How Do Banks Investigate ATM Withdrawals: Deadlines and Liability

When you dispute an ATM transaction, your bank investigates by pulling the machine’s electronic transaction journal, reviewing surveillance footage from the terminal and nearby cameras, and physically counting the cash still inside the ATM to see whether the records match. That three-part process is how banks investigate ATM withdrawals, and it runs on strict federal deadlines under Regulation E. The bank has 10 business days to finish the work or issue provisional credit to your account while it keeps looking.

The Electronic Journal and Transaction Logs

Every ATM keeps an electronic journal that records each transaction with timestamps, dollar amounts, card data, and machine status codes. These logs capture events down to the second. If the machine’s software registered a paper jam or cash-dispensing error at 3:42:17 PM and your transaction hit at 3:42:15 PM, that near-simultaneous sequence is strong evidence of a mechanical failure.

Hardware logs track every mechanical event inside the machine as well: door openings, cassette swaps, motor movements, and jam sensors. When those logs show a jam at the exact moment of your transaction, the dispute often resolves itself. For withdrawals made with a compromised card number used remotely, investigators trace the digital footprint of the transaction to determine where and how the card data was used.

Surveillance Footage

Most ATMs have cameras mounted on or near the terminal. Investigators review this footage to see who was physically present during the transaction, whether the machine appeared to malfunction, and whether the person using the card matches the account holder. When the ATM’s own camera is unclear or missing footage, cameras on nearby businesses sometimes fill the gap.

Card Technology and Geolocation

The way the card was read matters. Transactions processed through an EMV chip are significantly harder to counterfeit than magnetic stripe transactions, so a chip-read withdrawal carries a stronger presumption that the cardholder was present. A magnetic stripe transaction at a time when the card should have been chip-enabled is an inconsistency that flags the bank’s fraud team.

Some banks also use opt-in geolocation services that compare your phone’s location against the ATM’s location at the time of withdrawal. If your phone was 200 miles away when the money came out, that supports a fraud claim. The feature is still opt-in rather than universal, so it won’t apply to every dispute, but it is increasingly common at larger institutions.

Physical Cash Reconciliation

For disputes involving cash that wasn’t dispensed or was short-counted, the strongest evidence comes from physically reconciling the machine. The bank counts every bill remaining in the ATM’s cash cassettes and compares the total against the electronic journal’s record of all deposits and withdrawals since the cassettes were last loaded.

If the machine shows it dispensed $300 to you but the cassette has $300 more than it should, the bank has near-certain proof that the machine recorded the withdrawal without releasing the cash. A shortage can indicate the machine dispensed more than it logged or was tampered with.

When the ATM is owned by a third-party operator rather than your bank, this part gets slower. Your bank has to request the reconciliation data and hardware logs from the operator, and coordination between the two organizations eats into the timeline. That is one reason disputes involving independent ATMs more frequently run out the full investigation window.

The Deadlines Your Bank Must Meet

Regulation E sets firm timelines the bank cannot negotiate around. The framework runs in two stages.

The bank must investigate and reach a determination within 10 business days of receiving your error notice. If it finds an error, it must correct the account within one business day and report the results to you within three business days.¹

If the bank can’t finish within 10 business days, it can take up to 45 calendar days total, but only if it provisionally credits your account within those first 10 business days. The provisional credit must cover the full amount of the alleged error, including any interest, though the bank can hold back up to $50 if it has a reasonable basis for believing an unauthorized transfer occurred. The bank must tell you the amount and date of the provisional credit within two business days of issuing it, and you get full use of those funds while the investigation continues.¹

Three situations trigger longer timelines. For new accounts where the disputed transfer occurred within 30 days of the first deposit, the bank gets 20 business days instead of 10 for the initial investigation. The 45-day window stretches to 90 days if the disputed transaction was a point-of-sale debit card purchase, was initiated outside the United States, or occurred within 30 days of the account’s first deposit.¹

How to Trigger an Investigation

You can report an ATM error by phone, in person, through your bank’s app, or in writing. Your notice needs to give the bank enough information to identify you and the transaction: your name, account number, the type of problem, the date it happened, and the dollar amount involved. You don’t need to supply the ATM terminal ID or machine address, but including those details speeds things up because they let the bank pull the right machine’s logs immediately.

