When a customer disputes a card charge, the bank investigates by turning one notice into one file per disputed transaction: it names the rule each charge answers to — Regulation E for a debit claim, Regulation Z for a credit card billing error, the card network’s dispute rules on top — then gathers the evidence each claim rests on, from the authorization record to the merchant’s reply, and closes with a written decision a named analyst signs. That is how banks investigate disputes, and it is harder than it sounds because the evidence sits in four or five systems, each charge runs its own clock, and a first-party abuse signal is easy to mistake for a reason to deny. Botminds' Card Dispute Management is built around that investigation: six specialist agents read the notice, count the clocks, pull the records, weigh the signals and draft the decision, and the dispute analyst decides and signs. This page walks the investigation the way an examiner would read it afterwards — and asks the only question that matters months later: does the file show that anyone looked?
How banks investigate a card dispute, step by step
The sequence is the same at every issuer, whatever tools the desk uses. First the notice is read and split: one call or written notice often carries several charges, and each disputed charge becomes its own file with its own rule and its own clock. Second, the evidence is gathered — the authorization for each charge, the merchant’s reply, the carrier record where goods are claimed delivered, the account history, the call note itself. Third, the signals are weighed: whether the customer’s own devices, addresses or travel patterns sit oddly against the claim. Fourth, a decision is drafted per transaction — credit or deny — with a written explanation for any denial, and a named analyst signs. The investigation is only as good as the file it leaves behind, because that file is what the customer, the examiner and the court will ever see of it.
Run it on a sample claim in Card Dispute Management. Rachel Dunmore calls Silverpine Bank — the people and the bank are invented sample data — to dispute three charges on two cards, $2,286.15 in all. One click starts the investigation run: the notice reader splits the call note and the app form into three transactions and names each rule, the clock keeper checks four clocks against the bank’s business-day calendar, the transaction investigator pulls the authorizations and ninety days of activity, the merchant and network evidence agent reads the two merchant replies, the first-party screen weighs five signals, and the resolution drafter writes the recommendation. The run takes 85 seconds. What matters is not the speed; it is that every finding lands on the transaction it belongs to, linked to the record it came from.
Card Dispute Management: one investigation run, every finding on the transaction it belongs to
What “reasonable investigation” actually requires
The law sets the floor. Under Regulation E, a financial institution must investigate promptly and determine whether an error occurred within 10 business days of the notice — or provisionally credit the customer and take up to 45 days, 90 for point-of-sale, foreign-initiated and first-30-day transfers on a new account (12 CFR 1005.11). The Federal Reserve’s examiner magazine states the practical test in one sentence: “A reasonable investigation includes reviewing relevant information within the institution’s records” (Consumer Compliance Outlook, Third Issue 2025). Read it twice. The obligation is to review — not to glance, not to average, not to let the merchant’s answer stand unopened. An institution that never pulls its own authorization log, its own dispute history or its own customer records has not run an investigation, whatever its letter says.
Two corollaries follow. Provisional credit is part of the standard, not a courtesy: where the investigation cannot finish inside 10 business days the customer’s money moves first, with interest where it applies, and the same examiner article lists late or missing provisional credit among the violations found most often. And the duty to investigate is independent of what the card network decides — the network fight over a chargeback runs beside the legal duty to the customer, not instead of it. The two clocks a bank runs at once are mapped in Reg E and Reg Z, side by side.
The evidence a bank reviews: authorizations, replies, records, history
A defensible file holds evidence from four directions, and each answers a different question. The authorization answers “could this have been her?” — entry mode, chip or stripe, terminal, device, location. On the sample claim the Reno charge was read by magnetic stripe at a chip-capable terminal fifteen minutes after the same card’s chip-and-PIN read in Columbus, 1,950 miles apart: the record itself makes the argument. The merchant reply answers “what does the other side say?” — and nothing more until it is checked. The carrier record answers “did it arrive?” — Lumen’s reply says a walnut bookcase was delivered on 28 August; the carrier record for its own tracking number ends at a front desk in Tacoma, 2,000 miles from the customer’s address, and the reply collapses on contact with it. The account history answers “does this customer fit a pattern?” — weighed as context, never as a verdict.
