Electronic Fund Transfers: Disputes, Overdrafts, and Consumer Rights

If an electronic payment from your bank account goes wrong, federal law gives you a defined set of electronic fund transfer consumer rights: dollar caps on what you can lose to unauthorized charges, deadlines your bank must meet when you dispute a transaction, a right to stop recurring debits, and specific disclosures for money sent overseas. These protections come from the Electronic Fund Transfer Act (15 U.S.C. § 1693) and Regulation E (12 CFR Part 1005), administered by the Consumer Financial Protection Bureau.¹ They apply to accounts held primarily for personal, family, or household purposes, and they reward speed: the faster you report a problem, the more the law protects you.²

What You Can Lose to Unauthorized Debit Charges

Your financial exposure after a lost or stolen debit card, or after a thief gets into your account through phishing, depends almost entirely on how fast you tell your bank. Regulation E sets three tiers:

Report within two business days of learning about the loss, and your liability is capped at $50 or the amount of unauthorized transfers before you notified the bank, whichever is less.³
Report after two business days but within sixty days of the statement being sent, and your liability can reach $500.³
Report after sixty days, and you can be on the hook for the entire amount of unauthorized transfers that occurred after the sixty-day window closed, with no cap.³

The third tier is the one that hurts. Ignoring your statements for a few months after a card goes missing can mean losing everything a thief took during that period.

Credit cards work differently and more forgivingly. Under the Truth in Lending Act, your maximum liability for unauthorized credit card use is $50 regardless of when you report.⁴ Most major card networks go further with voluntary zero-liability policies for both credit and debit fraud, but those programs come with exclusions and are not required by law.⁵ The statutory tiers above are what you can count on.

Zelle, Venmo, and Cash App Count

Peer-to-peer payment apps are electronic fund transfers, and the CFPB has confirmed that any P2P or mobile payment meeting the definition falls under the same federal protections as traditional debit card and ACH transactions.⁶ A private user agreement that tries to offer less than Regulation E requires is overridden by federal law.

The Scam You Sent Yourself

There is one critical boundary. If someone steals your login credentials through phishing and then transfers money out of your account, that is an unauthorized transfer and the liability caps apply. The CFPB has specifically confirmed that when a consumer is tricked into sharing account access and a third party uses it to initiate a transfer, the transaction qualifies as an unauthorized EFT.⁶

But if you personally open Zelle and send $2,000 to someone pretending to sell you concert tickets, you made the transfer. The legal argument that it was “unauthorized” is much weaker because you, the account holder, initiated it. Getting the money back then depends on the recipient’s cooperation or your bank’s goodwill, not a guaranteed federal right. Treat P2P payments like cash.

How to Dispute a Transaction and What Your Bank Must Do

Regulation E defines “error” broadly. The categories include unauthorized transfers, incorrect transfer amounts, charges missing from your statement, computational mistakes by the bank, receiving the wrong amount from an ATM, and transfers that are not properly identified on your statement.⁷ You can also simply ask for more information about a transfer you don’t recognize.

Making the Report

Contact your bank as soon as you spot a problem. You can call, but follow up in writing, whether by letter, email, or secure message through the bank’s portal. Note the date and time of your call, the name of the person you spoke with, and any confirmation number. If you send a letter, use certified mail. The clock starts when the bank learns about the issue, so build a paper trail that proves exactly when that happened.

The Investigation Clock

Once your bank receives your error notice, it has ten business days to investigate and decide whether an error occurred. If it needs more time, it can extend to forty-five days, but only if it provisionally credits your account for the disputed amount (with any applicable interest) within those initial ten business days. You get full use of those funds while the investigation continues.⁸

Some situations get longer timelines. New accounts (within thirty days of the first deposit) get twenty business days for the initial investigation and up to ninety days total. The ninety-day extended window also applies to point-of-sale debit card transactions and to transfers that were not initiated within a state.⁸

After the Investigation

If the bank finds in your favor, the provisional credit becomes permanent. If it concludes no error occurred, it must send you a written explanation and tell you that you can request copies of the documents it relied on.⁸ The bank can then take back the provisional credit, but it must notify you of the date and amount of the debit and honor checks or preauthorized payments for five business days after that notification without charging overdraft fees.

Stopping a Recurring Payment

You have the legal right to stop preauthorized electronic debits from your account, even if you authorized them previously. Under Regulation E, you can cancel a recurring payment by notifying your bank at least three business days before the next scheduled transfer. The notice can be oral or written.⁹ If you call, your bank may require written confirmation within fourteen days. Skip the written follow-up and the oral stop-payment order expires.

