Unauthorized EFT: Regulation E Liability Limits and Reporting

An unauthorized electronic fund transfer is any digital transaction pulled from your account by someone other than you, without your permission, that gave you no benefit. Federal law caps what you can lose if you report it quickly: $50 if you notify your bank within two business days of learning a card or code was stolen, more if you wait longer, and potentially everything in the account if you miss the 60-day window after your statement arrives. The rulebook is Regulation E, which implements the Electronic Fund Transfer Act of 1978 and forces banks to investigate disputes on a strict clock.¹

What Counts as an Unauthorized Electronic Fund Transfer

Three elements must be present. Someone other than you initiated the transfer, that person had no actual authority to do so, and you received no benefit from it.² Withdrawals from an ATM with a stolen card, debit purchases a thief runs at a store, and ACH pulls someone sets up with your routing and account numbers all fit.

Regulation E defines an “access device” broadly as any card, code, or other means of accessing your account to initiate transfers.³ A debit card qualifies. So does your PIN, your online banking password, and a mobile wallet linked to your account. The “other means of access” language is deliberately open-ended so new technologies fall in automatically.

Being tricked still counts. If a phishing email captures your login, or a caller pretending to be your bank talks you into reading off your credentials, the transactions that follow are unauthorized. The CFPB has said that a consumer deceived into providing account access has not voluntarily furnished the access device, so the fraud exclusion does not apply.⁴

What Falls Outside the Definition

Two situations don’t qualify as unauthorized even when you feel wronged. If you voluntarily hand your card or PIN to someone, any transfers that person makes are treated as authorized until you tell the bank to cut off their access.² Transfers you initiate yourself with fraudulent intent, or transfers made by someone acting with you, are also excluded.

Several transaction types sit entirely outside Regulation E. Wire transfers are the big one. The Electronic Fund Transfer Act carves bank-to-bank wires out of its definition of an electronic fund transfer.⁵ Wire fraud victims cannot rely on Regulation E’s liability caps or investigation timelines; those transfers are governed by Article 4A of the Uniform Commercial Code, which offers far less consumer protection.

Business accounts are excluded too. EFTA only covers accounts established primarily for personal, family, or household purposes.⁵ An unauthorized ACH debit against a business checking account is handled under the deposit agreement and the UCC. Checks, securities and commodities transfers, and certain automatic transfers between accounts at the same institution are also outside Regulation E’s scope.

How Much You Can Lose Depends on When You Report

Your maximum exposure follows a tiered structure. Fast reporting keeps the number small. Delay can wipe you out. The rules split based on whether a physical access device went missing or whether a thief used only your account number.

Lost or Stolen Card, PIN, or Other Access Device

Report within 2 business days of learning the device is missing: your liability is capped at $50, or the total unauthorized transfers that happened before you notified the bank, whichever is less.⁶
Report after 2 business days but within 60 days of the statement showing the loss: liability can reach $500, and only if the bank proves the losses above $50 would not have happened had you reported sooner.⁶
Fail to report within 60 days of the statement: there is no cap on unauthorized transfers occurring after that window closes and before you finally notify the bank. You could lose the full account balance and any linked credit line.⁶

The two-day clock starts when you discover the device is missing, not when the first unauthorized transfer posts. A thief may use a stolen card before you notice it’s gone, and that gap doesn’t extend your reporting deadline.

Account Number Fraud Without a Missing Device

When someone compromises your account and routing numbers without stealing a physical card or code, the $50 and $500 tiers don’t apply. The 60-day periodic statement rule is your protection. Report the unauthorized transfer within 60 days of the statement that first shows it and you bear zero liability. Miss the window and you face uncapped exposure for unauthorized transfers occurring after those 60 days until you finally notify the bank.

If You Couldn’t Report on Time

Hospitalization, extended travel, or another circumstance beyond your control forces the bank to extend these deadlines to a reasonable period.⁷ “Reasonable” isn’t defined in the rule, so document your situation and contact the bank as soon as you can.

Your own carelessness cannot raise the ceiling. Even if you wrote your PIN on the card or reused a weak password, the bank cannot impose more liability than the tiered structure allows.⁴

How to Report an Unauthorized Transfer

You can start the process by phone or in person at a branch. No paperwork is needed to start the clock. Your notice must identify you by name and account number, describe the transaction you believe is unauthorized (including date and dollar amount), and explain why you think an error occurred.⁸ You don’t need to know how the fraud happened. “I didn’t make this transaction and I don’t recognize it” is enough.

