You searched something close to “unauthorised casino charge on my card,” “casino took money I did not authorise,” or “how to dispute an online casino transaction,” and ended up here. Two very different problems sit behind those phrases. They run through different federal laws, with different deadlines, and filing the wrong type of dispute will cost you the case. So the first job of this guide is to sort out which one you have.
First, Work Out Which Problem You Have
Below are two scenarios. One will probably describe your situation, and the procedure that follows depends entirely on which one fits.
Possibility one. The deposit was not yours. Someone else used your card, your account credentials, or your device to fund a casino account. The federal label for this is “unauthorised use” of a credit card under 15 U.S.C. § 1643, or, if the funds came out of a bank account, an “unauthorised electronic fund transfer” under the Electronic Fund Transfer Act.
Possibility two looks like this. The deposit was yours. You authorised it, the money went through, and the casino accepted it. The trouble shows up later, in some form or another. Maybe a withdrawal goes unpaid. Maybe the casino voids your balance. Maybe the account gets closed without the funds being released to you, or a sweepstakes redemption you qualified for is refused. Federal law does not treat any of that as unauthorised use. It sits in billing-error territory, services not delivered as agreed, which is a different statute and a different procedure altogether.
Why bother with the distinction? Because if you tell your bank a charge was unauthorised when you actually made it, Visa and Mastercard call that first-party misuse (you may have heard the phrase “friendly fraud”). The issuer denies the dispute, the money is gone anyway, and you may face civil exposure for the false claim. Get the category right before doing anything else.
If your situation does not fit either category cleanly (an unpaid withdrawal that has not yet hit your statement, a KYC stalemate, or an account closure that is not really about a single transaction), our complete guide to resolving online casino disputes covers the wider range of problems players run into.
Category 1: Someone Else Made the Deposit
When the deposit was not yours, federal law is clear and the procedure is direct.
Credit cards first. 15 U.S.C. § 1643 caps your liability for someone else’s use of your card at $50. Regulation Z carries that through at 12 C.F.R. § 1026.12(b). On debit cards and ACH transfers, the framework is a different one. The relevant statute is the Electronic Fund Transfer Act (EFTA), at 15 U.S.C. §§ 1693f and 1693g, and the implementing rules sit in Regulation E, 12 C.F.R. Part 1005.
Time matters here, particularly on the debit side. How quickly you give the bank notice can change what you end up paying.
The shorthand most people repeat online ($50 if reported in two business days, $500 within sixty, unlimited after) is approximately right and legally loose. The actual rule is more conditional.
If the bank receives your notice inside two business days of when you found out about the loss, what you can be charged is capped at $50, or the amount of the unauthorised transfers up to that point, whichever is the smaller of the two. Take longer than that, but still get notice in within sixty days of the statement, and the cap goes up. It rises to $500, and there is also exposure for whatever unauthorised transfers happened in the gap between the two-business-day mark and your eventual notice. Past day sixty, you are exposed only to those later transfers the institution can show would not have happened with timely notice.
The takeaway from all of that, stripped down: every day of delay costs you protection. Get written notice in front of the bank as quickly as possible.
Where the notice gets sent is more particular than people often realise. Card issuers and banks publish a specific billing-inquiries address. You will usually find it on the back of your statement, and on the bank’s website under a heading along the lines of “dispute,” “billing error,” or “error resolution.” That is the address the notice has to reach. A phone call to customer service does not satisfy the requirement, regardless of what the agent on the line tells you. The deadline is sixty days, running from the first statement that shows the charge. From that point, the bank has ten business days to investigate, extendable to forty-five if it provisionally credits your account, and to ninety days for new accounts and certain other matters.
Documents and records to pull together:
- Statement entries showing the charge or transfer.
- The exact date and time you discovered the charge.
- Every piece of communication with the bank, with timestamps.
- If you filed a police report or an identity-theft report, include it.
- Anything that goes to how the card or login was compromised in the first place. A data-breach notice from a service you use is useful. So is a lost-card or device-theft report, if you filed one. Pull together whatever you have on this.
Category 2: When the Deposit Was Yours and the Operator Broke the Deal
This route runs through different statutes because the law you need is not the unauthorised-use law. Credit-card disputes here come under the Fair Credit Billing Act, the FCBA. The exact provision is 15 U.S.C. § 1666(b)(3). What it covers is goods or services that the obligor never accepted, or that the merchant failed to deliver “in accordance with the agreement made at the time of the transaction.” The procedure that goes with all of that is set out in Regulation Z, at 12 C.F.R. § 1026.13.
