Finding an unfamiliar charge on your health savings account feels like a gut punch. You spent years building that balance for medical bills. Now someone else may have spent it for you. An HSA fraud claim is different from a normal reimbursement dispute, and knowing the difference determines how fast you get your money back. This guide covers what counts as fraud, how to report it, what documents win your case, and what taxes might follow if you don’t act fast enough.
What Counts as HSA Fraud (and Why It’s Different from a Denied Claim)
A denied HSA claim usually means your plan disagreed that an expense qualified as medical. That’s an administrative disagreement. Fraud is different. It means someone used your account, your card, or your identity without permission.
If your custodian denied a reimbursement because a receipt didn’t show a qualified expense, that’s a coverage dispute. If someone stole your HSA debit card and bought electronics with it, that’s theft. The steps you take, and the protections you can claim, depend on which situation you’re in.
Common Types of Health Savings Account Fraud
HSA fraud generally falls into a few recognizable patterns:
- Stolen or cloned debit card use. Someone gets your physical card or card number and makes purchases at pharmacies, retailers, or online stores.
- Phishing and account takeover. A scammer tricks you into giving up login credentials, then transfers funds or changes your linked bank account.
- Provider billing fraud. A medical office bills your HSA for services you never received, or inflates charges beyond what it actually provided.
- Employer or plan administrator errors that mimic fraud. Rare, but sometimes a payroll mistake or a data breach at your HSA custodian exposes account numbers to bad actors.
Each pattern requires a different first move. But they all start with the same instinct: stop the bleeding, then start documenting.
How to File a Health Savings Account HSA Fraud Claim Step by Step
Speed matters here. Most custodians give you a limited window, often 60 days from the date of the statement showing the fraudulent charge, to dispute it under Regulation E protections. Waiting weeks to “see if it resolves itself” is the most common mistake people make.
- Freeze or cancel the card immediately. Log into your HSA portal or call the number on the back of the card. This stops new charges while you investigate old ones.
- Pull your last three to six months of statements. Look for a pattern, not just one bad charge. Fraud rings often test a card with a small purchase before a larger one.
- Write down every transaction you don’t recognize. Include the date, amount, merchant name, and how it appeared on your statement.
- Submit a written dispute to your custodian, not just a phone call. Phone reports start the clock, but written disputes create a record you can point to later.
- Ask for a provisional credit. Many custodians will restore disputed funds while they investigate, similar to a bank reversing a fraudulent debit card charge.
- Track your custodian’s response deadline. Ask them directly how many business days their investigation will take, and get the answer in writing.
Contacting Your HSA Custodian or Bank
Most HSA custodians, including banks like Fidelity, HealthEquity, and Optum Bank, run a fraud dispute process similar to a standard debit card claim, since HSAs are FDIC-insured deposit accounts. Call the fraud department, not general customer service, so your case gets flagged properly from the start.
Ask for a case number on every call. Confirm it by email if the representative allows it. If your custodian has an online fraud dispute form, use it and keep a screenshot of your submission and confirmation.
Filing a Police Report and FTC Complaint
A police report isn’t just paperwork. Custodians often require one before approving a fraud reversal above a certain dollar amount. File one with your local police department, even if you think they can’t catch the culprit. The report number matters more than the outcome.
You should also file a complaint with the Federal Trade Commission through its identity theft reporting system. The FTC’s report can support your dispute. In identity theft cases, it can also help you get fraudulent charges removed from other accounts. If you’re outside the US, your country’s consumer protection or fraud reporting body serves the same purpose.
Documentation That Strengthens Your Fraud Dispute
Custodians don’t take your word for it, and they shouldn’t have to. What actually gets a fraud claim approved is a clear, dated paper trail. It needs to show the charge wasn’t yours and that you acted quickly once you noticed it.
Gather these documents before you file:
- Full account statements showing the disputed transactions
- Explanation of Benefits (EOB) forms from your health insurer, if the fraud involves a medical provider
- Screenshots of your HSA transaction history with timestamps
- Copies of any phishing emails or suspicious login alerts
- The police report number and FTC complaint confirmation
- Your written dispute letter and any reply from the custodian
Building a Paper Trail Like a Proof of Loss
If you’ve ever filed a homeowners or business insurance claim, this process will feel familiar. Insurers ask for a proof of loss to establish exactly what was lost, when, and how much it’s worth. HSA fraud disputes work the same way, even though no insurance policy is technically involved.
