Unauthorized Credit Card Charges: Your Rights, Steps to Dispute, & How to Prevent Them

A credit charge you don't recognize hits your statement. It might be fraud, it might be a billing error, or it might be a forgotten subscription. The legal protections, the dispute process, and the deadlines depend on which one it is. This guide covers what counts as an unauthorized credit card charge in 2026, the Fair Credit Billing Act rights every cardholder has, how to dispute a charge step by step, the timeline the bank must follow, and the hotel and corporate travel exposure that produces these charges more often than most travelers realize.

What Are Unauthorized Credit Card Charges?

An unauthorized credit card charge is any transaction the cardholder did not approve or initiate. Federal regulators group these into three buckets that look similar on a statement but behave differently under the law: outright fraud, billing errors, and unknown charges.

• Fraudulent charges happen when someone other than the cardholder uses the card without permission. The thief might have your physical card, your card number, or your account credentials. Under federal law, fraudulent charges receive the strongest consumer protection.‍
• Billing errors are charges from a real merchant transaction where something went wrong: the amount is wrong, the same charge appears twice, a charge appears for goods you never received, or the math on the statement is off. These have a separate dispute path under the Fair Credit Billing Act.‍
• Unknown charges are the trickiest category. The cardholder may have authorized the original transaction (a free trial, a one-time subscription, a service deposit) but doesn't recognize the merchant descriptor on the statement or didn't expect the recurring charge to continue. Sometimes these are legitimate; sometimes they're a billing error or fraudulent recharge.

A debit card carries similar but weaker protections than a credit card. With credit, your liability for unauthorized use is capped at $50 by law and at $0 in practice by every major issuer. With debit, liability scales with how quickly you report (up to $500 if reported within 60 days, unlimited after that). The rest of this guide focuses on credit cards.

How Do Unauthorized Credit Card Charges Happen?

Unauthorized credit card charges happen through six common paths. Knowing which one produced the charge changes how you respond and how quickly you should act. The FTC's Consumer Sentinel Network logs hundreds of thousands of credit card fraud reports every year, making it one of the most-reported categories in the database.

• Card theft, physical or digital: A stolen wallet or compromised phone exposes a card to in-person and mobile-wallet fraud. Card numbers harvested from skimmers at gas pumps and ATMs continue to feed online fraud rings.
• Phishing and account takeover: A convincing email or text directs the cardholder to a fake site that captures card details and account credentials. Once an attacker has both, they can transact and sometimes lock the real cardholder out.
• Data breaches exposing card details: Large merchant or processor breaches release millions of card numbers into resale markets. Most cardholders learn about the exposure only after fraudulent charges appear.
• Subscription charges the cardholder didn't knowingly authorize: Free trials that auto-renew, recurring charges with unclear cancellation paths, and subscriptions sold by third parties under different descriptors. These often look like billing errors but are technically authorized transactions the cardholder forgot about.
• Merchant errors: A clerk runs the wrong amount, a system double-bills, or a deposit converts to a sale without the cardholder's consent. These are billing errors under the FCBA, not fraud.
• Post-stay hotel charges added without consent: A hotel keeps the original credit card authorization on file and bills it after the guest checks out for incidentals, minibar items, damage claims, or parking charges the guest never agreed to. This is the most common form of unauthorized charge in corporate travel, and we cover it in depth below.

Your Rights Under the Fair Credit Billing Act (FCBA)

The Fair Credit Billing Act of 1974 is the federal law that defines your rights when an unauthorized credit card charge appears. It applies to credit card accounts and other open-end consumer credit, and it gives you the structured dispute path most cardholders learn about only after they need it. The single most important number: your maximum liability for unauthorized charges is $50, and even that is waived in practice by all major US issuers.

