Will a Bank Refund an Unauthorized Transaction? Rules and Timing

A bank will usually refund an unauthorized transaction, but how much you actually get back depends on the type of account, how fast you report the problem, and whether the transaction fits the legal definition of “unauthorized.” Credit card charges are capped at $50 of consumer liability by federal law, and most issuers waive even that. Debit card losses are also capped at $50 if you report within two business days of noticing, but that ceiling rises to $500 after two days and disappears entirely if you wait more than 60 days past the statement date. Wire transfers, business accounts, and payments you were tricked into sending yourself sit largely outside these protections.

Debit Card Refunds and the Reporting Clock

Debit card fraud is governed by the Electronic Fund Transfer Act and Regulation E.¹ Your maximum out-of-pocket loss climbs in tiers based on when you tell the bank:

Report within two business days of learning about the loss or theft, and your liability is capped at $50 or the amount taken before you notified the bank, whichever is less.¹
Report after two business days but within 60 days of the statement showing the fraud, and liability rises to as much as $500 for transfers that happened after the two-day window, if the bank can show those later transfers could have been prevented by earlier notice.¹
Wait longer than 60 days after the statement is sent, and you face unlimited liability for anything the thief takes after that 60-day window closes. The bank is not required to reimburse those losses.²

The two-day clock starts when you learn of the loss or theft, not when the fraud happened. That is why checking your account regularly matters so much: a purely calendar-based delay in noticing still counts against you.

There is one meaningful carveout. If only your account number was stolen and your physical card stayed in your possession, the tiered $50 and $500 limits do not apply. In that scenario you generally have zero liability, provided you report within 60 days of the statement. The tiered caps exist for lost or stolen access devices; when no device left your hands, that trigger is never met.³

If you missed a deadline because of something serious and outside your control, such as hospitalization or extended travel, federal law requires the bank to extend both the two-day and 60-day windows to “a reasonable time.”² Document the circumstances and raise them when you file the dispute; the bank has to consider your situation rather than mechanically apply the calendar.

Credit Card Refunds Are More Generous

Credit cards carry stronger protections than debit cards. Under the Truth in Lending Act and Regulation Z, your liability for unauthorized credit card charges cannot exceed $50 no matter how large the fraud or how long it took you to notice.⁴ Many issuers voluntarily go further with zero-liability policies.

The dispute process runs on a different track from debit cards. The Fair Credit Billing Act gives you 60 days from the first bill showing the error to send a written dispute to the card issuer’s billing inquiry address, which is usually not the payment address.⁵ Oral notice does not count for credit card disputes. Include your name, account number, the disputed charge, and why you believe it is an error, and send it by certified mail with a return receipt to prove timely delivery.⁶

The issuer must acknowledge your notice within 30 days and resolve the dispute within two full billing cycles, and never more than 90 days. While the investigation runs, the issuer cannot try to collect the disputed amount or report it as delinquent to credit bureaus. Provisional credit is not required for credit card disputes, though many issuers offer it anyway.⁷

What the Bank Must Do After You Report

For debit cards and other electronic transfers, you can notify the bank orally or in writing. A phone call is enough to start the investigation, though the bank may require written confirmation within 10 business days. If the bank asks for that written follow-up and you fail to send it, the bank is not required to provisionally credit your account during the investigation.⁸ Following a phone call with a written notice is the safer path.

Once notified, the bank has 10 business days to investigate and decide whether an error occurred. It can extend the investigation to 45 days, but only if it provisionally credits your account for the full disputed amount, including any interest, within those first 10 business days.¹ You have full use of that money while the investigation continues.⁸

The window stretches to 90 days instead of 45 in three situations: the transfer was initiated outside the United States, it was a point-of-sale transaction, or it happened within 30 days of the first deposit to a new account. Even in these cases, provisional credit must still land within 10 business days.¹

If the bank agrees the transaction was unauthorized, the provisional credit becomes permanent and the bank must finalize the correction within one business day.⁸ If it denies the claim, it will reverse any provisional credit and send a written explanation identifying the evidence it relied on and your right to request copies of the investigation documents.⁹

Your refund is not limited to the stolen amount. When the bank confirms an unauthorized electronic transfer, it also has to credit interest you lost and refund any fees the bank imposed as a consequence, such as overdraft fees triggered when the fraud drained your balance. For credit cards, the issuer must reverse any finance charges that accrued on the disputed amount.¹⁰ Fees the bank would have charged anyway are not refundable.

