Electronic Funds Transfer: Liability, Errors, and Zelle Scams

Your electronic funds transfer rights and protections come primarily from the federal Electronic Fund Transfer Act and its implementing rule, Regulation E. Together they cap your liability for unauthorized transfers (as little as $50 if you report within two business days), give you 60 days from your statement to dispute an error, and force your bank to investigate on a strict clock. These rules apply to consumer accounts used for personal, family, or household purposes. Business accounts fall outside the law and are governed by the Uniform Commercial Code and your account agreement instead.¹

Which Transactions Are Covered

Federal law defines an electronic fund transfer broadly: any transfer started through an electronic terminal, phone, or computer that tells a bank to debit or credit your account.¹ That covers debit card purchases, ATM withdrawals, direct deposit, ACH payments for recurring bills, pay-by-phone, and peer-to-peer apps like Venmo, Zelle, and Cash App.

A few things are specifically excluded. Check guarantee services that don’t directly hit your account are out. So are securities transactions through a broker-dealer, one-off phone transfers that aren’t part of a recurring arrangement, and large bank-to-bank wires through Fedwire that aren’t designed primarily for consumers.¹ If your transaction falls into one of those buckets, the liability caps and dispute rights below don’t apply.

Prepaid cards are covered, with one trap worth knowing: if you never register or verify your identity on a prepaid card (other than a payroll or government benefit card), the issuer doesn’t have to honor the liability limits or investigate errors until you complete that verification.²

How Much You Can Lose on an Unauthorized Transfer

If someone uses your card, account, or app credentials without permission, your maximum loss depends almost entirely on how fast you tell your bank. The jumps between tiers are steep.

Within 2 business days of discovering the loss or theft: Maximum liability is $50, or the amount of unauthorized transfers before you gave notice, whichever is less.³
After 2 business days but within 60 days of your statement: Liability can climb to $500 for transfers that occurred after the two-day window closed and before you spoke up.³
After 60 days from the statement: Unlimited liability for transfers happening after that 60-day window, if the bank can show those later transfers wouldn’t have occurred had you reported sooner.³

One rule surprises most people. Your own negligence cannot be used to push your liability above these caps. Even if you wrote your PIN on the back of your debit card, the bank still has to honor the $50 and $500 limits based on reporting speed alone.⁴ The bank might lecture you about card security, but it can’t use carelessness to strip the statutory protection.

What Counts as an Error You Can Dispute

Regulation E defines “error” more broadly than most consumers expect. You don’t have to prove fraud to trigger an investigation. Any of these qualifies:

An unauthorized transfer from your account.
A transfer posted for the wrong dollar amount.
A transfer missing from your statement that should be there.
A computational or bookkeeping mistake by the bank on an electronic transfer.
Receiving the wrong amount of cash from an ATM.
A transaction on your statement that doesn’t include the required identifying information.
A simple request for documentation or clarification about a transfer, including asking whether an error exists.⁵

That last category is the most underused. You can trigger the bank’s formal investigation process just by asking for more information about a suspicious-looking charge. You don’t have to be certain an error occurred before filing a notice.

How to Report an Error and What Happens Next

You have 60 days from the date your bank sends the periodic statement reflecting the problem to report the error.⁶ Your notice must include your name and account number, a description of the error, and the dollar amount involved. You can report by phone, in person, or in writing. Writing creates a paper trail.

The Investigation Clock

Once the bank receives your notice, it generally has 10 business days to investigate and decide whether an error occurred. It must then report its findings within three business days of finishing and correct any confirmed error within one business day.⁵

If the bank can’t wrap up in 10 business days, it can take up to 45 days, but only if it provisionally credits your account for the disputed amount within 10 business days of your notice.⁶ That credit must include any applicable interest, and you get full use of those funds during the investigation. The bank can hold back up to $50 of the credit if it has reasonable grounds to suspect the transfer was authorized.

Three situations stretch the windows. For a transfer that occurred within 30 days of your first deposit into the account, the bank gets 20 business days before it must issue a provisional credit and 90 days to finish the investigation. The 90-day extension also applies to point-of-sale debit card transactions and international transfers.⁵

If You Reported by Phone

Your bank can ask you to follow up a phone report with a written confirmation within 10 business days. If it makes that request, it must tell you at the time of your call and give you the address.⁶ Miss the 10-day follow-up and the bank is no longer required to provisionally credit your account during the investigation. The investigation still has to happen, but you lose temporary use of the funds. This is where a lot of disputes go sideways: a consumer calls, assumes it’s handled, never sends the letter, and gets denied the provisional credit.

If the Bank Says No Error Occurred

If the bank determines that no error happened, or that the error was different from what you described, it must send you a written explanation and notify you of your right to request copies of the documents it relied on. It must provide those documents promptly on request.⁵ Always ask for them. They show what evidence the bank actually had, and whether its conclusion holds up.

