Bank of America: unauthorized charge

Collect

• statement with the charge
• date you noticed it
• card status

Steps

1. For a credit card, call the 24/7 credit card line and report the card lost or stolen.

   PhoneCredit card customer service (including lost or stolen card) +1-800-732-9194 Account holder only

2. For an ATM or debit card, call the debit fraud line, or dispute online.

   PhoneReport fraudulent ATM or debit card charges +1-877-366-1121 Account holder only

3. If Bank of America does not resolve it, file a complaint with the CFPB.

   RegulatorConsumer Financial Protection Bureau +1-855-411-2372

More contacts for this issue

Facts you can cite

• Policy

  For a lost or stolen credit card, Bank of America states "You won't be liable for any fraudulent charges."

  Source: bankofamerica.com, verified 2026-10-12

• Process

  Locking your account is not a replacement for reporting your card lost or stolen.

  Source: info.bankofamerica.com, verified 2026-10-12

• Policy

  Bank of America credit card agreements require binding arbitration administered by the American Arbitration Association whenever either party chooses it; the only exception is an individual claim in small claims court.

  Source: files.consumerfinance.gov, verified 2026-10-12

Rules in force

• Electronic Fund Transfer Act error resolution and unauthorized-transfer liability (Regulation E)
  12 CFR 1005.6; 12 CFR 1005.11; 12 CFR 1005.2(m) (Regulation E)

  For debit cards, ATM transfers, ACH and other electronic fund transfers from a consumer account (including P2P payments that meet the EFT definition), the consumer has 60 days after the statement is sent to report an error. The institution must investigate within 10 business days, or within 45 days if it provisionally credits the account within 10 business days. Liability for unauthorized transfers is capped at $50, $500 or more depending on how fast the consumer reports.

  Source: consumerfinance.gov, verified 2026-10-12

  12 citable points

  • Limit

    If the consumer reports a lost or stolen access device within two business days after learning of the loss or theft, liability is limited to "the lesser of $50 or the amount of unauthorized transfers that occur before notice".

    Source: consumerfinance.gov, verified 2026-10-12

  • Limit

    If the consumer does not report within two business days after learning of the loss or theft, liability is "the lesser of $500 or the sum of" up to $50 of transfers in the first two business days and later transfers the institution shows would have been prevented by timely notice.

    Source: consumerfinance.gov, verified 2026-10-12

  • Deadline

    An unauthorized transfer that appears on a periodic statement must be reported "within 60 days of the financial institution's transmittal of the statement" to avoid liability for later transfers that timely notice would have prevented. The institution must extend these time limits to a reasonable period when extenuating circumstances (for example extended travel or hospitalization) delayed notice.

    Source: consumerfinance.gov, verified 2026-10-12

  • Process

    Notice of an unauthorized transfer may be given in person, by phone or in writing. Written notice is considered given at the time the consumer mails it. Lower liability under state law or the account agreement controls.

    Source: consumerfinance.gov, verified 2026-10-12

  • Policy

    An unauthorized EFT is a transfer from the consumer's account initiated by someone other than the consumer without actual authority and from which the consumer receives no benefit. It does not include a transfer by a person to whom the consumer gave the access device (until the consumer tells the institution that person is no longer authorized), a transfer made with fraudulent intent by the consumer or someone acting with the consumer, or a transfer by the institution or its employee.

    Source: consumerfinance.gov, verified 2026-10-12

  • Policy

    Errors covered by the error-resolution procedure include an unauthorized EFT, an incorrect EFT to or from the account, an omitted transfer on a statement, a computational or bookkeeping error, receiving the wrong amount of cash from an ATM, and a request for documentation or clarification about a transfer.

    Source: consumerfinance.gov, verified 2026-10-12

  • Deadline

    The consumer must give notice of an error no later than 60 days after the institution sent the periodic statement on which the error first appears. The notice must let the institution identify the consumer's name and account and say why the consumer believes there is an error. If notice is oral, the institution may require written confirmation within 10 business days.

    Source: consumerfinance.gov, verified 2026-10-12

  • Deadline

    The institution must investigate and decide within 10 business days, report results within 3 business days after it completes the investigation, and correct an error within 1 business day after it finds one. It may take up to 45 days only if it provisionally credits the disputed amount within 10 business days. It need not provisionally credit if it asked for written confirmation of an oral notice and did not receive it within 10 business days.

    Source: consumerfinance.gov, verified 2026-10-12

  • Deadline

    Longer periods apply in some cases: 20 business days instead of 10 for transfers within 30 days after the first deposit to a new account, and 90 days instead of 45 for point-of-sale debit card transactions, transfers not initiated within a state, and new-account transfers.

    Source: consumerfinance.gov, verified 2026-10-12

  • Process

    If the institution finds no error, it must give a written explanation and tell the consumer of the right to request the documents it relied on. If it debits a provisional credit, it must notify the consumer of the date and amount and honor checks and preauthorized transfers for five business days after the notice.

    Source: consumerfinance.gov, verified 2026-10-12

  • Policy

    P2P (CFPB guidance, not rule text): the CFPB's Electronic Fund Transfers FAQs state that any P2P payment that meets the definition of an EFT is covered by EFTA and Regulation E, and that when a consumer is fraudulently induced into sharing account access information with a third party, the resulting transfer by that third party is an unauthorized EFT.

    Source: consumerfinance.gov, verified 2026-10-12

  • Process

    CFPB guidance (Electronic Fund Transfers FAQs): an institution must begin its investigation promptly on an oral or written notice of error and may not require a police report or require the consumer to contact the merchant first. Consumer negligence, such as writing a PIN on the card, cannot be used to impose greater liability.

