Bank accounts are not insured against theft the way most people assume. FDIC and NCUA deposit insurance only pays out if your bank or credit union fails; neither covers a dime of what a thief takes from your account. What actually gets your money back is a separate set of federal laws, and how much you recover depends on how the theft happened and how fast you reported it. For a stolen debit card you can walk away paying $50 or nothing; for a fraudulent wire transfer from a business account, you may be out the full amount with no federal backstop at all.
What FDIC and NCUA Insurance Actually Covers
The Federal Deposit Insurance Corporation guarantees deposits up to $250,000 per depositor, per insured bank, per ownership category.1FDIC. Deposit Insurance FAQs The National Credit Union Administration provides the same coverage for credit union accounts.2eCFR. 12 CFR Part 745 – Share Insurance and Appendix Both programs exist for one scenario: the institution itself fails and can’t return your money.
That coverage never triggers because of criminal activity against your individual account. If a thief drains your checking balance, the bank is still solvent, the deposit insurance system isn’t involved, and you have to look elsewhere for recovery. The confusion between the two is common and creates a false sense of security.
Stolen Debit Cards and Unauthorized Electronic Transfers
Your real protection comes from the Electronic Fund Transfer Act and its implementing rule, Regulation E. The law covers unauthorized debit card charges, ATM withdrawals, and ACH debits from consumer accounts, and requires your bank to investigate and, in most cases, return the money.3Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
How much you lose depends almost entirely on how fast you notify the bank. Regulation E uses a tiered system, and the clock runs from different points depending on the situation:4Consumer Financial Protection Bureau. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
- Report within 2 business days of learning your card or access code was lost or stolen, and your maximum loss is $50 (or the amount actually taken, if less).
- Report after that window but before 60 days have passed since your statement was sent, and your maximum loss rises to $500.
- Wait more than 60 days after your statement was sent, and you face unlimited liability for anything taken during the gap between the 60-day deadline and your notification.
The two-day clock starts when you learn about the loss, not when the transfer happens. The 60-day clock starts when the bank sends the statement showing the first unauthorized transaction.3Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability If you don’t check your statements, that outer window can close without you noticing. Being careless with your PIN or card doesn’t push your liability past these caps.5Consumer Financial Protection Bureau. Comment for 1005.6 – Liability of Consumer for Unauthorized Transfers And if hospitalization, extended travel, or similar extenuating circumstances prevented timely reporting, the bank must extend the deadlines to a reasonable period.6eCFR. 12 CFR Part 1005 – Electronic Fund Transfers
Many consumers never pay even the $50 floor because Visa and Mastercard both apply voluntary zero-liability policies to their branded debit cards. Visa’s policy guarantees no responsibility for unauthorized charges and requires issuers to replace stolen funds within five business days of notification.7Visa. Zero Liability Policy These policies are voluntary and have carve-outs for certain commercial cards, anonymous prepaid cards, and transactions outside the network. If a bank disputes a claim, the legal floor remains the $50/$500 Regulation E framework.
Stolen Credit Card Numbers
Credit cards offer significantly stronger protection. Under the Truth in Lending Act, your maximum liability for unauthorized credit card charges is $50, with no escalating tiers and no unlimited exposure window.8Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card Report the theft before any fraudulent charge posts and your liability is zero. Once you report, no later unauthorized charges can be billed to you.
This is the structural reason credit cards are safer for everyday purchases. A thief who steals your credit card number can’t drain your checking account while you wait on an investigation; the disputed charges sit on the issuer’s books, not yours.
Scams and Phishing: The Gray Zone
A thief who tricks you into revealing your login credentials, debit card number, or confirmation codes has not been “furnished” that information in the legal sense. The Consumer Financial Protection Bureau has said transfers initiated after that kind of fraud still qualify as unauthorized under Regulation E, so the same reporting deadlines and liability caps apply.9Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
Transfers you initiate yourself are a different story. If a scammer talks you into sending money through Zelle, Venmo, or a similar service and you personally authorize the payment, the transfer technically isn’t unauthorized. Regulation E was built for transfers someone else initiates using your account, not transfers you send under false pretenses. Banks have pushed back hard against claims in this category, and the law is still unsettled. If pressure to send money through a payment app ends up being a scam, recovery odds are much worse than when a thief accesses your account directly.
Business Accounts and Wire Transfers Fall Outside These Rules
Regulation E only applies to accounts established primarily for personal, family, or household purposes.10eCFR. 12 CFR 1005.2 – Definitions Business accounts are excluded. A commercial checking account drained by an unauthorized ACH debit or debit card transaction gets no liability caps and no mandatory investigation timeline. What the business can recover depends on its account agreement and state law, which tend to favor the bank.
Wire transfers are a bigger gap still. Regulation E explicitly excludes wire transfers sent through Fedwire or similar systems.6eCFR. 12 CFR Part 1005 – Electronic Fund Transfers They’re governed instead by Article 4A of the Uniform Commercial Code. Under Article 4A, if the bank followed commercially reasonable security procedures and verified the payment order in good faith, the customer generally bears the loss on an unauthorized wire. The customer avoids liability only by showing the person who sent the fraudulent order wasn’t entrusted with any role in the security process and didn’t gain access through the customer’s own systems. An employee tricked by a phishing email into triggering a wire can cost a company the full amount, with no federal safety net resembling what consumers have for debit card fraud. For high-value wires, many banks offer optional callback verification, and using it is worth the small friction.
Forged Checks
Paper checks follow their own framework. Under UCC Article 3, an unauthorized signature on a check is ineffective as the purported signer’s signature, meaning the bank had no authority to pay it and must restore the funds once you report the forgery.11Legal Information Institute (LII). UCC 3-403 – Unauthorized Signature
The catch is a duty to review your statements. If the same forger writes multiple bad checks and you don’t catch the first within a reasonable period (generally not more than 30 days), the bank can refuse to reimburse you for later forgeries by that same person.12Legal Information Institute (LII). UCC 4-406 – Customer Duty to Discover and Report Unauthorized Signature or Alteration There’s also a hard outer deadline: fail to report any forged signature within one year after your statement is made available and you lose the right to challenge it entirely.
What to Do the Moment You Notice Theft
Call the bank immediately. Your initial report can be oral, but the bank can require written confirmation within 10 business days, and if you don’t provide it the bank can withdraw any provisional credit and skip the extended investigation period. Send written confirmation whether or not the bank asks, and keep a record of every call.
Once you report an unauthorized electronic transfer, the bank has 10 business days to investigate and decide whether an error occurred.13eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors If it confirms fraud, it must correct the error within one business day and report the results to you within three business days. If it needs more time, it can extend the investigation to 45 days, but only if it provisionally credits your account within the initial 10 business days and gives you full access to the funds while it continues looking. The bank can hold back up to $50 from the provisional credit if it has a reasonable basis to believe an unauthorized transfer occurred. New accounts get longer windows: 20 business days and 90 days.
If the Bank Denies Your Claim
Denials happen more often than people expect, particularly when a transaction looks authorized to the bank’s fraud systems. Start by requesting the written results of the investigation, which the bank must provide within three business days of completing it.
If the internal process goes nowhere, file a complaint with the Consumer Financial Protection Bureau. The CFPB forwards your complaint to the bank, which generally responds within 15 days, or up to 60 days in complex cases.14Consumer Financial Protection Bureau. Learn How the Complaint Process Works Banks take CFPB complaints seriously because they enter a public database and a regulatory record. You then have 60 days to tell the CFPB whether the response resolved the issue. For disputed amounts that still aren’t paid, small claims court is available in every state, with jurisdictional limits that typically run between $2,500 and $25,000.