An unauthorized transaction dispute starts with someone the customer never authorized; a billing error dispute starts with a charge the customer authorized but something went wrong. The two feel identical on the phone — "I want my money back" — but they run under different rules, different clocks, and different evidence. Regulation E gives an unauthorized electronic transfer a 10-business-day investigation with provisional credit; Regulation Z gives a billing error 30 days to acknowledge and two billing cycles to resolve, with no credit advanced; and a suspected first-party dispute, where the evidence says the customer made the purchase, belongs to neither category until someone proves it. The analyst's first job is not fraud or not fraud. It is which rule — because the rule decides the clock, and the clock is already running. Botminds' Card Dispute Management classifies each charge at the moment its notice is read, before any investigation starts.
The examples come from the solution's fictional sample bank, Silverpine Bank, and Rachel Dunmore's claim of 29 September: three charges on two cards, each of which lands in a different track. The regulations quoted are the current text of 12 CFR 1005 and 12 CFR 1026.
The first decision is not fraud or not fraud — it's which rule
Customers do not call in regulatory categories. They say "I didn't buy this," which can mean my card details were stolen (Regulation E unauthorized transfer, or a network counterfeit-fraud chargeback), or the merchant never delivered (a Regulation Z billing error), or the customer made the purchase and regrets it (no rule category at all until the evidence says otherwise). Each meaning starts a different file, gathers a different packet of evidence, and answers to a different deadline. In the CFPB’s complaint data, the most common credit card issue was a problem with a purchase shown on the statement, and in those complaints consumers often disputed transactions which they stated were the result of outright fraud or errors on the part of merchants (CFPB Consumer Response Annual Report, March 2023) — the same two meanings, arriving mixed together. So the classification problem arrives at volume — and it must be made in minutes, not after a week of investigation, because the 10-day clock does not wait for certainty.
The classification is provisional and reviewable, which is what makes speed possible. The notice reader names the most likely rule per charge; the analyst confirms or changes it when the evidence arrives; the file shows which rule each charge ran under and why. A wrong initial classification is a paperwork fix if it is caught early and a violation if it lets a clock run out on the wrong track.
The classification, question by question: notice in, rule out
Debit, ATM or prepaid — an electronic fund transfer out of a deposit account — goes to Regulation E. A credit card charge goes to Regulation Z. Different money, different rule.
No one was — or the customer got no benefit from it — that is an unauthorized transfer under Reg E, or unauthorized use on the credit side. Someone was, and something else went wrong — keep going.
Not delivered as agreed, never accepted, a payment not credited, an accounting mistake, and the rest of 12 CFR 1026.13(a) — if it fits, it is a billing error notice with Reg Z's clocks, whatever the customer calls it.
Device match, a used ticket, timing — that is a first-party signal, screened and shown to a person. A signal is never a rule category and never a reason to deny on its own.
What makes a transaction 'unauthorized' under Reg E
Regulation E is precise about the word. Under 12 CFR 1005.2(m), an unauthorized electronic fund transfer is one "initiated by a person other than the consumer without actual authority", from which the consumer receives no benefit. Two consequences follow. First, the family member or ex-partner who still has the card you gave them is generally not an unauthorized user until you tell the institution their authority is revoked — that is a dispute with the person, not an error in the transfer. Second, the test is about authority, not about the customer's feelings: a charge made with the customer's own card, from the customer's own device, points toward an authorized transfer, whatever the customer says on the phone, until the evidence shows the card or device was out of the customer's control. The definition also excludes a transfer initiated "with fraudulent intent by the consumer or any person acting in concert with the consumer", which is where a proven first-party claim lands.
Timing matters as much as the definition. The CFPB's electronic fund transfer FAQs confirm that error resolution applies when notice arrives within 60 days after the institution sends the periodic statement showing the transaction — so a charge from April noticed in July may be outside the error-resolution window entirely, whatever it is. Notice that the window runs from the statement, not the transaction, and that oral notice counts: the phone call that starts the classification is itself the notice that starts the clock. The same FAQs close a trap that card network rules can set: some networks require notice "within 60 days of the date of the transaction", but "less protective rules do not change a financial institution's Regulation E obligations", so a desk that rejects a debit claim because it missed a network window has applied the wrong rule.
The seven kinds of billing error under Reg Z, and where disputes usually land
Regulation Z does not use the word fraud in its billing error rule at all. 12 CFR 1026.13(a) defines a billing error as a reflection on a periodic statement of any of seven things — from a charge "not made to the consumer" or made in a different amount, through goods or services "not accepted by the consumer or the consumer's designee, or not delivered to the consumer or the consumer's designee as agreed", to a computational error and the creditor's own failure to send the statement to the last known address. A request for clarification or documentary evidence is itself a billing error. The protection attaches to the consumer's written notice, received within 60 days of the first statement reflecting the alleged error (12 CFR 1026.13(b)(1)).
