Start with the account and the card issuer
Consumers who see unauthorized activity on a retail account should secure the account, report the charges to the card issuer and keep records of each contact. Walmart tells customers to change their password through the retailer’s account-security webpage or mobile-app settings, according to WPXI. The issuer may provide temporary credit while it reviews the claim, but that credit can be withdrawn if the issuer accepts the merchant’s evidence before the dispute is resolved.
The case behind the warning
WPXI reported that Colleen German, a longtime Walmart customer, found that her account had been used for two Florida grocery pickup orders totaling more than $2,000. After the account information was changed, German contacted Walmart’s fraud department, but the orders were collected. Walmart initially directed her to dispute the charges with her credit card company. Her bank first issued temporary credit and later reversed it after Walmart reported that the pickup process included a valid barcode scan, according to WPXI.
After WPXI’s Florida sister station contacted Walmart, the retailer reviewed the account and classified the orders as fraudulent. Walmart then told German to submit another dispute. A Walmart spokesperson said the company is committed to preventing fraud and working with law enforcement, and WPXI later reported that German said she received a full refund.
Options for Pennsylvania consumers
Pennsylvania residents who suspect identity theft should contact the affected account provider immediately and close accounts they believe have been tampered with, according to the Pennsylvania Office of Attorney General. The office also says an initial fraud alert remains on a credit report for 90 days and entitles the consumer to a free credit report. For broader national context, the FBI’s Internet Crime Complaint Center said in its 2025 annual report that it had received more than 10 million complaints as of the report’s publication. That total covers a broad range of cyber matters, however, rather than Walmart account takeovers specifically, so it cannot be used to measure how common the incident described here is.
What complaint data can show
The Consumer Financial Protection Bureau cautions that its complaint database is not a statistical sample and that published complaints are not necessarily representative of consumers’ experiences. The CFPB says complaints are eligible for publication only after the company responds, confirms a commercial relationship or 15 days pass, whichever comes first, according to the agency. Those limits mean the database alone does not establish how often Pennsylvania consumers report unauthorized credit-card transactions or disputes with card issuers. For dated national context, the Federal Trade Commission says its Consumer Sentinel Network received nearly 2.7 million consumer reports across 30 categories during 2017. The FTC cautions that the data was based on unverified consumer reports and was not a consumer survey, according to the agency; the supplied data therefore does not provide a current Pennsylvania-specific rate or show what share involved new or misused financial accounts.
What the dispute rules cover
For unauthorized credit-card use, Regulation Z generally limits a cardholder’s legal liability to $50 after the issuer is notified, according to the Consumer Financial Protection Bureau. The supplied consumer guidance also distinguishes that liability rule from the billing-error procedure: written notice of a disputed charge generally must be sent within 60 days after the statement was mailed, according to AdvoraHQ. Those rules do not guarantee that a temporary credit will remain in place during every investigation, which is why consumers should keep records of notices, claim numbers and issuer decisions.
What remains unclear
The available reporting does not establish why the bank accepted the later dispute, identify the card network’s decision or provide an independent legal assessment of the transaction. WPXI remains the source for the account takeover, Walmart’s response and German’s reported refund. The incident therefore illustrates how a merchant’s transaction records can affect a dispute without independently documenting every decision made by the retailer and issuer.
