They Charged You After You Canceled: The US Dispute Deadlines Nobody Tells You (Reg E, Reg Z, and the 120-Day Card Rule)

On a credit card you have 60 days from the first statement showing the charge to send a written billing-error notice. On a debit card or bank account you have 60 days from the statement to report the error, and three business days before a scheduled payment to stop it. A card-network chargeback may still be filed up to 120 days after the transaction. Which of those clocks you are on is decided by one thing: the rail the money left from.

Cancel with the company, keep records, contact your bank: the standard advice never says how many days you have left. Three systems are stacked here and they do not share deadlines — two federal regulations with enforceable remedies, and a private rulebook written by the card networks. Every day count below is quoted from the provision named beside it.

Last reviewed: September 8, 2026. A plain-language walkthrough of the regulation text, not legal advice. US consumer accounts only; business accounts and payments made abroad fall outside Regulation E and Regulation Z as described here. Issuers may be more generous than the regulation requires, never less.

Start Here: Which Rail, and Every Deadline

Open the transaction and answer one question. Did this charge hit a credit card, or a debit card or bank account?

If you cannot tell, resolve that first: our billing descriptor decoder exists for that step, and if the same service appears twice, work out which duplicate to kill before you dispute either. The answer routes you into one of two entirely different legal regimes:

• Credit card → the Truth in Lending Act, implemented by Regulation Z. Your tool is the billing error notice, in writing, and you may withhold payment while it is investigated.
• Debit card, ACH, or anything drawn on a checking or savings account → the Electronic Fund Transfer Act, implemented by Regulation E. Your tools are the stop-payment order, the revocation of authorization and the notice of error. Notice can be oral. The money is already gone, so the fight is about how fast it comes back.

People lose money at this branch by using advice written for the other rail. Asking a credit card issuer to "stop payment" gets a confused answer; sending a debit dispute as a Regulation Z billing-error letter gets it filed under the wrong process.

Every deadline on one page

The column that ruins people is the third one. The clock is almost never running from the day you noticed.

Debit Card and Bank Account: What Regulation E Gives You

Regulation E §1005.2(k) defines a preauthorized electronic fund transfer as "an electronic fund transfer authorized in advance to recur at substantially regular intervals." A monthly subscription billed to a debit card fits, and so does an ACH pull from checking.

1. The three-business-day stop payment

Section 1005.10(c)(1) is unusually plain: "A consumer may stop payment of a preauthorized electronic fund transfer from the consumer's account by notifying the financial institution orally or in writing at least three business days before the scheduled date of the transfer."

Two things people misread. Orally is genuinely allowed, so you do not need a letter to make the order effective on day one. And business days are business days: a Friday call about a Monday charge is too late.

2. The 14-day fuse on an oral order

Section 1005.10(c)(2) quietly kills people's stop payments: "The financial institution may require the consumer to give written confirmation of a stop-payment order within 14 days of an oral notification." If your bank requires it and you do not send it, the oral order stops binding after 14 days and the charge comes back. The OCC's consumer guidance says the same, and adds that a written stop-payment order often expires after six months and can be renewed — which matters if the subscription bills annually.

3. The 10-day notice you are owed when the price changes

Section 1005.10(d) requires that when a preauthorized transfer will differ in amount from the previous transfer under the same authorization, you get written notice of the amount and date at least 10 days before the scheduled transfer. You may elect a narrower version instead: notice only when the amount falls outside a range you agree.

This is the sleeper provision for price hikes on debit-billed services. A varying charge that landed with no advance notice is a second claim, worth raising alongside the charge itself.

4. The 60-day error window and the 10-business-day investigation

Section 1005.11(b)(1) gives you until 60 days after the institution sends the periodic statement on which the error first appears. Notice may be oral or written, and the institution may require written confirmation within 10 business days of an oral notice — a different number from the 14 days on a stop payment, so do not rely on memory for either.

Then the bank's clock starts. Under §1005.11(c)(1) it must determine whether an error occurred within 10 business days and report the result within three business days of finishing. It may take 45 days instead, but only if it provisionally credits your account within those first 10 business days and tells you within two business days. Under §1005.11(c)(3) the outer limit stretches to 90 days for a point-of-sale debit card transaction, a transfer not initiated within a state, or one in the account's first 30 days — and only in that last case does the initial window widen to 20 business days.

If the bank finds no error, §1005.11(d) requires a written explanation and requires it to tell you that you may request the documents it relied on. Request them. A one-line denial citing "merchant provided proof of authorization" proves nothing until you have seen what the merchant sent.

5. The exclusion nobody explains

Regulation E's machinery is strongest for an unauthorized transfer. Section 1005.2(m) defines that as a transfer "initiated by a person other than the consumer without actual authority to initiate the transfer and from which the consumer receives no benefit." But it excludes a transfer initiated "by a person who was furnished the access device to the consumer's account by the consumer, unless the consumer has notified the financial institution that transfers by that person are no longer authorized."

