Do Banks Reimburse Stolen Money? Cards, Checks, and Claims

Banks do reimburse stolen money in most cases, but how much you get back depends on what was stolen, how it was taken, and how fast you tell the bank. Federal law caps your liability at $50 for unauthorized credit card charges no matter when you report, and at $50 for debit card or electronic transfers if you report within two business days. Wait longer and the ceiling climbs quickly — after 60 days, it disappears entirely for electronic transfers, and you could lose everything a thief takes. Paper checks, wire transfers, and scams where you sent the money yourself each follow different rules.

Debit Cards and Electronic Transfers

The Electronic Fund Transfer Act and its implementing rule, Regulation E, govern unauthorized debit card charges, ATM withdrawals, direct deposits, and electronic bill payments on personal accounts.¹ A transfer counts as unauthorized when someone other than you initiates it without your permission and you receive no benefit from it.²

Your liability is tied directly to how quickly you notify the bank:

Report a lost or stolen card before any unauthorized charge occurs, and you owe nothing.³
Report within two business days of learning of the loss, and your maximum liability is $50, or the amount of the unauthorized transfers, whichever is less.⁴
Report after two business days but within 60 days of the statement showing the activity, and your liability rises to as much as $500.⁴
Report after that 60-day window closes, and the bank is not required to reimburse any unauthorized transfers that occurred after the deadline. There is no cap on what you can lose.³

The two-day clock runs from when you learn of the theft. The 60-day clock runs from when the bank sends the statement showing the unauthorized activity. If something like hospitalization or extended travel kept you from reporting on time, the bank must extend these deadlines to a reasonable period.

Credit Cards

Stolen credit card charges are handled under the Fair Credit Billing Act, and the protection is stronger. Your maximum liability for unauthorized use is $50, full stop, with no tiered deadlines. The card issuer carries the burden of proving either that you authorized the charge or that the conditions for imposing liability were met.⁵ Report the card stolen before any charge posts, and you owe nothing.

In practice, most cardholders pay less than the statutory cap. Visa and Mastercard both offer zero-liability policies covering unauthorized purchases in stores, online, by phone, or through mobile devices, on both credit and debit cards branded with their networks.⁶⁷ These policies typically exclude commercial cards and unregistered prepaid cards and require you to have used reasonable care and reported the loss promptly.

There is a practical difference beyond the numbers. When a debit card is stolen, the money leaves your checking account immediately, and you may wait weeks for the investigation to conclude. When a credit card is stolen, no money leaves your bank account while the charge is disputed.

Stolen Checks

Paper checks fall outside the Electronic Fund Transfer Act, but the Uniform Commercial Code, adopted in some form by every state, still protects you. A bank can only charge your account for items that are “properly payable,” meaning authorized by you and consistent with your account agreement.⁸ A check with a forged signature is not properly payable, so the bank generally bears the loss.

You still have a duty to review your statements and flag forged or altered checks within a reasonable time. Delay too long and you may lose the right to recover. The specific deadline varies by state, typically running from 30 days to one year after the bank makes the statement available. Check your account agreement for the exact terms.

When the Bank Can Say No

Not every loss qualifies for reimbursement. The most common denials involve transactions that the bank considers authorized because you technically initiated or approved them, even if you were deceived.

Scams Where You Sent the Money Yourself

If a scammer convinces you to send money through a peer-to-peer payment app, a wire transfer, or a bank transfer, the bank will usually classify the transaction as authorized. You pressed send using your own credentials. Regulation E defines an unauthorized transfer as one initiated by someone other than you, without your permission, from which you received no benefit.² When you initiated the payment yourself, even under false pretenses, that definition is harder to satisfy.

The line moves when a fraudster gets your credentials. If someone steals your login through a data breach, a phishing site, or by tricking you into sharing a confirmation code, and then uses those credentials to move money out of your account, the Consumer Financial Protection Bureau has said that transfer is unauthorized under Regulation E. The same applies when a hacker takes control of your phone and uses a mobile wallet or payment app to send funds.⁹ The key question is who actually initiated the transfer.