What that means in practice: if you put money in, the casino accepted it, and then the operator turned around and refused to let you play, kept a balance you should have been paid, or wouldn’t honour a sweepstakes redemption you had qualified for, that is a billing error in federal law’s eyes. Services not delivered as agreed. There is no requirement to chase the merchant first. The notice goes straight to the card company.
Debit and ACH cases work differently. There is no statutory billing-error track to use; the dispute runs through the network instead, meaning Visa or Mastercard’s chargeback process going through your bank. The merchant-performance codes that come into play are Visa Dispute Conditions 13.1 (“Merchandise/Services Not Received”) and 13.3 (“Not as Described”), or Mastercard’s Reason Code 53. Both networks have written compelling-evidence procedures specifically for gaming payment transactions, which is to say the dispute does get a real process. The trade-off, though, is that the operator gets a structured opportunity to push back.
Procedural deadlines for Category 2 are not identical to Category 1, even if they look similar at first glance. Notice in writing, going to the billing-inquiries address, has to reach the creditor within sixty days of the first statement showing the charge. After that, the creditor’s clock runs. Acknowledgement in writing is due within thirty days (unless the creditor just settles the matter sooner). The resolution itself has to come within two billing cycles, or ninety days, whichever is the shorter of the two.
What you will want on file:
- Statement entries showing your deposit.
- Casino account history: deposits, balances, withdrawal requests.
- Whatever the operator’s terms and conditions said on the day you deposited. If you can, take a screenshot, or save the page locally to your computer. Operators do rewrite their terms, and sometimes the rewrite is retroactive. You do not want to be arguing about a version that has been overwritten.
- Anything you have that shows the account before the operator took action. Balance, pending withdrawal, dashboard screenshots, that sort of thing.
- Your communications with the operator. Chat logs, emails, support tickets. Make sure the dates are showing.
- Whatever the operator told you about why this happened, in its own words.
- A timeline. The dates that matter are the deposit date, the withdrawal request date, and the operator’s response date.
If the Casino is Licensed in Curaçao, Read This
Curaçao licenses most of the offshore casinos that accept US players. The licensing now sits under the Landsverordening op de Kansspelen, the LOK, published as P.B. 2024, no. 157, which replaced the older Curaçao licensing system in 2024. That has practical consequences for how a dispute against the operator can play out, and they are worth setting out plainly.
Player-versus-operator disputes are not something the Curaçao Gaming Authority (CGA) handles. The CGA itself says so, on its official contact page. The regulator on the licence is therefore not a venue you can use to recover money.
A Curaçao licence also does not place the operator under any US state gaming regulator. Your home-state gaming commission cannot order the operator to pay you, and that holds even if you live in a state with a fully regulated domestic gambling market.
The practical legal point sits with US payments law, not gaming law. Your enforceable consumer-protection rights run against your US issuer or payment processor under EFTA, TILA, and FCBA. They do not run against the Curaçao licensee under US gambling law. The dispute, in legal terms, is between you and the bank that processed the charge.
Some operators that accept US players hold no licence at all, including a few that present themselves as licensed. The issuer dispute is still available in those cases, and so are state enforcement agencies, but escalating to a foreign regulator is not.
Sweepstakes casinos sit in their own category. They typically present as US-facing promotional or entertainment businesses, often using Gold Coins / Sweeps Coins or similar dual-currency structures, and they are not coded as gambling merchants for payments purposes. The federal hook for deceptive promotion is FTC Act § 5. The merchant-performance route under FCBA § 1666(b)(3) still applies where the operator refused a redemption you were entitled to. Because the merchant is not coded as gambling, the dispute is likely to run under non-gambling-specific dispute codes; that is not necessarily bad news, but it changes the evidentiary frame.
For deeper coverage of the specific dispute mechanics, including which fact patterns qualify, the evidence the issuer expects, and the risks of initiating a dispute, see our walkthroughs on when offshore casino chargebacks work in the US and whether a sweepstakes casino chargeback works in your situation.
After the Issuer Says No
A denial is not the end. There is a sequence to follow, and each step assumes you have finished the previous one.
