If money is missing from your checking or savings account and you didn’t authorize the transaction, call your bank right now, then follow up in writing. An unauthorized withdrawal from a bank account is governed by the Electronic Fund Transfer Act and Regulation E, and how quickly you report it determines whether you owe $0, $50, $500, or the entire loss. The most important deadline is two business days after you discover the problem.
Call the Bank Today
Use the number on the back of your debit card or on your bank’s official website. When you get someone on the line, give them the date, amount, and a short description of the charge you’re disputing. Ask for a claim or reference number. Write down the name of the representative, the exact time, and the date of your call. That timestamp is what your maximum liability turns on under federal law, so pin it down.
While you’re still on the phone, ask the bank to freeze or replace the card and change your PIN. Change your online banking password too, and if you reused that password anywhere else — email, bill-pay services, other financial accounts — change those as well. Anyone who has your debit card number often has enough to try the doors on connected accounts.
Check for recurring payments tied to the compromised card or account number. Subscriptions, utility autopays, and loan payments will bounce once the bank issues a replacement card, so updating them quickly heads off late fees and service cutoffs.
Put It in Writing Within 10 Business Days
Your phone call starts the clock, but the bank can require written confirmation within 10 business days of your oral report. If it asks for one and you don’t send it, the bank has no obligation to provisionally credit your account while it investigates.1Office of the Law Revision Counsel. 15 USC 1693f – Preauthorized Transfers People lose that provisional credit all the time by assuming the phone call was enough.
Your written notice should include your name, account number, the specific transaction, the amount, and why you believe it wasn’t authorized. Send it to the address the bank gives you. Keep a copy. Certified mail gives you a delivery receipt; a secure message through your bank’s portal creates a timestamped record automatically.
What You Could Owe Depending on When You Report
Regulation E creates a tiered liability structure for unauthorized electronic transfers from consumer accounts:
- Report a lost or stolen debit card before anyone uses it: you owe nothing.
- Report within two business days of learning about the loss or theft: your liability caps at $50 or the total unauthorized amount, whichever is less.2Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
- Report after two business days but within 60 days of the statement showing the transfer: liability jumps to $500 or the unauthorized amount, whichever is less.2Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
- Report more than 60 days after the statement was sent: unlimited liability for any unauthorized transfers that happen after the 60-day window closes.3Consumer Financial Protection Bureau. Regulation E 1005.6 – Liability of Consumer for Unauthorized Transfers
The two-business-day window does not include the day you discovered the problem, and weekends and bank holidays don’t count. Notice a fraudulent charge Friday evening, and your two business days start Monday and end at close of business Tuesday.3Consumer Financial Protection Bureau. Regulation E 1005.6 – Liability of Consumer for Unauthorized Transfers Extended travel or hospitalization can stretch the two-day deadline to a period “reasonable under the circumstances.”2Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
What Counts as Unauthorized
Regulation E defines an unauthorized transfer as one initiated by someone other than you, without your permission, from which you received no benefit. There’s a significant exception: if you gave someone your card or account access, transfers they make aren’t unauthorized unless you previously told the bank to cut off that person’s access.4eCFR. 12 CFR 1005.2 – Definitions If your roommate has your debit card and drains the account, or an ex-spouse who knew your PIN uses it, the bank can deny the claim on that ground.
Fraudulent ACH Debits
When a company or scammer pulls money directly through ACH and no card was lost or stolen, the $50 and $500 tiers don’t apply. Your protection comes from the 60-day statement rule: report within 60 days of receiving the statement showing the unauthorized debit and your liability is $0. Miss that window, and you face unlimited liability for any subsequent unauthorized debits that occur after the deadline passes.3Consumer Financial Protection Bureau. Regulation E 1005.6 – Liability of Consumer for Unauthorized Transfers
What Happens After You File the Claim
Once you report the error, the bank has 10 business days to investigate and reach a decision.5eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors If it needs more time, it can take up to 45 calendar days, but only if it provisionally credits your account within those first 10 business days. The bank can hold back up to $50 of that credit if it reasonably believes an unauthorized transfer occurred and you bear some liability under the tiers above.6Consumer Financial Protection Bureau. Regulation E 1005.11 – Procedures for Resolving Errors
When the investigation finishes, the bank has to notify you of the result within three business days. If it finds the error occurred, it must correct it within one business day of that determination and send you written confirmation.
If the Bank Denies Your Claim
A denial has to come with a written explanation and the evidence the bank relied on. You have the right to request copies of that evidence — receipts, transaction logs, whatever the bank used to conclude the transfer was authorized.1Office of the Law Revision Counsel. 15 USC 1693f – Preauthorized Transfers If provisional credit was issued, it will be reversed, but the bank must tell you the date of the reversal.
Read the evidence carefully. Banks sometimes deny claims on the theory that a chip or PIN was used, treating that as proof of authorization. That reasoning doesn’t hold when the card was stolen with the PIN, or when a skimming device captured both.
If the Bank Says No
File a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov/complaint. The CFPB forwards your complaint to the bank, which generally has 15 days to respond, with up to 60 days for complex cases.7Consumer Financial Protection Bureau. Learn How the Complaint Process Works You’ll receive the bank’s response and have 60 days to indicate whether the issue was resolved.
You can also sue under the EFTA. The statute of limitations is one year from the date of the violation, not from when you discovered it, so don’t sit on a significant loss waiting to see how the complaint plays out. Small claims court is available for amounts within your jurisdiction’s limit and doesn’t require an attorney.
Business Accounts and Credit Cards Follow Different Rules
Regulation E only covers accounts established primarily for personal, family, or household purposes.8Consumer Financial Protection Bureau. Regulation E 1005.2 – Definitions Business accounts don’t get the tiered liability caps, mandatory investigation timelines, or provisional credit requirements. They’re generally governed by the Uniform Commercial Code, and a bank that followed commercially reasonable security procedures can push the entire loss onto the business. Sole proprietors using a personal checking account for business may still be covered, because the account type controls, but a formally opened business account probably isn’t.
Credit card fraud runs on a different track. Under the Fair Credit Billing Act, your liability for unauthorized credit card charges caps at $50, and drops to $0 once you notify the issuer.9Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card The practical difference matters: with a credit card, the disputed money never left your bank account in the first place.
When It’s Bigger Than One Charge
If the withdrawal is part of broader identity theft — new accounts in your name, address changes you didn’t request, multiple institutions hit — go beyond a single bank dispute. File a report at IdentityTheft.gov, which generates a recovery plan and an identity theft affidavit you can give your bank and creditors. File a police report; some banks require one for high-value claims, and it creates an official record that supports your dispute.
Freeze your credit reports with Equifax, Experian, and TransUnion. Freezes are free to place and lift, and they stop new accounts from being opened in your name. Watch your other accounts closely for months — anyone who had enough information to drain one often has enough to try others.
Preventing the Next One
Turn on real-time transaction alerts in your bank’s app. Set the threshold low; even a $1 alert catches the small test charges fraudsters run before larger withdrawals. The sooner you see something, the better your position under the reporting deadlines.
Use a unique password for your bank account and turn on multi-factor authentication. A password alone is a single point of failure. Be skeptical of any email, text, or phone call asking you to verify your account information or PIN. No legitimate bank initiates contact to ask for those details.