A charge you did not make, arriving alongside something in the account you also did not make: an unrecognised device or active session, a delivery address you never added, a changed recovery email or phone, a second order in the same period, or a gift-card balance drained.
How to Handle an Unauthorized Amazon Purchase
A charge you did not make runs on two clocks: the attacker's, which starts first, and your dispute window, which starts second. Here is the order that protects you: secure, triage, dispute, monitor, escalate, using official Amazon and card-issuer routes only.
General information only. This guide explains the shape of handling an unrecognised charge. Account menus, dispute windows and refund rules vary by region, payment method and account, so check your platform's Help pages and your card issuer, and read our disclaimer.
The Situations
Four Situations Behind an Unauthorized Charge
The secure-before-you-dispute reframe — the wallet is open and the attacker's clock runs, so the first move is to secure, not to argue. There is a charge I did not make, so I will call the card issuer right now and dispute it before anything else. While you build the dispute file, the account may still be open — the session live, the payment method saved, the address editable — and the attacker can make a second charge. The order is secure → triage → dispute → monitor → escalate: change the password, check or enable two-step verification, sign out the sessions and devices, remove or flag the unauthorised payment method and address, and only then build the dispute on the dated record. The attacker's clock runs first; the dispute window runs second. This is the reframe the page exists to make, and it is the most carefully hedged line in the batch, because the naive version — "argue the charge immediately" — leads a reader to fight the first charge while the wallet stays open for the second, and the second naive version — "report every unfamiliar charge as fraud" — leads a reader to fail a dispute over a teenager's purchase.
The honest position is neither panic nor passivity: the charge is real and the dispute matters, but the order is what protects you, and the triage is what keeps the dispute honest. Secure first, because the wallet is the attacker's door; triage second, because not every unfamiliar charge is fraud; dispute third, on the dated record; monitor fourth, because the attacker's clock may not have stopped; escalate fifth, through the right route. The page teaches the order and the triage; it does not assert a universal fraud window, a guaranteed refund, or a claim outcome, because those are the payment provider's, the platform's, and the law's to state. The most common loss is the second charge made while the reader was on hold arguing the first; the second most common is the fraud report filed over a household purchase or a forgotten subscription, which can fail the dispute and flag the reader's own account instead of the attacker's.
Quadrant 1 — the account is compromised
What it looks like
The tell
The account state moved, not just the money. This is a takeover, and a card-only dispute will not close the door that opened it.
The route
Full secure sweep first (credentials, sessions, wallet, doorstep), then the platform's security process and the payment provider's fraud process, then monitor for days, then escalate. Where a crime is suspected, the police.
Quadrant 2 — the instrument is compromised
What it looks like
A charge you did not make where the account itself is clean: every session and device is yours, the address book is yours, the recovery details are unchanged — and the same card shows unfamiliar charges at other merchants too.
The tell
The card number travelled outside this one platform. The platform's account was never entered, so sweeping its sessions will find nothing.
The route
The payment provider's fraud process is the primary route; remove or replace the card, check where else it is saved, and notify the platform so the saved instrument is updated rather than left stale.
Quadrant 3 — a household member made it
What it looks like
An unfamiliar charge made from a device you recognise, on a session that is yours, with a delivery address that is yours, in a pattern consistent with the household — a teen's game add-on, a housemate's order, a child's in-app purchase.
The tell
Everything in the account state points inward. This is a household-governance event wearing the costume of a fraud event.
The route
A conversation, then the platform's parental or permission controls and a spending limit — not a fraud claim. The boundary callout below is the load-bearing guardrail here.
Quadrant 4 — you authorised it and forgot
What it looks like
A recurring or one-off charge that matches a trial that converted, a subscription you meant to cancel, a digital add-on with auto-renew, or an authorisation you gave months ago and never wrote down.
The tell
The order history explains it once you look. The charge is not unfamiliar; the memory is.
The route
Verify against the order and subscription records, cancel or change the renewal through the benefits guide's route, and use the platform's digital-content refund route where it applies — reporting a charge you authorised as fraud can fail the dispute and strain the provider relationship.