• The $50 cap: If your card is used without your permission, the FCBA caps your liability at $50 regardless of how much was charged. Visa, Mastercard, American Express, and Discover all offer voluntary zero-liability protection on top of the federal cap. Practically, you owe nothing for confirmed unauthorized use.
• The 60-day window: You have 60 days from the date the statement containing the disputed charge was mailed to send your written dispute. After 60 days, FCBA protections weaken. If a charge appears on your March statement (mailed March 5), the written dispute must be postmarked by May 4. This deadline is hard, so spot-check your statement the day it arrives rather than at the end of the year.
• Billing errors versus illegal use: The FCBA covers both, but with slightly different procedures. Billing errors include charges for goods you didn't receive, charges with incorrect amounts, unauthorized charges, math errors, and failures to credit returns. "Illegal credit card charges" is informal language for what the FCBA calls "unauthorized use," and the same dispute path applies ).
• What protection requires: To trigger FCBA protections, you must report the disputed charge in writing within 60 days, continue paying undisputed charges, and provide enough detail for the issuer to investigate. A phone call alone is not enough to lock in your legal rights; the written notice is what triggers the timeline.

What to Do When You Find an Unauthorized Charge

Four steps protect your rights and shorten the resolution timeline. Take them in this order; skipping the written step is the most common mistake.

Step 1: Check the merchant descriptor before disputing

A charge from "SP MERCHIES INC" might be a legitimate purchase from a small business using a payment processor that scrambles the merchant name. Google the descriptor first. Many "unauthorized" charges are simply unrecognized.

Step 2: Call the card issuer right away

Use the number on the back of the card or the issuer's secure messaging in your account. Report the charge as unauthorized. The issuer can often freeze the card, issue a new one, and provisionally remove the charge from your balance the same day.

Step 3: Write to the issuer within 60 days

The phone call gets you provisional relief; the written dispute locks in your FCBA rights. Use the address listed for billing inquiries on your statement (this is usually different from the payment-remittance address). Your letter should include your name and account number, a copy or description of the disputed charge, the dollar amount, why you believe it's an error, and any supporting documentation (receipts, screenshots, prior emails). Keep a copy and send it certified mail with return receipt.

Step 4: Keep paying the undisputed portion

During the investigation, you don't have to pay the disputed amount or interest accruing on it. You do have to pay everything else on the statement to avoid late fees and credit-score impact. The issuer can't downgrade your credit reporting based on the disputed amount alone.

How to Dispute an Unauthorized Credit Card Charge

A formal FCBA dispute is a structured process with specific obligations on both sides. Once your written notice arrives at the issuer's billing-inquiries address, the clock starts. The issuer has 30 days to acknowledge your dispute in writing and must complete the investigation within two billing cycles or 90 days, whichever is shorter.

• Acknowledgment: Within 30 days of receiving your dispute, the issuer must send written acknowledgment that they've received it. This isn't a resolution; it's a receipt. If the issuer doesn't acknowledge in 30 days, they've already violated the FCBA.
• Investigation: During the investigation, the issuer asks the merchant for documentation supporting the charge. If the merchant can't produce signed receipts, delivery confirmation, or proof you authorized the transaction, the dispute resolves in your favor.
• Your rights during the review: While the dispute is open, the issuer cannot try to collect the disputed amount, cannot charge you interest on it, and cannot report the disputed amount as delinquent to credit bureaus. The disputed amount is essentially frozen on your account.
• If they rule in your favor: The charge is permanently removed from your account along with any interest or fees that accrued on it. The issuer sends you written notice of the outcome.
• If they rule against you: The issuer sends a written explanation of why the charge is valid. You then have at least 10 days to pay the disputed amount before it can be reported as late to credit bureaus. You can still pursue the merchant directly, file a complaint with the CFPB, or take the issuer to small-claims court if you believe they violated the FCBA.
• Legal remedies for FCBA violations: If the issuer doesn't follow the FCBA process (no acknowledgment, missed timeline, collected on the disputed amount during the dispute, reported it as delinquent), federal law allows you to recover actual damages, statutory damages up to $1,000 per violation, court costs, and reasonable attorney's fees. 

How Long Does a Credit Card Dispute Take?

The FCBA sets a hard ceiling of two billing cycles or 90 days, whichever is shorter, from the date the issuer receives your written dispute. Most disputes resolve faster, often inside 30 to 45 days when the documentation is clear. The 90-day limit is a maximum, not a default.