Shared Credentials and Negligence

Banks also deny claims when they conclude the account holder failed to take basic precautions. Writing a PIN on the card, sharing login credentials, or leaving an unlocked device unattended are common reasons cited. If you gave someone your card or account access voluntarily, transfers by that person are not considered unauthorized unless you previously notified the bank to revoke their access.²

Business Accounts

Regulation E applies only to accounts established primarily for personal, family, or household purposes.⁹ The $50 and $500 caps do not apply to business checking accounts. Those disputes are generally governed by UCC Article 4A, which places greater responsibility on the business to maintain its own security procedures. If the bank and business agree on a commercially reasonable security procedure and the bank follows it, the bank may not be liable even if a payment order turns out to be fraudulent.¹⁰ Review your account agreement and use any dual-authorization or fraud-monitoring tools the bank offers.

How to Report the Theft

Speed is the single biggest factor in recovering the money. Before you call, pull together:

The account number for the affected account.
Exact dates, dollar amounts, and merchant names for each suspicious transaction.
When you first noticed the activity, and, if applicable, when you lost the card or credentials.
A brief description of how you think the unauthorized access happened.

Most banks will ask you to complete a formal affidavit or written statement confirming the transactions were unauthorized and that you did not share your credentials. These statements carry legal weight, so be thorough and accurate. If you first report by phone, the bank can require written confirmation within 10 business days, and if you don’t send it, the bank is not required to issue provisional credit while it investigates.¹¹ Always follow up a phone call in writing.

If the theft is part of a broader identity theft, filing a report at IdentityTheft.gov creates an official FTC Identity Theft Report and generates a personalized recovery plan.¹² A local police report is also worth filing; some banks request one during their investigation.

What Happens After You Report

Once you notify the bank of an unauthorized electronic transfer, federal deadlines take over. The bank must investigate and resolve the claim within 10 business days. If it needs more time, it must provisionally credit your account for the disputed amount, plus any applicable interest, within those same 10 business days, and then has up to 45 days total to finish investigating.¹¹

The 45-day window stretches to 90 days in three situations: the transfer originated outside the United States, it resulted from a point-of-sale debit card transaction, or it occurred within 30 days of the first deposit to a new account.¹³ During the investigation, you can use the provisionally credited funds. If the bank ultimately concludes the transfer was authorized, it can reverse the credit, but must give you advance written notice.

If the Bank Denies Your Claim

If the bank denies reimbursement or misses the investigation deadlines, you have escalation options.

Submit a complaint to the Consumer Financial Protection Bureau at consumerfinance.gov/complaint.¹⁴ The CFPB forwards the complaint to the bank and generally requires a response, which sometimes produces a different result than the bank’s internal dispute department gave you.

You also have the right to sue under the Electronic Fund Transfer Act. If a bank fails to provisionally credit your account within 10 business days without a good-faith investigation, or knowingly and willfully concludes your account was not in error when it was, a court may award treble damages up to three times the proven loss.¹¹ Banks are separately liable for damages they proximately cause by failing to properly handle electronic transfers, including failing to execute authorized transfers or stop preauthorized payments when instructed.¹⁵

Check your account agreement for a mandatory arbitration clause before planning any lawsuit. Many agreements require individual arbitration and bar class actions. You can still pursue an individual arbitration claim or file in small claims court, depending on the amount at stake and the terms of your agreement.

1
Legal Information Institute (LII). Electronic Funds Transfer Act
2
eCFR. 12 CFR 1005.2 – Definitions
3
Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
4
eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
5
Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
6
Visa. Visa’s Zero Liability Policy
7
Mastercard. Mastercard Zero Liability Protection Policy
8
Legal Information Institute (LII). UCC 4-401 – When Bank May Charge Customer’s Account
9
Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
10
Legal Information Institute (LII). UCC Article 4A – Funds Transfer (2012)
11
Office of the Law Revision Counsel. 15 USC 1693f – Error Resolution
12
Federal Trade Commission. IdentityTheft.gov
13
Consumer Financial Protection Bureau. 12 CFR 1005.11 – Procedures for Resolving Errors
14
Consumer Financial Protection Bureau. Submit a Complaint
15
Office of the Law Revision Counsel. 15 USC 1693h – Liability of Financial Institutions