    Source: consumerfinance.gov, verified 2026-10-12

• Fair Credit Billing Act billing-error and purchase-dispute rights (Regulation Z)
  12 CFR 1026.13; 12 CFR 1026.12(c) (Regulation Z)

  For credit card and other open-end credit accounts, a written billing-error notice that the creditor receives within 60 days after it sent the first statement with the error starts a dispute process. The creditor must acknowledge it within 30 days and resolve it within 2 complete billing cycles (no later than 90 days). Until then, the consumer need not pay the disputed amount and the creditor may not collect it or report it as delinquent. A separate rule lets a cardholder assert claims and defenses about a card purchase against the card issuer.

  Source: consumerfinance.gov, verified 2026-10-12

  1 citable point

  • Policy

    A billing error includes a charge for credit not made to the consumer or an authorized user; a charge for property or services not accepted by the consumer or not delivered as agreed; a failure to credit a payment or other credit properly; a computational error by the creditor; a charge for which the consumer asks for clarification, including documentary evidence; and failure to send a statement to the last address the creditor received in writing at least 20 days before the end of the billing cycle.

    Source: consumerfinance.gov, verified 2026-10-12

• Restore Online Shoppers' Confidence Act (ROSCA) negative option requirements
  15 U.S.C. 8401-8405

  A seller that charges consumers online through a negative option feature (for example an automatic renewal or a free trial that converts to paid) must clearly disclose all material terms before taking billing information, get the consumer's express informed consent before charging, and provide simple mechanisms to stop recurring charges. The FTC enforces ROSCA.

  Source: law.cornell.edu, verified 2026-10-12

  4 citable points

  • Policy

    Before obtaining the consumer's billing information, the seller must provide text that "clearly and conspicuously discloses all material terms of the transaction".

    Source: law.cornell.edu, verified 2026-10-12

  • Policy

    The seller must obtain "a consumer's express informed consent before charging the consumer's credit card, debit card, bank account, or other financial account".

    Source: law.cornell.edu, verified 2026-10-12

  • Policy

    A post-transaction third-party seller may not charge a consumer for an online sale unless it discloses the material terms and gets express informed consent, including the consumer's full account number, before charging. An initial merchant may not pass a customer's account number or other billing information to such a seller.

    Source: law.cornell.edu, verified 2026-10-12

  • Process

    A ROSCA violation is treated as a violation of an FTC rule on unfair or deceptive acts or practices, and the FTC enforces ROSCA with its FTC Act powers and penalties. Report violations to the FTC.

    Source: law.cornell.edu, verified 2026-10-12

• Credit card unauthorized-use liability limit (Regulation Z)
  12 CFR 1026.12(b) (Regulation Z)

  A cardholder's liability for unauthorized use of a credit card cannot exceed the lesser of $50 or the amount obtained before the cardholder notifies the card issuer. Notice can be in person, by phone or in writing. A state law or the card agreement that sets lower liability controls.

  Source: consumerfinance.gov, verified 2026-10-12

  5 citable points

  • Limit

    Liability for unauthorized use "shall not exceed the lesser of $50 or the amount of money, property, labor, or services obtained by the unauthorized use before notification to the card issuer".

    Source: consumerfinance.gov, verified 2026-10-12

  • Policy

    Unauthorized use means use by a person other than the cardholder who does not have actual, implied or apparent authority for the use, and from which the cardholder receives no benefit.

    Source: consumerfinance.gov, verified 2026-10-12

  • Policy

    The issuer can hold the cardholder liable only if the card is an accepted card, the issuer gave adequate notice of the maximum potential liability and of how to report loss or theft, and the issuer provided a means to identify the cardholder or authorized user.

    Source: consumerfinance.gov, verified 2026-10-12

  • Process

    Notice to the issuer may be given in person, by telephone or in writing, at the cardholder's option. Written notice counts as given when received or when the time ordinarily required for transmission has passed, whichever is earlier.

    Source: consumerfinance.gov, verified 2026-10-12

  • Limit

    If state law or the cardholder agreement sets lower liability, "the lesser liability shall govern". When an issuer gives 10 or more cards to employees of one organization, the issuer and the organization may agree to different liability terms, but an employee can still be held liable only as this section permits.

    Source: consumerfinance.gov, verified 2026-10-12

If that fails, escalate

Go up one step at a time. Keep the reference numbers and dates from each contact.

1. Customer service

   PhoneCredit card customer service (including lost or stolen card) +1-800-732-9194 Account holder only

2. Written complaint

   MailCredit card billing inquiries (written billing disputes) Bank of America, PO Box 672050, Dallas, TX 75267-2050

   Card billing errors in writing within 60 days of the statement. For deposit accounts, write to the checking and savings address.

3. Federal regulator

   RegulatorConsumer Financial Protection Bureau +1-855-411-2372

4. State agency

   Your state’s financial regulator. Find it in the list of state agencies (also as JSON: states/<code>.json, for example states/ny.json).

5. Arbitration

   Bank of America credit card agreements require AAA arbitration if either party chooses it; either side may use small claims court instead.

Watch out

Related

• Unauthorized charge at other companies
• How Bank of America complaints actually go (dossier, checked 2026-10-12)
• Banks and card issuers — how complaints work
• Bank of America: dispute with a merchant through the bank
• Bank of America: fraud or scam
• Bank of America: fee reversal
• Bank of America: account frozen or closed
• Bank of America: billing error