You gave the merchant your card details, so under that exclusion its charges are not "unauthorized" until you have told your bank the authorization is revoked. The date you notify the institution is the date that changes the legal character of every charge after it.

The official commentary at comment 10(c)-2 goes further than a single stop payment: once a financial institution "has been notified that the consumer's authorization is no longer valid, it must block all future payments for the particular debit transmitted by the designated payee-originator." Not one payment — every one from that originator, going forward.

So revoke with the merchant and notify the bank, same day, in writing both times. The CFPB's guide to stopping automatic payments walks that two-step and supplies sample letters. It also flags what goes wrong afterward: "cancelling an automatic payment does not cancel what you owe." A gym contract keeps generating a balance long after the payment rail is closed.

Credit Card: Regulation Z Section 1026.13

Your situation is an enumerated billing error

Credit cards give you the better hand, and it is not close. You do not have to argue that a post-cancellation charge is like a billing error. Section 1026.13(a)(3) lists it: "A reflection on or with a periodic statement of an extension of credit for property or services not accepted by the consumer or the consumer's designee, or not delivered to the consumer or the consumer's designee as agreed."

A service you canceled and were then billed for is a service not delivered as agreed. Use that phrase. It maps your complaint onto a category the creditor's compliance team already has a process for.

60 days, in writing, to the right address

Section 1026.13(b)(1) requires a written notice received by the creditor at the address disclosed under §1026.7(a)(9) or (b)(9) "no later than 60 days after the creditor transmitted the first periodic statement that reflects the alleged billing error." It must identify your name and account number, say that you believe a billing error exists, and give the reasons plus the type, date and amount.

Three traps in one sentence. Received, not postmarked. The billing-inquiries address, not the payment envelope; the CFPB's dispute guidance puts the deadline as "within 60 calendar days after the charge appeared on your statement." And it runs from the first statement showing the charge, so on a subscription that has quietly billed for eight months, the first seven charges are already outside the window.

What the creditor owes you back

Under §1026.13(c) the creditor must acknowledge your notice in writing within 30 days of receiving it, unless it has already resolved the matter, and must complete resolution within two complete billing cycles and in no event later than 90 days.

Section 1026.13(d) is the provision to quote at anyone who tells you to pay it and sort it out later. Pending resolution the creditor may not try to collect the disputed amount or related charges, report the account delinquent over it, or close or restrict the account solely because you disputed in good faith. You still owe the rest of the bill.

The second credit-card right, for when 60 days is gone

Miss the billing-error window and credit cards still have a slower second door: section 1026.12(c), the right to assert against the card issuer the claims and defenses you have against the merchant.

It has conditions. You must have made a good faith attempt to resolve the dispute with the merchant first, the amount must exceed $50, and the transaction must have occurred in your state or within 100 miles of your address. Those two limits fall away when the merchant is the card issuer, is controlled by it, is a franchised dealer in its products, or got your order through the issuer's own mail solicitation.

For an online subscription the geography test is unsettled: the official commentary says where a mail, internet or telephone transaction occurs "is to be determined under state or other applicable law." Do not build your case on §1026.12(c) — but know it exists, because it has no 60-day fuse.

The Network Layer: Where 120 Days Comes From

Underneath both regulations sits a third rulebook that is not law: the card networks' own dispute rules. Visa has a reason code for exactly this scenario — 13.2, Cancelled Recurring Transaction — for a charge processed after the cardholder withdrew permission or cancelled the plan, with a filing window of 120 days from the transaction. Mastercard ran the same scenario as code 4841 and has since folded it into the broader cardholder-dispute code 4853; industry references put its window at 120 days from the transaction date as well.

Three things to hold in mind:

1. Longer is not stronger. A network chargeback is a private arbitration between two banks. Regulation Z and Regulation E give you deadlines the creditor must meet, documents you can demand, and a statutory remedy. The network gives you a request.
2. The rules are not published for consumers. The operating regulations go to acquirers and issuers under contract, the figures reach the rest of us through chargeback-industry references, and issuers layer their own windows on top. Treat 120 days as a working number, not a guarantee.
3. Debit cards get both. A Visa or Mastercard debit card sits under Regulation E and under network rules, which is why a debit dispute filed on day 90 can still succeed. You just have no leverage if the answer is no.