Regulation Z's seven billing errors, in the regulation's own order
- A charge not made to you — or not in the amount shown
Including a charge made by someone without actual, implied or apparent authority to use the account. 12 CFR 1026.13(a)(1).
- A charge the statement fails to identify properly
The extension of credit was not identified in accordance with the statement rules. 12 CFR 1026.13(a)(2).
- Goods or services not accepted, or not delivered as agreed
The workhorse category — see the next section. 12 CFR 1026.13(a)(3).
- A payment or other credit the statement failed to reflect
You paid, or a credit was due, and the statement did not show it. 12 CFR 1026.13(a)(4).
- A computational or similar accounting error
Arithmetic of the account, not of the purchase. 12 CFR 1026.13(a)(5).
- Your request for clarification or documentary evidence
Asking for documents about a specific charge is itself a billing error. 12 CFR 1026.13(a)(6).
- A statement never mailed to your last known address
The creditor's own delivery failure is the consumer's billing error. 12 CFR 1026.13(a)(7).
Where disputes actually land: most card-not-present disputes that are not outright theft are (a)(3) — not delivered, not as agreed — or (a)(1) when the card details were used without authority. The purely mechanical categories, (a)(4) and (a)(5), are rarer on cards and commoner on lines of credit. Category (a)(6) is the one desks forget: a customer who writes in asking for the documentation behind a charge has filed a billing error notice, and the 30-day acknowledgment clock has started whether the desk noticed or not.
Not delivered, not as agreed: the category customers hit most
The third category deserves its own section because it carries the everyday weight. Goods ordered and never arrived; services booked and never performed; deliveries signed for by someone else at another address — the regulation covers them with one phrase: an extension of credit for property or services "not accepted by the consumer or the consumer's designee, or not delivered to the consumer or the consumer's designee as agreed" (12 CFR 1026.13(a)(3)). No fraud needs to be proved, and none should be alleged: the merchant's delivery claim is tested against the delivery evidence, and if the tracking ends at a front desk in another state, the category is satisfied on the documents.
not accepted by the consumer or the consumer's designee, or not delivered to the consumer or the consumer's designee as agreed
12 CFR 1026.13(a)(3), the billing-error definition
The sample claim's Lumen charge is the worked example. The merchant answered that the bookcase was delivered, with a tracking number. The carrier's record for that number ends at a front desk in Tacoma, Washington; the customer's order ships to Columbus, Ohio. No fraud theory was needed, none was drafted: the purchase was credited, and the recovery went through the network as a not-received chargeback. The classification did the work.
When one notice splits into two or three claims
One call, split into three transactions before any clock is miscounted
The unit of classification is the charge, not the conversation. Rachel Dunmore's call of 29 September named three charges on two cards; the desk's file carries three transactions: the Reno debit charge — classified as an unauthorized transfer, supported by the card's own history, a chip read with a PIN in Columbus at 16:51 and a magnetic-stripe swipe at a chip-capable terminal in Reno, 1,950 miles away, fifteen minutes later; the Lumen credit charge — a not-delivered-as-agreed billing error; and the SkyHarbor credit charge — disputed, but with device, IP and travel evidence pointing at the cardholder, so it is screened as suspected first-party abuse rather than filed under any rule category. One customer, one call, three tracks, three clocks, three evidence packets.
The three tracks one phone call can start, side by side
| Reg E error resolution | Reg Z billing error | Network chargeback | |
|---|---|---|---|
| Typical charge | Debit or ATM: a transfer the customer did not authorize or that went wrong | Credit card: goods not delivered as agreed, payment not credited, and the other (a) categories | Either card: recovering money from the merchant through Visa or Mastercard |
| What starts it | Any oral or written notice, within 60 days after the statement | A written billing error notice, within 60 days of the first statement showing the error | A reason-coded filing inside the network's own windows |
| The clock | 10 business days to decide or credit; up to 45 — 90 for point-of-sale, foreign and new-account transactions — to finish | Acknowledge within 30 days; resolve within two complete billing cycles, 90 days at most | Network deadlines for filing, answering and pre-arbitration |
| The evidence | The authorization log: entry mode, chip, terminal, device, IP, location, card status | The merchant's records tested against delivery and service proof | The merchant's representment, checked against the bank's own records |
| Who decides | The dispute analyst; fraud denials above $1,000 take a second signature | The dispute analyst; denial letters state the reason and the documents the customer may ask for | The analyst with the chargeback specialist's reading |
First-party fraud: a signal, not a rule category
Some disputes are neither unauthorized transfers nor billing errors: the evidence says the customer made the purchase — their device, their IP, a ticket they used — and disputes it anyway. No regulation creates a category called first-party fraud, and a desk that treats the signal as a classification will deny claims on a screen's say-so, which is how banks end up in enforcement actions. The CFPB's USAA order is the standing lesson: roughly $12 million in restitution for a bank that failed to initiate and complete reasonable error resolution investigations — the failure was in the process, not the outcome.
