Under Regulation E’s 60-day rule, if you don’t tell your bank about an unauthorized electronic fund transfer within 60 calendar days after it transmits the statement showing the first bad charge, you can be held liable for every unauthorized transfer that happens after that deadline, with no dollar cap.1Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability The bank has to show those later losses would have been prevented by timely notice, but in practice that is a low bar: a phone call triggers a card freeze, and anything charged after that freeze wouldn’t have happened. Miss the window and a thief running small recurring charges can drain the account with no federal remedy left to you.
When the 60-Day Clock Starts
The countdown starts on the date your financial institution transmits the periodic statement that first shows an unauthorized transfer. For a paper statement, that is the date the bank mails it. For an electronic statement, it is the date the bank makes the statement available through its online portal.2eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers Mail delays don’t push the date back. Neither does the fact that you never opened the email or logged in.
The 60 days are calendar days, not business days.3Consumer Financial Protection Bureau. 1005.6 Liability of Consumer for Unauthorized Transfers Weekends and holidays count. The regulation has no provision extending the deadline when day 60 lands on a Saturday or a bank holiday, so treat it as hard. If you are anywhere near the edge, call the bank the same day rather than counting hours.
A small habit that pays off if a dispute ever arises: note the transmittal date on every monthly statement and keep a record of it. That date anchors every calculation the bank and, if it comes to it, a judge will make.
What You Owe If You Report On Time
Regulation E splits liability into two tracks depending on how the fraud happened, and both funnel toward the same 60-day cliff.
Lost or Stolen Card
When someone takes your physical card, three tiers apply:
- Report within 2 business days of learning of the loss, and your liability is capped at $50 or the amount stolen before you notified the bank, whichever is less.2eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
- Report after 2 business days but within 60 calendar days of the statement, and liability can reach $500. The bank must prove the losses above $50 could have been prevented by faster reporting.2eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
- Fail to report within 60 calendar days of the statement, and liability is unlimited for every unauthorized transfer that occurs after day 60.1Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
Account-Number Fraud With No Card Involved
When a fraudster compromises your account number, routes an ACH debit, or initiates transfers without ever holding your physical card, the $50 and $500 tiers do not apply. Those caps are tied specifically to a lost or stolen access device.3Consumer Financial Protection Bureau. 1005.6 Liability of Consumer for Unauthorized Transfers For account-number fraud, you owe nothing as long as you report within 60 calendar days of the statement showing the first unauthorized charge.
This catches people off guard. Someone who never lost a card assumes strong protection all the way through, and within 60 days they have it. The 60-day cliff still applies, and it is the point where the protection effectively ends.
What Unlimited Liability Actually Looks Like After Day 60
Once the window closes, the regulation shifts every post-deadline unauthorized transfer onto you, on one condition. The bank has to establish that the transfers “would not have occurred had the consumer notified the institution within the 60-day period.”2eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers The burden of proof sits with the bank, not with you.
Banks can almost always meet it. A timely report triggers a card deactivation or account freeze that would have stopped the later charges. The nuance occasionally matters in cases involving sophisticated attacks where the bank’s own security failures contributed, since a freeze wouldn’t have blocked a method the bank couldn’t detect either way. Assume in advance that the bank will clear its burden and act on the deadline itself.
There is no dollar ceiling on what you can lose. A dormant checking account with a modest balance and a small recurring fraudulent ACH can bleed out over months, and once day 60 passes, everything charged from that point forward is legally yours to eat.
When the 60-Day Deadline Can Be Extended
The regulation has a safety valve. If your delay was caused by “extenuating circumstances,” the bank must extend the reporting window to a reasonable period.4eCFR. 12 CFR Part 1005 – Electronic Fund Transfers, Regulation E The official regulatory commentary specifically names extended travel and hospitalization as qualifying circumstances.5eCFR. 12 CFR Part 205 – Electronic Fund Transfers, Regulation E – Section 205.6(b)(4)
The regulation does not define “reasonable period,” so the extension is fact-specific. A consumer hospitalized for three weeks who reports within days of discharge has a strong argument. Someone who simply forgot to open statements for six months does not. If you need to invoke this provision, document the circumstances: hospital admission records, travel itineraries, or anything else showing why you could not have reviewed your statements sooner.
Transactions the 60-Day Rule Doesn’t Cover
Regulation E applies only to accounts held by individuals for personal, family, or household purposes. Business and commercial bank accounts are excluded from its protections entirely.4eCFR. 12 CFR Part 1005 – Electronic Fund Transfers, Regulation E If a fraudster drains a business checking account, the 60-day framework in this article does not apply, and commercial disputes are generally handled under Article 4A of the Uniform Commercial Code, which places more responsibility on the business when the bank followed commercially reasonable security procedures.
Wire transfers between financial institutions or businesses are also excluded from Regulation E’s definition of “electronic fund transfer.”4eCFR. 12 CFR Part 1005 – Electronic Fund Transfers, Regulation E Money moved through Fedwire or similar systems is not protected by the consumer liability rules discussed here.
Peer-to-peer apps like Zelle and Venmo do fall under Regulation E when a transfer meets the definition of an electronic fund transfer. The CFPB has confirmed that a transfer initiated by a fraudster through a P2P provider is an unauthorized EFT, and the same liability and error-resolution rules apply.6Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs The distinction that trips people up: if you authorized the transfer yourself because a scammer tricked you into sending money, that is generally not treated as “unauthorized” under the regulation, even though you were deceived. The protection covers fraud where someone else initiates the transfer from your account without your permission.
How to Report Before the Deadline Hits
Start with a phone call to your bank’s fraud department. Verbal notice is legally sufficient under Regulation E, and the clock stops running the moment you make that call.4eCFR. 12 CFR Part 1005 – Electronic Fund Transfers, Regulation E Ask the representative to freeze the compromised card or account while you are on the line. Follow up with written notice sent by certified mail or through the bank’s secure online portal so you have a dated confirmation.
Before you call, pull the details together: your account number, dates and dollar amounts of each suspicious transaction, and merchant names or ATM locations. If a card was lost or stolen, note the date you first realized it was missing. Cross-reference your transaction history so every unauthorized item is captured on the first pass.
If a fraudster set up recurring transfers, you can stop preauthorized payments by notifying your bank at least three business days before the next scheduled transfer. The stop-payment order can be made by phone or in writing, though the bank may require written confirmation within 14 days of an oral request.7eCFR. 12 CFR 205.10 – Preauthorized Transfers
If the Bank Denies a Timely Claim
Reporting on time does not guarantee the bank will pay. Denials happen, particularly when the disputed activity resembles the account holder’s usual patterns. Filing a complaint with the Consumer Financial Protection Bureau is the most accessible next step. You can submit online or call (855) 411-2372, and the CFPB forwards the complaint to the bank, which generally has 15 days to respond (or 60 days for complex cases).8Consumer Financial Protection Bureau. Submit a Complaint
The Electronic Fund Transfer Act also gives you a private right to sue. If a bank violates the statute, you can recover actual losses plus statutory damages between $100 and $1,000 for individual claims, and courts can award reasonable attorney’s fees and costs.9Office of the Law Revision Counsel. 15 USC 1693m – Civil Liability For smaller amounts, small claims court is a practical option. Bring copies of your statements, your fraud report, the bank’s denial letter, and any correspondence showing when you notified the bank. The date you gave notice, measured against the transmittal date of the statement showing the first unauthorized charge, is the point everything turns on.