The quad is the page's entire triage compressed into four boxes, and its power is that it forces the question whose charge is it? before the question how do I dispute it? The two naive reflexes the grid refuses are the ones that cause the most damage: treating every unfamiliar charge as a takeover (which wastes the household and forgotten-subscription resolutions, and can flag your own account), and treating every unfamiliar charge as a card problem (which leaves an open account door swinging). Quadrants 1 and 2 look identical from the statement and are completely different from the account — which is why the sweep of the sessions, the address book, and the other merchants comes before the dispute is filed, not after it is denied. And quadrants 3 and 4 are not fraud at all; they are the two most common explanations for an unfamiliar charge, and the page says so plainly, because a reader who learns the fraud route without learning the triage has learned a weapon they will point at the wrong target.
The fraud claim — you did not authorise the transaction
- The object — an unauthorised charge: no consent, no initiation, no benefit received by you
- The evidence — the account-state story: the session list, the device list, the address book before and after, the recovery-detail change, the timestamps you can account for
- The route — the payment provider's fraud process and the platform's security process, in that order after securing
- The clock — the provider's fraud window, which is the provider's to state, not ours
- The failure mode — filing it while the account is still open, or filing it over a quadrant-3 or quadrant-4 charge
The dividing line is one question: did you authorise this transaction? Yes-and-the-goods-failed is a not-as-described claim; no-never-authorised-it is a fraud claim. The evidence sets differ, the routes differ, the clocks differ, and the consequences of mixing them differ — a not-as-described order reported as fraud can be denied on the papers and can flag your account, and a genuine fraud routed as a return leaves the attacker's door open while you negotiate a refund. The triage decides the route; the route decides the evidence; the evidence decides the claim. Do not reverse that order in a hurry.
The not-as-described claim — you authorised it, the outcome failed
- The object — an authorised charge where the goods or service did not arrive as agreed: wrong item, damaged, missing (113), not delivered, or a subscription you cancelled that billed anyway (116)
- The evidence — the dated chronology: order, tracking, both timestamps, the proof-of-delivery photo, the cancellation record, the chat transcript
- The route — the platform's return or claim process first (114, 113), then the payment provider on that ground if the platform does not resolve it
- The clock — the return window and the claim window, both local and category-specific (114)
- The failure mode — routing it as fraud, which discards the chronology you built and invites a denial on the authorisation question
The two bands and the divider are the page's routing discipline in one distinction, and its power is that it converts a reflex ("this is fraud") into a determination ("did I authorise it?"). The failure mode the split prevents is the sympathetic one: a reader who, alarmed by an unfamiliar charge, reaches for the strongest-sounding label and files a fraud claim over a delivery that went wrong (113) or a trial that converted (116) — and is denied, because the papers show an authorisation, and who then has to rebuild the claim on the right ground while the window narrows. The discipline is to answer the authorisation question first, honestly, using the quad, and to pick the route that matches the answer. And the honest limit is that the windows and the outcomes belong to the provider, the platform, and the law; the page routes, it does not promise.
The incident-response sequence — secure → triage → dispute → monitor → escalate
1
Secure the credentials before you touch the chargeChange the password from a device you trust, check whether two-step verification is on and whether the second factor is yours, and inspect the recovery email and phone — because a changed recovery detail is the attacker's persistence route and will undo a password change you make without fixing it.
The 111 surfaces become 118's first actions: the same payment methods, addresses, and sessions you review on a calendar are the ones you sweep in an incident, and the order is the same — the door before the contents.
2
Kill the sessions and the spare keysSign out all active sessions and remove every device you do not recognise. A live session on the attacker's device is an open door that survives a password change, which is why this rung sits immediately after the credentials and not at the end.
The 111 device-and-session tell in incident form: a forgotten key is a spare key, and in a takeover it is the attacker's.
3
Sweep the wallet and the doorstepRemove or flag every payment method you did not add, every delivery address you do not recognise, and check the gift-card balance and the linked accounts. Note what you found before you change it, because the before-state is evidence in the claim you are about to build.
The 113 diversion tell, seen from the charge side: an unauthorised address alongside an unauthorised charge is a takeover signature, not a card problem.
4
Contain the instrument, and check where else it livesIf the triage points at the card rather than the account, use the issuer's lock or replacement route, and check whether the same card is saved at other merchants — because an instrument that travelled will show up beyond this one platform, and that is the fact that separates quadrant 2 from quadrant 1.