What Changed at the CFPB in June 2026

If your mental model of the escalation path is "the bank says no, so I file a CFPB complaint," update it. On June 24, 2026 the CFPB announced an overhaul of the complaint system, after credit reporting complaints rose from more than 150,000 in 2019 to more than five million in 2025. What changed, and what it means for a subscription dispute:

• Identity verification. The Bureau launched two-factor authentication requiring people who create online accounts to verify both an email address and a mobile phone number. Have your phone to hand.
• Exhaust the direct dispute route first. The hard version is aimed at credit reporting, where the Bureau added a notice that consumers must first exhaust their dispute rights directly with the consumer reporting agencies. Nothing makes that a precondition for a card or bank complaint, but one showing what the issuer's own process already said is stronger.
• A new Company Portal Manual setting out how companies should use the substantive and administrative closure categories, with the Bureau saying it is exploring further administrative response options. Vague, story-shaped complaints are the ones most exposed to an administrative close.
• A defined backlog. Complaints awaiting action for more than 30 calendar days from submission now count as backlog.

The mechanics did not change. The CFPB's submit-a-complaint page says most companies respond within 15 days, with a final response within 60 days in some cases. You can attach up to 50 pages of documents, and you have 60 days after the response to give feedback on it. Use the attachments.

The Evidence Packet and the Order of Play

Every channel above asks for the same eight things. Assemble them once.

1. The rail. Credit or debit, issuer name, last four digits.
2. The transaction date and the exact descriptor as it appears on the statement, character for character.
3. The statement date the charge was sent or transmitted on, not the transaction date. Both 60-day clocks run from this.
4. The cancellation date, with proof. A confirmation email, a screenshot with a visible timestamp, a support-ticket number, a chat transcript.
5. The date you notified your bank of the revocation, on a debit or bank account. Per §1005.2(m), charges after it become unauthorized.
6. The full charge history — when it started, what it cost each time, whether the amount ever changed.
7. The merchant's cancellation and refund terms, screenshotted as the page reads today.
8. One sentence stating the category. On a credit card: "services not delivered as agreed under §1026.13(a)(3)." On a debit card: "an unauthorized electronic fund transfer, authorization having been revoked and the institution notified on [date]."

If you track subscriptions in SubBuddy, most of that comes out of the CSV export: payment method and card last four, start and renewal dates, amount, currency, billing interval, cancellation URL and cancellation notes. The notes field is where the cancellation date and confirmation number belong on the day you cancel, not the day you need them — nobody remembers a confirmation number four months later, and four months later is when the annual renewal lands.

The order, by day

Sequence matters: a chargeback filed while the merchant is mid-refund produces a duplicate credit that gets clawed back.

Where the merchant's cancellation flow is a maze, the platform-by-platform cancellation guide has the exit and the dark-patterns breakdown covers the retention traps built to run out your clock. For the last row, the state-by-state map shows whether your state gives you more than federal law does.

Six Ways People Forfeit a Deadline

1. Calling instead of writing on a credit card. A call may get a goodwill refund; it does not start the §1026.13 clocks.
2. Counting 60 days from the charge, not the statement. On a charge posted early in a cycle, that discards nearly a month you had.
3. Telling the merchant but not the bank. On a debit card that leaves you inside the §1005.2(m) exclusion, where the charges stay formally authorized.
4. Letting an oral stop payment lapse. Fourteen days, and the charge returns as if you never called.
5. Replacing the card and calling it done. Account updaters push new credentials to merchants, which is why subscriptions keep charging a replaced card, and a new number resets no deadline.
6. Accepting a denial without asking for the file. Regulation E entitles you to be told you may request the documents relied on. Ask in writing, every time.

Sources and Scope

• Regulation E §1005.2 — the definitions of a preauthorized transfer and an unauthorized transfer, including the furnished-access-device exclusion.
• Regulation E §1005.10 — stop payment, the 14-day confirmation, the 10-day varying-amount notice.
• Regulation E §1005.11 — the 60-day notice of error, the 10-business-day investigation, provisional credit, the 45- and 90-day extensions.
• Commentary to §1005.10 — comment 10(c)-2, blocking future payments from a payee-originator after revocation.
• Regulation Z §1026.13 — the billing-error definition, the 60-day notice, the 30-day acknowledgment, the two-cycle and 90-day limits, the rules pending resolution.
• Regulation Z §1026.12(c) — claims and defenses against the issuer, and the $50 and 100-mile conditions.
• CFPB: stopping automatic payments and CFPB: disputing a credit card charge — the consumer-facing versions, with sample letters.
• OCC HelpWithMyBank — stop-payment mechanics and the six-month expiry of a written order.
• CFPB, June 24, 2026 and the submit-a-complaint page — the overhaul, and the 15- and 60-day response windows.
• Visa reason code 13.2 and Mastercard 4841, now folded into 4853 — the 120-day window, per chargeback-industry references rather than the networks' own documentation, which is not published for consumers.

Scope note: US consumer accounts. Spain and the EU run on a different framework — SEPA direct debit refund rights and the distance-selling withdrawal period — covered separately. The cancellation hub collects the rest of the workflow.