The CFPB recommends a two-pronged approach: tell the company collecting the payment that you are revoking authorization, and separately instruct your bank to block future debits from that company.¹⁰ Once you have done both, any additional debits that company pulls are considered errors and can be disputed through the normal error resolution process.

Two cautions. Your bank may charge a stop-payment fee, often $15 to $36, though some banks waive it for requests submitted online or for premium accounts. And canceling the automatic payment does not cancel the underlying contract. If you owe on a loan or subscription, you are still responsible for paying through another method.¹⁰

Related rule worth knowing: when a recurring payment is going to change in amount from the previous transfer, the payee or your bank must notify you at least ten days before the scheduled date.⁹

Sending Money to Another Country

International remittances come with their own Regulation E rules. Before you pay, the provider must give you a written disclosure showing the transfer amount, all fees and taxes the provider will collect, the exchange rate, any third-party fees in the receiving country’s currency, and the total amount the recipient will actually receive.¹¹ The point is to let you see the full cost (including exchange rate markup) before you commit.

You also get a cancellation window. Federal law gives you at least thirty minutes after making payment to cancel the transfer and receive a full refund of all fees and taxes, provided the recipient has not already picked up or received the funds. The provider must process the refund within three business days at no additional cost.¹² Thirty minutes is short. Review the pre-payment disclosure carefully rather than planning to cancel later.

Overdraft Fees You Never Agreed To

Here is a protection many account holders don’t know they have. Your bank cannot charge you overdraft fees on ATM withdrawals or one-time debit card purchases unless you specifically opted in to overdraft coverage for those transactions. The bank must give you a written notice describing the service, provide a reasonable chance to consent, and confirm your consent in writing, along with a reminder that you can revoke it at any time.¹³

If you never opted in, the bank must simply decline the transaction when your balance is too low. The bank also cannot condition other account features on whether you opt in. Consumers who have not opted in receive the same terms, conditions, and features as those who have, minus the overdraft coverage on debit card and ATM transactions.¹³ If you opted in years ago and don’t remember doing so, call your bank and revoke. A declined transaction is almost always a better outcome than a $30 or $35 fee on a $4 coffee.

Business Accounts Don’t Get These Rights

Regulation E covers only accounts established primarily for personal, family, or household purposes, and defines a “consumer” as a natural person.² If your business account gets hit with unauthorized wire transfers, you do not get the $50/$500 liability caps, the ten-day investigation timeline, or the provisional credit requirement.

Business transfers are instead governed primarily by Article 4A of the Uniform Commercial Code, adopted in some form by every state. Under Article 4A, the key question is whether your bank used a “commercially reasonable” security procedure. If the bank followed that procedure in good faith and an unauthorized transfer still went through, the bank can enforce the payment against you unless you can prove the fraud did not come from someone with access to your payment systems or security credentials. Business account holders also have a duty to review statements and notify the bank within a reasonable time (not to exceed ninety days) after learning that an unauthorized order was accepted; missing that deadline costs you interest on any refund, and failing to object within one year waives the challenge entirely.¹⁴

If you run a business, negotiate security procedures with your bank upfront, use dual-authorization controls on outgoing transfers, and review account activity daily rather than monthly. The consumer safety net is not there to catch you.

1
Office of the Law Revision Counsel. 15 USC 1693 – Congressional Findings and Declaration of Purpose
2
eCFR. Electronic Fund Transfers (Regulation E) – Section 1005.2
3
eCFR. Electronic Fund Transfers (Regulation E) – Section 1005.6
4
Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
5
Federal Reserve Consumer Compliance Outlook. Consumer Liability for Unauthorized Transactions
6
Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
7
Consumer Financial Protection Bureau. Regulation E Section 1005.11 – Procedures for Resolving Errors
8
eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
9
eCFR. 12 CFR 205.10 – Preauthorized Transfers
10
Consumer Financial Protection Bureau. How Do I Stop Automatic Payments From My Bank Account?
11
eCFR. 12 CFR 1005.31 – Disclosures
12
eCFR. 12 CFR 1005.34 – Procedures for Cancellation and Refund of Remittance Transfers
13
eCFR. 12 CFR 1005.17 – Requirements for Overdraft Services
14
Legal Information Institute. UCC Article 4A – Funds Transfer