Do not cancel the card as a substitute for sweeping the account, and do not sweep the account as a substitute for containing the card. The triage tells you which, and sometimes it is both.
5
Run the four-way triage and write down the answerBefore filing anything, decide which quadrant you are in: account compromised, instrument compromised, household member, or forgotten authorisation. Write the answer and the reason. Quadrants 3 and 4 leave the fraud route entirely and go to the boundary callout and the benefits guide respectively.
The hardest discipline on the page: the triage comes before the claim, and an honest triage sometimes means there is no claim to file.
6
File on the right route with the dated record and one clear askFraud quadrant: the platform's security process and the provider's fraud process, with the account-state evidence. Not-as-described quadrant: the platform's return or claim process, with the chronology (113, 114). Either way, one clear ask — a refund or a reversal — stated once, with the exhibits attached, and keep the reference number.
The 67–69 one-clear-ask discipline: a claim built on exhibits and a single ask survives scrutiny better than a narrative of alarm, and the public post is not the claim.
7
Monitor for days, because the attacker's clock may not have stoppedWatch the statement, the order history, the account surfaces, and the alerts for a period after the incident. A second small charge can be a test; a drained gift-card balance can follow a week later; a re-appearing address means the door never shut. Re-check the sweep, not just the charge.
The 117 dependency in the open: if you muted the transactional carve-out, you have no timeline to monitor against — which is why the alert channel is a security surface, not an inbox preference.
8
Escalate on the right rung, then rebuild the hygiene that failedIf the claim is denied, escalate through the platform, then the provider, then a consumer-protection authority, then a small-claims route where the value warrants it; where a crime is suspected, the police. Then close the loop: re-run the 111 hygiene check, restore the carve-out notifications, and decide whether a shared account or a saved card across merchants was the root cause.
The 96 denied-is-not-the-end discipline, and the 111 return-to-scheduled posture: an incident ends when the hygiene resumes, not when the refund lands.
The sequence's logic is the order of operations, and the order is the whole payload: secure the credentials, kill the sessions, sweep the wallet and the doorstep, contain the instrument, triage honestly, file on the matching route, monitor for days, then escalate and rebuild — because the most common failure is not a lost dispute, it is a dispute filed first and a wallet left open, or a fraud report filed over a teenager's purchase. The discipline is to treat rungs 1 to 5 as preconditions of rung 6 rather than as optional preparation, and to treat rung 7 as part of the incident rather than as its aftermath, because a takeover that is half-closed produces a second charge and a second claim. And the honest limit is that the windows, the evidence requirements, and the outcomes belong to the provider, the platform, and the law; the page sequences the actions, it does not promise the result.
The post-incident surface sweep — what to check, in what order, and what each finding means
The recovery credentials
What to sweep
The recovery email, the recovery phone, the two-step verification method, and any passkey or authenticator enrolment you do not recognise.
Why it decides the incident
A changed recovery detail is the persistence route: fix the password without fixing it and the account reopens tomorrow. Its presence is a quadrant-1 signature, because a stolen card number cannot change your recovery email.
The sessions and devices
What to sweep
Every active session and every recognised device, with locations and timestamps where the surface shows them.
Why it decides the incident
This list is the authorisation evidence in both directions: an unrecognised device points at a takeover, and a device you recognise points at the household. Save it before you sign anything out.
The payment methods
What to sweep
Every saved card and payment instrument, the order in which they appear, and whether the charge in question used a method you added or one you did not.
Why it decides the incident
An added method you never added is quadrant 1; a clean method list with unfamiliar charges elsewhere is quadrant 2. The sweep is what separates them.
The address book
What to sweep
Every saved delivery address, and specifically any pickup point, locker, business, or private address you do not recognise.
Why it decides the incident
This is the 113 diversion tell imported wholesale. An unauthorised address alongside an unauthorised charge is the strongest single indicator that the account, not just the card, was reached.
The gift-card balance and digital credits
What to sweep
The stored balance, any recent redemption, and any digital credit that was already money inside the account rather than a charge to a card.
Why it decides the incident
A drained balance is the fastest loss and the hardest to recover, because the funds were already in the wallet. It is also a common second move after a takeover, which is why monitoring outruns the first claim.
The linked accounts and sign-in bridges
What to sweep
Any linked social or email sign-in, and the hygiene of the account on the other side of that bridge.
