If money is missing from your checking or savings account and you didn’t authorize the transfer, call your bank the moment you notice it and then confirm the dispute in writing. An unauthorized withdrawal from a bank account can cost you anywhere from nothing to the full amount drained, depending on how quickly you report. The pivotal deadline is two business days after you discover the problem; miss it and your maximum liability jumps from $50 to $500, and after 60 days from the statement date it becomes unlimited.
Call the Bank First
Use the number printed on the back of your debit card or posted on your bank’s website. Give the representative the date, the amount, and a short description of the transaction you’re disputing. Ask for a reference number. Write down the name of the person you spoke with, the time of the call, and the date. That timestamp is what fixes your liability under federal law, so pin it down before you hang up.
While you still have someone on the line, ask the bank to freeze or replace the compromised card. Change your PIN and your online banking password immediately. If the same password protects your email or a bill-pay service, change those too. Someone who has your debit card number often has enough other information to try the related accounts.
Check your recurring payments. Subscriptions, utility autopays, and loan payments tied to the old card number will bounce once the replacement is issued, and late fees pile up fast if you don’t update them.
Send Written Confirmation Within 10 Business Days
The phone call starts the clock, but your bank is allowed to require written confirmation within 10 business days of your oral report. If the bank asks for it and you don’t send it, the bank has no obligation to provisionally credit your account while it investigates.1Office of the Law Revision Counsel. 15 USC 1693f – Preauthorized Transfers People miss this all the time. They call, assume the matter is handled, and lose their right to interim credit because no written notice ever followed.
Your written notice should include your name, account number, the specific transaction you’re disputing, the amount, and the reason you believe it was unauthorized. Send it to the address the bank gives you during the call. Keep a copy. If you mail it, send it certified so you have a delivery receipt. A secure message through the bank’s online portal works as well and creates a timestamped record automatically.
How Much You Can Lose Depends on When You Report
The Electronic Fund Transfer Act and Regulation E set a tiered liability structure for unauthorized transfers from consumer checking, savings, and other deposit accounts. There are three tiers plus a before-the-fact tier:
- Report a lost or stolen debit card before anyone uses it: you owe nothing.
- Report within two business days of learning about the loss or theft: liability is capped at $50, or the total unauthorized amount if that is less.2Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
- Report after two business days but within 60 days of the statement showing the transfer: liability rises to $500, or the unauthorized amount if that is less.2Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
- Report more than 60 days after the statement was sent: unlimited liability for any unauthorized transfers that occur after the 60-day window closes.3Consumer Financial Protection Bureau. Regulation E 1005.6 – Liability of Consumer for Unauthorized Transfers
The two-business-day window does not include the day you discovered the problem, and weekends and bank holidays don’t count. If you spot a fraudulent charge on a Friday evening, the two business days start Monday and end at the close of Tuesday.3Consumer Financial Protection Bureau. Regulation E 1005.6 – Liability of Consumer for Unauthorized Transfers
The law allows for situations where on-time reporting wasn’t possible. Extended travel or hospitalization can push the two-business-day window out to a longer period that is “reasonable under the circumstances.”2Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
What Counts as Unauthorized
Regulation E defines an unauthorized transfer as one initiated by someone other than you, without your permission, and from which you received no benefit. There’s a catch worth knowing. If you gave someone your card or account access, transfers that person makes are not unauthorized unless you had already told the bank to cut off that access.4eCFR. 12 CFR 1005.2 – Definitions A roommate who drains your account after you handed over the card, or an ex-spouse who still knows your PIN, can leave the bank with grounds to deny your claim.
ACH Debits Without a Lost Card
When a company you never authorized pulls money directly from your account, there was no lost or stolen access device, so the $50 and $500 tiers don’t apply. The protection you have is the 60-day statement rule: report the unauthorized ACH debit within 60 days of receiving the statement showing it, and your liability for that transfer is zero. Miss the 60 days and you face unlimited liability for any additional unauthorized debits that happen after the deadline.3Consumer Financial Protection Bureau. Regulation E 1005.6 – Liability of Consumer for Unauthorized Transfers
Business Accounts Are Not Covered the Same Way
Regulation E only applies to accounts established primarily for personal, family, or household purposes.5Consumer Financial Protection Bureau. Regulation E 1005.2 – Definitions If someone drains a business checking account, the tiered caps, the mandatory investigation timelines, and the provisional credit rules do not apply. Business account fraud generally runs under the Uniform Commercial Code (Article 4A for wire transfers), and a bank that followed commercially reasonable security procedures can push the entire loss onto the business.
