Your money in a U.S. bank is safe from hackers in one specific legal sense: federal law caps your loss at $50 if you report an unauthorized electronic transfer within two business days of discovering it.1Office of the Law Revision Counsel. 15 U.S. Code 1693g – Consumer Liability Wait longer and your exposure climbs fast, eventually to your entire balance. The protection is real and enforceable, but it is sharply time-sensitive, and it works differently depending on whether the theft hits a debit card, a credit card, a payment app, or a business account.
What the Law Actually Protects
The Electronic Fund Transfer Act and its implementing rule, Regulation E, are the backbone of consumer protection against unauthorized digital transactions.2eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E) They apply to checking accounts, savings accounts, and prepaid cards at any bank or credit union.3Consumer Financial Protection Bureau. 12 CFR 1005.2 – Definitions The central principle is simple. If someone else moves money out of your account without your permission, the bank bears the loss, not you.
Regulation E defines an unauthorized transfer as one initiated by someone other than you, without your permission, and from which you received no benefit.3Consumer Financial Protection Bureau. 12 CFR 1005.2 – Definitions That covers the classic hacking scenario in which a criminal breaks into your online banking and wires money out. It covers a stolen debit card used at a store. It also covers the case where a scammer tricks you into sharing your login credentials and then logs in and moves the money themselves. The CFPB has clarified that a consumer who hands over account information under fraudulent pretenses has not truly furnished the access device, so the transfer remains unauthorized. Your own carelessness does not strip your protections either. The law bars banks from denying claims or imposing extra liability because you left a password on a sticky note.4Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
The Trap: Transfers You Send Yourself
The word “initiated” does a lot of work in the definition. If a scammer calls you pretending to be your bank, walks you through logging into a payment app, and convinces you to send $2,000, you initiated that transfer. It was dishonest and predatory, but under current federal rules the bank has no obligation to refund it. The deciding factor is who pressed the button. If the criminal logged in and moved the funds, you are covered. If the criminal talked you into moving the funds yourself, you likely are not.
Wire transfers are especially hard to recover. Once a wire settles, the sending bank has virtually no ability to claw the funds back, and the window to attempt a recall is measured in minutes. Treat any request to wire money to a party you have not independently verified as a red flag, no matter how legitimate the request sounds.
How Fast You Report Decides How Much You Lose
For transfers that do qualify as unauthorized, the speed of your notice to the bank determines your maximum liability. The law creates three tiers, and the jumps between them are severe.
- Within 2 business days of discovering the loss: your maximum liability is $50, or the actual amount stolen if it was less.1Office of the Law Revision Counsel. 15 U.S. Code 1693g – Consumer Liability
- After 2 business days but within 60 days of your statement: exposure rises to $500 for transfers the bank could have stopped had you reported sooner.2eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
- More than 60 days after the statement is sent: unlimited liability for unauthorized transfers that occur after that window closes. Your entire balance and any linked overdraft line of credit are at risk.1Office of the Law Revision Counsel. 15 U.S. Code 1693g – Consumer Liability
The 60-day clock starts when the bank transmits your statement, not when you open it.2eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E) Let two months of statements pile up while you travel and the deadline runs anyway. This is where most consumers lose their leverage. Checking your accounts regularly, even briefly, is one of the most valuable financial habits you can have.
Debit Cards and Credit Cards Are Not Equally Protected
Credit card fraud operates under a different federal law, the Truth in Lending Act, and the math is far more forgiving. Your maximum liability for unauthorized credit card charges is a flat $50, period.5Office of the Law Revision Counsel. 15 U.S. Code 1643 – Liability of Holder of Credit Card There is no escalating tier based on how quickly you report. Most major issuers go further and waive even the $50 through zero-liability policies.
The practical difference is enormous. When a thief uses your credit card, the stolen funds are the card issuer’s money while you dispute the charge. When a thief drains your debit card, the missing money is yours. Even with a prompt report and eventual restoration, you may spend days or weeks without access to funds you need for rent, groceries, or bills. For online purchases or travel, that alone is a reason to favor a credit card.
What to Do the Moment You Spot Fraud
Every hour you wait works against you. Call your bank’s fraud line first. Report the specific transactions, ask the representative to freeze or restrict the compromised account, and request new credentials. Get the name of the person you speak with and a case or reference number.
