Imagine you receive your credit card statement and find 32 pages of more than 1,700 unauthorized charges, made one right after another over three days. The majority of the debits are for $4.38, with about a dozen for $2.19, all to the same vendor, totaling close to $8,000.

Simple to fix, right?

Well, for one 66-year-old widow from Minnesota’s Twin Cities, getting those transactions removed became an odyssey.

Her story is a warning for anyone who ever has to dispute fraudulent activity on a credit card.

If there is one thing I’ve learned from my own experiences with fraud and from helping readers who have been scammed, it’s that you have to be your own fiercest advocate. This means being relentlessly persistent.

Federal law provides protections for unauthorized charges. But you can’t procrastinate on reporting fraud. And in some cases, asserting your rights may require filing complaints with every state and federal agency responsible for protecting consumers.

Lisa’s saga began when she got a text message from Citibank. It flagged the very first unauthorized charges of $2.19 to Apple.com on her Costco-branded Visa card.

The bank representative didn’t suggest she cancel the card, and she didn’t think it was necessary, either. Lisa, who asked that I not use her last name to prevent further fraud, had no idea that those debits were the first in an onslaught of fraudulent activity spanning three days, March 9, 10 and 11.

After returning home from a trip to California, she saw the hundreds of charges. Citibank told her to call Apple. Apple had no record of the small transactions, but it was aware of two legitimate charges, for a new iPhone and an Apple Watch. She called Citibank back and was repeatedly told that they were looking into the matter.

Then came the “scary” letter. “During our investigation we learned that you provided the merchant(s) with your account information,” Citibank concluded. “The charge(s) totaling $7,816.65 will remain on your account,” the letter from Citibank said. There may have been some confusion, because the multitude of charges included two for Apple products she had actually purchased.

“I called Citibank, explicitly stated that none of these hundreds of charges were mine, and spent over an hour with the fraud department representative,” Lisa said. “I live alone. There is no kid in my house downloading games.”

If there is another lesson, it is that quick, constant communication with your credit card company provides a better safeguard. It’s not a guarantee, but you have proof you tried.

Here’s how federal law provides consumer protections for unauthorized charges. If your physical card is lost or stolen, and you report the loss to your bank before a thief can use it, you are not responsible for a single penny. If the missing card is swiped before you report it, your maximum legal liability is capped at $50.

In practice, however, you will rarely pay even that, because almost all major credit card companies go further and offer zero-liability policies. And you should have no liability for fraudulent billing if your card number is stolen but you still have the card.

Payment card fraud losses worldwide amounted to a staggering $33.41 billion in 2024, according to the latest numbers from the Nilson Report. A disproportionate amount of this fraud happens in the U.S., which accounted for nearly 42% of global fraud losses. Because of federal consumer protections, financial companies are supposed to absorb these huge losses. But you must dispute the unauthorized action within 60 days of the date the bank mailed or electronically delivered the billing statement. Missing that window can cost you your legal leverage.

Lisa took the right steps. She reported the incidents to her bank immediately. She was eventually issued a new card. I suggest you get a replacement card if the dispute involves unauthorized activity, because it’s clearly been compromised.

When the charges weren’t removed, Lisa sent Citibank a letter disputing the transactions. If you’re not sure what to include in such a letter or where to send it, the Federal Trade Commission has instructions. Go to FTC.gov and search for “Sample Letter for Disputing Credit or Debit Card Charges.” The FTC suggests you send the letter by certified mail and ask for a return receipt.

She also complained to the Office of the Minnesota Attorney General, the Consumer Financial Protection Bureau and multiple senior executive offices at Citibank. With each call, she recorded the day and names of the representatives she spoke with.

“I had to keep complaining, because no one at Citi would state anything with certainty except that they would keep investigating and call back,” she said.

Frustrated, Lisa emailed me. “My house and car are paid for. I am frugal and hope to retire within five years. Maybe you can help. I thought I did everything right.”

I reviewed her statements and correspondence with Citibank and then called the bank. “Citi has resolved the case and communicated the outcome directly to the customer,” a spokesperson emailed. “We are committed to helping our customers protect their accounts and stand behind our $0 liability promise on unauthorized charges.”

Then Lisa received a letter from Citibank. “During the course of the investigation, our fraud team made multiple attempts to contact you to review the activity; however, we were unable to reach you at those times, which contributed to delays and the earlier closure of the case,” the letter said. “Additional calls were reviewed and because our internal matters are confidential, we’re unable to provide you with details of any corrective action.”

Lisa disputes that she was unresponsive. In its last letter to Lisa, Citibank said that after a “comprehensive reevaluation” of her account, it was reversing the thousands of dollars in Apple.com charges, “along with applicable interest adjustments.”

Yet, she’s still concerned about this point made in the letter: “The security investigation can take up to 90 days to complete. … If you do not hear from us after 90 days, the credits will become permanent.”

I understand banks have to verify disputes to ensure customers aren’t lying about their bills. But 32 pages of over 1,700 identical swipes for $4.38 and $2.19 certainly looked like a textbook case of cyber credit card fraud.

Michelle Singletary is a columnist for the Washington Post.