Online banking fraud and charges you did not make
Found a charge you do not recognize, or been caught by online banking fraud? These steps stop the damage, get the dispute filed and, in many cases, get your money back.
- Call your bank and have the account or online access locked (number from the back of your card or the official website).
- Lock the card in your banking app or by phone if the card is involved too.
- Approve no further codes and follow no instructions from anyone who called you.
- Document the charge (screenshot or photo) for the dispute and the report.
First, size it up: what happened?
Online banking fraud comes in several shapes. The common ones:
- Phishing: you entered credentials or a one-time code on a fake bank page.
- A call from “your bank”: someone pressures you to approve a payment “for security” or confirm it in the app.
- A charge you never agreed to: a debit appears that you never authorized.
- Card misuse: payments made with your card – then also see Credit card misused .
The usual trigger is a fake bank message like this one. No real bank asks for your code:
- Pressure and a threat: A supposed account lock creates panic. Your bank does not lock accounts by text message, and it never pushes you to act this way.
- Asking for your code: No bank ever asks for a one-time code, a PIN or a password - through any channel. Anyone who asks is a scammer.
- A domain that is not the bank: "chase-secure-verify.com" does not belong to Chase. Open banking only through the real app or an address you typed yourself.
Step by step
Protect the account and get the money back
- Call the bank immediately and have the account or online access locked.
- Lock the card as well if it is involved.
- Dispute the unauthorized transaction in writing – note the date you reported it.
- Change your online banking password and set up the second factor again.
- Check other accounts where the same details are stored.
- File a police report and report the fraud at IC3.gov – banks often ask for it.
What not to do
- Never give out a one-time code, not even “to cancel a transaction.” Real banks never ask.
- Do not install remote access software (AnyDesk, TeamViewer) because a caller asked you to.
- Do not call back a number from a suspicious message – always the official bank number.
- Do not wait. The dispute deadlines run from the statement date, and your liability grows the longer you leave it.
Who to contact
- Your bank – branch or official hotline – to lock, dispute and report.
- Your card issuer separately if a card is involved.
- Local police for a report; the case number is often needed for the refund.
- IC3.gov (FBI) for online fraud, and IdentityTheft.gov if personal data was taken.
- The CFPB at consumerfinance.gov if the bank refuses to refund you.
Preserve the evidence
Collect everything that documents the fraud: the statement or a screenshot of the transaction, suspicious emails or texts, the fake web address, and the time and number of any call. Note when you reported it to the bank. Those records decide the dispute.
Protecting yourself from now on
- Spot phishing before you enter anything.
- Use a password manager and two-factor authentication for your bank login.
- Turn on push alerts for every transaction, so you see misuse the same day.
Frequently asked questions
How long do I have to dispute an unauthorized charge?
Report it fast – the deadlines are strict. For electronic transfers from a bank account, Regulation E generally gives you 60 days from the statement date, and your liability is far lower if you report within two business days of noticing. For credit cards, the Fair Credit Billing Act gives you 60 days from the statement date.
Am I guaranteed to get my money back?
For genuinely unauthorized transactions, the bank generally has to refund you – provided you report within the deadline. It is different if you authorized the payment yourself after being tricked. Report the case right away and describe honestly what happened.
Should I change my online banking password now?
Yes, immediately, and set up the second factor again. If there is any chance your credentials were captured, have the bank reset your access rather than doing it from the same device.