Electronic Fund Transfer Act: Liability, Disputes, and Lawsuits

The Electronic Fund Transfer Act gives consumers a specific set of rights when money moves electronically out of a personal bank account: a cap on what you can lose to unauthorized transactions, a formal process for disputing errors with deadlines the bank must meet, the right to stop recurring payments, and the right to sue for damages when a bank breaks the rules. The protections cover debit card purchases, ATM withdrawals, direct deposits, preauthorized payments, and peer-to-peer app transfers from consumer accounts.¹ Credit card charges are governed by a different law with different rules.

How Much You Can Lose to Unauthorized Transfers

Federal law defines an unauthorized electronic fund transfer as one initiated by someone other than you, without your permission, from which you receive no benefit.² A stolen debit card used at an ATM is the obvious case. A scammer who tricks you into revealing your online banking password and drains the account also qualifies.

How much you owe depends almost entirely on how quickly you notify the bank. The system is deliberately tiered to reward fast reporting.

When a Card, PIN, or Access Code Is Lost or Stolen

Report the loss within two business days of learning about it, and your liability is capped at $50, or the amount of unauthorized transfers before you called, whichever is less.³

Wait longer than two business days but report within 60 days of the statement showing the transfers, and your liability can reach $500. The bank must prove that the transfers above $50 could have been prevented if you had reported sooner.³

Miss the 60-day window entirely and you are on the hook for every unauthorized transfer that happens after that window closes, up until you finally report, as long as the bank can show those transfers were preventable. That can mean losing the full balance.³

When No Card Is Involved

The $50 and $500 tiers apply when a physical or electronic access device was lost or stolen. If someone drains your account after a data breach or hacks your online banking without stealing a card or code from you, the 60-day statement rule is what governs. Report within 60 days of the statement showing the unauthorized transfers and your liability should be zero. Wait longer, and you become liable for later unauthorized transfers the bank can prove were preventable.³

Situations That Can Extend the Deadlines

If extended travel, hospitalization, or similar circumstances kept you from reviewing your statement or contacting the bank, the institution must extend the reporting deadlines.⁴ You still need to report as soon as reasonably possible once the situation ends.

One Important Carve-Out

A transfer is not “unauthorized” if you gave someone your card or PIN and they misused it, unless you had already told the bank to cut off that person’s access.² Share your PIN with a roommate who later empties the account, and the bank will likely argue every transfer was authorized until the moment you formally revoked access.

What the Bank Must Have Done First

Before the bank can hold you liable for any amount, it must have given you the required disclosures about your rights and the liability limits. For transactions involving an access device, the bank must have issued that device to you and provided a way to identify you as the cardholder.³ If it skipped any of that, it cannot shift losses onto you.

Reporting an Error and Starting an Investigation

Unauthorized transfers are only one type of “error” you can dispute. Regulation E lets you report seven kinds:

An unauthorized transfer
An incorrect transfer, wrong amount or wrong account
A transfer missing from your statement
A computational or bookkeeping mistake involving a transfer
An ATM that dispensed less cash than it debited
A transaction on your statement missing required identifying information
A request for documentation or clarification about a transfer

That last category is broader than it looks. You do not need to prove an error occurred to file a notice; you can file one because you need more information to figure out what happened.⁵

To start the bank’s investigation clock, your notice needs enough information for the bank to identify you and the problem: your name and account number, the date, approximate amount, and type of the suspected error, and why you think something is wrong. You can report orally or in writing, and either method starts the clock. If you report by phone, the bank can require written confirmation within ten business days, and if you do not send it, provisional credit can be pulled back.⁶

You have 60 days from the date the bank sends the statement showing the transaction to file a notice. Miss that deadline and the bank is no longer required to investigate under these rules.

The Deadlines the Bank Must Meet

Once your notice arrives, the timelines are strict, and this is where consumers who know the rules have real leverage.

The bank has ten business days to investigate and reach a conclusion. If it finds an error, it must correct the account within one business day of that finding.⁶

If the bank needs more time, it can take up to 45 days total, but only if it provisionally credits the disputed amount to your account within the first ten business days and notifies you of the credit within two business days after posting it.⁶ You have full use of that money during the investigation.

