When a bank denies your fraud claim, you are not out of options. Federal law gives you the right to see the documents the bank relied on, submit an appeal built around new evidence, complain to a federal or state regulator, and ultimately sue under the Electronic Fund Transfer Act. What matters most is speed: the deadlines that control how much you can recover run from the date of your statement, not from the date of the denial, and they keep running while you argue.
Get the Bank’s Investigation File
A denial letter cannot be a form rejection. Under Regulation E, the bank must give you a written explanation of its findings and tell you that you can request copies of the documents it used to reach its conclusion.1eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors Ask for those documents in writing the day you get the denial.
What comes back usually includes transaction logs, IP addresses, timestamps, and device or location data. Read it looking for a specific question: what did the bank get wrong, and what did it ignore? Banks often deny claims because a PIN or saved password was used and treat that as proof of authorization. That reasoning ignores skimming, data breaches, and social engineering. If the file shows a login from a city you have never visited or a device you do not own, that gap is what your appeal should target. Denials also rest on outdated addresses, misread timestamps, or the assumption that because a card was not reported lost, the charge must be legitimate. Pinning down the specific flaw is what separates an appeal that gets a second look from one that gets rubber-stamped.
The 60-Day Clock Governs Everything
For debit cards and other electronic fund transfers, your liability climbs on a sliding scale tied to how quickly you notified the bank:
- Within 2 business days of learning your card or access information was compromised, liability caps at $50.
- Between 2 and 60 days after the bank sent the statement showing the unauthorized transfer, liability rises to $500.
- After 60 days, you face unlimited liability for unauthorized transfers that occur after the 60-day window closes.2Office of the Law Revision Counsel. 15 USC 1693f – Error Resolution
That 60-day window also controls whether the bank has to investigate at all. It has no obligation to investigate an error notice received more than 60 days after it sent the statement reflecting the transaction.3Consumer Financial Protection Bureau. 12 CFR 1005.11 – Procedures for Resolving Errors
Appeals have their own trap. If the bank has already investigated and denied your claim in compliance with the regulation, it has no further obligation to reopen the case when you reassert the same error.3Consumer Financial Protection Bureau. 12 CFR 1005.11 – Procedures for Resolving Errors Your appeal needs to land quickly after the denial, and it needs to bring something new. Simply restating the original complaint gives the bank a clean basis to close the file again.
Credit Card or Debit Card Changes Your Position
Credit card fraud disputes are governed by the Fair Credit Billing Act and Regulation Z, not Regulation E. Maximum liability for unauthorized credit card charges is $50, with no sliding scale.4Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card The burden of proof runs the other way too: the card issuer must show the charge was authorized. Most major issuers waive even the $50 as a policy matter.
Debit disputes are harder for two reasons beyond the tiered liability. The money is already gone from your checking account, so you are trying to claw it back rather than refuse to pay a bill. And Regulation E does not let you assert merchant-related disputes through your bank the way Regulation Z does. If you paid a merchant by debit card and the goods never arrived, your bank has no federal duty to help you recover.
This shapes your appeal. On a credit card, lean on the fact that the issuer carries the burden of proving authorization. On a debit card, you have to affirmatively show the transfer was unauthorized, ideally with evidence the bank did not have the first time around.
Build an Appeal That Contradicts the Denial
Effective appeals are targeted, not general. Start with the documents the bank produced and build around whatever it got wrong.
File a police report with local law enforcement. Beyond creating an official record, the report shows you are willing to make statements under penalty of law. Then file an Identity Theft Report through the FTC at IdentityTheft.gov, which produces a standardized federal document that businesses treat as proof someone stole your identity and that triggers certain legal rights.5Federal Trade Commission. What to Do Right Away
If the bank claims you were physically present or that the transfer came from your device, disprove that specific finding. Cell tower records, phone GPS data, receipts from a different location, and timestamped photos can put you elsewhere. If the bank’s logs show a login from another state, use those logs against it. Inconsistencies across the bank’s own data points are often the strongest evidence you have.