The defensible handling is to screen, not classify. The first-party screen weighs signals — device and IP match, a used ticket, timing, earlier disputes — and shows each with its weight and its source. In the sample claim it rates SkyHarbor strong on three of five signals, and notes that the customer's two earlier disputes in 24 months were small, in her favor, and show no pattern. Then a person reads the evidence and decides. The signal's place in the file is exactly there: visible, sourced, and never the decision.
Two card reads, fifteen minutes and 1,950 miles apart
What happens if the wrong rule gets picked
Usually, at first, nothing — which is what makes it dangerous. A billing error worked as if it were fraud investigation wastes days gathering the wrong evidence, but the deeper failure is the clock: a charge filed under the network's chargeback process may have its Reg E or Reg Z deadlines passing unmonitored, and a denial issued on the wrong rule collapses under the first complaint, because the letter cannot state the reason the regulation requires. Under 12 CFR 1005.11(c) the institution "shall investigate promptly"; a misclassified investigation is, by definition, not investigating the notice the customer actually gave. The correction is structural: classify at intake, per charge, review the classification when the evidence arrives, and keep the rule each charge ran under on the file where an examiner can see it.
Is a disputed subscription a billing error or fraud?
Usually neither, at first — and the distinction is the whole lesson. A recurring charge the customer signed up for and now disputes is an authorized transfer: the card details worked exactly as the customer allowed. If the customer cancelled and the merchant kept billing, that is a billing error under the not-as-agreed category, worked against the cancellation evidence. If the customer never signed up at all and the card details were taken from somewhere else, it is an unauthorized transfer (Reg E) or a charge not made to the consumer (Reg Z (a)(1)). The customer's word "scam" tells you the charge felt wrong; the evidence — a signup record, a cancellation, a device match — tells you which rule runs. Card Dispute Management starts each charge on its own clock so the classification, not the call, decides.
Questions people ask
What counts as an unauthorized transaction?
Under Regulation E, an electronic fund transfer initiated by someone other than the consumer, without actual authority, from which the consumer receives no benefit (12 CFR 1005.2(m)). The key word is authority: charges made by someone you gave your card to are generally not unauthorized until you revoke that authority with the bank. The test is about authority, not about whether you like the charge.
Is a billing error the same as fraud?
No. A billing error is a Regulation Z category covering things that went wrong with a charge you may have authorized — goods not delivered as agreed, payments not credited, accounting errors — and it requires no fraud at all. Fraud is a fact about who made the charge; a billing error is a fact about what went wrong with it. Many disputes are one and not the other, and the evidence packet differs for each.
What is a billing error under Reg Z?
Any of seven things reflected on a periodic statement: a charge not made to you or in the wrong amount; a charge the statement failed to identify properly; goods or services not accepted or not delivered as agreed; a payment or credit the statement did not reflect; a computational or accounting error; your request for clarification or documentary evidence; or a statement never mailed to your last known address (12 CFR 1026.13(a)(1)–(7)).
Who decides if a transaction is unauthorized?
The bank decides, on the evidence, after investigating — and a fraud denial above $1,000 takes a second signature on a well-run desk. The evidence is the authorization log: entry mode, chip or magnetic stripe, terminal, device, IP and location, against the customer's account history. The customer's statement starts the clock; the documents decide the classification.
If goods never arrive, is that fraud or a billing error?
A billing error — goods or services "not accepted by the consumer or the consumer's designee, or not delivered to the consumer or the consumer's designee as agreed" is the third Reg Z category (12 CFR 1026.13(a)(3)). No fraud needs to be proved. The merchant's delivery claim is tested against the delivery evidence, and a tracking number that ends somewhere else satisfies the category on the documents.
Does a disputed subscription count as an unauthorized transaction?
Not if you signed up for it — a subscription you authorized is an authorized transfer, even one you regret. If you cancelled and the merchant kept billing, that is a not-as-agreed billing error; if you never signed up and your card details were taken, it is an unauthorized transfer on a debit card or a charge not made to you under Reg Z on a credit card. The evidence, not the feeling, decides which.
Can one phone call become more than one type of claim?
Routinely. One call about three charges on two cards can carry an unauthorized transfer under Reg E, a not-delivered billing error under Reg Z, and a first-party signal screened for a person — each with its own clock, evidence packet and letter. The unit of classification is the charge, never the conversation.