Follow the call with written notice. Regulation E allows banks to require written confirmation within 10 business days of your oral report, and some banks use a missed written confirmation to slow-walk or deny claims.6Consumer Financial Protection Bureau. 12 CFR 1005.11 – Procedures for Resolving Errors Send an email or letter describing the unauthorized transactions, dates, and amounts. Keep a copy.
Beyond your bank, report the fraud to the Federal Trade Commission at IdentityTheft.gov, especially if the thief may have obtained personal information like your Social Security number.7Federal Trade Commission. What To Do if You Were Scammed Filing there generates an identity theft affidavit and a recovery plan. Contact local police as well. A police report strengthens your dispute with the bank and may be required by the bank’s fraud department.
What the Bank Must Do After You Report
Once you report an error, the bank must investigate promptly and reach a conclusion within 10 business days.6Consumer Financial Protection Bureau. 12 CFR 1005.11 – Procedures for Resolving Errors If it confirms an unauthorized transfer, it must correct the error within one business day, then notify you of the results within three business days after completing the investigation.
Banks frequently need more time. When they do, Regulation E allows them to extend the investigation to 45 days, but only if they provisionally credit your account within 10 business days of receiving your notice.6Consumer Financial Protection Bureau. 12 CFR 1005.11 – Procedures for Resolving Errors The bank may hold back up to $50 of that provisional credit if it has a reasonable basis to believe the transfer was unauthorized. Otherwise the full disputed amount must be available to you while the review continues. If the bank ultimately determines no error occurred, it can reverse the provisional credit, but only after explaining its findings in writing.
The provisional credit rule is where the law shows its teeth. Without it, banks could sit on disputes for weeks while you scrambled to cover bills. If your bank takes more than 10 business days and hasn’t credited your account, that itself is a violation you can escalate.
If the Bank Denies Your Claim
Denials happen more often than consumers expect, sometimes after a cursory investigation. If the bank concludes no error occurred, it must provide a written explanation, and you have the right to request copies of all documents the bank relied on.6Consumer Financial Protection Bureau. 12 CFR 1005.11 – Procedures for Resolving Errors Ask for them immediately. Reviewing the bank’s evidence often reveals a superficial investigation or flawed assumptions about IP addresses or device identifiers.
If the bank refuses to budge, file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov.8Consumer Financial Protection Bureau. Submit a Complaint The CFPB forwards your complaint and requires a response. Banks treat CFPB complaints with more urgency than calls to a customer service line. You can also file with your state attorney general and the FTC.7Federal Trade Commission. What To Do if You Were Scammed For smaller amounts, small claims court is available in every state, with filing limits ranging from $2,500 to $25,000 depending on jurisdiction.
Two Things This Protection Does Not Cover
Business accounts play by different rules. If you run a business and a hacker empties your commercial checking account, the Electronic Fund Transfer Act does not apply. Business accounts are explicitly excluded from Regulation E and are governed instead by the Uniform Commercial Code, specifically Article 4A.9Legal Information Institute. U.C.C. Article 4A – Funds Transfer Under Article 4A, the bank can shift liability onto the business if it verified the fraudulent order using a commercially reasonable security procedure the two of you had agreed to, and it followed that procedure in good faith. No $50 cap exists. The security procedures in your account agreement are effectively the ceiling of your protection.
FDIC insurance is the other misconception. It does not reimburse hacking losses. FDIC insurance protects your deposits if the bank itself fails, up to $250,000 per depositor, per insured bank, per ownership category.10FDIC. Understanding Deposit Insurance11eCFR. 12 CFR Part 330 – Deposit Insurance Coverage A stolen balance from an operating bank is a Regulation E matter, not an FDIC one.
Money held in a fintech app or neobank is a related trap. These companies are not banks. Your funds only qualify for deposit insurance if the company places them at an FDIC-insured bank and maintains records identifying you as the owner and the amount you own.12FDIC. Banking With Third-Party Apps Even then, the insurance only applies if the partner bank fails. If the fintech itself goes bankrupt, FDIC coverage does not apply. Before trusting a balance to any app that claims FDIC protection, verify which specific bank holds the deposits and confirm its status through the FDIC’s BankFind tool.