Why it decides the incident
A linked account is a second door to the same wallet. If the bridge account is the one that was compromised, securing this account alone will not hold.
The order history and the subscription list
What to sweep
Every order and recurring charge in the period around the incident, and every active subscription with its renewal date and its origin trial.
Why it decides the incident
This is where quadrants 3 and 4 are found. A trial that converted, an auto-renew you forgot, or a second order on a recognised device reclassifies the incident entirely — and reclassifying it before filing is worth more than winning a dispute afterwards.
The notification channel itself
What to sweep
Whether the login alert, the order confirmation, and the delivery notice actually arrived, and when — and whether the carve-out was muted during an earlier tidy-up (117).
Why it decides the incident
The alerts are your timeline. Without them you cannot say when the account was reached, which is the single fact every investigator asks for. Restore the carve-out as part of the incident response, not as a later preference.
The ripple beyond this platform
What to sweep
Whether the same password was used elsewhere, whether the same card is saved at other merchants, and whether the email address appears in a known breach.
Why it decides the incident
A credential-stuffing event rarely stops at one service, and a leaked instrument rarely bills at one merchant. The general breach-response route belongs to the identity-protection guide and the later security cluster; this rung only names the ripple so it is not missed.
| Surface | What to sweep | The finding that reclassifies | The action |
|---|---|---|---|
| Recovery credentials | Recovery email/phone, 2FA method, passkeys | A detail you did not set | Fix before the password; quadrant 1 |
| Sessions/devices | Active sessions, recognised devices | Unrecognised = takeover; recognised = household | Save the list, then sign out |
| Payment methods | Saved instruments and their order | Added-by-someone-else vs clean-plus-elsewhere | Remove/flag; separate Q1 from Q2 |
| Address book | Every saved address, locker, pickup | An unknown doorstep (113's diversion) | Remove; treat as takeover |
| Gift-card balance | Stored funds and redemptions | Drained = fastest, hardest loss | Report; monitor for a second move |
| Linked accounts | Sign-in bridges and their hygiene | The bridge account is the weak door | Secure both ends |
| Orders/subscriptions | Recurring charges, renewal dates, trials | A converted trial or a household order | Reclassify to Q3/Q4 before filing |
| Notification channel | Whether the alerts arrived and when | A muted carve-out = no timeline | Restore it as part of the response (117) |
| Beyond the platform | Password reuse, card saved elsewhere, breaches | The event did not stop at one service | Route to the identity and security guides |
The sweep is the same claims-vs-mechanism habit the payslip, bill, and record guides taught, applied to an incident where the claim is "someone stole my money" and the mechanism is nine surfaces that decide whether that is true, partly true, or not true at all. A changed recovery email is not a card problem. A recognised device is not a takeover. A converted trial is not a theft. A drained balance is not a reversible charge. A muted alert channel is not a preference — it is the missing timeline. The discipline is the sweep: check the surfaces in order, save the before-state as evidence, and let the findings choose the quadrant rather than letting the alarm choose it. And the honest limit is that the sweep is diagnostic, not curative — it tells you which route to take, and the route's window and outcome belong to the provider, the platform, and the law.
The two-clocks tells — what the alarm hides on both sides
the second charge arrives while the first dispute is pending
a small charge appears that looks like a test
the recovery email or phone changed and you did not change it
an address, locker, or pickup point you never added
a gift-card balance drained after the charge
the same card billing at merchants you never used
a trial that converted on a date you did not diary
a recognised device and a household-shaped pattern
no alert arrived because the carve-out was muted
the claim is denied because the papers show an authorisation
The tells are the two clocks in the page's title, and the discipline is to read them as sequencing signals rather than as drama. The attacker's clock runs while the wallet is open — hence the second charge, the test charge, the drained balance, the re-appearing address. The dispute clock runs on the provider's terms, and it can be wasted by filing on the wrong ground — hence the denial that cites an authorisation, which is the sound a quadrant-3 or quadrant-4 charge makes when it is reported as fraud. And the muted-carve-out tell is the quietest and the most consequential: a reader who cannot say when the account was reached has no timeline to give anyone, and that gap was created by an inbox preference. The safe posture is the same one the account-security, missing-package, and notifications guides teach: secure before you argue, triage before you file, and keep the channel that tells you when.
