Who Is Liable for Bank Account Fraud: Cards, Checks, and Wires

Who is liable for bank account fraud depends on two things: what kind of account or payment method the thief used, and how quickly you reported the problem. Federal law caps your out-of-pocket loss at $50 for credit card fraud no matter how long you take to notice. Debit card losses start at $50 and climb to unlimited as the days pass. Check fraud, wire transfers, peer-to-peer app payments, and business accounts all run on different rules, and the protections get weaker as you move down that list.

Credit Card Charges: $50 at Most, Usually Zero

Credit cards carry the strongest fraud protection in federal law. Under the Truth in Lending Act, the most you can owe for unauthorized charges on your credit card is $50, and there is no escalating penalty if you report late.¹

Even that $50 only applies if the issuer met a short list of conditions: it told you about your potential liability, gave you a way to report the loss, and provided a method for identifying authorized users. Miss any of those, and you owe nothing. Once you notify the issuer that your card is lost, stolen, or compromised, your liability for anything charged after that moment is zero.¹

On top of the legal floor, most major issuers advertise zero-liability policies that wipe out even the $50. Those are voluntary marketing commitments rather than law, but they are widespread, and most cardholders never pay anything for fraudulent charges.

While an investigation is open, the Fair Credit Billing Act bars the issuer from trying to collect the disputed amount, closing your account over it, or reporting you as delinquent.²

Debit Cards and Electronic Transfers: The Reporting Clock Decides

Debit cards and other electronic fund transfers fall under the Electronic Fund Transfer Act and its implementing rule, Regulation E. Your liability is tied almost entirely to how long you wait to tell the bank.³

Report within two business days of learning about the fraud, and your maximum loss is $50 (or the actual unauthorized amount, if less).
Report after two business days but within 60 days of the statement that first showed the fraud, and your exposure can reach $500. The bank can only hold you responsible for transfers that occurred after the two-day window if it can show those transfers would have been stopped by earlier notice.
Report more than 60 days after the statement, and you face unlimited liability for transfers that happened after that 60-day window and before you called. Again, the bank has to show the later transfers were preventable.

The last tier is where people get wiped out. If a thief slowly drains your account and you never open your statements, the bank is not required to put back the money it could have saved had you noticed. The clock starts when the bank sends or makes the statement available, not when you open it.³

The regulation builds in some grace. If your delay was caused by extenuating circumstances such as hospitalization or extended travel, the bank must extend the deadlines to a reasonable period. You have grounds to push back if a bank denies your claim purely on timing after an emergency kept you away from your mail.

Once you do report, the bank has 10 business days to investigate and either correct the error or extend the review up to 45 days. If it takes the extension, it must provisionally credit your account for the disputed amount within those first 10 business days so you have use of the money while the investigation runs.⁴

Check Fraud: One Year to Catch It

Forged, altered, or counterfeit checks are governed by the Uniform Commercial Code, not Regulation E, and the rules work differently. You have a duty to review your statements with reasonable promptness and tell the bank quickly about any payment you did not authorize.⁵

The absolute cutoff is one year. If you do not discover and report a forged signature or an alteration within one year of the bank making your statement available, you lose the right to challenge the item at all. That deadline applies even if the bank was also careless.⁵

A shorter practical deadline exists too. If the bank can show it lost money because you did not report within a reasonable time (often treated as around 30 days), you can be barred from recovering for payments earlier notice would have prevented. The UCC does not set dollar caps on your liability. Instead, it assigns the loss based on who was in a better position to catch the fraud and how fast each side moved.

Wire Transfers: Security Agreements Shift the Risk

Wire transfers fall under UCC Article 4A. The default rule is that the bank is responsible for unauthorized payment orders, but banks almost always move that risk through a security agreement with the customer.