When a Bank Will Not Refund

Banks distinguish sharply between an unauthorized transaction, where someone accessed your account without permission, and a transaction you initiated after being deceived. If a scammer tricks you into sending money through a peer-to-peer payment app, the bank treats the transfer as authorized because you took the action yourself. The Zelle network has required participating banks to reimburse a narrow category of imposter scams since mid-2023, but that coverage is limited, and other payment apps often offer less.

Banks also routinely deny claims in these situations:

You shared your PIN, login credentials, or a one-time passcode. Once someone has your access information with your consent, the resulting transactions are treated as authorized.
A family member or household guest used your card without asking, and you had not previously told the bank to cut off that person’s access.
You authorized the purchase but are unhappy with the product. That is a merchant dispute, which follows a different process.

One narrow exception cuts the other way. If someone physically forces you to make a transfer, such as at an ATM under duress, Regulation E treats that as unauthorized even though you pressed the buttons.¹

Several account and product types fall outside the standard consumer protections entirely:

Business accounts. The Electronic Fund Transfer Act applies only to consumer accounts. Federal law does not cap liability for unauthorized transactions on business debit cards.¹¹ Business account holders rely on their deposit agreement, state law, and UCC Article 4A for any recovery rights.¹²

Wire transfers. Wire transfers through Fedwire and similar systems are carved out of Regulation E.¹ They are governed by UCC Article 4A, which puts more responsibility on the sender. Recovery is possible if the bank can intercept the funds before they are withdrawn at the receiving end, but it depends heavily on speed.

Unregistered prepaid cards. Prepaid debit cards are covered by Regulation E only after you register them and the issuer verifies your identity. Before registration, the liability limits and error resolution procedures do not apply.¹³

If the Bank Denies Your Claim

Start by requesting the bank’s investigation documents. The denial notice must inform you of your right to see the evidence the bank relied on, and the bank has to provide those materials promptly on request.⁹ If the reasoning rests on wrong facts or a thin investigation, that is your basis for escalating.

You can file a complaint with the Consumer Financial Protection Bureau online or at (855) 411-2372. The CFPB forwards the complaint to the bank, which generally must respond within 15 days, with up to 60 days for a final response in some cases.¹⁴ If your bank is a Federal Reserve member, Federal Reserve Consumer Help is another route, and typically notifies you of results within 60 days.¹⁵

If the bank missed an investigation deadline, failed to give required provisional credit, or otherwise violated the Electronic Fund Transfer Act, you can sue. A successful suit recovers your actual losses plus statutory damages between $100 and $1,000, along with attorney’s fees and court costs.¹⁶ Banks are also liable for damages caused by failing to properly execute or stop an electronic fund transfer when instructed.¹⁷ Small claims court handles individual disputes, with filing fees that vary by jurisdiction.

1
eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
2
GovInfo. 15 USC 1693g – Consumer Liability
3
Consumer Financial Protection Bureau. Liability of Consumer for Unauthorized Transfers
4
eCFR. 12 CFR Part 226 – Truth in Lending (Regulation Z)
5
Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors
6
Federal Trade Commission. Using Credit Cards and Disputing Charges
7
Consumer Financial Protection Bureau. Billing Error Resolution – 1026.13
8
Office of the Law Revision Counsel. 15 USC 1693f – Error Resolution
9
eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
10
eCFR. 12 CFR Part 205 – Electronic Fund Transfers (Regulation E)
11
FDIC.gov. Your Business, Your Deposits
12
LII / Legal Information Institute. UCC – Article 4A – Funds Transfer
13
Consumer Financial Protection Bureau. Requirements for Financial Institutions Offering Prepaid Accounts – 1005.18
14
Consumer Financial Protection Bureau. Learn How the Complaint Process Works
15
Federal Reserve Consumer Help. Federal Reserve Consumer Complaint Process
16
Office of the Law Revision Counsel. 15 USC 1693m – Civil Liability
17
Office of the Law Revision Counsel. 15 USC 1693h – Liability of Financial Institutions