Banks do reimburse fraud in most cases, but whether you get every dollar back depends on how the money was taken and how fast you reported it. Credit cards give you the strongest protection, with federal law capping your liability at $50 and the major networks waiving even that. Debit card losses can range from $50 to unlimited depending on timing. Checks follow their own rules under state commercial law. Wire transfers and payment apps like Zelle offer almost nothing if you sent the money yourself, even when a scammer tricked you into doing it.
Credit Card Charges You Didn’t Make
Federal law caps your liability for unauthorized credit card use at the lesser of $50 or the total charged before you notified the issuer.1Consumer Financial Protection Bureau. Regulation Z 1026.12 – Special Credit Card Provisions There is no escalating penalty for reporting slowly. Whether a thief uses your card for two days or two months, your statutory exposure stays at $50.
The law goes further. An issuer can only impose that $50 if it gave you notice of your potential liability, provided a way to report a lost or stolen card, and included a method to verify you as the authorized user. Miss any of those conditions and your liability drops to zero. In a dispute, the burden of proof falls entirely on the issuer to show the charge was authorized or that all conditions for the $50 cap were met.2Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
In practice, even $50 rarely applies. Visa’s Zero Liability Policy eliminates consumer liability for unauthorized transactions on personal cards, whether the card was lost, stolen, or used fraudulently online.3Visa. Zero Liability Mastercard does the same for in-store, online, phone, mobile, and ATM transactions.4Mastercard. Zero Liability Protection Policy Both networks exclude commercial cards and unregistered prepaid cards like gift cards, and both require you to have taken reasonable care of the card and reported the problem promptly.
One separate deadline is worth knowing. To force the issuer to formally investigate a charge as a billing error, you have to send written notice within 60 days of the statement showing it.5Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors Missing that window doesn’t push your liability above $50, but it can limit your ability to compel a formal investigation.
Debit Card and ATM Fraud
Debit cards run on a different statute, and timing is what controls how much of your money the bank has to give back. The Electronic Fund Transfer Act sets three tiers based on how quickly you report the loss.6Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
- Report within 2 business days of learning about the loss or theft, and your liability is capped at the lesser of $50 or the amount taken before you notified the bank.
- Report after 2 business days but within 60 days of the statement showing the fraud, and your liability climbs to as much as $500 for transfers made during that delay.
- Report more than 60 days after the statement date, and you face unlimited liability for anything taken after the 60-day window closes.
That last tier is real. If a thief drains your account three months after the first fraudulent charge appeared on a statement you never opened, the bank has no obligation to reimburse anything beyond what the earlier tiers already cover.
The 60-day rule also applies when the card was never lost. If someone captures your account number and makes unauthorized purchases while your card sits in your wallet, you still have to catch those charges within 60 days of the statement that first shows them.7Consumer Financial Protection Bureau. Regulation E 1005.6 – Liability of Consumer for Unauthorized Transfers
One definition trips people up. A “business day” under this law is a day when your bank is open for substantially all of its functions, not just when the ATM or app is available. A Saturday when the branch takes deposits but can’t process fraud investigations doesn’t count.8Consumer Financial Protection Bureau. Regulation E 1005.2 – Definitions
Forged and Altered Checks
Check fraud is governed by the Uniform Commercial Code, adopted in some form by every state. The starting rule is that a bank paying a forged or altered check has made an unauthorized payment and should bear the loss. But the UCC also puts duties on you.
You have to review your statements with reasonable promptness. If you miss a forged check and the same person forges more on your account, the bank can cut off liability for the later forgeries as long as it paid them in good faith and you had at least 30 days to review the statement showing the first one. Catching the initial fraudulent check quickly is what keeps the losses from multiplying.9Legal Information Institute. UCC 4-406 – Customer Duty to Discover and Report Unauthorized Signature or Alteration
There is also a hard outer limit. Fail to discover and report an unauthorized signature or alteration within one year of when the statement was made available, and you lose the right to assert the claim against the bank at all. The exception: if the bank itself failed to use ordinary care in paying the check, the loss gets split between you and the bank based on how much each side’s negligence contributed. A bank that cashes a crudely forged check can’t shift the whole loss to you just because you were slow.
Wire Transfers, Zelle, Venmo, and Cash App
This is where reimbursement gets thin. The line that matters is whether the transaction was unauthorized or authorized.