Understanding how a proof of loss form works in commercial insurance claims can help you organize your HSA fraud file the same way: chronological, itemized, and backed by evidence for every dollar you’re claiming. Custodians respond better to disputes that read like a case file, not a complaint email.
Tax and IRS Implications of Fraudulent HSA Withdrawals
Here’s the part many people miss until it’s too late: the IRS doesn’t automatically know your withdrawal was theft, not a personal expense. If a fraudulent charge is still sitting on your HSA records as an unqualified distribution when you file your taxes, it can be taxed as ordinary income.
IRS penalties for non-qualified HSA withdrawals typically run 20% on top of ordinary income tax for account holders under 65. A fraudulent charge can cost you twice: once when it’s stolen, and again at tax time if it’s never corrected on the record.
The fix is documentation, not panic. If your custodian confirms the charge as fraud and reverses it, your account records should show the funds restored, not spent. If the investigation is still open when you file taxes, talk to a tax preparer about how to report the disputed amount. Ask whether you’ll need an amended return once the dispute resolves. Don’t assume the IRS will take your word that a charge was theft. The custodian’s fraud determination is what makes the difference.
What to Do If Your HSA Fraud Claim Is Denied
A denial isn’t the end of the road. Custodians sometimes reject fraud disputes because the paperwork was incomplete, the timeline looked delayed, or the investigator simply got it wrong. You have the right to push back.
Start by asking for the denial in writing, along with the specific reason. Then resubmit with any documentation gaps filled in. If the merchant charge looks like a card-present transaction but you can prove you were elsewhere, submit that evidence directly: travel records, time-stamped receipts, or a statement from a witness.
If your dispute involves a real reimbursement amount that the custodian is lowballing rather than denying outright, the tactics used in negotiating a stronger settlement with an insurer apply here too. Push for a full accounting of why the amount was reduced. Don’t accept a partial reversal without an explanation.
Escalating to a Regulator or Ombudsman
If your custodian won’t budge, you can escalate. In the US, file a complaint with the Consumer Financial Protection Bureau, since HSAs held at banks fall under its jurisdiction for account-related disputes. You can also contact your state’s banking regulator or attorney general’s consumer protection office.
Outside the US, look for the equivalent financial ombudsman or consumer protection agency in your country. Regulators can’t force every outcome, but a formal complaint on record often speeds up an internal review that’s been sitting untouched.
When to Consult a Consumer Protection Attorney
For larger amounts, or when a custodian has denied a well-documented claim without explanation, it’s worth talking to a consumer protection attorney. Many offer free consultations for fraud disputes, and some work on contingency. An attorney’s letter alone sometimes prompts a custodian to reopen a case that a customer service line kept closing.
If your case also involves an insurance denial tied to the same medical expenses, understanding the broader process of filing and managing an insurance claim can help you keep both disputes moving together instead of one stalling the other.
Preventing Future HSA Fraud on Your Account
Once your dispute is resolved, lock the account down so it doesn’t happen again.
- Turn on transaction alerts. Most custodians let you get a text or email for every charge, no matter how small.
- Use a unique password and two-factor authentication for your HSA login, separate from your email or bank password.
- Lock your card when it’s not in active use, if your custodian’s app supports it.
- Reconcile EOBs against HSA debits every month. A stolen card often shows up as a mismatch between what your insurer says was billed and what your HSA actually paid out.
- Shred or securely store old HSA statements that list your account number.
A common fraud pattern: someone uses a stolen HSA debit card at a pharmacy or online retailer for non-medical purchases. The cardholder often only discovers it while reconciling statements months later. Monthly checks close that gap fast.
HSA fraud is stressful, but it’s rarely unfixable. Move quickly. Document everything the way you would for a proof of loss. Don’t accept a denial as the final word. Your funds, and your tax return, depend on getting the paper trail right the first time.