- Get the denial in writing. Specifically, ask the bank to set out why the dispute was denied and which evidence the institution relied on. Do this in writing, even if the agent has already explained it on a phone call. Keep the response.
- File a CFPB complaint about the bank’s handling, at consumerfinance.gov. The institution generally responds within fifteen days, with a final response within sixty days where the initial response is not final. Three recent CFPB orders bear directly on issuer dispute-handling: the 2023 Citizens Bank action (which alleged failure to manage credit-card disputes and fraud claims), the 2024 Goldman Sachs Apple Card order (restating the FCBA acknowledgement and resolution timing), and the 2025 Block order (faulting Block for routing unauthorised-transaction claims into chargebacks instead of running statutory error-resolution). The Bureau is paying attention to issuer dispute conduct.
- Push for network chargeback escalation. If the issuer never ran the dispute through Visa or Mastercard, ask why. The networks have their own dispute and arbitration procedures, and the issuer can be required to use them.
- On state enforcement, gaming regulators have been doing the heavy lifting on offshore operators, not attorneys general. Michigan is the cleanest example. The Michigan Gaming Control Board hit forty-five illegal offshore operators with cease-and-desist orders on 7 April 2026, and nine unlicensed online casinos got similar letters back on 12 February 2025. The New Jersey Division of Gaming Enforcement has flagged sweepstakes casinos as an area of attention. That said, attorneys general are not entirely out of the picture. Your state’s consumer-protection unit may take a complaint, especially if the conduct sits inside the state’s UDAP statute (unfair and deceptive acts and practices). Picking the right authority depends on your state and the operator’s licensing posture, and our state-by-state guide on how to report an online casino in the US covers which regulator to approach and in what order.
- Litigate. Where federal claims and regulatory escalation have not produced a result, a civil claim against the operator or the issuer is still available. Some deadlines are short, so this is not a step to leave for the end of the calendar.
When We Will Tell You Not to Bother
Player Protection Legal does not take cases that have no path forward. We will tell you upfront if a dispute is not going to succeed. The clearest categories of “no”:
- You authorised the deposit, played, and lost. There is no consumer right that backs out of a real loss. Federal billing-error claims do not exist for losing legitimately at a game the operator allowed you to play.
- You are past the sixty-day window. The window typically runs from the first statement showing the charge, not the day you discovered the problem.
- You filed a Category 1 claim on a charge you actually authorised. The issuer’s denial is correct in that situation, and the more pressing issue at that point is your potential exposure for the false claim, not the recovery.
- The operator is unlicensed and you funded the deposit by cash, wire, or cryptocurrency that did not pass through a US issuer. Without a US issuer in the chain, federal consumer-finance protections simply do not attach.
How We Work
Player Protection Legal acts for players in disputes against offshore and sweepstakes-casino operators internationally, including for US cardholders, on a no-win, no-fee basis. You pay nothing upfront, and we are paid only if we recover funds for you.
The work covers federal billing-error notices, the correspondence with banks and card networks that goes with them, drafting and assisting with the CFPB complaint, pushing for chargeback escalation through Visa or Mastercard, and, where US-court action is the right step, coordination with US local counsel. The practical result is that you are not the one trying to find the FCBA address on a credit-card website, drafting the § 1666 notice yourself, or arguing with a fraud-team representative reading from a script.
And we will tell you when you do not have a case. If you authorised the deposit and lost, or you missed the federal timeframes, we say so before you spend energy on a claim that is not going anywhere.
Our 12-plus years of player-side gambling-law experience and the casino dispute and chargeback services we provide are set out separately.
What’s Coming in 2026
The legal and regulatory environment around offshore gambling and US payments keeps moving. Three things to keep an eye on:
- CFPB enforcement on issuer dispute-handling. The Citizens Bank, Goldman Sachs Apple Card, and Block orders set the current expectations for how your bank must treat your claim. Future enforcement will sharpen those expectations further.
- State gaming regulators. Michigan and New Jersey have been the most active so far. Other state regulators are likely to follow, particularly on sweepstakes operators.
- Curaçao reform. The Orange Seal arrangement ended on 15 October 2025, and operator obligations under the LOK keep tightening through 2026. That changes, but does not remove, the limits of the Curaçao route for individual players.
To start a dispute, or to get a candid read on whether your situation has a viable claim, contact Player Protection Legal.