The difference between authorized and unauthorized electronic fund transfers comes down to a three-part test in federal law: a transfer is unauthorized only when someone other than you initiated it, that person had no permission to use your account, and you received no benefit from the transaction.1eCFR. 12 CFR 1005.2 – Definitions If any one of those elements is missing, Regulation E treats the transfer as authorized, and the loss stays with you rather than the bank.
The Three-Part Test and Its Hard Exclusions
All three elements have to be present at once. A stolen debit card used at an ATM by a thief you’ve never met is the clean case: not you, no permission, no benefit to you. But if a neighbor uses your account without asking to pay a bill you owed, the bank can argue you benefited, which pulls the transfer out of the unauthorized category.2Office of the Law Revision Counsel. 15 USC 1693a – Definitions
Federal law also carves out three situations that can never qualify as unauthorized, no matter how the transfer plays out:
- Transfers by someone you voluntarily gave your card, PIN, or login credentials to, unless you’ve already told the bank that person is no longer authorized.
- Transfers you took part in with dishonest intent, or that someone made while working with you on a scheme.
- Transfers the bank or its employees initiated, which fall under a separate error-resolution track.
The first exclusion is where most real disputes are decided.2Office of the Law Revision Counsel. 15 USC 1693a – Definitions
When You Handed Someone Your Card, PIN, or Password
Once you voluntarily give a person access to your account, every transfer they make is treated as authorized. The regulatory commentary is direct: if a family member or coworker uses the access you gave them and spends more than you agreed to, you are fully liable unless you notified the bank beforehand that the person is no longer authorized.3Consumer Financial Protection Bureau. 12 CFR 1005.2 – Definitions
The consequence surprises people. Say you hand your roommate your debit card to grab groceries and they pull an extra $300 from an ATM. You never approved the $300, but the bank has no obligation to investigate or reimburse. You furnished the access device, and the regulation puts everything that follows on you until you formally cut that person off. Complaints after the fact don’t trigger any bank duty.
The way to stop the exposure is to notify your financial institution that the person’s access is revoked. Any transfers that person makes after your notice shift back into the unauthorized category, and the bank has to treat them that way.1eCFR. 12 CFR 1005.2 – Definitions
Scams: Stolen Credentials vs. Payments You Sent Yourself
Being tricked is not the same as voluntarily furnishing access. The CFPB has confirmed that when a scammer deceives you into revealing a login, password, or one-time text code and then uses that information to pull money out of your account, the resulting transfer is unauthorized.4Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs The classic version is a caller posing as your bank’s fraud department who talks you into reading a passcode aloud, then drains the account. That still counts as unauthorized because the scammer initiated the transfer.
The line moves the other way when the scammer talks you into sending money yourself, whether by wire transfer or a peer-to-peer app. Even though you were deceived, you initiated the transfer, which makes it far harder to classify as unauthorized under current law. Banks routinely deny reimbursement in that scenario because a third party did not move the money. It is one of the most consequential gaps in the consumer protection framework right now.
What You Owe If a Transfer Is Unauthorized
Assuming the transfer meets the definition, how much of the loss falls on you depends almost entirely on how fast you tell the bank.5Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
- Report within 2 business days of learning about the loss or theft, and your maximum liability is $50, or the total unauthorized amount, whichever is less.
- Report after 2 business days but within 60 days of the statement showing the transfer, and your maximum liability rises to $500, covering transfers the bank can show earlier reporting would have prevented.
- Miss the 60-day window from the statement date, and liability for anything the bank could have blocked with faster reporting becomes potentially unlimited.
The clock on the 60-day deadline runs from when the bank sends the statement, not when you open it. Careless handling of your card, like writing your PIN on the back, does not by itself increase your liability above these tiers.6Consumer Financial Protection Bureau. Regulation E – Liability of Consumer for Unauthorized Transfers If something like hospitalization or extended travel kept you from reporting on time, the bank has to extend the deadlines to a reasonable period.7eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
How to Report and What the Bank Has to Do
You can start a dispute by phone, and the bank’s investigation duties begin the moment you call.8Office of the Law Revision Counsel. 15 USC 1693f – Error Resolution The bank can require a written follow-up within 10 business days, but only if it tells you so at the time and gives you an address. Skipping the written follow-up after it’s requested lets the bank withhold the provisional credit it would otherwise owe you during its investigation.
Your notice needs to include your name and account number, the specific transfer you’re disputing with date and dollar amount, and why you believe it wasn’t authorized.9eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors No notarization, no bank form, no sworn statement. A clear written description covering those three points satisfies the rule. Supporting documents like a police report or evidence you were somewhere else strengthen the claim in practice.
Once the bank has your notice, the standard timeline gives it 10 business days to investigate and report back. If it needs more time, it can take up to 45 days total, but it has to provisionally credit your account within the first 10 business days, and you can use those funds during the investigation. Point-of-sale debit card transactions, transfers not initiated in the United States, and disputes on accounts opened within the last 30 days stretch to 90 days total (20 business days plus 70). The bank has three business days after finishing to notify you of the result. If it decides the transfer was authorized, it can reverse the provisional credit, but it must give you a written explanation.9eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
Business Accounts Are Not Covered
Everything above applies to consumer accounts held for personal, family, or household purposes. Regulation E defines “consumer” as a natural person and limits the covered accounts to those with a personal purpose.3Consumer Financial Protection Bureau. 12 CFR 1005.2 – Definitions Run the same transaction through a business checking account and the liability caps, investigation deadlines, and provisional credit rights disappear. Your rights then come from your account agreement and the Uniform Commercial Code as adopted in your state. Sole proprietors who use a business account for personal spending get caught by this constantly.
If the Bank Sides Against You
A denial isn’t the end. You can file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov/complaint or by calling (855) 411-2372.10Consumer Financial Protection Bureau. Submit a Complaint The CFPB forwards the complaint to the bank, which generally responds within about 15 days. Put your full case in the first submission (attachments are capped at 50 pages) because you usually can’t refile on the same problem. Prioritize account statements and any written communications from the bank.
The Electronic Fund Transfer Act also gives you a private right of action. If the bank missed a deadline, failed to provisionally credit your account, or wrongly denied a legitimate claim, you can recover actual damages plus statutory damages of $100 to $1,000, and the court can award attorney’s fees if you win.11Office of the Law Revision Counsel. 15 USC 1693m – Civil Liability The fee provision is what makes these cases viable when the disputed amount alone wouldn’t justify a lawyer.