Unauthorized means someone accessed your account and moved money without your knowledge. Those transfers fall under Regulation E and use the same debit-card liability tiers described above.7Consumer Financial Protection Bureau. Regulation E 1005.6 – Liability of Consumer for Unauthorized Transfers
Authorized push payment scams are different. A fraudster tricks you into sending the money yourself, often by impersonating your bank and telling you to move funds to a “safe” account. Because you initiated the transfer, the bank generally has no obligation to reimburse you. This is the gap where consumers lose the most money and have the fewest protections.
Zelle has begun reimbursing certain imposter scams where the fraudster posed as a bank, business, or government entity, but Zelle’s own materials say only that “qualifying imposter scams may be eligible” without specifying which ones. Wire transfers are the least forgiving of all: once executed, they are functionally irreversible.
If a scammer talked you into sending money, call your bank and the payment service within minutes to try a recall, file a police report, and submit a complaint to the FBI’s Internet Crime Complaint Center.10Internet Crime Complaint Center (IC3). Home Page Recovery is difficult, but acting fast is the only chance to freeze the funds before they move again.
When the Person Who Took the Money Is Someone You Know
Fraud by a family member, roommate, or ex-partner creates a specific problem. If you gave the person your debit card, PIN, or account login, transfers they make using that access are generally not considered unauthorized, even if they spent far more than you agreed to.11Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
The exception matters. Once you notify your bank that a specific person is no longer authorized, any transfers they make after that become unauthorized under the law and the normal protections apply. If a relationship has soured and someone else has your card or login, call the bank immediately, revoke access, and get a new card and PIN. Without that notification, the bank can treat the transfers as authorized and deny the claim.
This rule doesn’t apply if the person got your card or PIN through theft or trickery. A card stolen from your bag is unauthorized use regardless of whether you know the thief.
How to Report It and What the Bank Owes You
Call the bank’s fraud line the moment you notice the problem. Most banks also let you flag transactions in the app or online. Use whichever is fastest, because your reporting date is what controls your liability.
Have the dates and amounts of the suspicious transactions ready, along with merchant or payee names and when you first noticed. Follow up in writing, complete any claim form the bank sends, and keep copies of everything, including notes from the phone call with the date, time, and representative’s name. That paper trail is your proof of when you reported. For identity theft or large losses, file a police report as well; some banks require one to finish the investigation.
For unauthorized debit card or ATM transactions, the bank has 10 business days from your notice to investigate and tell you the result. If it confirms fraud, the correction has to happen within one business day of that finding.12eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
If the bank can’t finish in 10 business days, it has to provisionally credit your account for the disputed amount by the end of that 10th day, so you have your money back while the investigation continues. The bank can hold back up to $50 if it has a reasonable basis to think you bear some liability under the timing tiers.
With provisional credit issued, the bank gets up to 45 days from your notice to complete the investigation. That extends to 90 days for new accounts (opened less than 30 days before the transfer), in-store point-of-sale debit transactions, and transfers not initiated in the United States. New accounts also get 20 business days instead of 10 for the initial period. Once the investigation ends, the bank has three business days to notify you of the result. If it decides against you, it has to explain in writing and make available the documents it relied on.13GovInfo. 15 USC 1693f – Error Resolution
If the Bank Says No
A denial isn’t the end. Request the written explanation and the supporting documents. Reviewing them often shows where the investigation went wrong or what evidence would change the outcome. Respond in writing with anything that contradicts the bank’s findings.
If that fails, file a complaint with the Consumer Financial Protection Bureau. Submit online in about 10 minutes or call (855) 411-2372. The CFPB forwards your complaint to the bank, which generally has to respond within 15 days, though complex matters can take up to 60. You can review the response and add feedback, and the complaint becomes part of a public database that banks pay attention to.14Consumer Financial Protection Bureau. Submit a Complaint
You can also sue. If a bank fails to comply with any part of the Electronic Fund Transfer Act, including the investigation timelines, the provisional credit rule, or the written explanation requirement, you can recover actual damages plus statutory damages of $100 to $1,000 and attorney’s fees. Class actions cap out at the lesser of $500,000 or 1% of the bank’s net worth. You have one year from the violation to file.15Office of the Law Revision Counsel. 15 USC 1693m – Civil Liability
Can You Deduct an Unreimbursed Loss on Your Taxes?
For most people, no. Since 2018, personal theft losses are deductible only if they result from a federally declared disaster, which fraud does not qualify as. The rule applies through at least 2025 under the Tax Cuts and Jobs Act and, absent new legislation, through 2026.16Internal Revenue Service. Publication 547 – Casualties, Disasters, and Thefts A narrow exception exists when the fraud involved a transaction entered into for profit, such as an investment scam, which may still be deductible as a loss on a business or investment activity. For a stolen debit card or unauthorized credit card charges, the tax code offers nothing.