Help—My Debit Card Was Charged for Something I Didn’t Buy

Errant Charges on Your Debit Card?

When Frank Johnson spotted unfamiliar transactions on his debit card accounts, he knew something wasn’t right. The Charlotte business owner soon discovered fraudulent activity on two company debit cards. Despite Johnson’s best efforts to resolve the issue with his bank, he lost $6,000 to the scam [*]. 

In 2022, the Federal Trade Commission (FTC) received over 68,000 reports of debit card fraud — with losses totaling over $196 million [*].  

If your debit card was charged for something you didn't buy, you can’t ignore it — criminals may have more of your sensitive data. Left unchecked, small debit card fraud could lead to ongoing identity theft scams that cost you significant time and money. 

In this guide, we’ll explain how criminals gain access to your debit card, what to do if you see unauthorized purchases, and how to protect your bank account from scammers.

{{show-toc}}

How Did Scammers Use Your Debit Card (Without Your Card)?

Unauthorized charges on your bank statement are among the clearest warning signs of debit card fraud — and even identity theft. With enough of your personally identifiable information (PII), criminals can gain access to your debit account, open new accounts in your name, and drain your savings account. 

Unfortunately, debit card fraud is more common than most people think — second only to credit card fraud [*].

Here are five ways that scammers can gain access to your debit card number and other personal finance information:

• Your bank account details were leaked in a data breach. There were more data breaches in 2022 than in any other year [*]. Hackers publish and sell stolen debit card information, account numbers, and passwords on the Dark Web. Once scammers have your details, they can exploit your accounts.
• Criminals used a skimmer to steal your card details. Skimming increased by almost 500% in 2022 — compromising over 161,000 cards [*]. If you use an ATM or point-of-sale terminal that has a skimmer, thieves could steal your card information and drain your account within minutes. 
• You accidentally shared your account information in a phishing scam. Imposters use social engineering tactics in bogus emails and text messages to create a sense of urgency and pressure people into disclosing sensitive data. When Cody Mullenaux received fake fraud alert texts claiming to be from Chase Bank, he made several wire transfers to scammers — losing $120,000 [*].  
• You used your banking app on a random Wi-Fi network. If you do banking or online shopping in a hotel, cafe, or airport, there’s a risk someone could intercept your private information. Hackers can exploit unsecured networks with Wi-Fi sniffers or fake hotspots. 
• A thief intercepts your new bank cards in the mail. Not every scam relies on high-tech methods. Paula Holley was shocked to receive two new Cash App debit cards in the mail — with a credit limit of $17,000. Someone had used her details to order the cards; but luckily, Holley got to her mailbox before the scammer [*]. 

What To Do If There’s an Unauthorized Charge on Your Debit Card

Did you find unauthorized debit card charges for something that you didn’t buy? You need to take action before fraudsters rack up more debts in your name.

Here are nine steps to protect your finances and credit:

1. Lock your cards
2. Contact your bank’s fraud department
3. Contact the merchant
4. Follow up with a written dispute letter
5. Check your statements
6. File an official report with the FTC
7. Report a lost or stolen debit card
8. Update your payment information
9. Continue to monitor your financial accounts

1. Lock your cards by using your mobile banking app

The first thing you want to do when you find an unauthorized charge on your debit card is minimize the damage. While you can call the number on the back of your card to talk to your bank’s fraud department, many mobile banking apps allow you to lock your cards instantly.

Here’s what to do:

• Log in to your mobile banking app or the bank's official website. Always make sure you're on a secure network, as scammers create fake bank login pages to swipe user credentials. 
• Check for a “lock card” option on your checking account. When you select a card, you should see a card lock option with an on-off switch. Simply switch on the card lock to prevent anyone from using it.
• Remember recurring payments. Locking your card stops new charges and cash withdrawals. But scheduled payments — like your Netflix subscription — will still work. If you want to stop everything, you need to cancel the card or change the payment method for each subscription. 

📚 Related: Did Scammers Use Your Credit Card? Take These 10 Steps Now →

2. Contact your bank’s fraud department

It is important to contact all of your financial institutions — including your bank, credit card company, and credit unions. By letting lenders know that you were targeted, authorities can take additional security measures to protect you from further financial fraud. 

Here’s what to do:

• Review your debit card statements for signs of fraud. You can review statements online or on paper. Highlight any unfamiliar debit card transactions that could be fraudulent.
• Report issues to the bank. Provide full details of your concerns to the card issuer or bank’s fraud department, with supporting evidence about the disputed transactions. Ask them to cancel your debit cards and issue new cards.

📚 Related: How To Protect Your Bank Account From Identity Theft →

3. Contact the merchant to get more information about the charge

Sometimes, it’s possible to resolve fraud by directly contacting any companies at which the fraudster used your debit card account to make a payment. Even if merchants can’t refund you immediately, they can offer useful information for the investigation.

