Regulation E: Consumer Protections for Electronic Fund Transfers

Regulation E is the federal rule that protects you when money moves electronically into or out of your consumer bank account. It implements the Electronic Fund Transfer Act of 1978, is maintained by the Consumer Financial Protection Bureau, and gives you three practical things: a cap on what you can lose to unauthorized transfers, a right to have your bank investigate disputes on a strict deadline, and disclosure of the fees and terms attached to your account. The consumer protections under Regulation E apply to debit card purchases, ATM activity, direct deposits, automatic bill payments, and most peer-to-peer app transfers that touch a consumer bank account. Using those protections effectively comes down to knowing which transactions qualify, reporting problems fast, and understanding where the rule stops.

What Regulation E Covers and What It Doesn’t

The rule reaches any transfer of funds initiated through an electronic terminal, telephone, computer, or magnetic tape that instructs a bank to debit or credit a consumer’s account.¹ In everyday terms: debit card purchases, ATM withdrawals and deposits, direct deposit of a paycheck, automatic bill pay, and transfers you send through Venmo, Zelle, or Cash App when those payments flow through a consumer account. Payroll cards and government benefit accounts are covered too.

Several categories are outside the rule:

Wire transfers through Fedwire and similar systems.
Transfers whose main purpose is buying or selling investments regulated by the SEC or CFTC.
Check guarantee or authorization services that don’t debit or credit your account.
A single transfer arranged by phone with your bank, unless it’s part of a recurring bill-pay plan.
Automatic transfers your bank moves between your own accounts, or to a family member’s account at the same institution, under a standing agreement.

Prepaid accounts get their own protections, but there’s a catch worth flagging up front: if you haven’t completed the issuer’s identity verification, the full liability and error resolution rights may not apply to your prepaid card until you register it.²

Your Liability When Someone Else Moves Your Money

An unauthorized electronic fund transfer means a transfer from your account initiated by someone other than you, without your permission, and from which you received no benefit.³ A stolen debit card or a phishing attack that lets a hacker into your account both fit. When one of those transfers hits your account, how much you can lose depends almost entirely on how fast you tell the bank.

The tiers work like this:

Report within two business days of learning your card or credentials were lost or stolen, and your liability tops out at $50, or the amount of unauthorized transfers that occurred before you notified the bank, whichever is less.⁴
Report after two business days but within 60 days of the statement showing the problem, and liability can reach $500, limited to transfers the bank can show would have been prevented if you’d reported sooner.⁴
Report after that 60-day window, and liability is unlimited for unauthorized transfers occurring after the window closes that the bank shows it could have stopped with earlier notice. Everything in the account is at risk.

Two clock details matter. The two-day window counts business days only, so weekends and federal holidays don’t count. The 60-day window starts when the bank sends the periodic statement, not when it lands in your mailbox or inbox. Reviewing every statement the day it arrives is the single most effective habit for keeping these caps low.

When You Sent the Money Yourself

This is where Regulation E disappoints a lot of people. If a scammer poses as your bank, calls you, and talks you through sending $2,000 through Zelle, many banks argue the transfer was authorized because you initiated it. The liability caps were built for situations where someone else moves your money, not where you move it under false pretenses. A phishing email that captures your credentials and lets the thief log in and transfer funds is unauthorized. A phone call that convinces you to press the buttons yourself typically is not, in the bank’s view.

The CFPB proposed an interpretive rule in early 2025 that would have addressed coverage for emerging payment mechanisms, then formally withdrew the proposal in May 2025, leaving the existing framework in place.⁵ The rule also expressly excludes transfers by someone you gave your card or login to, unless you’d already told the bank to cut off that person’s access, and transfers you or someone working with you made fraudulently.³ Handing a family member your PIN and being surprised by what they spent is not, by itself, an unauthorized transfer.

How to Report an Error to Your Bank

“Error” under Regulation E is broader than just unauthorized transfers. It also covers a transfer for the wrong amount, a transfer missing from your statement, an ATM that shorted you cash, a bookkeeping error by the bank on an electronic transfer, and a transfer that isn’t properly identified on your statement or receipt.⁶ Routine balance inquiries and requests for duplicate records don’t qualify.

Your notice must reach the bank no later than 60 days after the institution sent the periodic statement that first reflected the problem.⁷ Include your name, account number, a description of why you believe an error occurred, and the dollar amount involved. Use the phone number or address in the bank’s disclosures rather than a general customer service line, so the report goes to the department that handles disputes.

You can start with a phone call. That oral notice is enough to trigger the bank’s investigation duties. But the bank is allowed to require a written follow-up within 10 business days, and if you skip it after being warned, the bank can withhold provisional credit during the investigation.⁷ Always send the written confirmation.

What the Bank Must Do After You Report

The bank has 10 business days from your notice to investigate and decide whether an error occurred.⁸ If it resolves the dispute within that window, it corrects the error and notifies you within three business days.

