Dispute route order after a phished payment-app account

A phished payment-app account followed by an unfamiliar bank debit is the case where one incident needs several routes. Each route has its own recipient, facts, deadline and expected result, so the order in which the documents go out matters.

What to take away

Sort the facts before you file

Calling every problem fraud can send it down the wrong path. Decide what actually happened first, because a duplicate debit, a missing refund and an account takeover call for different records and processes.

State only what the evidence supports. Distinguish:

The answer decides which of the four routes below applies, and which does not.

The four routes at a glance

The routes differ by recipient, core question, evidence and possible result. The comparison describes functions, not guaranteed legal categories or remedies.

An error notice goes to the bank, issuer or covered provider and asks whether the record is wrong. A merchant dispute goes to the seller and sometimes the issuer. A fraud report goes to a provider, law enforcement or a reporting body. A regulatory complaint goes to an agency with jurisdiction.

One incident, four documents

Each document shares the same timeline but asks a different recipient to do a different job. For a phished payment-app account followed by an unfamiliar debit, the sequence runs from the app to the bank, then to the fraud channels, then to a regulator.

The error notice comes before the fraud report because it carries the clock and the report does not correct an account. Fraud reporting is not wasted effort. It records the crime while the bank works the record.

Step 1: report to the app provider

Start with the provider whose account was compromised, through the channel in its own terms. Say who initiated the payment and which credentials or sessions were compromised, using only what the evidence supports.

Keep a copy of every message and response, and revoke the app access the compromised credentials had. The provider may also be the right recipient for a duplicate merchant charge or a held payment, which are different problems and need their own words.

Step 2: send the bank error notice

For a consumer account covered by the Electronic Fund Transfer Act (EFTA) and Regulation E, notify the institution no later than 60 days after it sends the statement showing the alleged error (12 C.F.R. § 1005.11(b)(1)). A missed window is costly, so read the Regulation E deadlines first.

Contact the institution through the channel in the account statement. Identify the transaction and the error clearly, and keep a copy of the notice and any response.

The deadline differs for other products, and Regulation E does not cover every payment or account. The FDIC's Electronic Fund Transfer Act examination section lists error categories such as unauthorized or incorrect electronic fund transfers, omitted transfers, bookkeeping errors, incorrect terminal cash, and requests for required documentation or clarification. Do not cite that framework for a transaction outside its scope.

If the unfamiliar debit was a credit-card charge, the Fair Credit Billing Act (FCBA), implemented by Regulation Z, provides a written notice route instead. Send notice to the billing-inquiries address on the statement within 60 days after the issuer sends the first statement showing the error. Identify your name, account, amount and reason (15 U.S.C. § 1666; 12 C.F.R. § 1026.13).

Use the issuer's dispute channel promptly as well, and see how card disputes and chargebacks differ from a refund.

Step 3: file the fraud report

A fraud report may go to a provider, financial institution, police agency, the FTC or IC3, depending on the event. For identity theft, use IdentityTheft.gov. For scams or deceptive business practices, use the FTC's ReportFraud portal. For internet-enabled crime, submit the FBI's IC3 complaint form.

The FTC's identity-theft reporting instructions direct consumers to complete its online complaint form and give as many details as possible, or call 1-877-438-4338. The form is not available on mobile devices.

A report can support containment and investigation. It does not itself reverse a transfer or decide liability, and a police report does not replace the account provider's own notice and investigation process.

Step 4: escalate to a regulator

A regulatory complaint is generally appropriate after you identify the legal provider and the agency that covers it. Gather the product and account details, dates and amounts, supporting records, prior provider contact, the provider's response and the precise unresolved issue.

For consumer financial products within its remit, including bank accounts, credit cards, money transfers and loans, submit through the CFPB complaint portal. The CFPB may forward the complaint to the company for a response or refer it elsewhere. Our guide to CFPB complaint data explains what to check before you rely on it.

Regulators differ in jurisdiction and authority. For a national bank or federal savings association, use the OCC's HelpWithMyBank complaint channel. For a state consumer-protection issue, contact the state attorney general's consumer-protection office. A complaint may be routed to a company, referred elsewhere, used for supervision, or result in an explanation that private relief is outside the agency's role.

Check the routing before each filing

Common questions