Your personal savings account is safer from hackers than most people assume, because federal law puts the loss on the bank rather than on you in the most common attack scenarios. If someone drains your account remotely through a phishing scheme, malware, or a data breach, and you report it within 60 days of the statement showing the fraud, your out-of-pocket liability is $0. Banks add encryption, multi-factor authentication, and behavioral monitoring on top of that legal floor. The catch is timing: how quickly you notice and report unauthorized activity determines how much of that protection you actually keep.
What Federal Law Says You Can Lose
The Electronic Fund Transfer Act, implemented through the Consumer Financial Protection Bureau’s Regulation E, sets your maximum liability for unauthorized electronic transfers from a personal account. Two things decide the number: whether a physical access device (a debit card or PIN) was lost or stolen, and how fast you tell the bank.1eCFR. 12 CFR 1005.6 Liability of Consumer for Unauthorized Transfers
Remote Hacks Without a Lost Card
Most hacking fits here. A criminal gets in through a stolen password, a phishing link, or a breach at a third party. No card left your possession. In that case, you owe nothing for the unauthorized transfers, provided you notify the bank within 60 days of the date it sent the statement showing the fraud.1eCFR. 12 CFR 1005.6 Liability of Consumer for Unauthorized Transfers
Miss that window and the rule shifts. You can be held liable for unauthorized transfers that happen after the 60 days and before you finally report, but only if the bank can show it could have stopped those later transfers had you reported sooner. Anything the hacker took during the first 60 days still comes back to you.
Lost or Stolen Debit Card or PIN
When a physical access device is involved, a tiered system applies:
- Report within 2 business days of learning the device is missing, and your liability is capped at $50 (or the amount taken before you called, whichever is less).
- Report after 2 business days but within 60 days of the statement, and liability can climb to $500, though the bank must prove the additional transfers would not have happened had you reported sooner.
- Report after 60 days, and you can lose everything taken after the window closes, including funds pulled through overdraft lines tied to the account.
These caps only apply when the bank has already given you the required disclosures about your liability.1eCFR. 12 CFR 1005.6 Liability of Consumer for Unauthorized Transfers
Zero-Liability Policies
Many banks and credit unions voluntarily waive even the $50 minimum through zero-liability policies. These are private commitments, not federal requirements, and they usually apply only to personal accounts where the customer did not act negligently. Check your account agreement or ask directly.
Two Boundaries Worth Knowing
Business Savings Accounts Are Not Covered
Regulation E only protects accounts established primarily for personal, family, or household purposes. A business savings account falls outside these consumer rules entirely. Business account fraud runs under Article 4A of the Uniform Commercial Code, which lets a bank enforce an unauthorized payment order against the business as long as it accepted the order in good faith and followed a commercially reasonable security procedure the business agreed to.2Legal Information Institute (Cornell Law School). UCC Article 4A Funds Transfer The bank does not have to prove the transaction was authorized, only that its process was reasonable. If real money sits in a business account, ask the bank exactly what fraud protection applies.
FDIC and NCUA Insurance Do Not Cover Fraud
Deposit insurance is often confused with fraud protection. It is not the same thing. The FDIC reimburses up to $250,000 per depositor, per insured bank, per ownership category if your bank fails.3Office of the Law Revision Counsel. 12 USC 1821 Insurance Funds The National Credit Union Share Insurance Fund does the same for credit unions.4NCUA. Share Insurance Coverage Neither pays out when a hacker takes money from an otherwise healthy institution. That situation runs through the bank’s dispute process and Regulation E, not through insurance.
How Banks Try to Stop Hackers Before They Get In
The legal protections above are your backstop. Layered security is what prevents you from ever needing them.
Encryption
Banks encrypt stored data using the Advanced Encryption Standard with 256-bit keys, the same standard approved for sensitive federal government data.5National Institute of Standards and Technology (NIST). Federal Information Processing Standards Publication 197 – Advanced Encryption Standard Traffic between your device and the bank’s servers travels over Transport Layer Security, so intercepted data is unreadable without the key.
Multi-Factor Authentication
MFA requires something beyond your password: a one-time code by text, an authenticator app, a fingerprint, or a hardware security key. If a hacker has your password from a breach somewhere else, MFA is the second door they still have to open.