The household-versus-intruder boundary — the triage must come before the fraud report, because a false fraud report has consequences of its own. Most unfamiliar charges are not attacks. A teen's in-app purchase, a housemate's order, a child's game add-on, and a partner's gift are all made on an account where the payment method is saved and the address is yours — and in the payment provider's eyes an authorised-on-the-account purchase is generally not fraud, however unwelcome it is at home.
- Talk before you file. The first move on a quadrant-3 charge is a conversation, not a claim form. The account state — a recognised device, your address, a household-shaped pattern — is already pointing there, and a claim filed against it will read as what it is.
- Use the controls, not the accusation. The route is the platform's parental or permission controls, a spending limit, approval requirements for purchases, and the shared-account caution the account-security guide names — plus, where a device or store has its own family controls, those. This is a governance fix, and it is reversible in a way a fraud flag is not.
- Know what a false report costs you. Reporting a household purchase as fraud can fail the dispute, can flag or freeze your own account or card, can strain the provider relationship you will need later for a real incident, and — where the purchaser is a minor — can turn a household conversation into something much harder to undo. The page is not saying never escalate; it is saying triage first, honestly.
- Watch the tells that flip it to intruder. An unrecognised device or session, an unrecognised address or locker, a changed recovery detail, a pattern inconsistent with the household, or charges at merchants nobody in the house uses — any of these moves the event out of the boundary and into quadrant 1, and the full secure-and-report route applies.
- Where the pattern is not a child's purchase. If the spending is connected to coercion, control, or financial abuse within a household, that is not a dispute question and it is not a parenting question; it routes to specialist support and, where there is danger, to the appropriate authority. The page names the boundary rather than advising inside it, because the right answer there is a person, not a claim form.
The parental and permission controls, the spending limits, and the household arrangements are the platform's to describe on your local page; the fraud determination is the payment provider's and the platform's; the coercive-control and financial-abuse route belongs to specialist support and, where relevant, the police. This page's job is one sentence long: answer "whose charge is it?" before you answer "how do I report it?" — because a page that taught the fraud route without teaching the triage would be handing out a weapon with the safety off.
A worked example: the two readers, and the one who triaged before filing
Concretely, the secure-before-you-dispute reframe, the four-way triage, the fraud-versus-not-as-described split, the incident-response sequence, the post-incident surface sweep, the two-clocks tells, and the household boundary meeting two readers who both find the same unfamiliar charge on the same family account.
Reader one argues the charge first and discovers the rest later. The statement shows an order they do not remember. Reader one calls the card issuer immediately, spends forty minutes on the phone narrating the alarm, and files a fraud claim while the account session is still live and the saved card is still saved. Two days later a second charge lands — the wallet was never shut. Then the issuer's review comes back: the purchase was made from a device on the household's own network, to the household's own address, and the account state shows no intrusion, so the claim is denied on the authorisation question. It was the thirteen-year-old's game add-on, bought on the tablet reader one had handed over a week earlier. The loss is doubled: a second charge made through an open door, and a fraud flag on the reader's own account arising from a household event that needed a conversation and a purchase-approval setting. The forty minutes on the phone were spent in the wrong order.
Reader two secures, sweeps, and lets the findings choose the route. The same charge, the same alarm — but reader two starts at rung 1 rather than at the phone number. They change the password from a trusted device, check that two-step verification and the recovery details are still theirs, sign out the sessions, and sweep the wallet and the doorstep: no added payment method they did not add, no unknown address, no drained balance, no changed recovery email. The session list shows the household tablet. The order history shows the game add-on; the notification channel — which reader two kept open through the last inbox tidy — shows the order confirmation arriving at a time the tablet was in use at home. The triage lands in quadrant 3, and reader two says so out loud to themselves before opening any claim form. The route is a conversation, purchase approval switched on for the household account, a spending limit, and a note in the diary to re-check the surfaces in a month. Had the sweep instead shown an unknown device and an unrecognised locker address, reader two would have read the diversion tell, classified it as quadrant 1, and taken the secure-then-fraud-then-police route with the before-state preserved as evidence — the same discipline, a different answer, and the right door shut either way.
