include your name, account identifier, the transaction date and amount, and a plain sentence saying you did not authorize the charge.
   • Keep a copy, screenshot, upload receipt, secure-message confirmation, or mailing proof.

5. Stop repeat drains and linked-payment routes.

   • Ask the bank or card issuer to block the compromised card number and any recurring charges tied to it.
   • Check scheduled bill pay, saved merchants, wallet apps, P2P payment apps, newly added payees, and external linked accounts.
   • Remove anything you do not recognize, or ask the bank to help disable it if you cannot safely remove it yourself.

6. Protect rent, food, utilities, and paychecks first.

   • Tell the bank if the missing funds could cause missed rent, overdrafts, late fees, utilities trouble, or lack of food or medication.
   • Ask whether fraud-related fees can be reversed, whether overdraft effects can be paused, and whether the case can be expedited because essentials are at risk.
   • Move incoming paychecks or benefits only after the bank tells you the safest destination for deposits and credits.

7. Treat possible identity theft as a separate containment task.

   • If personal information may have been used, go to IdentityTheft.gov and follow the recovery steps that fit what happened.
   • Consider a credit freeze with each of the three major credit reporting agencies if you think someone could open accounts in your name.
   • Check recent bank, card, and credit-report activity for new accounts, new addresses, or inquiries you do not recognize.

8. Escalate if the bank will not give clear answers.

   • Ask for the claim number, department name, and the next written update date.
   • Ask for the bank’s final answer or current position in writing if they keep saying only “wait.”
   • File a CFPB complaint if you cannot get a clear written response about timing, provisional credit, or what rules they are applying.