If someone stole money from your bank account through an unauthorized electronic transfer, federal law generally entitles you to a full refund, as long as you report the theft quickly. Under the Electronic Fund Transfer Act, your maximum out-of-pocket loss can be as low as $0 to $50 if you notify your bank within two business days of noticing the problem. Wait longer and your potential losses grow. The rules are different if the theft involved a forged check or a scam where you sent the money yourself.
Call Your Bank Right Away
Contact your bank’s fraud department the moment you spot a transaction you didn’t make. Have your account number and the dates and amounts of the suspicious charges ready. Ask the representative to freeze the account so no further unauthorized transactions can go through. A freeze blocks all activity temporarily, but that inconvenience beats watching your balance drain while you sort things out.
After the call, change your online banking password and your debit card PIN. If you reused that password anywhere else, change those too. Thieves with your banking credentials often try other accounts.
Your bank can require you to confirm the report in writing within 10 business days of your phone call. If it asks for written confirmation and you don’t send it, the bank may refuse to issue a provisional credit while it investigates. Ask during your initial call whether written follow-up is required and where to send it.1Consumer Financial Protection Bureau. 12 CFR 1005.11 – Procedures for Resolving Errors
How Fast You Report Changes What You Owe
The Electronic Fund Transfer Act and its implementing rule, Regulation E, tie your financial exposure directly to how fast you notify your bank. The law creates three tiers of liability for unauthorized electronic transfers.2eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
- Within two business days of learning about the loss or theft of your card or credentials, your maximum liability is $50. The clock starts when you become aware of the problem, not when the first fraudulent charge posts.
- After two business days but within 60 calendar days of the bank sending your statement, your liability can climb to $500.
- After 60 days from the statement date, there is no cap. You could lose every dollar stolen after that 60-day window closed.
In any dispute, the bank bears the burden of proving a transaction was authorized. If the bank claims you made or approved a transfer, it has to demonstrate that, not the other way around.3Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
Visa and Mastercard also apply zero-liability policies to their branded debit cards, which in practice give many consumers better protection than the federal minimum. Those policies layer on top of Regulation E rather than replacing it, and they don’t apply to certain commercial or anonymous prepaid cards.4Visa. Visa Zero Liability Policy5Mastercard. Mastercard Zero Liability Protection for Unauthorized Transactions
File a Police Report and an FTC Identity Theft Report
A police report creates an official record that strengthens your case with the bank and may be needed to block fraudulent accounts from appearing on your credit report. Some banks and creditors specifically ask for a copy before resolving a dispute.6Office for Victims of Crime. Steps for Victims of Identity Theft or Fraud If your local police department pushes back, mention that creditors and credit bureaus often require the report.
Also file an identity theft report at IdentityTheft.gov, the FTC’s dedicated portal. The site generates a personalized recovery plan and produces an official FTC Identity Theft Report, which carries the same legal weight as a police report for many purposes.7Federal Trade Commission. Report Identity Theft
What the Bank Must Do After You Report
Once you report an unauthorized transaction, your bank has 10 business days to complete its investigation and decide whether the transaction was in fact unauthorized. For accounts open less than 30 days, the bank gets 20 business days.1Consumer Financial Protection Bureau. 12 CFR 1005.11 – Procedures for Resolving Errors
If the bank can’t finish within 10 business days, it must provisionally credit your account for the disputed amount, including any interest, while it continues investigating. The bank can hold back up to $50 from the provisional credit to cover your potential liability under Regulation E. It must tell you within two business days of issuing the credit exactly how much was credited and when.
The extended investigation can run up to 45 days total from when the bank received your notice. For point-of-sale debit card purchases, international transfers, and transfers involving new accounts, the deadline stretches to 90 days.8eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
The bank must report its findings to you in writing within three business days of finishing the investigation. If it confirms unauthorized activity, the provisional credit becomes permanent and the bank must correct the error within one business day. If the bank decides no error occurred, it will reverse the provisional credit, send you a written explanation, and let you know you have the right to request the documents it relied on.
When These Protections Don’t Cover You
Regulation E has limits that catch a lot of people off guard.
Scams Where You Sent the Money Yourself
An “unauthorized electronic fund transfer” under Regulation E means a transfer initiated by someone other than you, without your permission, and from which you received no benefit.9eCFR. 12 CFR 1005.2 – Definitions If a scammer tricked you into sending money through Zelle, Venmo, CashApp, or a wire transfer, you technically authorized the transfer even though the request was deceptive. Regulation E’s liability protections generally don’t cover that scenario.
A common version: someone posing as your bank’s fraud department calls and convinces you to “move your money to a safe account.” You initiate the transfer yourself. Under the current rules, the bank can argue that transfer was authorized. Some banks have begun voluntarily reimbursing certain scam victims, but reimbursement is not guaranteed. If someone contacts you claiming to be from your bank and asks you to move money, hang up and call the number on the back of your card.
Business Accounts
Regulation E only protects accounts established primarily for personal, family, or household purposes. Business checking accounts fall outside these federal consumer protections, and account holders must rely on whatever their bank offers by contract or on state commercial law.
Forged or Altered Checks
Stolen checks fall under the Uniform Commercial Code, not Regulation E. The general rule is that a forged check is not “properly payable,” meaning the bank shouldn’t have paid it and is responsible for the loss.10Legal Information Institute. UCC 4-406 – Customer’s Duty to Discover and Report Unauthorized Signature or Alteration But you have to review your statements with reasonable promptness. If the same person forges additional checks and the bank pays them in good faith before you speak up, you can lose the right to challenge those later payments, especially after 30 days from the statement. If you don’t discover and report a forged signature or alteration within one year, you’re barred from making a claim against the bank at all.
If the Bank Denies Your Claim
A denial isn’t the end of the road. Banks sometimes get these investigations wrong, and federal law gives you ways to push back.
Start by filing a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov. Provide your contact information, details about the bank, and a clear description of what happened. The CFPB forwards your complaint to the bank, which must provide an initial response within 15 calendar days and a final response within 60 days.11Consumer Financial Protection Bureau. Your Company’s Role in the Complaint Process The oversight tends to prompt a second look. Try resolving things directly with the bank first, though, since CFPB guidance recommends starting there.12USAGov. Bank, Credit, and Securities Complaints
If the CFPB process doesn’t resolve things, you can sue. The Electronic Fund Transfer Act gives consumers a private right of action against financial institutions that violate its provisions. If you win, you can recover your actual losses plus statutory damages between $100 and $1,000 per case, along with attorney’s fees and court costs.13Office of the Law Revision Counsel. 15 USC 1693m – Civil Liability For smaller amounts, small claims court is often the most practical option: filing fees are low, you don’t need a lawyer, and most states set their small claims limits between $5,000 and $10,000. The bank has a defense if it can show the violation was unintentional and resulted from a genuine error despite reasonable procedures, but that’s the bank’s burden to prove.