If the bank reverses a provisional credit, it must tell you the date and amount of the reversal and honor checks and preauthorized payments from your account without charging you overdraft fees for five business days after the notification.

Stopping a Recurring Payment

If you’ve authorized a company to pull recurring payments from your account, you can stop any future payment by notifying your bank at least three business days before the scheduled transfer date. The notice can be oral or written.⁷ If you call, the bank can require written confirmation within 14 days and must tell you so during the call.

When a preauthorized transfer will vary in amount from the previous payment, either the payee or your bank must send written notice of the new amount at least 10 days before the scheduled date.⁸ If your bank fails to honor a valid stop-payment order given with at least three days’ notice, it is liable for your losses.

Overdraft Fees on Debit Card and ATM Transactions

Federal rules bar your bank from charging overdraft fees on one-time debit card purchases or ATM withdrawals unless you’ve given affirmative consent to the bank’s overdraft service for those transaction types.⁹ Without your opt-in, the bank must decline the transaction when the account lacks funds. The bank cannot pressure you into opting in by threatening to limit other account features or by tying overdraft coverage for checks and ACH to your consent for debit card overdrafts.

You can revoke consent at any time, and the bank must act on the revocation as soon as reasonably practicable. On joint accounts, any one holder can revoke consent for the whole account.¹⁰ If you’ve been paying debit card overdraft fees and never made an active choice to opt in, that’s worth investigating. The bank was supposed to get your written or electronic agreement first.

Peer-to-Peer Apps, Zelle, and Scams

Transfers through Venmo, Zelle, and Cash App are electronic fund transfers covered by the same federal rules. What matters is whether the transfer was authorized.

If someone steals your phone and sends themselves money from your app, that’s an unauthorized transfer and the standard liability limits apply. Fraud by deception is trickier. The CFPB has clarified that when a scammer tricks you into handing over your login credentials, confirmation codes, or debit card number, and then uses that information to initiate transfers from your account, those transfers are unauthorized under Regulation E.¹¹ A consumer who is deceived into sharing access information has not “furnished an access device” under the regulation, so the bank can’t lean on that to deny your claim.

Protections get weaker when you personally initiate the transfer to someone who turns out to be a scammer. If you open your app, type the amount, and hit send, you authorized that transfer, even if the recipient lied about why they needed the money. The law draws a hard line between being tricked into giving access (unauthorized, bank covers it) and sending money to the wrong person (authorized, your loss in most cases). Figure out which side of that line your situation falls on before contacting your bank.

Sending Money Abroad

International remittance transfers through a bank or money transfer company trigger separate Regulation E requirements built around pricing transparency. Before you pay, the provider must disclose the transfer amount, all fees and taxes it charges, the exchange rate rounded to at least two decimal places, any third-party fees in the recipient’s currency, and the total the recipient will actually receive.¹² The receipt must also show the date funds will be available abroad and contact information for both the provider and the CFPB.

You can cancel an international remittance transfer and get a full refund of all fees and taxes within 30 minutes of making payment, as long as the recipient hasn’t already picked up or received the funds.¹³ The provider must process the refund within three business days. That 30-minute window is tight, but it exists for the moment right after you hit send and realize something is wrong.

If the Bank Won’t Follow the Rules

Banks that violate the Electronic Fund Transfer Act face real consequences. A consumer who sues successfully can recover actual damages plus statutory damages between $100 and $1,000, along with attorney’s fees and court costs.¹⁴ A class action can recover up to $500,000 or one percent of the institution’s net worth, whichever is less. The statutory damages provision means you can recover something even when your actual loss was small.

Before filing suit, you can submit a complaint to the Consumer Financial Protection Bureau online or by calling (855) 411-2372. Most companies respond within 15 days, and you get 60 days to review the response and provide feedback. A CFPB complaint doesn’t replace legal action, but it creates a documented record and often pushes the bank to resolve the dispute faster than its internal process would.

1
Office of the Law Revision Counsel. 15 USC 1693a – Definitions
2
Consumer Financial Protection Bureau. 12 CFR 1005.18 – Requirements for Financial Institutions Offering Prepaid Accounts
3
eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
4
Consumer Financial Protection Bureau. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
5
Consumer Financial Protection Bureau. 12 CFR 1005.11 – Procedures for Resolving Errors
6
eCFR. 12 CFR 205.11 – Procedures for Resolving Errors
7
Office of the Law Revision Counsel. 15 USC 1693e – Preauthorized Transfers
8
eCFR. 12 CFR 205.10 – Preauthorized Transfers
9
eCFR. 12 CFR 1005.17 – Requirements for Overdraft Services
10
eCFR. 12 CFR 205.17 – Requirements for Overdraft Services
11
Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
12
eCFR. 12 CFR Part 1005 – Electronic Fund Transfers, Regulation E
13
eCFR. 12 CFR 1005.34 – Procedures for Cancellation and Refund of Remittance Transfers
14
Office of the Law Revision Counsel. 15 USC 1693m – Civil Liability