Her card was hit with 1,700 unauthorized charges — then the bank said she’d approved them. Here’s what it took to get her money back

What began as a single fraud alert quickly turned into a much larger dispute that stretched over months. By the time she pulled the full statements together, the scale of it became clearer.

Her account showed more than 1,700 unauthorized charges, spread across 32 pages, most of them repeated transactions to the same vendor.

What she didn’t anticipate, however, was the prolonged back-and-forth with the bank over what actually happened on her account, and who should be responsible for reversing the transactions.

A $2.19 alert that turned into nearly 1,700 charges

Back in March, Lisa got a text from Citibank alerting her to a small suspicious charge: just $2.19 from Apple.com on her Costco-branded Visa card. At the time, neither she nor the bank thought it was necessary to cancel the card.

But over a three-day span that month, the activity escalated dramatically. In total, her statements later showed more than 1,700 unauthorized charges. The majority were for $4.38, with roughly a dozen smaller charges of $2.19, adding up to nearly $8,000 in disputed transactions.

Citibank told her it was investigating. Apple, meanwhile, confirmed two legitimate purchases on the account, but had no record of the smaller transactions.

Then came a letter from Citibank which said that, after reviewing the account, it had concluded she “provided the merchant(s) with [her] account information,” and that the $7,816.65 in charges would “remain” on her account.

Lisa pushed back immediately. “I called Citibank, explicitly stated that none of these hundreds of charges were mine, and spent over an hour with the fraud department representative,” she told The Washington Post. “I live alone. I don’t play games. There is no kid in my house downloading games.”

Over time, she escalated the complaint to the Minnesota Attorney General’s Office, the Consumer Financial Protection Bureau, and senior Citibank executives. She also kept detailed records of every call, including dates and the names of representatives she spoke with.

Citibank later said its fraud team had made multiple attempts to reach her, which it said contributed to delays in the case. Lisa disputes this, according to the Post, saying she always answers calls, even from unknown numbers. “I answer my phone no matter if I know the phone number or not,” she said.

Eventually, after what Citibank described as a “comprehensive reevaluation,” the bank agreed to reverse the charges tied to Apple.com purchases, “along with applicable interest adjustments.”

However, Lisa told the Post she remains uneasy about another line in the notice, which states: “The security investigation can take up to 90 days to complete... If you do not hear from us after 90 days, the credits will become permanent.”

Moneywise reached out to Citibank for comment. A Citi spokesperson said the case has been resolved and the outcome communicated directly to the customer. “We are committed to helping our customers protect their accounts and stand behind our $0 liability promise on unauthorized charges,” the company said. They added that customers who suspect fraudulent activity should contact Citi immediately.

What consumer protections apply — and how to dispute fraud

Cases like Lisa’s act as a reminder that credit card fraud doesn’t have to involve big purchases to do serious damage. In this instance, it was a steady stream of tiny charges that eventually added up to thousands of dollars.

The Nilson Report estimates global card fraud losses reached $33.41 billion in 2024, with nearly half of that (42%) tied to the U.S.

Consumers do have protections in place, but they depend on how quickly the issue is caught. If something looks off, even a single small charge, it’s usually safest to contact the bank right away and request a card freeze or replacement before more transactions are posted.

Under federal rules, cardholders generally aren’t responsible for unauthorized charges as long as they’re reported in time. If a card is lost or stolen and used before it’s reported, liability is usually capped at $50, though in practice most major credit card companies end up absorbing the loss entirely under zero-liability policies.

But what catches most people off guard is the timing. Most disputes need to be filed within about 60 days of the statement date, and once that window closes, it can become harder to reverse charges or lean on the same protections.