Banks do reimburse stolen money in most cases, but whether you get it all back depends on the payment method, how quickly you reported the theft, and whether the transaction meets the legal definition of unauthorized. Federal law caps your liability at $50 for credit card fraud and for debit card or electronic transfer fraud reported within two business days. Wait longer and you can lose $500 or the entire balance. Checks follow a separate rule, and transactions you sent yourself, even under a scammer’s pressure, are often treated as authorized and denied.
Debit Cards, ATM Withdrawals, and Electronic Transfers
The Electronic Fund Transfer Act and its implementing Regulation E govern unauthorized debit card charges, ATM withdrawals, direct deposits, and electronic bill payments on personal accounts.1Legal Information Institute (LII). Electronic Funds Transfer Act Under this framework, your liability depends entirely on when you notify the bank.
- Report the card lost or stolen before any unauthorized charges post: you owe nothing.2Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
- Report within two business days of learning of the loss: your maximum liability is $50, or the amount taken before you called, whichever is less.3eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
- Report after two business days but within 60 days of the statement showing the activity: liability rises to as much as $500.3eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
- Report after that 60-day window closes: the bank has no obligation to reimburse any unauthorized transfers that happened after it closed, and you could lose the entire amount stolen with no cap.2Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
If extenuating circumstances like hospitalization or extended travel kept you from reporting on time, the bank must extend these deadlines to a reasonable period.
Credit Card Fraud
Credit cards fall under a different law, the Fair Credit Billing Act, and the protection is stronger. Your maximum liability for unauthorized use of a credit card is $50, no matter when you report it.4Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card There is no tiered clock, and the card issuer, not you, has to prove either that the charge was authorized or that the conditions for imposing that $50 have been met. Report the card before any unauthorized charges appear and you owe nothing.
Most consumers pay even less than $50 in practice. Visa and Mastercard both offer zero-liability policies covering unauthorized purchases on their credit and debit cards, whether made in stores, online, by phone, or through mobile devices.5Visa. Visa’s Zero Liability Policy6Mastercard. Mastercard Zero Liability Protection Policy These network policies generally exclude commercial cards and unregistered prepaid cards, and they expect you to have used reasonable care and reported the loss promptly.
Stolen or Forged Checks
Paper checks sit outside Regulation E, but the Uniform Commercial Code protects you in a similar way. A bank may only charge your account for items that are “properly payable,” meaning authorized and consistent with your account agreement.7Legal Information Institute (LII). UCC 4-401 – When Bank May Charge Customer’s Account A check with a forged signature is not authorized, so the bank generally bears the loss.
The catch is your duty to review statements and report forgeries within a reasonable time. State law sets the specific deadline, typically somewhere between 30 days and one year after the bank makes the statement available. Miss it and you can lose the right to demand reimbursement, so check your account agreement and flag unfamiliar checks as soon as you see them.
When Banks Refuse to Reimburse
Not every theft qualifies. Banks deny claims routinely when the transaction does not meet the legal definition of “unauthorized,” and the most common gap involves payments you technically initiated yourself.
Scams Where You Sent the Money
If a scammer talked you into sending money through Zelle, another peer-to-peer app, a wire transfer, or a bank transfer, the bank will usually classify the transaction as authorized. Regulation E defines an unauthorized transfer as one initiated by someone other than you, without your permission, from which you received no benefit.8eCFR. 12 CFR 1005.2 – Definitions Pressing “send” yourself, even after being deceived, makes that definition harder to satisfy.
There is an important distinction. If a fraudster steals your login credentials through a data breach, phishing, or a fake call from “your bank” that tricks you into sharing a confirmation code, and then uses those credentials to move money, the Consumer Financial Protection Bureau has stated the transfer is unauthorized under Regulation E. The same applies when a hacker takes over your phone and uses a mobile wallet to send funds.9Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs The question is who actually initiated the transfer.
Shared Credentials and Negligence
Banks also deny claims when they conclude the account holder failed to take basic precautions: a PIN written on the card, login credentials handed to someone else, a device left unlocked in public. If you voluntarily gave someone access, transfers by that person are not unauthorized unless you previously told the bank to revoke their access.8eCFR. 12 CFR 1005.2 – Definitions
Business Accounts Are Not Covered
The $50 and $500 caps described above apply only to accounts established primarily for personal, family, or household purposes.9Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs Business checking accounts are governed by UCC Article 4A, which puts more responsibility on the business itself.10Legal Information Institute (LII). UCC Article 4A – Funds Transfer (2012) If the bank offered a commercially reasonable security procedure and followed it when processing the payment order, the bank may not be liable even if the order turns out to be fraudulent. Review your business account agreement carefully and adopt the fraud monitoring and dual-authorization tools your bank offers.
How to Report Stolen Funds
Speed matters more than anything else. Before you call the bank, pull together:
- The full account number for the affected account.
- The exact dates, dollar amounts, and merchant names for each suspicious charge.
- When you first noticed the unauthorized activity and, if relevant, when you lost your card or credentials.
- A description of how you believe the theft happened: stolen card, data breach, phishing, or something else.
Most banks require a written affidavit confirming the transactions were unauthorized and that you did not share your credentials. These forms are usually available through the bank’s online portal or at a branch. Be accurate: a false declaration to a federally insured institution can violate federal or state law.
If the theft is part of broader identity theft, filing a report at IdentityTheft.gov creates a formal FTC Identity Theft Report and a personalized recovery plan.11Federal Trade Commission. IdentityTheft.gov Some banks also ask for a local police report as part of their investigation.
How Long the Bank Has to Investigate
Federal law sets firm response deadlines. The bank must investigate and resolve the claim within 10 business days of your report. If it cannot finish that fast, it must provisionally credit your account for the disputed amount, plus any applicable interest, within those 10 business days and then has up to 45 days total to complete the investigation.12Office of the Law Revision Counsel. 15 USC 1693f – Error Resolution
That 45-day window extends to 90 days in three situations: transfers originating outside the United States, point-of-sale debit card transactions, and transactions that occurred within 30 days of the first deposit to a new account.13Consumer Financial Protection Bureau. 12 CFR 1005.11 – Procedures for Resolving Errors You have full use of the provisional credit during the investigation. Once the bank decides, it must notify you in writing, and if it concludes the transfer was authorized, it must give you advance notice before reversing the credit.
One trap to avoid: if you first report the error by phone, the bank can require a written confirmation within 10 business days. Skip that written follow-up and the bank does not have to issue provisional credit while it investigates.12Office of the Law Revision Counsel. 15 USC 1693f – Error Resolution Always follow a phone call with something in writing.
What to Do If Your Claim Is Denied
If the bank denies your claim or misses the timelines above, escalate. The Consumer Financial Protection Bureau accepts complaints about banks online and forwards them to the institution for a response, which sometimes produces a different result than dealing with the internal dispute department alone.14Consumer Financial Protection Bureau. Submit a Complaint
You can also sue under the Electronic Fund Transfer Act. If a bank fails to provisionally credit your account within 10 business days without a good-faith investigation, or knowingly and willfully concludes your account was not in error when it was, a court may award treble damages, up to three times the proven loss.12Office of the Law Revision Counsel. 15 USC 1693f – Error Resolution Note that many account agreements contain mandatory arbitration clauses that prevent class actions and route individual disputes to arbitration or small claims court instead.