What Happens If Your Bank Account Is Defrauded?

If your bank account has been defrauded, call the fraud line on the back of your debit card today. Federal law caps your out-of-pocket loss at $50 when you report unauthorized activity within two business days of discovering it. Wait longer and that cap jumps to $500, then disappears entirely. Everything else you need to do — the written dispute, the police report, the credit freeze — matters, but nothing matters more than making that first call before the clock runs out.

Call the Bank Today

The Electronic Fund Transfer Act, implemented through Regulation E, ties your financial exposure directly to how quickly you notify your bank. The rules work in three tiers.

Report within two business days of learning that your card was lost, stolen, or used without permission, and your maximum liability is $50 or the amount of unauthorized transfers before you notified the bank, whichever is less.¹ If a thief drains $3,000 from your account and you call the bank the next morning, you owe at most $50.

Miss the two-day window and your exposure jumps. If you report after two business days but within 60 calendar days of the bank sending the statement that shows the fraud, you could be on the hook for up to $500. That covers your original $50 of exposure plus any additional unauthorized transfers the bank can show would not have happened if you had reported within two days.¹

The worst outcome hits if more than 60 days pass after the bank sends a statement showing the fraudulent activity. At that point you lose protection for any unauthorized transfers that occur after the 60-day window and before you finally notify the bank. The bank still has to show those later transfers would not have occurred had you spoken up sooner, but the potential exposure has no dollar cap.¹ This is why checking statements regularly is not optional advice. It is the mechanism that preserves your legal protections.

Steps to Take in the First 24 Hours

Work through these in order. The phone call is first because it starts your legal protections running.

Call your bank’s fraud line immediately. Every major bank has a 24/7 number printed on the back of your debit card. Ask the representative to freeze the compromised account and issue a new card. Write down the date and time of the call, the representative’s name, and any reference number. This call starts the clock on your two-business-day reporting window.
Follow up in writing. Send a written notice to your bank by certified mail with return receipt requested. The phone call starts your protection, but paper proof the bank received your dispute is invaluable if a disagreement later arises about when you reported.
Change every compromised credential. Update your online banking password, your security questions, and any other account that shares the same password. Turn on two-factor authentication if you haven’t already.
Review your full transaction history. Don’t just flag the obvious charges. Fraudsters often test an account with a small transaction before making a large withdrawal. Identify the last transaction you actually authorized so you can give the bank a clean timeline.

Before you call, pull together the dates and exact dollar amounts of every suspicious transaction, including merchant names or transfer recipients from your statement. Having that ready stops the call from stalling while you dig for details.

What to Put in Your Written Dispute

Most banks let you start a dispute through their online portal, mobile app, or by phone, but the written follow-up matters most legally. Regulation E requires the bank to investigate any error you report, and written notice creates the clearest record of when the bank’s obligations began.²

Your written notice should include the account number, a description of each disputed transaction with dates and amounts, an explanation of why you believe the transactions were unauthorized, and your contact information. Banks typically have their own dispute forms. Using the bank’s form is fine, but you are not required to; a letter covering the same information satisfies the regulation.

Keep copies of everything. Screenshot the confirmation page if you upload documents through the bank’s portal. Keep a copy of the letter plus the certified mail receipt if you mail it. This documentation becomes essential if the bank later claims it never received your dispute or that you filed it late.

What the Bank Must Do Next

Once your bank receives the error notice, it has 10 business days to investigate and reach a conclusion. If it needs more time, it can extend the investigation to 45 calendar days, but only if it provisionally credits your account within those first 10 business days for the full disputed amount plus any interest that would have accrued.² The provisional credit lets you use the money while the bank finishes its review. If the bank confirms the fraud, the credit becomes permanent. If it denies your claim, it can take the credit back after notifying you.

Those timelines stretch for certain transactions. If your account is new, opened within the last 30 days, the bank gets 20 business days instead of 10 to issue provisional credit, and 90 calendar days instead of 45 to complete the investigation. The same 90-day extension applies to point-of-sale debit card transactions and transfers that originated outside the United States.³

After the investigation wraps up, the bank must notify you of the results within three business days. If the bank found an error, it has one business day to correct it. If it denies your claim, the notice must explain why and tell you that you can request the documents the bank relied on during the investigation.²

If the Bank Denies Your Claim

Start by asking for the documents the bank used to decide. Sometimes the denial rests on a misunderstanding, such as the bank seeing that a transaction occurred in your home city and assuming it was legitimate. Additional evidence, like proof you were traveling elsewhere, can reopen the case.

When the bank won’t budge, file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov/complaint. The CFPB forwards your complaint directly to the bank, which generally responds within 15 days. More complex cases can take up to 60 days.⁴ The complaint becomes part of a public database, and banks tend to take CFPB complaints seriously because the agency has enforcement authority. You also have 60 days after the bank responds to tell the CFPB whether the response resolved your issue.

For smaller amounts, small claims court is another route. Filing limits range from $2,500 to $25,000 depending on the state, and the process doesn’t require a lawyer. For larger losses, or where the bank clearly violated Regulation E’s procedural requirements, a consumer protection attorney may be worth consulting. Banks that skip the provisional credit, blow past the investigation deadlines, or otherwise violate Regulation E face real consequences. You can sue and recover your actual damages plus a statutory penalty between $100 and $1,000, along with attorney’s fees and court costs.⁵

Report the Fraud to Law Enforcement

Your bank handles the money recovery, but reporting the crime creates a paper trail that strengthens your case and helps federal agencies track fraud patterns.

File a report at IdentityTheft.gov, the FTC’s dedicated portal. The system generates an Identity Theft Report and builds a customized recovery plan based on your situation.⁶ It also produces template letters you can send to creditors and debt collectors if the fraud extends beyond your bank account.