Every finding in the file cites the record it rests on, so the analyst reads the evidence, not a summary of it. That is the difference between an investigation and a workflow: a workflow can close a claim on schedule with nothing behind it, and for years nobody can tell the difference. The difference only becomes visible when the file is challenged — by the customer, by an examiner, or by a regulator reading a sample of closed claims.
What a dispute file that can survive a second look contains — the checklist Card Dispute Management keeps on every claim
- The notice, tied to each transaction
The call note or written notice itself, split into charges, with what the customer said kept as evidence.
- The rule named per charge
Reg E for the debit claim, Reg Z for each credit card charge, the network’s rules on top — each clock written down.
- The authorization record for each charge
Entry mode, chip or stripe, terminal, device, IP and location, read from the bank’s own log.
- Every merchant reply, read and checked
The reply quoted, the tracking number looked up, the claim never settled on the merchant’s word alone.
- The customer’s history, weighed as context
Earlier disputes and activity patterns shown with dates — context for the judgment, never the reason for it.
- Signals shown with their source
Each first-party signal with its weight and the record behind it; a signal is never the decision.
- The decision, its evidence and the written explanation
Credit or deny per transaction, the records relied on, and for a denial the reason and the documents the customer may ask for.
- Who decided, who co-signed, and when
The signature with its meaning, the second signature where the limit requires it, the times — nothing edited after the fact.
What USAA’s $12 million order shows about skipping evidence
The enforcement record says the same thing the regulation says, at a price. In January 2019 the Consumer Financial Protection Bureau ordered USAA Federal Savings Bank to pay approximately $12 million in restitution and a $3.5 million civil money penalty, including for what the bureau called failing to initiate and complete reasonable error resolution investigations — error claims denied without the investigation the law requires (CFPB enforcement action, January 3, 2019). The point for a dispute desk is not the size of the bank or the era. It is that the failure was procedural: files closed without the looking. No technology gap explains it, because looking is not expensive. What is expensive is building a desk whose only measure is closure, so an analyst who closes thirty claims a day is never asked what was inside them.
What the Block Inc order adds to the standard
The more recent order widens the lesson. In January 2025 the bureau ordered Block, Inc. — the company behind Cash App — to pay at least $75 million and up to $120 million in consumer redress and a $55 million civil money penalty, finding the company had “failed to comply in multiple ways with the requirements of EFTA and Regulation E, including regarding error resolution” (CFPB enforcement action, January 16, 2025). Two things matter here. First, the rule follows the account, not the charter: Block is a nonbank running a payments app, and the order still applied the oldest finding in the book, error claims not resolved as Regulation E requires. The bureau also found that Block "used the card network chargeback process as a substitute for fulfilling its obligations" to investigate unauthorized-transaction disputes, which is the network-versus-law confusion in its plainest form. Second, the amounts have moved: restitution, redress and penalties across these two orders come to between about $145 million and $190 million, depending on how much of Block's redress range is paid.
Two orders, six years apart, scored against the four tests a file must answer
Did anyone review the bank’s own records?
Faulted: error claims were denied without a reasonable resolution investigation.
Faulted: EFTA and Regulation E error-resolution requirements broken in multiple ways.
Was the customer’s money made good on the clock?
About $12 million ordered back to consumers.
At least $75 million, up to $120 million, ordered in redress.
Did the decision rest on evidence that was looked at?
Investigations were not initiated or completed.
Errors were not resolved as the regulation requires.
Was the penalty separate from the harm?
$3.5 million civil money penalty on top of restitution.
$55 million civil money penalty on top of redress.
Do banks look at past transactions? Yes — and the file must show it
A reasonable investigation uses what the bank already knows about the customer, and says so. On the sample claim, the first-party screen found the SkyHarbor ticket was bought from the same phone and home connection as the customer’s banking app, matching two earlier undisputed purchases, and that she boarded the flight four days after disputing it. It also showed what cut the other way: two earlier disputes in twenty-four months, both small and both resolved in her favour, which show no pattern of abuse. Both belong in the file, because an analyst who sees only the incriminating half is not investigating — and an analyst who is shown a score instead of the evidence is being asked to sign someone else’s guess. Where the line between a signal and a decision must sit, and why the law keeps it there, is the subject of what an AI may decide in a fraud dispute.