• Faster resolutions: Disputes resolve in days rather than weeks when the unauthorized charge is small, the merchant doesn't respond to the issuer's inquiry, the card was reported stolen, or the issuer's fraud team flags the transaction independently before the cardholder reports it. Modern issuers also pre-empt many disputes by texting cardholders to confirm unusual transactions in real time.
• Longer investigations: Complex disputes take the full 90 days when the merchant produces partial documentation, the transaction is recurring (subscription fights stretch longer), or the charge sits in a category with frequent fraud (online digital goods, in-app purchases, gray-market resale).
• If the bank exceeds the timeline: File a complaint with the CFPB and with your state attorney general's consumer protection division. Both will route the complaint to the issuer's compliance team and trigger a response. If the issuer also reported the disputed amount as delinquent during the dispute period, that's a separate FCBA violation worth raising in your complaint.

Unauthorized Hotel Credit Card Charges in Corporate Travel

Hotel-related unauthorized charges are the most common type of unauthorized credit card charge in business travel, and they're also the most preventable. The exposure traces to one document: the credit card authorization form (the CCA form) a corporate travel team sends to the hotel before a trip. If the form does not specify what the card covers, the hotel can interpret broadly and bill for things the company never agreed to.

• How the exposure builds: A corporate travel manager sends a CCA form authorizing the company card for "room, tax, and incidentals." The guest checks in, runs up minibar charges, and checks out paying their own personal card for incidentals. The hotel still has the original CCA on file. Three weeks later, a $340 charge for "post-stay damage" appears on the corporate card with no supporting documentation.
• Why corporate cards are more exposed: Higher credit limits mean small unauthorized charges sit below the threshold that triggers a fraud alert. Third-party hotel bookings (through GDS, OTAs, or a TMC) create handoff gaps where the property's billing team isn't talking to the booking agent's billing team. Group bookings often share one CCA across dozens of room nights, multiplying the exposure surface.
• A travel manager's experience: A travel program manager at a mid-market services firm we spoke with described the pattern this way: "We had three Marriott properties bill the original CCA card for damage claims after guests checked out using their personal AmEx. The reconciliation took six weeks and one of the disputes is still open." The CCA form had said "room and tax only," but the property billed anyway and made the company prove the form's scope after the fact.
• How to remove the exposure: Three controls work - specify scope on the CCA form (room and tax only, with incidentals on a personal card at check-in). Use virtual cards with capped limits and merchant locks instead of a master card. Reconcile statements weekly, so post-stay charges show up while the booking details are still fresh.

Virtual cards close the loophole entirely. A virtual card issued for a specific hotel stay with a capped amount can only be charged up to that amount; anything the property tries to add after checkout is declined at the network level. ITILITE issues per-trip virtual cards with capped limits and merchant restrictions, so the hotel cannot bill the company for charges the booking didn't authorize. The exposure mechanism disappears.

How to Prevent Unauthorized Credit Card Charges

Five controls do most of the prevention work. The first three apply to anyone with a credit card; the last two are for finance and travel teams running corporate programs 

1. Turn on transaction alerts

Every major issuer offers real-time push notifications, SMS alerts, or email alerts for every transaction or for transactions above a chosen amount. Cardholders who get the alert as the charge clears spot fraud in minutes instead of weeks. This single setting is the highest-ROI prevention step.

2. Review statements monthly, not at year-end

Reading the statement the day it arrives means a 60-day FCBA window starts fresh, not five months late. Even a five-minute scan flags the obvious unauthorized charges.

3. Use virtual cards for online and hotel bookings

Virtual cards generate a unique card number for each merchant or each transaction, with capped limits and an expiration. If the merchant's database is breached, the exposed number is single-purpose and limited.

4. Limit where card details are stored

Every site that stores your card is a potential breach vector. Pay through a digital wallet (Apple Pay, Google Pay) or a one-time virtual card for sites you rarely use, and remove saved cards from sites you no longer transact with.

5.For corporate programs, layer in policy controls

Merchant category controls (block gambling, adult content, certain MCCs), spend velocity limits (cap how much a single card can transact in 24 hours), real-time spend visibility (finance sees every charge as it clears), and immediate card freeze (one click in the admin console, no call to the issuer required). A corporate card platform that ships these controls by default removes the manual monitoring burden from finance and travel teams. ITILITE combines per-trip virtual cards, merchant category controls, and a real-time spend dashboard so the prevention work doesn't fall on individual cardholders.