File a police report with your local department as well. Bring your FTC Identity Theft Report, a government-issued photo ID, proof of your address, and documentation of the fraudulent transactions. Some banks require a police report for higher-value fraud claims, and having the case number available prevents delays later.⁶

If the fraud involved online banking, phishing, or any internet-based attack, report it separately to the FBI’s Internet Crime Complaint Center at ic3.gov. The IC3 will ask for your financial loss details, transaction dates and amounts, information about who received the money, and a narrative of what happened.⁷ These reports feed federal investigations that sometimes result in fund recovery operations, particularly for wire fraud and business email compromise schemes.

If your Social Security number was exposed, report it to the Social Security Administration’s Office of the Inspector General at oig.ssa.gov or by calling 1-800-269-0271.⁸

Freeze Your Credit

Bank account fraud often signals that your personal information is circulating beyond just the compromised account. A credit freeze blocks anyone from opening new credit accounts in your name, and it is free under federal law. Contact each of the three major credit bureaus separately: Equifax, Experian, and TransUnion.⁹ Each bureau’s website has a dedicated page to place and lift freezes.

A freeze does not affect your existing accounts or your credit score. It only blocks new applications. When you need to apply for credit yourself, you temporarily lift the freeze at the relevant bureau, complete your application, and refreeze. The entire process is free in both directions. If you suspect your information was compromised but aren’t sure whether new accounts have been opened, pull your free annual credit reports from annualcreditreport.com and review them for anything unfamiliar.

When Different Rules Apply

The Regulation E protections above cover electronic fund transfers from a consumer account: debit cards, ATM withdrawals, online transfers, and direct debits. A few common situations fall outside those rules.

Credit Card Charges

Credit cards operate under the Truth in Lending Act, which caps unauthorized charges at $50 regardless of when you report them.¹⁰ There is no escalating penalty for slow reporting, and most major networks voluntarily waive even that $50. A fraudulent credit card charge never touches your cash; you dispute it and the issuer handles the rest.

Payments You Sent Yourself to a Scammer

The key Regulation E question is who pressed the buttons. If a thief steals your card number or tricks you into handing over login credentials and then moves the money themselves, the transfer is unauthorized and the liability caps apply in full. The CFPB has confirmed that even when a scammer tricks you into sharing login details, a texted confirmation code, or your card number, a transfer the scammer then initiates is unauthorized.¹¹ But if you personally logged into Zelle or Venmo, typed the amount, and hit send because someone convinced you they were a legitimate business or a family member in trouble, you authorized the transfer yourself. Banks have historically argued those claims fall outside Regulation E, and recovery depends more on the bank’s internal policies than on federal law.

Forged or Altered Checks

Check fraud shifts to the Uniform Commercial Code. Under UCC Article 4, you have a duty to review your statements and report any forged or altered checks. The outer deadline is one year from when the bank makes the statement available. Miss that window and you lose the right to hold the bank responsible for the forged item, regardless of whether the bank was careful.¹² For forged endorsements, where someone signs the back of a check made out to you, the deadline extends to three years in most states. Liability for check fraud often involves shared fault based on whether you or the bank was more careless, which differs sharply from Regulation E’s bright-line deadlines.

Business Accounts

Regulation E applies only to consumer accounts, meaning accounts held by individuals for personal, family, or household purposes. For business accounts, there are no federally mandated liability caps, no required provisional credit, and no investigation timelines the bank must follow.¹³ Commercial wire transfers fall under UCC Article 4A, where liability turns on whether the bank followed commercially reasonable security procedures. If it did, the loss generally falls on the business, even though the business never authorized the payment.

Deducting a Loss You Can’t Recover

If you cannot get the stolen funds back, you might wonder whether you can deduct the loss on your taxes. For most individuals, the answer is no. The Tax Cuts and Jobs Act suspended the personal theft loss deduction for tax years 2018 through 2025, allowing it only when the loss is attributable to a federally declared disaster. Bank account fraud does not qualify.¹⁴ Unless Congress extends the restriction, the personal theft loss deduction is scheduled to become available again for tax year 2026.

An exception exists for losses from a transaction entered into for profit. If the fraud occurred in the course of a business or targeted funds held specifically as a profit-generating investment, the loss may be deductible under IRC Section 165. The IRS requires you to show that the taking was illegal under state law, that no reasonable prospect of recovery remains, and that the loss arose from a profit-motivated transaction.¹⁵ Losses from personal scams, like romance fraud or impersonation schemes targeting your personal checking account, do not meet this standard. If you believe your situation qualifies, talk to a tax professional and file Form 4684 with your return.

1
eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
2
eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
3
eCFR. 12 CFR Part 1005 – Electronic Fund Transfers, Regulation E
4
Consumer Financial Protection Bureau. Submit a Complaint About a Financial Product or Service
5
Office of the Law Revision Counsel. 15 USC 1693m – Civil Liability
6
Federal Trade Commission. IdentityTheft.gov
7
Internet Crime Complaint Center (IC3). Frequently Asked Questions
8
Social Security Administration. Fraud Prevention and Reporting
9
Consumer Financial Protection Bureau. What Is a Credit Freeze or Security Freeze on My Credit Report?
10
GovInfo. 15 USC 1643 – Liability of Holder of Credit Card
11
Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
12
Legal Information Institute. UCC 4-406 – Customer’s Duty to Discover and Report Unauthorized Signature or Alteration
13
eCFR. Part 205 – Electronic Fund Transfers, Regulation E
14
Internal Revenue Service. Topic No. 515, Casualty, Disaster, and Theft Losses
15
Internal Revenue Service. Publication 547 (2025), Casualties, Disasters, and Thefts