If you and the bank agreed to a security procedure that a court considers commercially reasonable, and the bank followed it in good faith, you bear the loss from an unauthorized wire. What counts as commercially reasonable depends on the size and frequency of your typical transfers, what other security options the bank offered, and what similar customers and banks generally use.⁶

If the bank offered you multi-factor authentication or callback verification and you turned it down for something lighter, a court is far more likely to find the agreed procedure reasonable and leave the loss with you. Wire transfers are the hardest form of bank fraud to recover from, in part because Article 4A generally prevents customers from suing on separate negligence or breach-of-contract theories.

Zelle, Venmo, and Cash App Payments

Peer-to-peer apps sit in an awkward spot. If someone gets into your account and sends money without your knowledge, that is an unauthorized electronic fund transfer, and the bank or app provider has to follow the same Regulation E liability and investigation rules that apply to debit card fraud.⁷

The more common scenario is uglier. If a scammer tricks you into sending the money yourself, most banks treat that as an authorized payment and deny reimbursement. A customer tricked into sending money to a fake romantic interest or a caller posing as a government official generally has no federal right to a refund, because the customer pressed send.

The CFPB has carved out one important exception. If a scammer tricks you into handing over your login credentials or a verification code and then uses those to move money, those transfers count as unauthorized under Regulation E. You did not furnish an access device in that situation, so the fraud protections apply.⁷

Zelle announced a policy in late 2023 requiring participating banks to reimburse customers for qualifying imposter scams, but the criteria are not public and many claims are still denied on authorization grounds. Recovering money sent to a scammer through a P2P app remains difficult.

Business Accounts Are on Their Own

If you operate a business account, Regulation E’s consumer protections generally do not apply. Business accounts run under the UCC, and the liability rules favor the bank.

Under Article 4A, the bank is responsible by default for unauthorized electronic payment orders, but the same commercially-reasonable-security-procedure framework that applies to consumer wires applies here too. If the bank offered a strong procedure, you accepted one in writing, and the bank followed it, the loss falls on your business. Declining a more robust option in writing will usually be treated as commercially reasonable, cementing your exposure.

For check fraud, business accounts face the same UCC Section 4-406 rules, including the one-year absolute deadline. Banks often impose tighter contractual reporting windows on business customers than the UCC default.⁵

Read the security agreement, accept the strongest procedures the bank offers, and reconcile accounts often. Federal law will not backstop you the way it does a consumer.

What to Do the Moment You Spot Fraud

Speed matters, especially for debit card fraud where every day of delay widens your liability.

Call the bank right away using the number on your card or on its website. Note the date, time, and the name of the person you spoke with, and list the unauthorized transactions by date and amount.
Send written confirmation of your report within 10 business days. If the bank asked for it and you did not provide it, the bank can refuse provisional credit during an extended investigation.⁴
Change passwords, PINs, and security questions for the affected account and anywhere else you reused them.
File a police report. Some banks require it, and it creates a paper trail.
If your personal information was compromised, file an identity theft report at IdentityTheft.gov. The site generates a recovery plan with pre-filled letters for banks and creditors.⁸
Place a fraud alert or credit freeze with one of the three major credit bureaus (Equifax, Experian, or TransUnion); the one you contact will notify the other two for a fraud alert.

If the Bank Will Not Pay

Banks sometimes deny claims they should honor, miss investigation deadlines, or skip provisional credit. File a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov/complaint or by calling (855) 411-2372. The CFPB sends your complaint to the bank, which generally must respond within 15 days, and in some cases up to 60. You can review the response and add your own feedback.⁹

A complaint does not guarantee a refund, but it tends to produce better outcomes than calling customer service again. If you believe the bank missed Regulation E’s investigation deadlines or failed to provide required provisional credit, say so directly in the complaint.

1
Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
2
Joint Base Andrews. The Fair Credit Billing Act
3
eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
4
eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
5
Legal Information Institute (LII) / Cornell Law School. UCC 4-406 – Customer Duty to Discover and Report Unauthorized Signature or Alteration
6
Legal Information Institute (LII) / Cornell Law School. UCC 4A-201 – Security Procedure
7
Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
8
Federal Trade Commission. Report Identity Theft
9
Consumer Financial Protection Bureau. Submit a Complaint