When it needs more time, it can extend the investigation to 45 days, but only if it provisionally credits your account for the full disputed amount within 10 business days of your notice.⁸ You get full use of that money during the investigation. The bank must tell you the credit amount and date within two business days of posting it. If the bank has a reasonable basis to believe an unauthorized transfer occurred and has properly disclosed your liability, it can withhold up to $50 from the provisional credit, matching the first-tier cap.⁹

The timeline stretches to 90 days for point-of-sale transfers, transfers originating outside the United States, and transfers on accounts less than 30 days old.⁸

If the bank concludes no error occurred, it must send a written explanation of its findings and tell you that you have the right to request the documents it relied on.⁷ Ask for those documents every time. They often show whether the bank actually investigated or simply denied the claim. When the bank revokes provisional credit, it must give you the date and amount of the debit, and it must honor checks and preauthorized payments — without charging overdraft fees — for five business days after that notice, giving you a short cushion to move funds in.

Overdraft Fees You Never Agreed To

Your bank cannot charge you a fee for covering an overdraft on a one-time debit card purchase or ATM withdrawal unless you affirmatively opted in to its overdraft service.¹⁰ The bank can still choose to pay the overdraft; it just can’t collect a fee for doing so if you never opted in.

Opt-in has rules. The bank must give you a standalone written notice describing the service, a reasonable opportunity to consent, and a written confirmation of your consent that reminds you of your right to revoke.¹⁰ A line buried in an account-opening signature card doesn’t count. You can revoke at any time using the same method the bank offered for opting in, and on a joint account any account holder can revoke for everyone. Fees the bank already charged before revocation don’t have to be refunded.

Gift Cards and Prepaid Accounts

Gift cards carry an expiration rule most consumers don’t know. No one may sell or issue a gift card with an expiration date unless the funds stay valid for at least five years from issuance or the last load date.¹¹ Inactivity and dormancy fees are allowed only if the card has seen no activity for at least a year, and only one such fee per calendar month is permitted. The amount, frequency, and conditions must be printed on the card itself.

Prepaid accounts come with a standardized “short form” fee disclosure the issuer must give you before purchase, listing the periodic fee, per-purchase fee, in-network and out-of-network ATM withdrawal fees, cash reload fee, balance inquiry fees, customer service call fees, and inactivity fee, plus the two other fees that generate the most revenue for the program. And again: if you never complete identity verification, the full protections may not attach to that prepaid account until you register.²

Sending Money Abroad

International remittance transfers get their own layer of protection. Before you pay, the provider must show you the exchange rate, all fees and taxes it will collect, any third-party fees, and the total amount the recipient will receive in the destination currency.¹² You also receive a receipt covering the availability date, the provider’s contact information, and a statement of your error and cancellation rights.

You can cancel within 30 minutes of payment as long as the recipient hasn’t picked up the funds. A valid cancellation requires a full refund of the amount sent plus all fees and taxes, within three business days, at no cost.¹³ The error reporting window is much longer than the domestic one: 180 days from the disclosed availability date.¹⁴

Suing a Bank That Won’t Comply

You can sue a bank that fails to comply with the Electronic Fund Transfer Act. In an individual action, the bank is liable for your actual damages plus statutory damages of $100 to $1,000 per violation, along with court costs and reasonable attorney fees.¹⁵ In a class action, damages can reach the lesser of $500,000 or 1% of the bank’s net worth. The attorney fee provision is what makes small-dollar claims worth pursuing, because a winning consumer’s lawyer gets paid by the bank rather than out of the recovery.

1
eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E) – Section 1005.3 Coverage
2
eCFR. 12 CFR 1005.18 – Requirements for Financial Institutions Offering Prepaid Accounts
3
eCFR. 12 CFR 1005.2 – Definitions
4
Consumer Financial Protection Bureau. 12 CFR Part 1005 (Regulation E) – Section 1005.6 Liability of Consumer for Unauthorized Transfers
5
Federal Register. Electronic Fund Transfers Through Accounts Established Primarily for Personal, Family, or Household Purposes Using Emerging Payment Mechanisms – Withdrawal
6
eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
7
Consumer Financial Protection Bureau. 12 CFR 1005.11 – Procedures for Resolving Errors
8
eCFR. 12 CFR 205.11 – Procedures for Resolving Errors
9
eCFR. 12 CFR Part 205 – Electronic Fund Transfers (Regulation E) – Section 205.11
10
Consumer Financial Protection Bureau. 12 CFR 1005.17 – Requirements for Overdraft Services
11
Consumer Financial Protection Bureau. 12 CFR 1005.20 – Requirements for Gift Cards and Gift Certificates
12
eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E) – Section 1005.31
13
eCFR. 12 CFR 1005.34 – Procedures for Cancellation and Refund of Remittance Transfers
14
eCFR. 12 CFR 1005.33 – Procedures for Resolving Errors
15
Office of the Law Revision Counsel. 15 USC 1693m – Civil Liability