If someone drained your bank account, call the bank’s fraud department right now, before you finish reading this. Under the Electronic Fund Transfer Act, your personal loss on unauthorized electronic transfers is capped at $50 if you notify the bank within two business days of learning about the theft. Wait longer and the cap rises to $500. Wait past 60 days from the statement that first showed the fraud and your liability becomes unlimited for anything stolen after that window closes.1Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability The first 48 hours matter more than anything you do later.
What To Do in the First Hour
Call the fraud number on the back of your debit card or on your bank’s website. Tell them the transactions are unauthorized and ask them to freeze the account. Every hour the account stays open is another hour the thief can keep pulling. Freezing will also stop any automatic payments and direct deposits running through that account, so jot down the recurring bills you’ll need to route somewhere else.
File a police report. The report creates an official record of the theft, and your bank will usually ask for a copy as it processes your fraud claim. Bring statements showing the unauthorized transactions and whatever you know about how the fraud happened.
Report the theft at IdentityTheft.gov. The federal site builds a personalized recovery plan and generates pre-filled letters you can send to your bank and creditors, and the FTC identity theft report itself works as documentation if you later need to dispute fraudulent accounts or charges.2Federal Trade Commission. Report Identity Theft
Place a credit freeze. You only need to contact one of the three major bureaus (Equifax, Experian, or TransUnion), and that bureau is required to notify the other two. A fraud alert asks lenders to verify your identity before opening new credit; a credit freeze blocks access to your credit report entirely, so no one can open new accounts in your name, including you, until you lift it.3Federal Trade Commission. Credit Freezes and Fraud Alerts If someone already has enough of your information to drain a bank account, a freeze is the safer choice because it doesn’t depend on a lender bothering to do the extra verification step.
How Much You’re on the Hook For
Regulation E caps your out-of-pocket loss on unauthorized electronic transfers, and the cap moves on a strict timeline tied to when you tell the bank.
- Reported within 2 business days of learning of the loss: your maximum liability is $50, or the amount stolen before you reported, whichever is less.1Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
- Reported after 2 business days but within 60 days of the statement showing the fraud: your maximum rises to $500, and the bank has to prove the additional losses would not have happened if you’d reported sooner.4eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
- Not reported within 60 days of that statement: unlimited liability for any unauthorized transfers that occur after the 60-day window closes.1Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
Two timing details matter. The two-day clock starts when you learn of the loss or theft, not when the transaction posted. The 60-day clock starts when the bank sends your statement, not when you open it. Extenuating circumstances like a long hospital stay or extended travel can extend these deadlines to a reasonable period, but that’s a judgment the bank makes, so don’t plan around it.
Your own carelessness does not raise the cap. Writing your PIN on your card or keeping it on a note in your wallet is negligent, but Regulation E says negligence cannot be used to impose greater liability than the statute allows.5Consumer Financial Protection Bureau. Liability of Consumer for Unauthorized Transfers
When Federal Protections Don’t Cover You
The EFTA definition of an “unauthorized electronic fund transfer” is narrower than people assume, and the gaps can cost you the whole balance.
Someone You Gave Access To
If you gave another person your card, PIN, or online banking login and that person later cleans you out, the transfer is not considered unauthorized unless you had already told the bank that person no longer has permission to use the account.6Office of the Law Revision Counsel. 15 USC 1693a – Definitions This comes up constantly with ex-partners, adult children, and former roommates. If you shared access with someone and the relationship has turned, notify the bank in writing right away. Until you do, the liability caps won’t save you.
Business Accounts
Regulation E covers only accounts “established primarily for personal, family, or household purposes.”7eCFR. 12 CFR 1005.2 – Definitions A drained business checking account falls outside these consumer protections. Business accounts run under UCC Article 4A for wire transfers, where a bank can shift the loss to you if it followed a commercially reasonable security procedure. Businesses often eat the full loss on fraud that a consumer would have been reimbursed for.
Forged Paper Checks
If the thief emptied the account using forged checks rather than electronic transfers, the Uniform Commercial Code governs instead of Regulation E. You generally have up to one year from the statement date to report a forged check, but many banks shorten this through their account agreements to as little as 30 or 60 days. Check your account terms. Miss the deadline and you lose the right to recover the forged amount no matter how obvious the forgery.
What the Bank Must Do After You Report
Once you’ve reported the fraud, Regulation E puts the bank on a clock. It has 10 business days to investigate and decide whether an error occurred, and three more business days to tell you the result.8eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
The bank can extend the investigation to 45 calendar days, but only if it provisionally credits your account within the first 10 business days. The provisional credit must cover the disputed amount, though the bank can hold back up to $50 if it has reason to believe the transfer really was unauthorized and has met its disclosure obligations. The bank must tell you the amount and date of the credit within two business days of posting it, and you get full use of the money while the investigation runs.8eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
One trap sinks a lot of fraud claims. If you reported by phone, many banks require written confirmation within 10 business days. If the bank asked for written confirmation and you didn’t send it, the bank doesn’t have to issue a provisional credit at all.8eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors Always follow a phone report with written confirmation, whether or not the representative tells you to.
If the bank confirms the fraud, the provisional credit becomes permanent. If it concludes no error occurred, it can reverse the credit after giving you a written explanation and copies of the documents it relied on. You can ask for those documents and challenge the finding.
If the Bank Won’t Reimburse You
Most promptly reported fraud ends with the bank making you whole. When it doesn’t, two paths remain.
You can sue the person who took the money in civil court, separate from any criminal case. Small claims court keeps filing fees and procedures manageable for smaller amounts; larger losses mean filing in a higher court with higher costs. The limitation is practical: a judgment is only worth what you can collect, and someone who stole money has often already spent it or hidden it.
Don’t count on a tax deduction to soften the hit. Personal theft losses have not been deductible on federal income taxes since 2018, when the Tax Cuts and Jobs Act suspended the deduction for losses unconnected to a federally declared disaster. Recent legislation made that restriction permanent, so a drained bank account produces no federal tax write-off regardless of the amount.