What to do about a transaction you do not recognise

A payment you do not recognise on your statement or in your banking app is an unauthorised payment until the bank shows otherwise. The first thing to do is tell your bank, using the phone number on the back of your card or on a recent statement, or through the app if it offers that route¹.

The rules are on your side. Under the Payment Services Regulations, you must notify your bank without undue delay once you become aware of an unauthorised payment, and in any event no later than 13 months after the debit date¹. Once you have told the bank, you are not liable for any unauthorised payments taken after that point². If you claim the use of the card was not authorised by you, it is for your bank to prove otherwise, not for you to prove your innocence³.

The bank must then refund the amount of the unauthorised payment and, where applicable, restore your account to the state it would have been in had the payment never happened². That is the legal duty, not a goodwill gesture.

Tell your bank straight away

Speed matters more than anything else you do. Contact your bank immediately if you spot transactions on your statements that you do not recognise, and use the phone number printed on the back of your card or on a recent statement rather than a number from an unexpected call, text or email⁴. That last point is not fussiness: fraudsters routinely pose as bank staff, and a genuine bank will not mind you hanging up and calling back on the printed number.

The same instruction applies whatever the payment was. If you think you have paid for a fake ticket or shared your financial information with a criminal, contact your bank immediately⁶. If someone has asked you to lie to your bank about why you are moving money, that is a scam, and the advice is not to engage and to report them immediately⁷. If you receive a letter or email about a loan or card you did not apply for, call your bank immediately, because that is a sign someone is using your identity⁸.

There is a second reason to move quickly. You are not liable for unauthorised payments taken after you tell the bank that your card has been stolen or that someone else has got hold of your security details². Every hour between noticing and reporting is an hour in which further payments can be taken and, in principle, disputed.

Report it through the app or by phone

Most banks now let you raise this in the app. At Santander, for example, the quickest route for a card payment is to tap the transaction you do not recognise and select 'Help with this transaction'⁹. Ulster Bank's app works differently: you click on the transaction, select 'Report a dispute, fraud or scam', then follow the remaining steps that suit the situation¹⁰. The wording varies by bank, but the shape is the same: find the payment, open it, and look for the dispute or fraud option.

If the app does not offer that, or you would rather speak to a person, phone the number on the back of your card. Independent guidance is consistent on this: if you have lost money or spotted an unauthorised transaction on your account, contact your bank immediately using the phone number on the back of your card¹¹. Independent Age gives the same instruction, adding that the number on a recent statement works too⁵.

A few practical points. Check how to report your phone as lost or stolen on your banking app or website before you need to, so you know the route if it happens¹². If you receive a SIM swap notification you did not request, contact your mobile provider immediately and inform any other businesses that use your mobile number for verification, including your bank¹³. And if you have given card details away to a fraudster, the bank is still the first call.

What your bank does once you report it

The bank's duty is set out in regulation. It must refund the amount of the unauthorised payment transaction to the payer and, where applicable, restore the debited payment account to the state it would have been in had the unauthorised payment transaction not taken place². In plain terms: the money comes back, and any knock-on charges caused by the missing money should be put right too.

The Payment Services Regulations and the Banking Conduct of Business rules place obligations on banks and building societies to provide a refund in these circumstances⁴. The burden sits with the bank. If you claim the use of the card was not authorised by you, it is for your bank to prove otherwise³. That is a meaningful protection: you do not have to reconstruct your movements or account for your password.

Some firms state the same promise in their own terms. NS&I says that if you did not authorise a payment from your account, it will normally return the account to the position it would have been in had the unauthorised payment not happened¹⁴. Its Income Bonds terms add the qualification that this applies unless the customer failed to take reasonable care or did not report lost security details promptly¹⁵. That qualification is the one to watch across the market: the refund duty is strong, but it is not unconditional.

If the bank will not give your money back, you can report them to Trading Standards³. For a bank transfer scam rather than an unauthorised card payment, the route is different, and a refused refund can go to the Financial Ombudsman Service.

Keep checking your accounts for more unfamiliar activity

One unrecognised payment is rarely the whole story. Check your transactions regularly for payments you do not recognise, and turn on your bank alerts so that spending shows up as it happens¹⁶. If you see spending you do not recognise, contact your bank immediately¹⁷.

The checks worth building into a routine are these. Check bank statements regularly and report any unrecognised transactions to your bank immediately¹⁸. Check your card statements and bank account balance for unfamiliar transactions after returning from overseas, and call your bank immediately if you spot one¹⁹. Check your bank account and credit card statements regularly for transactions you do not recognise, and check your credit file frequently for unrecognised accounts or unusual credit rejections²⁰. Regularly checking your credit report can help you spot suspicious activity, giving you a chance to report it before it goes too far²¹.

Watch for the wider signs of identity fraud too: purchases you did not make and charges you do not recognise on credit card and bank statements are among the warning signs²². Payments on your account that you do not remember making could be a sign a criminal has accessed your account¹³. Transactions you did not make are a warning sign of digital wallet fraud²³. Identity fraud involving plastic cards, online banking or cheques should be reported directly to the financial institution concerned²⁴.

If you find more unrecognised transactions after reporting the first, report those as well, and keep checking. Any further payments taken by a business after you cancel a recurring card payment are considered to be unauthorised transactions²⁵. For a recurring payment you have cancelled, you must report it as soon as possible or, in any event, within 13 months of the date the unauthorised payment was made²⁶. If a payment is taken after consent is withdrawn, your bank should give you a refund including any interest or charges added to your account²⁷.

Where the protection stops

The refund duty is strong but not absolute. NS&I's terms make the standard qualification explicit: it will normally refund unauthorised payments and restore the account unless the customer failed to take reasonable care or did not report lost security details promptly¹⁵. The 13-month deadline is a hard backstop: notify later than that and the entitlement to redress falls away¹.

Two situations are commonly confused with an unrecognised payment, and neither follows the same route. The first is a payment you authorised but now regret, such as a scam where you were persuaded to send money yourself. That is a different regime, with its own rules on reimbursement and its own grounds on which a bank can refuse. The second is money sent to the wrong account by mistake: if the account exists, you need to contact your bank to request your money back, and if the recipient disputes its return, the bank will investigate, with 15 business days allowed for that²⁸.

There is also a distinction between a card payment and a bank transfer. With a credit or debit card you have some rights to get your money back; with a bank transfer, contact your bank immediately²⁹. If you are asked to pay for something online by bank transfer, the guidance is blunt: do not do it²⁹.

Where a bank has failed or stopped serving customers, the position is different again, and the relevant compensation scheme rather than the payment rules applies. For free, impartial help on any of this, MoneyHelper offers guidance on banking problems, and the Financial Ombudsman Service can look at a complaint once the bank has had its chance to respond.