The window stretches to 90 days for three kinds of transactions: transfers not initiated in the United States, point-of-sale debit card transactions, and transfers occurring within the first 30 days after the first deposit into the account. The same provisional credit rule applies.⁶

When the investigation ends, the bank must report its findings to you within three business days. If it decides no error occurred, it must give you a written explanation and tell you that you can request the documents it relied on. It can then reverse any provisional credit, but must notify you of the date and amount of the debit.⁶

Stopping a Recurring Payment

If you authorized a company to pull recurring payments from your account, you can stop any one of them by notifying the bank at least three business days before the scheduled payment. The notice can be oral or written.⁷

The catch with an oral stop-payment order: the bank can require you to send written confirmation within 14 days, and it must tell you about this requirement and where to send the confirmation when you call. Skip the follow-up and the oral order expires.⁷ Put it in writing.

Sending Money Abroad

International remittance transfers get their own set of rules under Regulation E, and they favor the sender more than most people realize.

Before you pay, the provider must give you a written pre-payment disclosure showing the transfer amount, all fees and taxes the provider is charging, the exchange rate, any third-party fees the provider knows about, and the total the recipient will receive in the destination currency.⁸ If the written numbers do not match what you were told verbally, walk away.

You have 30 minutes after paying to cancel, as long as the recipient has not already picked up the funds. Cancel in time and the provider must refund the full amount, including all fees and taxes, within three business days.⁹

The error resolution process for remittance transfers gives the provider up to 90 days to investigate, with findings reported to you within three business days after the investigation ends.¹⁰ There is no ten-day initial window or provisional credit requirement for remittance disputes.

What the Act Does Not Cover

Several common transactions fall outside these rules, and assuming you are protected when you are not can be costly.

Business, partnership, and corporate accounts are not covered; the Act protects accounts held by individuals for personal, family, or household purposes.¹ Wire transfers through Fedwire, CHIPS, or SWIFT are excluded and governed by UCC Article 4A instead.¹¹ A paper check that clears as a paper check is not an electronic fund transfer. Securities and commodities transactions regulated by the SEC or CFTC are excluded, as are automatic transfers your bank makes between your own accounts under a standing agreement, and one-off telephone transfers you initiate by calling a bank employee outside a recurring bill-payment plan.¹²

Credit card charges are covered by the Truth in Lending Act, not this one. Credit card liability for unauthorized charges is capped at $50 regardless of when you report, which is more forgiving than what applies to your debit card.

Suing the Bank When It Breaks the Rules

The Act has real teeth when a financial institution ignores it. Under 15 U.S.C. § 1693m, you can sue for your actual losses plus statutory damages between $100 and $1,000 in an individual case. A successful plaintiff also recovers reasonable attorney’s fees and litigation costs, which makes smaller claims worth bringing.¹³

In a class action, the court sets total damages for the class, capped at $500,000 or one percent of the defendant’s net worth, whichever is lower. Class members can still recover actual damages and share in the court-determined award.¹³

The penalties climb when a bank mishandles an investigation in bad faith. A court can award treble (triple) actual damages when the bank failed to provisionally credit the account within the required ten-day window and either did not conduct a good faith investigation or had no reasonable basis to conclude the account was not in error. Treble damages also apply when the bank knowingly and willfully concluded no error occurred on evidence that could not reasonably support that conclusion.¹⁴

A bank has defenses. It can avoid liability by showing, by a preponderance of the evidence, that a violation was unintentional and resulted from a genuine error despite procedures reasonably designed to prevent it. It also has a defense when it acted in good faith reliance on an official CFPB rule, regulation, or interpretation.¹³ Separately, a bank is not liable for failing to complete a transfer when the failure resulted from circumstances beyond its control, such as a system outage, if it exercised reasonable care.

1
eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
2
Office of the Law Revision Counsel. 15 USC 1693a – Definitions
3
eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
4
Consumer Financial Protection Bureau. Comment for 1005.6 – Liability of Consumer for Unauthorized Transfers
5
Consumer Financial Protection Bureau. 12 CFR 1005.11 – Procedures for Resolving Errors
6
eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
7
Consumer Financial Protection Bureau. 12 CFR 1005.10 – Preauthorized Transfers
8
eCFR. 12 CFR Part 1005 Subpart B – Requirements for Remittance Transfers
9
eCFR. 12 CFR 1005.34 – Procedures for Cancellation and Refund of Remittance Transfers
10
eCFR. 12 CFR 1005.33 – Procedures for Resolving Errors
11
Consumer Financial Protection Bureau. 12 CFR 1005.3 – Coverage
12
eCFR. 12 CFR 1005.3 – Coverage
13
Office of the Law Revision Counsel. 15 USC 1693m – Civil Liability
14
Office of the Law Revision Counsel. 15 USC 1693f – Error Resolution