Banks do refund fraud money in most situations, but the answer is not a flat yes. How much you recover depends on what kind of account was hit, what type of fraud occurred, and — above all — how fast you reported it. Federal law caps your out-of-pocket loss at $50 for unauthorized credit card charges and for debit card charges reported within two business days. Wait too long on a debit card or a forged check, and you can lose the right to recover anything at all.
Debit Card and ATM Fraud
Unauthorized debit card charges, ATM withdrawals, and other electronic transfers out of your bank account are governed by the Electronic Fund Transfer Act and Regulation E.1eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E) Your maximum liability is set by how quickly you notify the bank:
- Within 2 business days of learning of the loss or theft: liability is capped at $50 or the amount of unauthorized transfers, whichever is less.
- After 2 business days but within 60 days of the statement showing the fraud: liability rises to a maximum of $500, covering unauthorized transfers the bank can show would not have happened if you had reported sooner.
- After 60 days from that statement: unlimited liability for unauthorized transfers that occur after the 60-day window.
These tiers come straight from the federal statute.2Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability The unlimited tier is where people get seriously hurt. If a thief drains your account slowly over several months and you never check your statements, the bank can legally refuse to refund charges that came more than 60 days after the first statement showing fraud.
One thing that surprises people: your own carelessness doesn’t move the tiers. Even if you wrote your PIN on the back of the card, the bank can’t use that to deny your claim or push your liability higher than the tiers above. Regulation E ties liability to reporting speed, not to how careful you were.1eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
Credit Card Fraud
Credit cards give you stronger protection than debit cards. Under the Truth in Lending Act, your maximum liability for unauthorized credit card charges is $50, period.3Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card There is no escalating tier. Report on day one or day thirty, the cap is the same.
The Fair Credit Billing Act adds a separate dispute process for billing errors. You must send written notice to the card issuer within 60 days of the first statement showing the error. The issuer then has 30 days to acknowledge your complaint and 90 days to resolve it.4Federal Trade Commission. Using Credit Cards and Disputing Charges
Most consumers never pay the $50 either. Visa and Mastercard both maintain zero-liability policies that eliminate that amount for unauthorized transactions. Visa’s policy covers any unauthorized charge processed through its network if you used reasonable care and reported promptly.5Visa. Visa’s Zero Liability Policy Mastercard offers the same coverage for purchases in stores, over the phone, online, or at ATMs.6Mastercard. Zero Liability Protection Both networks exclude certain commercial cards and unregistered prepaid cards like gift cards.
That is the practical advantage of credit cards. When a thief uses your credit card, you dispute a charge against the issuer’s money. When a thief uses your debit card, your cash is already gone while the bank investigates.
Check Fraud and Forgery
Checks follow a different rulebook. Instead of Regulation E, forged and altered checks fall under the Uniform Commercial Code, which every state has adopted in some form. UCC Section 4-406 puts an affirmative duty on you to review statements with reasonable promptness and report any unauthorized signatures or alterations.7Legal Information Institute. UCC 4-406 – Customer’s Duty to Discover and Report Unauthorized Signature or Alteration
Two deadlines matter. If you fail to report a forgery promptly and the same person writes more bad checks, the bank isn’t liable for checks it paid in good faith after giving you a reasonable time to review your statement (up to 30 days). And there is a hard outer limit: you must discover and report any unauthorized signature or alteration within one year of receiving the statement. Miss that window and you lose the right to recover, regardless of bank negligence.7Legal Information Institute. UCC 4-406 – Customer’s Duty to Discover and Report Unauthorized Signature or Alteration
Many banks shorten the reporting window through their account agreements, sometimes to 15 or 30 days. Read the deposit agreement you signed at account opening. The contractual deadline may be much tighter than the UCC default.
Wire Transfer Fraud
Wire fraud is the hardest to recover from. Wires are built to be fast and final. Under UCC Article 4A, which governs commercial fund transfers, the bank must refund an unauthorized wire it accepted without proper authorization.8Legal Information Institute. UCC 4A-204 – Refund of Payment and Duty of Customer to Report With Respect to Unauthorized Payment Order But if the bank used a commercially reasonable security procedure and the transfer was verified through it, the burden shifts to you to prove the transfer was not authorized.
Speed is everything. Recovery success drops sharply after 24 hours because the receiving party can withdraw the funds almost immediately. Caught within minutes, the bank may cancel the wire before it processes. After that, the bank sends a SWIFT recall — an urgent request to the receiving bank asking it to freeze and return the funds. Whether the receiving bank cooperates depends on whether the money is still there.
Beyond your bank, report wire fraud to the FBI’s Internet Crime Complaint Center (IC3) immediately. The FBI operates a Recovery Asset Team that works directly with receiving banks to freeze accounts when victims report quickly enough. File the IC3 complaint with all transaction details, reference numbers, and timestamps, then contact your local FBI field office and reference the IC3 complaint number.
Zelle, Venmo, and Cash App Fraud
This is where most people lose money they assume the bank will refund. The critical line is between unauthorized transfers and transfers you were tricked into sending yourself.