Sole proprietors using a personal checking account may still be covered, because the account type matters more than the use. If the account was opened as a business account, read the account agreement carefully and consider adding internal controls like dual authorization for larger transfers.
What the Bank Must Do After You Report
Once you report the error, the bank must investigate and reach a decision within 10 business days.6eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors It can extend that to 45 calendar days, but only if it provisionally credits your account within the first 10 business days. The bank is allowed to withhold up to $50 of that provisional credit if it reasonably believes an unauthorized transfer occurred and that you bear some liability under the tiers.7Consumer Financial Protection Bureau. Regulation E 1005.11 – Procedures for Resolving Errors
If the account was opened within the last 30 days, the bank gets 20 business days instead of 10 to investigate or issue provisional credit, and the extended investigation window stretches from 45 to 90 calendar days. The 90-day extension also applies to point-of-sale debit card transactions and transfers that originated outside the United States.6eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
When the investigation finishes, the bank must tell you the result within three business days. If it finds the error occurred, it has one business day from that determination to correct it. Any provisional credit becomes permanent, and the bank has to send written confirmation that your funds have been restored.
If the Bank Denies the Claim
A denial must come with a written explanation and the evidence the bank relied on. You can request copies of those documents, including signed receipts, transaction logs, and any security footage used to conclude the transfer was authorized.1Office of the Law Revision Counsel. 15 USC 1693f – Preauthorized Transfers If the account was provisionally credited, the bank will reverse the credit but must tell you the date the reversal will take effect.
Read the documents carefully. Banks sometimes treat the use of your card’s chip or PIN as proof you authorized the charge. That reasoning falls apart when the card was stolen with the PIN, or when a skimming device captured both at a terminal.
Escalating After a Denial
File a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov/complaint. The CFPB forwards it to the bank, which generally has 15 days to respond, with complex cases taking up to 60 days.8Consumer Financial Protection Bureau. Learn How the Complaint Process Works The CFPB doesn’t adjudicate the claim, but banks tend to look harder at a dispute once a federal regulator is in the thread. You’ll see the bank’s response and have 60 days to say whether the issue was resolved.
If the complaint route doesn’t produce results, you can sue under the EFTA. The statute of limitations is one year from the date of the violation, not from the date you discovered it. That window is tight, so if a significant amount is at stake, talk to an attorney early rather than waiting out an informal process. Small claims court is another option for amounts within your jurisdiction’s limit, and no lawyer is required.
If Identity Theft Looks Broader
If the withdrawal appears to be part of wider identity theft, meaning new accounts in your name, address changes you didn’t request, or multiple institutions affected, do more than file a single bank dispute. File a report at IdentityTheft.gov, which generates a personalized recovery plan and an identity theft affidavit you can hand to the bank and other creditors. File a police report as well. Some banks require one for high-value or complex fraud claims, and the report creates an official record that supports your dispute.
Freeze your credit reports with Equifax, Experian, and TransUnion. A credit freeze blocks anyone from opening new accounts in your name, and placing or lifting one is free. It won’t recover the money already taken, but it stops the damage from spreading. Watch your other bank and credit card accounts closely for several months, because anyone with enough information to drain one account usually has enough to try others.
Reducing the Risk of a Repeat
Turn on real-time transaction alerts in your bank’s app. Most banks let you set a dollar threshold that triggers a push notification. Setting it low catches the small test charges fraudsters often run before a larger withdrawal, and the faster you see a suspicious transaction, the better your position under the reporting deadlines.
Use a unique password for your bank account, not one you’ve used anywhere else, and turn on multi-factor authentication. A password alone is a single point of failure. Multi-factor adds something beyond the password, like a code sent to your phone, which makes unauthorized access much harder even if your credentials leak.
Be skeptical of any email, text, or phone call asking you to verify account information or a PIN. No legitimate bank initiates contact to request those details, and any message that does is almost certainly a phishing attempt.
Credit card fraud works under a different statute with its own $50 cap and separate network policies, so if the unauthorized charge hit a credit card rather than a deposit account, the deadlines and liability tiers above don’t apply in the same way.9Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card