Banks do reimburse fraud in most cases, but whether you get your money back depends almost entirely on two things: the type of payment involved and how fast you report it. Credit card charges are nearly always covered in full. Debit card and ATM losses are covered on a sliding scale that can leave you responsible for $50, $500, or everything, depending on when you notify the bank. Forged checks follow a separate set of state-law rules with their own deadlines. Wire transfers and peer-to-peer payments like Zelle sit in the weakest position, especially if you sent the money yourself after being tricked.
Credit Card Fraud Is Almost Always Fully Covered
Federal law caps your liability for unauthorized credit card charges at the lesser of $50 or the total charged before you notified the issuer.1Consumer Financial Protection Bureau. Regulation Z 1026.12 – Special Credit Card Provisions There is no escalating penalty for slow reporting. Whether the thief uses your card for two days or two months, your statutory exposure stays at $50.
The law is even more protective than that. A card issuer can hold you liable for the $50 only if it gave you notice of your potential liability, provided a way to report a lost or stolen card, and included a method for verifying you as the authorized user. Fail any of those conditions and your liability drops to zero. The burden of proving the use was authorized falls entirely on the issuer.2Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
In practice, even the $50 rarely applies. Visa’s Zero Liability Policy eliminates consumer liability for unauthorized transactions on personal cards.3Visa. Zero Liability Mastercard offers the same protection for in-store, online, phone, mobile, and ATM transactions.4Mastercard. Zero Liability Protection Policy Both networks exclude commercial cards and unregistered prepaid cards like gift cards, and both require reasonable care and prompt reporting.
One deadline still matters. If you want to force the issuer to formally investigate a charge as a billing error, you must send written notice within 60 days of the statement date.5Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors Missing that window doesn’t raise your $50 cap, but it can limit your leverage in the dispute process. Read your statements every month anyway.
Debit Card and ATM Fraud: The Clock Controls Your Liability
The Electronic Fund Transfer Act ties your liability for unauthorized debit and ATM transactions directly to how quickly you report. The tiers are hard lines, not guidelines.
- Report within 2 business days of learning about the loss or theft, and your liability is capped at the lesser of $50 or the amount of unauthorized transfers made before you notified the bank.
- Report after 2 business days but within 60 days of your statement, and your liability rises to as much as $500 for unauthorized transfers that occurred during the delay.
- Report after 60 days from your statement date, and you face unlimited liability for any unauthorized transfers that happen after the 60-day window closes and before you contact the bank.6Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
The jump to unlimited liability is not theoretical. If a thief drains your account three months after the first fraudulent charge appeared on a statement you never opened, the bank has no obligation to reimburse anything beyond the amounts covered by the earlier tiers.
The 60-day rule applies even when your card was never physically lost or stolen. If a fraudster copies your account number and starts making purchases, you still have to catch those charges within 60 days of the statement that first shows them. Keeping your card safe in your wallet doesn’t extend the deadline.7Consumer Financial Protection Bureau. Regulation E 1005.6 – Liability of Consumer for Unauthorized Transfers
One detail trips people up. “Business day” under the EFTA means a day when your bank is open for substantially all of its functions, not just when the ATM or the website is up. A Saturday when the branch takes deposits but can’t run fraud investigations does not count.8Consumer Financial Protection Bureau. Regulation E 1005.2 – Definitions
Check Fraud Follows a Different Rulebook
Forged and altered checks are governed by the Uniform Commercial Code, which every state has adopted in some form. A bank that pays a forged or altered check has generally made an unauthorized payment and should bear the loss. But the UCC also puts real duties on you.
You are expected to review your statements with reasonable promptness and report unauthorized signatures or alterations as soon as you should reasonably have discovered them. If you miss a forged check and the same person forges more, the bank can cut off its liability for the later forgeries if it paid them in good faith and you had at least 30 days with the statement showing the first forgery. Catching the first fraudulent check quickly is critical, because the same-wrongdoer rule can multiply your losses fast.9Legal Information Institute. UCC 4-406 – Customer Duty to Discover and Report Unauthorized Signature or Alteration
There is also an absolute cutoff. Fail to discover and report an unauthorized signature or alteration within one year of when the statement was made available, and you lose the claim against the bank entirely. One exception: if the bank itself failed to use ordinary care in paying the item, the loss is split between you and the bank based on how much each side’s negligence contributed. A bank that cashes a crudely forged check can’t escape all responsibility just because you were slow.
Wire Transfers and P2P Payments: The Gap Where Reimbursement Often Fails
Wire transfers and peer-to-peer apps like Zelle, Venmo, and Cash App are the weakest category for consumer protection, and the reason is a distinction that matters far more here than with cards: authorized versus unauthorized.