Here’s what to do:

• Find the merchant’s contact information. You can usually find a company’s official contact details with a quick search on Google and social media. Use the transaction information from your bank statement to guide your search.
• Get in touch by using the company’s email address or phone number. Let the company know a fraudster used your data to do business with them. Provide the details, including the date and amount of any fraudulent transactions.
• Keep note of communications for your own records. Fraud recovery is a challenging process. It's easier when you keep track of whom you spoke with and details of every conversation. Whenever possible, keep transcripts — as this will help resolve any disputes.

4. Follow up with a written dispute letter

A credit dispute letter is a written query about a suspected error on your credit report. You can make an official dispute to remove fraudulent activity that would otherwise negatively affect your credit score. 

Here’s what to do:

• Review your credit file for unauthorized transactions. Check your report at each of the three major credit reporting bureaus — Experian, Equifax, and TransUnion. You can order your free credit reports from Annualcreditreport.com. 
• Write a dispute letter with detailed information about the fraud. Include the dates, figures, and merchants. Explain why you believe the transactions are inaccurate or fraudulent. 
• Provide supporting documentation. You can help the investigation by enclosing anything that supports your claim — like bank statements, invoices, or any communications with a suspected scammer. 

📚 Related: How To Spot a Chase Phishing Email (5 Examples) →

5. Check your statements for further signs of fraud

Fraud and identity theft are almost never isolated events. If you’ve been scammed once, there are probably other instances of fraud just waiting to be uncovered. As soon as you find fraudulent charges on your debit card, you should check your other accounts for signs of fraud. 

Here’s what to do:

• Review your online or paper bank statements. Check your statements as soon as you receive them (or at least weekly if using online statements). Look for anything you don’t recognize — even small charges. Fraudsters often “test” stolen account details with small transactions before moving on to larger ones. 
• Check your other online accounts for signs of hacking. If your bank account has been compromised, your other online accounts could also be at risk. Check your email, social media, and other important online accounts for signs that you’ve been hacked. 
• Consider signing up for Dark Web monitoring. Aura monitors the Dark Web 24/7 for your most sensitive information — including your Social Security number (SSN), full name, financial information, and more. If any personal data gets leaked, you’ll find out quickly so you can shut down scammers. 

6. File an official report with the FTC

If your debit card was charged for something you didn't buy, an official report from the FTC can help you prove your innocence and recover from fraud. Many companies will want to see an FTC report before they close accounts or refund your money from fraudulent transactions. 

Here’s what to do:

• Gather your information. Before making a report, you need to prepare essential details. In addition to personal information, you should provide evidence of the fraud — like emails, receipts, and bank statements.
• Visit the FTC’s complaint page. You can report fraud by going to IdentityTheft.gov. Here, you can explain the fraud and supply your supporting documents.
• Keep a record. After you submit the complaint, the FTC will provide you with an official report. Whenever you dispute charges with merchants and lenders, you can use this document to prove you are a victim of fraud. The FTC may contact you later for additional information or to provide updates about their investigation. 

7. Report a lost or stolen debit card (or wallet) to your local police

It’s crucial to file a police report if you lost your debit card — or think it was stolen. Local law enforcement can investigate to see if there were witnesses or any closed-circuit television (CCTV) evidence to help apprehend the suspect. A police report may also be necessary to cancel fraudulent debts in your name.

Here’s what to do: 

• Prepare your evidence. Gather your FTC report and any supporting materials to help explain the crime to the police. Also, remember to bring identity documents, such as your driver’s license.  
• Visit the local police in the area where you last had your card. If you lose your wallet or debit card in a bar away from your hometown, you should file a report with the local police in the municipality where the loss occurred. 
• Follow up a few weeks later. Give the police time to look into the matter, but make sure to check in periodically. You can get a status update and share any new information that may help the investigation. 

📚 Related: What To Do If You’ve Been Scammed Out of Money →

8. Update your payment information for any direct debit accounts

After a thief compromises your debit card, you should remove the card details from any linked online accounts or scheduled payments. For example, removing the card details from your Amazon account payment methods page can prevent more fraudulent charges from being made. 

Here’s what to do:

• Visit all accounts to remove the debit card details. You will have to manually contact all of your account providers by phone or online. Consider changing your payment details wherever the card data is saved — including your utility bills, phone provider, social media, and e-commerce stores. 
• Remove your card from digital payment platforms. Make sure to check your Google Wallet, Zelle, Venmo, Cash App, etc. Also, remove card details from connected smartphone apps, like Google Play Store and the App Store.
• Double-check your bank’s direct debits. Contact your bank to find any other linked payment details. The bank may be able to help if you can’t cancel a direct debit with a company. 

📚 Related: The 7 Latest Ally Bank Scams (How To Avoid Them) →

9. Continue to monitor your financial accounts

Almost one in three victims of identity theft fall prey to another scam [*]. If you want to protect your finances against further fraud, it’s vital that you monitor your financial accounts.

