If an automatic payment has already come out of your account that you did not authorize — a debit you never set up, a charge for the wrong amount, or one that posted after you cancelled — this guide explains how to get it reversed. This is the dispute process: a charge has already posted, and you want your money back. It runs through your bank under the federal error-resolution rules in Regulation E, and it is time-sensitive, so the first move is to report it as soon as you notice it.
Make sure this is your situation. If the debit has not happened yet and you want to block it, that is a stop payment, not a dispute — see stopping payment on a check or ACH. If you want to end an ongoing recurring charge so no future payment comes out, that is revoking the authorization — see stopping an automatic ACH payment. And to understand what an ACH authorization is, see what an ACH authorization form is. This article covers disputing a debit that already posted and getting the money back.
Dispute vs. revoke vs. stop payment
These three actions solve different problems. A dispute (this article) challenges a payment that has already posted as unauthorized and asks the bank to reverse it under Regulation E. Revoking an authorization ends a recurring agreement so future debits stop — it is forward-looking and does not, by itself, claw back money already taken. A stop-payment order blocks one specific upcoming item before it is paid.
Which one you need depends on timing. Money already gone and unauthorized? Dispute it. Want the series to stop going forward? Revoke with the company and tell your bank. A single upcoming item to block? Stop payment. If a company kept charging after you revoked, you will use two tools: you already revoked to stop the series, and now you dispute the charge that posted anyway.
- Dispute (this article): reverse a charge that already posted and was unauthorized.
- Revoke: stop a recurring series going forward (see stopping an automatic ACH payment).
- Stop payment: block one specific upcoming item (see stopping payment on a check or ACH).
The Regulation E investigation timeline
Once you report an error, Regulation E puts the bank on a clock. The institution must investigate and determine whether an error occurred within 10 business days of receiving your notice of error. If it cannot complete the investigation within that 10-business-day window, it may take up to 45 days from receipt of the notice to investigate — but only if it provisionally credits your account (more on that below).
Two longer windows exist for specific situations. The bank may use 20 business days in place of 10 when the disputed transfer occurred within 30 days after the first deposit to a new account, and it may extend the full investigation to 90 days in place of 45 for certain point-of-sale debit-card transactions or transfers not initiated within a state. When the bank determines an error did occur, it must correct it within one business day after making that determination.
- 10 business days to investigate after you report (20 for a new account's early transfers).
- Up to 45 days for a fuller investigation — but only with provisional credit.
- Up to 90 days for certain point-of-sale or out-of-state transfers.
- If an error is confirmed, the bank corrects your account within one business day.
Provisional credit: getting your money back during the investigation
You usually do not have to wait out the full investigation without your money. Under Regulation E, if the bank cannot finish within 10 business days and wants the extra time, it must provisionally credit your account for the amount of the alleged error (including, where applicable, related fees) within 10 business days of receiving your notice — so you have use of the funds while it investigates. The CFPB notes the bank may deduct a temporary credit by no more than a small amount in some debit-card cases, but the core protection is that you get provisional credit during the extended investigation.
If the investigation confirms the payment was unauthorized, the provisional credit becomes permanent and your account is made whole. If the bank instead concludes no error occurred, it can reverse the provisional credit, but it must notify you, explain its findings in writing, and tell you how to ask for the documents it relied on. Either way, you are not left without recourse while the bank works.
How much could I be on the hook for?
For a truly unauthorized electronic transfer, Regulation E caps your liability, but the caps tighten with delay. The CFPB explains that if you report a lost or stolen debit card within two business days of learning about it, your liability is limited to $50 or the unauthorized amount, whichever is less. Wait longer than two business days and you could be responsible for up to $500. And if you fail to report an unauthorized transfer within 60 days of the statement that shows it, you risk losing protection for transactions that occur after that window.
The takeaway is the same as the deadline above: report fast. A charge you never authorized is reversible, but your protection erodes the longer you wait. Prompt notice — ideally within two business days of noticing a problem and always well inside 60 days of the statement — keeps your potential liability at its lowest.
- Report within 2 business days: liability capped at $50 (or the amount, if less).
- Report after 2 business days: liability can rise to up to $500.
- Fail to report within 60 days of the statement: you risk losing protection for later transactions.
Put your dispute in writing
Even when you start by phone, follow up in writing — it fixes the date of your notice (which starts the bank's clock and proves you met the 60-day deadline) and records exactly what you disputed. Keep it factual: identify your account, the transaction by date, amount, and company name, state clearly that the payment was unauthorized (or wrong, or posted after you revoked permission), and ask the bank to investigate and reverse it under Regulation E. If you previously revoked the company's authorization, attach or reference that dated revocation as evidence.
When you need a clean notice to send, you can generate an automatic payment dispute letter with your account and transaction details and a clear statement of the error. Send it to your bank, keep a dated copy and any confirmation number, and track the 10-business-day and 45-day milestones. If your real goal is to stop future charges rather than reverse a past one, revoke the authorization instead — and if you only need to block an upcoming item, use a stop-payment order.
- Identify your account and the disputed transaction (date, amount, company).
- State plainly that the payment was unauthorized, wrong, or posted after you revoked.
- Ask the bank to investigate and reverse it under Regulation E.
- Reference any prior revocation letter as evidence.
- Keep a dated copy and note the 60-day deadline and investigation milestones.
The bottom line
To dispute an unauthorized automatic payment that already posted, report it to your bank as soon as you notice it — by law no later than 60 days after the statement showing it was sent. Under Regulation E, the bank generally has 10 business days to investigate; if it needs longer, it can take up to 45 days but must give you provisional credit within 10 business days so you have the money meanwhile. If it confirms the error, it corrects your account within one business day. Liability caps reward speed: $50 if you report a lost card within two business days, up to $500 if you wait. Put the dispute in writing and keep copies.