If someone hacks into your account and sends a wire or a P2P payment without your knowledge, that is unauthorized. Regulation E applies, and the same debit-card liability tiers and investigation deadlines described above kick in.7Consumer Financial Protection Bureau. Regulation E 1005.6 – Liability of Consumer for Unauthorized Transfers
The picture changes completely when you sent the money yourself after being tricked. In an authorized push payment scam — say, someone impersonates your bank and convinces you to wire funds to a “safe” account — the bank generally has no obligation to reimburse you, because you initiated the transfer. This is where consumers lose the most money and have the fewest rights.
Zelle has started reimbursing some imposter scams where the fraudster pretended to be a bank, business, or government entity, but the program’s details are vague. Zelle’s own site says you “may not be able to get your money back” for authorized payments and only that “qualifying imposter scams may be eligible for reimbursement,” without specifying which situations qualify. Wire transfers are even less forgiving. Once executed, they are functionally irreversible.
If you sent an authorized payment to a scammer, call your bank and the payment service immediately to attempt a recall, file a police report, and report the incident to the FBI’s Internet Crime Complaint Center, which is the central intake for cyber-enabled fraud.10Internet Crime Complaint Center (IC3). Home Page Recovery is difficult, but acting within minutes rather than hours significantly improves the odds of freezing the funds.
When the Fraud Comes From Someone You Gave Access To
Fraud by a family member, roommate, or ex-partner creates a special problem. If you gave someone your debit card, PIN, or account login, transfers they make with that access are generally not “unauthorized” under federal law, even if they spent far more than you expected or used the account for something you never agreed to.11Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
The critical exception: once you notify your bank that a specific person is no longer authorized, any transfers that person makes after that point become unauthorized and the normal protections apply. If a relationship has soured, contact your bank immediately to revoke access and get a new card and PIN. Without that notification, the bank can treat those transfers as authorized and deny your claim.
This rule does not apply when the person got your access device through fraud or theft. If someone stole your card from your bag or tricked you into revealing your PIN, those transfers are unauthorized regardless of whether you know the person.
How to Report the Fraud So the Protections Actually Apply
Speed is the single most important factor. Call your bank’s dedicated fraud line as soon as you spot the transaction. Most banks also accept fraud reports through their app or website; use whichever is fastest.
Have the details ready: the date and amount of each suspicious transaction, the merchant or payee name, and when you first noticed. That information starts the investigation and pins down your reporting date, which controls your liability tier.
Follow up in writing. Banks typically provide a claim form to complete and return. Keep copies of everything: your written notification, the completed form, screenshots of the fraudulent transactions, and notes from your call including the date, time, and name of the representative. This paper trail is your proof of when you reported.
For identity theft or large losses, file a police report. Some banks require one before completing their investigation, and the report number becomes part of your claim file.
The Bank’s Investigation and Provisional Credit
Once you report an unauthorized debit or ATM transaction, the bank must investigate promptly. The baseline is 10 business days from receiving your notice to determine whether an error occurred and report the results. If the bank confirms the transaction was unauthorized, it must correct the error within one business day of that determination.12eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
When the bank can’t finish inside 10 business days, it must provisionally credit your account for the disputed amount, including any applicable interest, by the end of that 10th business day. It can withhold up to $50 from the provisional credit if it has a reasonable basis to believe the transfer was unauthorized and that you bear some liability under the reporting rules. The rest of the money goes back into your account while the investigation continues.
With provisional credit issued, the bank has up to 45 days total from the date it received your notice to finish investigating. That window extends to 90 days in three situations:
- New accounts, where the first deposit was less than 30 days earlier. New accounts also get a longer initial investigation period of 20 business days instead of 10.
- Point-of-sale debit transactions, meaning in-store purchases using your debit card.
- Transactions not initiated within the United States.
After the investigation, the bank must notify you of the results within three business days. If the transaction was unauthorized, the provisional credit becomes permanent. If the bank decides you are liable, it can reverse the provisional credit, but only after providing a written explanation of its findings and making available copies of any documents it relied on.13GovInfo. 15 USC 1693f – Error Resolution
If the Bank Denies Your Claim
A denial isn’t the end. Request the written explanation and all supporting documents the bank relied on. Reviewing that record often shows where the investigation went wrong or what extra information could change the outcome. Respond in writing with any evidence that contradicts the bank’s findings.
If the bank won’t move, file a complaint with the Consumer Financial Protection Bureau online or by calling (855) 411-2372. The CFPB forwards the complaint to the bank, which generally must respond within 15 days, with complex cases taking up to 60. You can review the response and add feedback, and the complaint becomes part of the CFPB’s public database.14Consumer Financial Protection Bureau. Submit a Complaint
Federal law also lets you sue. If a bank fails to comply with any provision of the Electronic Fund Transfer Act — including the investigation timelines, provisional credit rules, or the written explanation requirement — you can recover your actual damages plus statutory damages between $100 and $1,000, along with attorney’s fees. Class actions are available with recoveries capped at the lesser of $500,000 or 1% of the bank’s net worth. The deadline to file is one year from the date of the violation.15Office of the Law Revision Counsel. 15 USC 1693m – Civil Liability