If you report by phone, the bank can require written follow-up within 10 business days and must tell you about this requirement and give you the mailing address during the call. Skip the written follow-up and the bank doesn’t have to issue provisional credit.¹ Save ATM receipts, screenshots of error messages, or photos of the machine displaying an error. These aren’t legally required, but they strengthen your position if the investigation comes back ambiguous.

The 60-Day Statement Deadline

You have 60 days from the date your bank sends the statement showing the disputed transaction to file a notice of error. Miss that window and the bank has no obligation to investigate under Regulation E’s error-resolution procedures at all.¹ The clock starts when the bank sends the statement, not when you open it. Ignoring your mail or skipping online banking for a couple of months can quietly destroy your claim.

Your Liability for Unauthorized Withdrawals

If the dispute involves someone else using your card, federal law caps your losses based on how fast you report:

Within 2 business days of learning your card was lost or stolen, your maximum liability is $50 or the amount of unauthorized transfers before you notified the bank, whichever is less.²
More than 2 business days but within 60 days of your statement, the cap rises to $500. The bank must prove the later transfers wouldn’t have happened if you’d reported sooner.²
More than 60 days after your statement, you’re on the hook for every unauthorized transfer that occurs after that mark, with no cap.²

Extenuating circumstances like hospitalization or extended travel require the bank to extend these deadlines to a reasonable period.³ The practical point: check your statements regularly, and if a card is lost or stolen, report it within two days.

How the Investigation Ends

The bank must send you a written report of its findings, usually by secure message or mail. If the bank confirms an error, any provisional credit becomes permanent. If it determines no error occurred, or that the error was different from what you described, it must provide a written explanation and tell you that you can request copies of the documents it relied on.¹

What to Do If the Bank Denies Your Claim

Request the investigation documents first. The bank must promptly provide them.¹ Look for gaps. Did the bank actually reconcile the cash cassette, or just check the electronic journal? Did it review surveillance footage? If the written explanation doesn’t address evidence you know exists, raise it.

You can file a complaint with the Consumer Financial Protection Bureau, which enforces Regulation E for most banks. The CFPB’s complaint portal forwards your dispute to the institution and typically forces a second look.⁴ For federally chartered credit unions, the National Credit Union Administration handles complaints. For nationally chartered banks, the Office of the Comptroller of the Currency does.

If the bank violated Regulation E’s procedures, such as missing the 10-day provisional credit deadline or failing to investigate, you have a private right of action under 15 U.S.C. § 1693m. In an individual lawsuit, you can recover actual damages plus statutory damages between $100 and $1,000, along with attorney’s fees if you win.⁵ One important limit: if the bank properly investigated and resolved the error under section 1693f’s procedures, even if you disagree with the outcome, the statutory damages provision doesn’t apply. The private right of action targets procedural violations, not disagreements over findings.

Filing a False Dispute

Knowingly claiming cash wasn’t dispensed when it was, or reporting a card stolen to reverse withdrawals you actually made, falls under federal bank fraud. Penalties under 18 U.S.C. § 1344 reach up to $1,000,000 in fines and 30 years in prison.⁶ Banks also maintain internal fraud databases shared across institutions, so a confirmed false claim can make it difficult to open accounts elsewhere. The reconciliation process is designed to catch these claims. If the cassette balances perfectly and surveillance shows you pocketing the money, the bank knows.

1
eCFR. 12 CFR 1005.11 Procedures for Resolving Errors
2
eCFR. 12 CFR 1005.6 Liability of Consumer for Unauthorized Transfers
3
Office of the Law Revision Counsel. 15 USC 1693g Consumer Liability
4
Consumer Financial Protection Bureau. Submit a Complaint
5
Office of the Law Revision Counsel. 15 USC 1693m Civil Liability
6
Office of the Law Revision Counsel. 18 USC 1344 Bank Fraud