Not all MFA is equal. Text-message codes can be captured through SIM-swapping, where a criminal convinces your carrier to move your number to their phone. Hardware security keys and passkeys built on the FIDO2 standard resist this because authentication uses a cryptographic key pair rather than a code that can be intercepted or coaxed out of you.6FIDO Alliance. Passkeys Passwordless Authentication If your bank supports either, turn it on.
Behavioral Monitoring
Banks run automated systems that watch login and transaction patterns. A login from an unfamiliar location, a new device, an odd time, or a transaction outside your usual behavior can trigger an automatic block and a review. The system catches things you would not spot until the next statement.
What to Do the Moment You See Something Wrong
Speed decides how much of the legal protection you actually get to use. Call your bank as soon as you notice an unauthorized transaction. A verbal report starts the clock under Regulation E. The bank cannot require written confirmation before opening its investigation, though it may ask for a written follow-up within 10 business days.7eCFR. 12 CFR 1005.11 Procedures for Resolving Errors
Have these ready when you call:
- Your name and account number.
- The specific transactions in dispute, with dates and dollar amounts.
- Why you believe the transfers were unauthorized.
- Any supporting evidence: screenshots of phishing messages, login alerts, or proof you were elsewhere when the transfers happened.
The bank may ask for a signed fraud affidavit. Some request a police report, but federal law does not require one to open the investigation. Regulation E says a valid notice of error needs only your name, account number, and a description of why you believe an error exists. If the bank refuses to investigate without a police report, remind them of that.
The Investigation Timeline
Once the bank has your notice of error, the deadlines are strict.
The First 10 Business Days
The bank has 10 business days to investigate and reach a determination. If it confirms the fraud in that window, it must correct the error within one business day and report the results to you within three.7eCFR. 12 CFR 1005.11 Procedures for Resolving Errors
Extension to 45 Days With Provisional Credit
The bank can extend the investigation to 45 days, but only if it provisionally credits your account for the disputed amount, including any lost interest, within 10 business days of your report. You get full use of those funds while the investigation continues. If the bank has a reasonable basis to suspect fraud on your part, it may withhold up to $50 from the provisional credit.
Extension to 90 Days
Three situations stretch the outer deadline to 90 days:
- Transfers not initiated within the United States.
- Point-of-sale debit card transactions at a merchant.
- Transfers within 30 days of the first deposit to a new account. For new accounts, the bank also gets 20 business days instead of 10 to issue the provisional credit.
Final Resolution
If fraud is confirmed, the provisional credit becomes permanent and any lost interest and fees caused by the fraud are refunded. If the bank finds no error, it can withdraw the provisional credit, but only after sending you a written explanation and notice that the credit will be removed.8eCFR. 12 CFR 1005.11 Procedures for Resolving Errors
If the Bank Denies Your Claim
A denial is not the end. The written explanation must tell you that you can request the documents the bank relied on. Ask for them. Reviewing that evidence often reveals gaps in the investigation that give you something to push back on.
If the bank still refuses after you have responded, file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov. The CFPB forwards complaints to the bank and typically requires a response within 15 days. That does not guarantee a reversal, but it adds regulatory pressure and creates a record. You can also complain to your state attorney general or, for smaller amounts, take the matter to small claims court, where filing fees generally range from $15 to $300 depending on the jurisdiction and the amount at stake.
How to Cut Your Risk in the First Place
The law limits what you lose after fraud. Preventing the intrusion avoids the cash-flow gap while the bank investigates. A few steps do most of the work:
- Turn on the strongest MFA your bank offers. A hardware security key, passkey, or authenticator app beats text-message codes.
- Use a unique password for your bank. Reused passwords from other breaches are the most common way accounts get taken over.
- Review your statements at least monthly. The 60-day clock starts when the bank sends the statement, not when you open it.
- Set up transaction alerts. Instant notifications cut your response time from weeks to minutes.
- Ignore unsolicited requests for your password, PIN, or verification code. Your bank will never ask.
- Lock your SIM. Ask your carrier to add a PIN or port freeze to your phone account so a SIM-swapping attack cannot capture your text-message codes.