If someone stole money from your bank account, federal law generally requires your bank to give it back, as long as the theft involved an unauthorized electronic transfer and you report it quickly. Under the Electronic Fund Transfer Act and Regulation E, your out-of-pocket loss can be as low as $0 to $50 when you notify the bank within two business days of noticing the problem. Wait longer and the cap climbs, eventually disappearing entirely. The rules are different, and weaker, if a scammer talked you into sending the money yourself, if the account is a business account, or if the theft involved forged checks rather than electronic transfers.
Call Your Bank Today, Not Tomorrow
Speed is the single biggest factor in how much you recover. Call the fraud number on the back of your debit card as soon as you spot a charge you didn’t make. Have your account number and the dates and amounts of the suspicious transactions ready. Ask the representative to freeze the account so nothing else can go through while the dispute is open.
After the call, change your online banking password and your debit card PIN. If you reused that password anywhere else, change it there too. Thieves who have one set of your credentials routinely try them against other accounts.
Your bank can require you to confirm the fraud report in writing within 10 business days of the phone call. If it asks and you don’t send anything, the bank may refuse to issue a provisional credit while it investigates. Ask during the initial call whether written follow-up is required and where to send it.1Consumer Financial Protection Bureau. 12 CFR 1005.11 – Procedures for Resolving Errors
Filing a police report creates an official record that strengthens your case with the bank and helps you block fraudulent accounts from appearing on your credit report. Some banks and creditors specifically ask for a copy before they’ll resolve a dispute.2Office for Victims of Crime. Steps for Victims of Identity Theft or Fraud Also file an identity theft report at IdentityTheft.gov. The FTC portal generates a personalized recovery plan and produces an official Identity Theft Report that carries the same weight as a police report for many purposes.3Federal Trade Commission. Report Identity Theft
How Much You Can Recover Depends on When You Report
Regulation E creates three tiers of liability for unauthorized electronic transfers, and the gap between them is dramatic.4eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
- Notify the bank within two business days of learning about the loss or theft, and your maximum liability is $50. The clock starts when you become aware of the problem, not when the first fraudulent charge posts.
- Report after two business days but within 60 calendar days of the bank sending your statement, and liability can climb to $500.
- Miss the 60-day window, and you can lose every dollar the thief takes after day 60. There is no cap.
In any dispute, the bank has the burden of proving a transaction was authorized. If it claims you made or approved a transfer, it has to demonstrate that, not the other way around.5Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
Most people get better protection than the federal floor. Visa and Mastercard both offer zero-liability policies on their branded debit cards, meaning you won’t owe anything for unauthorized transactions if you used reasonable care and reported promptly. Visa’s policy also requires issuers to return stolen funds within five business days of notification.6Visa. Visa Zero Liability Policy7Mastercard. Mastercard Zero Liability Protection for Unauthorized Transactions These network policies layer on top of Regulation E; they don’t replace it, and they don’t cover certain commercial cards or anonymous prepaid products like gift cards.
When the Protections Don’t Apply
Regulation E is powerful but has limits that catch people off guard.
Scams Where You Sent the Money Yourself
An “unauthorized electronic fund transfer” under Regulation E means a transfer initiated by someone other than you, without your permission, and from which you received no benefit.8eCFR. 12 CFR 1005.2 – Definitions If a scammer tricked you into sending money through Zelle, Venmo, CashApp, or a wire transfer, you technically authorized the transfer even though the person on the other end lied to you. Regulation E’s liability rules generally don’t cover that.
This is where most of the heartbreak happens. Someone posing as your bank’s fraud department calls and convinces you to “move your money to a safe account.” You initiate the transfer. The bank can then argue the transfer was authorized. Some banks voluntarily reimburse certain scam victims, but nothing guarantees it. If anyone contacts you claiming to be from your bank and asks you to move money, hang up and call the number on the back of your card.
Business Accounts
Regulation E only protects accounts established primarily for personal, family, or household purposes. Business checking accounts fall outside it.4eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers Business account holders have to rely on whatever protections their bank offers by contract, or on state commercial law. Small business owners who assume they have the same rights as consumers often find out the hard way that they don’t.
Forged Checks
Stolen checks fall under a different framework: the Uniform Commercial Code, adopted in some form by every state. The general rule is that a forged check isn’t “properly payable,” meaning the bank shouldn’t have paid it and is responsible for the loss.9Legal Information Institute. UCC 4-406 – Customer’s Duty to Discover and Report Unauthorized Signature or Alteration You still have obligations, though. You must review your statements with reasonable promptness. If the same forger writes additional checks and the bank pays them in good faith before you speak up, you can lose the right to challenge those later payments, especially if you waited more than 30 days after receiving the statement. And there’s a hard outer deadline: if you don’t discover and report a forged signature or alteration within one year, you’re barred from making a claim at all, regardless of fault.
What the Bank Must Do After You Report
Once you report an unauthorized transaction, federal law gives the bank 10 business days to complete its investigation. For brand-new accounts open less than 30 days, the bank gets 20 business days.1Consumer Financial Protection Bureau. 12 CFR 1005.11 – Procedures for Resolving Errors
If the bank can’t finish within 10 business days, it must provisionally credit your account for the disputed amount, including any interest, while it continues investigating. The bank can hold back up to $50 from that provisional credit to cover your potential liability. It must tell you within two business days of issuing the credit exactly how much was credited and when. The extended investigation can run up to 45 days total from when the bank got your notice, and up to 90 days for certain transaction types including point-of-sale debit purchases, international transfers, and transfers involving new accounts.10eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
The bank must report its findings to you in writing within three business days of finishing. If it confirms unauthorized activity, the provisional credit becomes permanent and the bank must correct the error within one business day. If it decides no error occurred, it will reverse the provisional credit, send you a written explanation, and let you know you can request the documents it relied on.
If the Bank Denies Your Claim
A denial isn’t the end. Banks sometimes get these investigations wrong, and you have real leverage.
Start by filing a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov. Include your contact information, details about the bank, and a clear description of what happened. The CFPB forwards your complaint to the bank, which must provide an initial response within 15 calendar days and a final response within 60 days.11Consumer Financial Protection Bureau. Your Company’s Role in the Complaint Process Formal regulatory oversight tends to prompt banks to take a second look. The CFPB’s own guidance recommends trying to resolve things directly with the bank first before filing.12USAGov. Bank, Credit, and Securities Complaints
If that fails, you can sue. The Electronic Fund Transfer Act gives consumers a private right of action against banks that violate its provisions. If you win, you can recover your actual losses plus statutory damages between $100 and $1,000, along with attorney’s fees and court costs.13Office of the Law Revision Counsel. 15 USC 1693m – Civil Liability Those statutory damages give you leverage even when the stolen amount is small. For smaller sums, small claims court is often the most practical route. Filing fees are low, you don’t need a lawyer, and most states set their small claims limits between $5,000 and $10,000.