Here’s what to do:

• Set up fraud alerts. Digital security providers monitor your bank and credit card accounts and send real-time notifications about profile changes, payments, and withdrawals. These features help you react quickly if there is any unauthorized activity.
• Review your statements monthly. Getting into the habit of checking your accounts will help you stay ahead of scammers. You can contact your bank if you find inaccurate or concerning information.
• Beware of unfamiliar activity. It’s easy to dismiss small transactions that you don’t recognize — but this is a mistake. Many thieves test stolen cards with small purchases before draining the entire balance. 

Aura’s all-in-one digital security solution includes three-bureau credit monitoring. You can get the fastest fraud alerts in the industry — notifying you before it’s too late if there’s any suspicious activity on your bank accounts or credit file.

Are You Liable for Unauthorized Charges on Your Debit Card?

In 2023, almost all credit card issuers offer zero fraud liability. You won't owe a penny if there are fraudulent credit card charges on your account. But debit cards don't provide the same level of protection.

The Electronic Fund Transfer Act (EFTA), also known as Regulation E, protects consumers when they use electronic payment methods. 

Here’s what you need to know about your liability for debit card fraud [*].  

• If you report a lost debit card immediately: You’re liable to pay $0 if you report the loss or theft of your card before any unauthorized charges are made.
• If you report a lost debit card within two business days: You’re liable to pay up to $50 if you notify the bank within two business days of losing your card.
• If you report a lost debit card after two business days: You're liable to pay up to $500 if you fail to notify the bank within two business days of losing the card. However, you must inform the bank within 60 days after your bank statement is mailed.‍
• If you lose your debit card and don’t report it within 60 days: If you fail to notify the bank within 60 days after your bank statement (with the unauthorized withdrawals) is mailed, you’re liable to pay for all charges.

If you suspect fraud on your debit card account, it's crucial to report the incident immediately. If you can convince the financial institution that your delay in reporting the fraud was due to extenuating circumstances, they might grant an extension. 

What should you do if the bank denies your claim of debit card fraud?

If your bank or lender denies your debit card dispute, you have other options. You can appeal the decision and seek further assistance from the government.

Here’s how it works:

• If you want to appeal the bank's decision, you must lodge your case within 10 days. 
• If your appeal is unsuccessful, the next step is to report the incident to the FTC. You can also file a complaint online with the CFPB or call (855) 411-CFPB (2372).
• The CFPB will liaise with the bank. Normally, you’ll get a response within 15 days. If the CFPB determines that the bank has violated any federal law or your rights under the Fair Credit Billing Act (FCBA), it may impose sanctions on the bank. 

Keep in mind: there's no guarantee that any of these measures will lead to a change in the result. A proactive attitude to securing your bank account against scams is always the best approach.

📚 Need more help? Learn How To Dispute Debts in My Name (That Aren't Mine) →

How To Protect Your Debit Card Against Fraud

Unauthorized charges on your debit card are an early warning sign of identity theft. There’s a good chance that more of your personal information could be compromised. 

Plus, fraudulent debit card charges can tie up your funds, causing a ripple effect for weeks or months. As your money is frozen during the investigation, you may struggle to pay bills; and legitimate charges could be declined or cause unexpected overdrafts. 

Despite the risks, many people use debit cards to help them budget properly and avoid taking on excessive debts. If you want to use your debit card, take extra precautions.

Here are nine tips to protect your debit card from fraudsters:

• Secure your online bank account with strong passwords. When you create strong, unique passwords, it’s less likely that someone could gain access by guessing or using credential-stuffing attacks.
• Enable two-factor authentication (2FA). An additional security step — like requesting a one-time password or SMS code — makes accessing your account harder for unauthorized users.
• Use your bank’s security features. You can remain vigilant by setting spending limits and enabling mobile bank alerts. These features make it easy to keep tabs on spending. 
• Avoid using your debit card in risky locations. Criminals target gas stations, bars, and ATMs in quieter areas. To avoid skimmers, use contactless payments. 
• Set up credit monitoring. To avoid issues when you need a car loan or mortgage, use credit monitoring services to protect your standing with the three major reporting bureaus (Experian, Equifax, and TransUnion). 
• Use digital wallets on your smartphone. Contactless payments are widely accepted in 2023, so you can often leave your physical card at home. For added security, use biometric verification methods in case someone steals your phone. 
• Protect your PIN at ATMs and stores. Some skimmers include tiny cameras that watch people enter their PINs. Hide the keypad when using ATMs in case a shoulder surfer is watching you. 
• Never share your banking details over the phone. It's best to avoid relaying your card information in public places where others can hear you. Call back at a different time if you can't find a quiet place to talk in private.

Lastly, consider signing up for identity theft protection. The best way to safeguard your personal information, bank accounts, and finances is with Aura's award-winning solution. 

With Aura, you get top-rated identity theft protection, 24/7 three-bureau credit and bank account monitoring, AI-powered digital security tools, a $1,000,000 insurance policy for eligible losses due to identity theft, and round-the-clock access to U.S.-based White Glove Fraud Resolution Specialists. 

Keep your bank account safe from scammers. Try Aura free for 14 days.