Can a bank rely on the merchant’s side of the story alone?
No — and the file proves it the moment the reply is checked. A merchant’s answer is one input, produced by the party that keeps the money if the claim fails. On the sample claim, Lumen’s reply was specific: order number, shipping date, a tracking number. Checked against the carrier, the parcel on that number ended in Tacoma, not Columbus. A desk that takes the reply unexamined either pays a loss it did not owe the customer or denies a claim it did — both are findings waiting to be written. The same discipline applies to the customer’s own statement: her word opens the investigation; it does not close it. The weighing of both sides is what “reasonable” means in practice, and it is why the quality of an investigation is inseparable from the evidence file it leaves behind.
The file in evidence view: the merchant’s reply on the left, the carrier’s record answering it on the right
What happens when an investigation is found inadequate — and how long the file must hold
The bill arrives in three parts, and the USAA and Block orders show each of them. First, restitution or redress: the customers whose claims were mishandled are paid back, at tens or hundreds of millions where the practice ran wide. Second, a civil money penalty on top, set partly by how systemic the failure was. Third, the remediation: orders of this kind require the practices to change and the bank to show that they have, which is work on top of the payments. None of it requires bad intent. The findings describe desks that were busy, not corrupt — which is precisely why the only defence is a file that shows the looking happened.
The file must be able to say so for years. Regulation E requires an institution to retain evidence of compliance — including the error-resolution file — for at least two years, and longer while any investigation or enforcement matter into it is open (12 CFR 1005.13). In practice the examiner’s lookback reaches further than the minimum: a sample of claims closed eighteen months ago is read with the same care as last week’s. What happens to the customer side of a denied claim, and what a denial letter owes her, is set out in why card disputes get denied.
The other kind of file: evidence that points back at the customer, with the checks a denial must pass
Questions people ask
How do banks investigate a credit card dispute?
The bank names the rule the charge answers to — for a credit card claim, Regulation Z — acknowledges the written notice within 30 days, gathers the authorization, the merchant’s reply and the account history, and resolves within two complete billing cycles, never more than 90 days (12 CFR 1026.13). The investigation must actually review the bank’s own records; a reasonable investigation, in the Federal Reserve’s words, “includes reviewing relevant information within the institution’s records.”
What evidence does a bank look at for a dispute?
The authorization record for the charge — entry mode, chip or stripe, terminal, device, IP and location; the merchant’s reply, checked against sources like the carrier’s delivery record; the customer’s account history and earlier disputes; and the notice itself, kept as evidence. Each finding in a defensible file cites the record it rests on.
What makes a dispute investigation “reasonable” under the law?
That it reviewed the relevant information available to the institution and resolved the claim on its clocks — 10 business days or provisional credit under Regulation E, acknowledgement in 30 days and resolution in two billing cycles under Regulation Z. Regulators have ordered restitution and penalties where investigations were never initiated or completed, as in the 2019 USAA order and the 2025 Block order.
Do banks look at past transactions when investigating a dispute?
Yes — account history and earlier disputes are part of the relevant information in the institution’s records. They are weighed as context for the decision, never as the decision itself: a first-party signal is shown with its source, and a claim is denied on evidence, not on a pattern score.
How long does a bank keep dispute evidence?
Regulation E requires evidence of compliance, including error-resolution files, to be kept at least two years, and longer while any investigation or enforcement matter is open (12 CFR 1005.13). In practice examiners sample claims closed well over a year before, so the file has to speak for itself long after the analyst has moved on.
Can a bank rely only on the merchant’s side of the story?
No. The merchant’s reply is one input from an interested party, and the duty to investigate is the bank’s own. A reply that says “delivered” has to survive contact with the carrier record; one that says “she made the purchase” has to survive the same checks in reverse. Taking either side unexamined is how files fail a second look.