Your notice must reach the bank within 60 days of the statement that first shows the unauthorized transfer.⁸ If a lost or stolen access device is involved, the separate two-day and 60-day tiers above also apply.

Banks can require you to follow up an oral report with written confirmation within 10 business days. If you skip the written follow-up, the bank no longer has to give you provisional credit while it investigates.⁹ Your dispute still moves forward, but you could be waiting weeks with the disputed funds gone. Send the written confirmation by certified mail so you have proof of delivery. Most banks also offer dispute forms through their website or mobile app.

The bank cannot demand a police report or make you contact the merchant before opening the investigation.⁴

What the Bank Must Do Next

Once your notice arrives, the bank must investigate and reach a determination within 10 business days. For new accounts (within 30 days of the first deposit), that initial window is 20 business days.⁸

If the bank needs more time, it can extend the investigation to 45 days, but only if it provisionally credits your account within those initial 10 business days. That credit must include interest where applicable.⁸ Provisional credit puts your money back while the bank finishes its work, which is why the written follow-up requirement matters: without it, the bank can make you wait the full period with an empty account.

Three situations extend the maximum investigation period from 45 days to 90 days: international transfers, point-of-sale debit card transactions, and transfers occurring within 30 days of the first deposit to a new account. If the bank confirms an error, it must correct it within one business day and report its findings to you within three business days of completing the investigation.⁸

If the Bank Denies Your Claim

A denial has to come in writing, and it must tell you that you can request the documents the bank relied on during the investigation.⁸ The bank must promptly hand those documents over when you ask. Requesting them often reveals whether the bank actually investigated or just closed the file.

If the bank gave you provisional credit and now wants it back, it can’t just pull the money. It must tell you the date and amount of the coming debit and honor checks, preauthorized payments, and similar items without overdraft charges for five business days after that notice.¹⁰ That buffer gives you time to adjust before the funds disappear.

If you think the denial is wrong, you can complain to the Consumer Financial Protection Bureau, which supervises bank compliance with Regulation E. You can also sue under the Electronic Fund Transfer Act. An individual lawsuit can recover between $100 and $1,000 in statutory damages regardless of your actual loss, plus actual damages, court costs, and reasonable attorney’s fees. Class actions are capped at the lesser of $500,000 or one percent of the institution’s net worth.¹¹

Bad-faith conduct triples the statutory damages. If the bank failed to provisionally credit your account within 10 days and either skipped a good-faith investigation or had no reasonable basis for denying your claim, treble damages apply. The same treatment applies if the bank knowingly and willfully concluded your account wasn’t in error when the evidence didn’t support that conclusion.¹²

P2P Apps and the Scam Loophole

Regulation E covers person-to-person payment services like Zelle, Venmo, and Cash App when the transaction meets the definition of an electronic fund transfer. The CFPB treats P2P providers as financial institutions under the rule if they hold consumer accounts or issue access devices, and your bank has Regulation E obligations even when the transfer moved through a third-party app.⁴

The dividing line trips people up. If a fraudster gets into your Venmo and sends your money to themselves, that’s an unauthorized transfer and Regulation E protects you. If you personally send $800 to a marketplace seller who turns out to be a scammer and the goods never arrive, most providers treat that as authorized because you initiated it. “Someone else sent money from your account” is protected. “You were tricked into sending money” usually is not.

If a bank tells you Zelle transactions can’t be disputed, that’s not accurate. The bank’s Regulation E obligations exist regardless of the payment channel, and network rules or private agreements cannot give you less protection than federal law requires.⁴

1
Legal Information Institute. Electronic Funds Transfer Act
2
eCFR. 12 CFR Part 205 – Electronic Fund Transfers (Regulation E) – Section: Definitions
3
eCFR. 12 CFR 1005.2 – Definitions
4
Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
5
Office of the Law Revision Counsel. 15 USC 1693a – Definitions
6
eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
7
Consumer Financial Protection Bureau. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
8
eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
9
eCFR. 12 CFR Part 205 – Electronic Fund Transfers (Regulation E) – Section: Error Resolution
10
Consumer Financial Protection Bureau. 12 CFR 1005.11 – Procedures for Resolving Errors – Section: 11(d)(2)
11
Office of the Law Revision Counsel. 15 USC 1693m – Civil Liability
12
Office of the Law Revision Counsel. 15 USC 1693f – Error Resolution