If a thief hacks your account or steals your login credentials and moves money through a payment app without your involvement, that is an unauthorized transfer. Regulation E applies, and you get the same tiered liability protection as debit card fraud. The Consumer Financial Protection Bureau has confirmed that person-to-person payment transfers qualify as electronic fund transfers under Regulation E, and that transfers initiated by a fraudster using stolen credentials are unauthorized whether they went through a bank app or a third-party platform like Zelle or Venmo.9Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
The harder scenario is when a scammer tricks you into sending the money yourself. If you open the app, type in the amount, and hit send, even because someone impersonated your bank or threatened you, you technically authorized the transfer. Federal law does not require the bank to refund that money, because Regulation E only covers transfers initiated without your authorization.9Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs There is one important exception: if a scammer fraudulently obtained your access credentials (through phishing, for example) and then used those credentials to initiate the transfer, the CFPB treats that as unauthorized, because you didn’t voluntarily furnish the access device.
Some payment networks have gone beyond the legal minimum. Zelle’s bank participants, for instance, began reimbursing victims of certain impersonation scams in mid-2023 as a network policy, not a legal requirement. But coverage varies by bank and by scam type. Don’t assume any payment app will make you whole if you sent money voluntarily.
Business Accounts Are Not Covered
Everything above applies to personal consumer accounts. If fraud hits your business bank account, the protections are substantially weaker. The Electronic Fund Transfer Act explicitly excludes business accounts, so Regulation E’s liability caps and investigation timelines don’t apply.
Business wires and ACH payments fall under UCC Article 4A, which requires the bank to refund truly unauthorized transfers but lets the bank shift liability to the customer when a commercially reasonable security procedure was in place and verified the transfer.8Legal Information Institute. UCC 4A-204 – Refund of Payment and Duty of Customer to Report With Respect to Unauthorized Payment Order Check fraud on business accounts uses the same one-year UCC deadline as consumer accounts, but banks often contractually shorten the business reporting window to as little as 15 to 30 days. If you own a business, your fraud protections are largely whatever you agreed to in your account contract.
How to File a Fraud Claim
Report the moment you discover it. Call the dedicated fraud number on the back of your card, which routes you to a specialist rather than general customer service. Most banks also let you flag suspicious transactions through their mobile app or online banking.
Have the details ready: date and approximate time of each suspicious transaction, dollar amount, and the merchant name as it appears on your statement. The bank will typically ask you to complete a fraud affidavit describing what happened, sometimes signed under penalty of perjury, so be precise about what you know versus what you’re estimating.
If the fraud involved identity theft or a stolen card, file a police report first. Banks frequently ask for the report number to cross-reference with law enforcement, and having it in hand speeds up intake. For larger losses, send copies of your affidavit and supporting documents by certified mail with return receipt. Once the bank accepts the claim, save the tracking number for every follow-up.
How Long the Bank Has to Investigate
Regulation E sets firm deadlines on debit card and electronic transfer disputes. The bank has 10 business days from receiving your error notice to complete its investigation. If it can’t finish in that window, it can take up to 45 days total, but only if it provisionally credits your account within those 10 business days for the disputed amount.1eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E) That provisional credit gives you access to the money while the investigation continues.
Three situations stretch the maximum investigation period from 45 to 90 days:
- New accounts, where the fraudulent transaction occurred within 30 days of the first deposit.
- International transfers not initiated within the United States.
- Point-of-sale debit card transactions, including mail and telephone orders processed as debit, but not ATM withdrawals even at merchant locations.
For new accounts, the bank also gets 20 business days instead of 10 to issue the provisional credit.1eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E) If you opened the account recently and fraud hits within the first month, expect a longer wait for both the temporary credit and the final resolution.
Once the investigation ends, the bank notifies you of the result. If your claim is validated, the provisional credit becomes permanent. If the bank concludes the transaction was authorized, it will revoke the provisional credit, but it must provide a written explanation and tell you that you have the right to request copies of all documents it relied on.10Consumer Financial Protection Bureau. Section 1005.11 Procedures for Resolving Errors
If the Bank Denies Your Claim
A denial is not the end. Start by exercising your Regulation E right to request every document the bank used to decide against you. The bank must provide them promptly and in a format you can actually read.10Consumer Financial Protection Bureau. Section 1005.11 Procedures for Resolving Errors Review them for holes.
If the bank claims the transaction was authorized, gather evidence that shows otherwise. Proof of your physical location at the time (work records, travel receipts, boarding passes), IP address logs showing the transaction came from a device you don’t own, or records of a cancellation request for a recurring charge all help. Submit a formal written appeal with the evidence attached and clearly labeled.
When the bank won’t move, escalate to the Consumer Financial Protection Bureau. File online at consumerfinance.gov/complaint or call (855) 411-2372. The CFPB forwards the complaint to the bank, which generally must respond within 15 days, with up to 60 days for a final response in some cases. You then have 60 days to review the response and provide feedback.11Consumer Financial Protection Bureau. Submit a Complaint Include all relevant documentation with your initial complaint. You generally can’t submit a second complaint about the same issue. For amounts within your state’s small claims limit (typically $10,000 to $20,000), a small claims action against the bank is another option that doesn’t require a lawyer.