The lesson is the whole page. Both readers had the same charge and the same family account; the difference was not the platform and not the amount — it was the order. Reader one filed before securing and before triaging, so the wallet stayed open and the claim landed on the wrong ground. Reader two secured, swept, and triaged, and the findings chose the route: a household conversation with a control attached, and a fully documented alternative path had the sweep pointed the other way. The secure-before-you-dispute reframe is what closed the door, and the household boundary is what kept the claim honest — because the two most expensive mistakes on this page are the same mistake made in opposite directions: treating a household event as an attack, and treating an attack as a card problem. The most common loss is the second charge filed behind a dispute you started too early, and the discipline is secure → triage → dispute → monitor → escalate, in that order, every time.
The Check
A Sensible Default
- Hold the reframe: secure before you dispute — the wallet is open and the attacker's clock runs, so the order is secure → triage → dispute → monitor → escalate, and the dispute is rung 6, not rung 1.
- Run the four-way triage honestly before filing anything: account compromised, instrument compromised, household member, or forgotten authorisation. Two of the four are not fraud at all.
- Respect the fraud-versus-not-as-described split: the question that decides the route is did you authorise this transaction? — and the evidence sets, the routes, and the clocks differ on each side.
- Sweep the nine surfaces and save the before-state as evidence: recovery credentials, sessions and devices, payment methods, the address book, the gift-card balance, linked accounts, the order and subscription history, the notification channel, and the ripple beyond the platform.
- Read the diversion tell from the charge side: an unauthorised address, locker, or pickup point alongside an unauthorised charge is a takeover signature (113), not a card dispute, and it changes the route.
- Obey the household boundary: a recognised device, your own address, and a household-shaped pattern point to a conversation plus the parental and permission controls and a spending limit — not a fraud report, which can fail the dispute and flag your own account.
- Monitor after the claim, because the attacker's clock may not have stopped: watch for a second or test charge, a drained balance, a re-appearing address, and charges at merchants nobody in the house uses.
- Restore the carve-out notifications as part of the response (117), and rebuild the scheduled hygiene afterwards (111) — an incident ends when the hygiene resumes, not when the refund lands.
- Assert no universal window, no guaranteed refund, and no claim outcome; route the specifics to the platform's security process, the payment provider, a consumer-protection authority, a small-claims route, and, where a crime is suspected, the police.
The honest takeaway is that an unauthorised charge is an incident with an order of operations rather than an argument with a deadline, and the discipline that protects you is the sequence: shut the door, sweep the surfaces, answer whose charge it is, file on the route that matches the answer, keep watching, and then rebuild the hygiene that the incident exposed. For the scheduled version of these same surfaces, see our account-security guide; for the diversion tell seen from the package side, see our missing-package guide; for the trial-conversion and forgotten-subscription quadrant, see our Prime-benefits guide; for the alert channel that gives you a timeline, see our notifications guide; for the not-as-described routes this page must not be confused with, see our returns and digital-purchases guides; for the general dispute discipline the one-clear-ask and escalation rungs import, see our win-a-dispute guide; and for the actual fraud windows, evidence requirements, refund outcomes, and escalation routes, see the platform's local Help and security process, your payment provider or card issuer, a consumer-protection authority, and, where a crime is suspected, the police — the authorities this page keeps routing you to, because the shape of the sequence is durable, the specifics are not ours to assert, and the second charge is the one that arrives while you are arguing the first.
Common Questions
Frequently Asked Questions
I see a charge I did not make. What do I do first?
Secure the account before you dispute the charge. The most common loss is calling the card issuer or filing a claim first, while the wallet-and-doorstep account is still open, so the attacker makes another charge from the still-live session or the still-saved payment method. The order is secure → triage → dispute → monitor → escalate: change the password, enable or check two-step verification, sign out the sessions and devices, remove or flag the unauthorised payment method and address, and only then build the dispute with the dated record. The clock that matters first is the attacker's, not the dispute window's.
Is an unauthorised charge the same as a disputed order?
No, and the split decides the route and the evidence. An unauthorised charge is a fraud claim — you did not authorise the transaction at all — and it routes to the payment provider's fraud process and the platform's security process. A wrong, damaged, or missing item on a charge you did authorise is a not-as-described claim, and it routes to the platform's return or claim process and, if needed, a chargeback on different grounds. Conflating them weakens the claim, because the evidence and the route differ; and reporting a not-as-described order as fraud, or a fraud as a return, can fail the claim and strain the payment-provider relationship.