Keep a running log of every contact with the bank: date, time, representative name, and what you were told. That record matters if the dispute reaches a regulator or a court. When you assemble the appeal package, tie each piece of evidence to a specific claim in the denial letter. Do not attach documents and expect someone to connect the dots.
Send It So the Timing Is Provable
Send the appeal by certified mail with return receipt requested. You need proof of exactly when the bank received it. Some banks accept appeals through secure portals that generate timestamped confirmations, and those work too, but a physical delivery receipt is hard to argue with later.
Because the bank has already met its initial investigation duty, your leverage on an appeal comes from the substance of the new evidence and from any procedural failure in the first go-around. If the bank ignored documents you submitted, missed a deadline, or never produced the investigation file when you asked, the faster route may be a regulator rather than the bank itself.
Escalate to a Regulator
The Consumer Financial Protection Bureau forwards consumer complaints to the financial institution, and the institution is expected to respond within 15 calendar days. If it cannot give a final response in that window, it can take up to 60 calendar days total.6Consumer Financial Protection Bureau. Your Companys Role in the Complaint Process These complaints reach compliance staff rather than the frontline team that denied you, and the different audience often produces a different answer.
If your account is with a nationally chartered bank or federal savings association, the Office of the Comptroller of the Currency handles complaints through its Customer Assistance Group.7Office of the Comptroller of the Currency. Consumer Complaints For credit unions, the National Credit Union Administration plays the same role. Filing with the right agency matters, because the CFPB routes complaints about institutions it does not supervise to the correct regulator, and the referral adds time.
Whichever agency you use, include the original claim number, a concise timeline, a copy of the denial letter, and all your supporting evidence. A complaint that documents a specific procedural failure, such as the bank failing to produce its investigation records when asked or ignoring evidence you submitted, is far more likely to move the file than a general grievance.
Your state attorney general’s consumer protection division is worth using in parallel. Many offer mediation for disputes with banks. Filing federal and state complaints at the same time is fine and puts more than one set of eyes on the case.
Suing Under the EFTA
If regulators cannot resolve the dispute, you can sue. Small claims court handles smaller amounts and is built to be used without an attorney; jurisdictional limits vary by state.
The Electronic Fund Transfer Act gives real financial teeth to a lawsuit. A bank that violated the law is liable for your actual damages, plus statutory damages between $100 and $1,000 in an individual action, plus attorney’s fees and court costs if you win.8Office of the Law Revision Counsel. 15 USC 1693m – Civil Liability The fee-shifting provision is what makes smaller claims worth a lawyer’s time on contingency or reduced fees.
Treble damages of three times your actual loss are available only in narrow circumstances. The bank must have failed to provisionally credit your account within the required 10 business days, and must have either conducted no good-faith investigation or had no reasonable basis for concluding your account was not in error.2Office of the Law Revision Counsel. 15 USC 1693f – Error Resolution A denial by itself does not qualify. Treble damages punish banks that cut corners on the investigation itself.
Two things can trip you up. The statute of limitations for EFTA civil actions is one year from the date of the violation.9Office of the Law Revision Counsel. 15 USC Chapter 41 Subchapter VI – Electronic Fund Transfers And check your deposit agreement for a mandatory arbitration clause. Many bank contracts push disputes into arbitration and block court litigation and class actions.
If You Cannot Recover the Money
When every avenue closes and the funds are gone, the loss may be deductible in limited circumstances. Personal casualty and theft losses generally must be tied to a federally declared disaster to be deductible under current rules, but theft losses from transactions entered into for profit are an exception. If the conduct qualifies as theft under your state’s law, you have no reasonable prospect of recovery, and the loss arose from a for-profit transaction, you can claim the deduction on IRS Form 4684.10Internal Revenue Service. Instructions for Form 4684 – Casualties and Thefts This will not fit every bank fraud situation, and it is worth walking through with a tax professional if the amount is significant.