An unauthorized charge means you did not approve the transaction—stolen card number, account takeover, or a merchant that ran a card you never used. A billing error can include wrong amounts, charges for goods you never received, or accounting mistakes on a card you did use. Both can be disputed, but the first 48 hours and the paperwork differ.
For merchant fights on cards you intentionally used (wrong size shipped, canceled sub still billing), start with Disputing a credit card charge. For phishing that led to the charge, pair this guide with How to spot phishing and account takeover.
Wallet taps after a stranger enrolled your card in Apple Pay or Google Pay: Fake Apple Pay or Google Pay scams.
If the number was copied at an ATM or pump, also harden habits in Skimming and card cloning. Do not confuse a normal pending preauthorization hold (hotel, gas, rental) with a posted unauthorized charge. If the card went missing with a wallet, run the full cancel-and-freeze sequence in Stolen wallet financial checklist.
Unauthorized vs billing error
| Situation | Usually treated as | First moves |
|---|---|---|
| Card number stolen; charge you do not recognize | Unauthorized / fraud | Freeze card in issuer app; call fraud line on the back of the card |
| Someone used your login after a phishing link | Unauthorized + account takeover | Change passwords; call issuer; review phishing / ATO |
| You bought an item; amount is wrong or never arrived | Billing error (FCBA-style) | Contact merchant, then written billing-error dispute |
| Family member used a card you shared informally | Often messy—issuer may still investigate | Document; consider authorized-user rules going forward |
| Travel hold or foreign-transaction fee you forgot | Often legitimate; confirm MCC and FX fee | Check travel alerts; see Travel card safety |
Credit cards generally fall under the Fair Credit Billing Act (FCBA) framework for many billing errors; unauthorized use also has liability caps when you report promptly. Debit cards more often follow Regulation E / unauthorized EFT rules with different timelines. Always use the issuer’s official dispute path.
First 48 hours
- Lock or freeze the card in the Chase, Bank of America, Capital One, Citi, American Express, or credit-union app—whatever issued it.
- Call the number on the card or statement, not a number in a text. Say you are reporting unauthorized charges.
- Ask for a replacement card and whether provisional credit applies.
- List every bad charge with dates and amounts; screenshot the app.
- Change passwords on email and the issuer login if phishing is possible; enable MFA.
- Check other cards and bank accounts the same day.
- Consider a fraud alert or freeze at Equifax, Experian, and TransUnion (Credit freezes and fraud alerts).
Pay undisputed balances by the due date so you do not create a separate delinquency problem while fraud is investigated.
Worked example
Maya sees a $487.19 charge from an online electronics store she has never used, plus two $1.00 “verification” charges from the same week. She did not share the card. In the Capital One app she locks the card, calls the fraud line printed on the card, and files unauthorized-use claims on all three charges. The bank ships a new card and notes provisional credit timing.
Separately, Maya has a $62 charge from a merchant she did order from—item never arrived. That one is a billing error path: she emails the merchant with tracking proof, then follows the written dispute steps in Disputing a credit card charge if the merchant fails. Mixing both issues on one angry call without distinguishing fraud vs non-delivery slows both cases.
Scam add-ons to ignore
- Anyone calling you to “verify” the fraud who asks for the full card number, one-time passcode, or remote desktop access
- Advance-fee “dispute helpers” that want a wire or gift cards (Credit and debt scams)
- Fake bank apps or phishing pages after you search “dispute charge” under stress
If identity theft spreads beyond one card, use How to rebuild after identity theft and report at IdentityTheft.gov / FTC.
Credit vs debit quick cues
- Credit: Dispute early; watch the statement closing date and written-window rules your issuer cites.
- Debit: Report unauthorized EFTs quickly; Reg E timing can be stricter—do not wait for the monthly PDF if the app already shows the hit. Written Reg E error notices: Bank errors within Regulation E.
- ACH bank pull (not card rail): Use the bank Reg E path in How to handle an unauthorized ACH debit.
- BNPL / store plans: Use that company’s dispute flow and watch late fees during the fight (Buy now, pay later risks).
Merchant billing errors and network chargeback clocks (not only stolen-card fraud): Credit card chargeback timeline.
Checklist
- Lock the card; call the issuer fraud line from the card or official site.
- Separate unauthorized charges from merchant billing errors on your notes.
- Request replacement card and written confirmation of the claim numbers.
- Change email and banking passwords if phishing is possible.
- Pay every undisputed amount on time.
- Calendar follow-up; keep screenshots and letters.
- Freeze credit and review all bureau reports if the pattern looks like ID theft.
Educational only. Not legal advice, credit advice, or an offer of credit. FCBA, Reg E, and network rules have details and exceptions; confirm with your issuer and CFPB resources for your situation.