My teenager bought something. Is that fraud?
Usually not, and this is the hardest line on the page. A purchase by a household member — a teen, a partner, a housemate — using a payment method you saved on the account is generally not fraud in the payment-provider sense, and reporting it as fraud can backfire: the provider may see an authorised-on-the-account purchase as not-fraud, the dispute may fail, and your own account or card may be frozen or flagged. The route is a household conversation plus the platform's parental or permission controls and a spending limit, not a fraud claim. The tell that it is a household event is a device, session, or address you recognise and a pattern consistent with the household; the tell that it is an intruder is an unrecognised device or session, an unrecognised address, or a credential-harvest sign.
The charge came with a delivery to an address I do not recognise. What is that?
Treat it as a diversion tell and a compromised-account event, not a mere card dispute. An unauthorised charge that arrives alongside an unauthorised delivery address, an unknown device or session, or a pickup or locker you never added is the signature of an account takeover rather than a stolen card number, because the attacker reached the account, not just the payment instrument. The discipline is to secure the account first (password, two-step verification, sign out sessions, remove the unauthorised address and payment method), then dispute through the platform's security process and the payment provider's fraud process, then monitor, and escalate to the police where a crime is suspected. This is the same diversion tell the missing-package guide names, seen from the charge side.
The charge is only small. Do I still need to secure the whole account?
Yes, and the smallness is often the reason to. A modest unauthorised charge can be a test — a check that the instrument or the account still bills before a larger move — and the account-state evidence that decides your quadrant lives in the sweep, not in the amount. The discipline is to run the full sequence regardless of size, because a half-closed door produces a second, larger charge, and because a small charge with an unknown address or a changed recovery detail is a takeover signal that no refund will retire. Where the amount is genuinely trivial and the sweep is clean, the practical outcome may be containment and monitoring rather than a protracted claim — but the sweep comes first, so you know which you have.
Do I cancel the card, the account, or both?
The triage decides, and sometimes it is both — which is exactly why the sweep precedes the phone call. A compromised instrument points to the issuer's lock-or-replace route plus checking where else that card is saved, with the platform notified so the stored instrument is refreshed rather than left stale. A compromised account points to the credential-and-session sweep plus the platform's security process, because replacing the card without shutting the door leaves the attacker able to add a new one. When both are in play, do both, in the order the sequence sets out. The page does not tell you which to cancel, because the determination is the platform's and the provider's; it tells you to gather the nine-surface evidence first so the choice is made from findings rather than from alarm.
The platform denied my claim because the purchase was made on my account. Is that the end?
No, and it is usually a routing problem rather than a verdict. "Made on your account" is what a denial says when the evidence shows an authorisation — which is why the triage exists: if the charge was a household purchase or a converted trial, the denial is correct and the real route is the boundary conversation or the subscription and digital-content route, not a fraud appeal. If the charge was genuinely unauthorised, the counter-evidence is the account state you saved before you cleaned up: the session and device list, the address-book before-and-after, the recovery-detail change, the timestamps you can account for. Take that to the platform's escalation, then the provider on the correct ground, then a consumer-protection authority, then a small-claims route where the value warrants it. The discipline is to read a denial as information about which question was asked, and to answer the question that was actually posed rather than repeating the one you filed.
Ask our AI. Handling an unauthorised charge or triaging an unfamiliar one? Tap the chat icon and tell us the charge, the date, whether you have already secured the account, and what the session list, address book, and order history show, and it can walk the incident-response sequence in order, run the four-way triage honestly, and flag the household boundary and the diversion tell — and it will never file a fraud report on a household purchase, never tell you to dispute before securing, and never promise a window or a refund. It will route the fraud determination to the platform's security process and your payment provider, the escalation to a consumer-protection authority, and a suspected crime to the police.
More commerce & incident guides like this
We treat an unauthorised charge as an incident with an order of operations rather than an argument with a deadline — so the discipline is secure → triage → dispute → monitor → escalate, with the four-way triage answering "whose charge is it?" before any claim form is opened, because two of the four quadrants are not fraud at all.
Explore All GuidesKeep Reading
Sources:
Other Projects
More from the creator
Explore two other projects from the same creator.