If someone drained your bank account, call your bank’s fraud line right now and ask them to freeze the account, because federal law caps your personal loss at $50 only if you report within two business days of learning about the theft. Wait longer and your liability climbs to $500. Wait past 60 days from the statement showing the fraud, and you can be on the hook for every dollar taken after that window closes.1Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability The next few hours matter more than anything you do later.
What To Do in the First Few Hours
Call the fraud department using the number on the back of your debit card or on the bank’s website. Tell them you’re reporting unauthorized transactions and ask them to freeze the account immediately. Every hour the account stays open is another hour the thief can pull more money out. Once it’s frozen, automatic payments and direct deposits tied to that account also stop, so jot down any recurring bills you’ll need to redirect.
File a report with your local police department. A police report creates an official record of the theft, and your bank will likely ask for a copy when processing your fraud claim. Bring statements showing the unauthorized transactions and whatever you know about how the fraud happened.
Report the theft at IdentityTheft.gov, the federal government’s identity theft recovery tool.2Federal Trade Commission. Report Identity Theft The site generates a personalized recovery plan and pre-filled letters you can send to your bank and creditors. The FTC identity theft report itself works as documentation if you later have to dispute fraudulent accounts opened in your name.
Place a fraud alert or credit freeze on your credit files. You only need to contact one of the three major bureaus (Equifax, Experian, or TransUnion), and that bureau is required to notify the other two. A fraud alert tells lenders to verify your identity before opening new credit. A credit freeze is stronger: it blocks access to your credit report entirely, which prevents anyone from opening new accounts, including you, until you lift it.3Federal Trade Commission. Credit Freezes and Fraud Alerts If someone has already gotten into your bank account, a freeze is the safer choice because it doesn’t rely on a lender bothering to do extra verification.
How Much of the Money You’re Liable For
The Electronic Fund Transfer Act and its implementing rule, Regulation E, cap how much you can lose when someone makes unauthorized electronic transfers from your account. The cap depends entirely on how fast you notify your bank.
- Reported within 2 business days: your maximum loss is $50, or the amount stolen before you notified the bank, whichever is less.1Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
- Reported after 2 business days but within 60 days of your statement: your maximum loss rises to $500, and even then the bank has to prove the additional losses wouldn’t have happened if you’d reported sooner.4eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
- Not reported within 60 days of your statement: unlimited liability for any unauthorized transfers that occur after that 60-day window closes.1Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
Watch how the clocks start. The two-day clock starts when you learn of the loss or theft, not when the unauthorized transaction happens. The 60-day clock starts when the bank sends the statement showing the fraudulent activity, not when you open the envelope. Extenuating circumstances like hospitalization or extended travel can push these deadlines to a “reasonable” period, but that’s a judgment call the bank makes, so don’t count on it.
One point that catches people off guard: your own carelessness doesn’t raise your liability above these caps. Writing your PIN on your debit card or leaving it on a sticky note in your wallet is negligent, but Regulation E explicitly says negligence can’t be used to impose greater liability than the statute allows.5Consumer Financial Protection Bureau. Liability of Consumer for Unauthorized Transfers
Situations Where These Protections Don’t Apply
Not every case of missing money qualifies as an “unauthorized electronic fund transfer” under federal law. The statute defines that term narrowly, and the gaps can be painful.
Someone You Gave Access To
If you gave your debit card, PIN, or online banking credentials to another person and that person later drains your account, the transfer is not considered unauthorized unless you had already told your bank the person no longer has permission to use your account.6Office of the Law Revision Counsel. 15 USC 1693a – Definitions This comes up constantly with ex-partners, adult children, and former roommates. If you shared access with someone and the relationship has soured, notify your bank in writing right away. Until you do, the EFTA caps won’t protect you.
Business Accounts
Regulation E covers only accounts “established primarily for personal, family, or household purposes.”7eCFR. 12 CFR 1005.2 – Definitions Drained business checking accounts fall under a different framework (UCC Article 4A for wire transfers), where a bank can shift liability to you if it followed a commercially reasonable security procedure. The practical result: businesses often eat the full loss for transactions a consumer would have been reimbursed for.
Forged Paper Checks
When a thief drains your account with forged checks rather than electronic transfers, the Uniform Commercial Code applies instead of Regulation E. Under the UCC you generally have up to a year from the statement date to report a forged check, but many banks shorten this window through their account agreements, sometimes to as little as 30 or 60 days. Read your account terms. Miss the deadline and you lose the right to recover, no matter how obvious the forgery.
What the Bank Must Do Once You Report
Once you report unauthorized transactions, Regulation E gives the bank 10 business days to complete its investigation and decide whether an error occurred. The bank has to report its results to you within three business days after finishing.8eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
If the bank needs more time, it can extend the investigation to 45 calendar days, but only if it provisionally credits your account within the initial 10 business days. The provisional credit has to cover the alleged error amount, though the bank can withhold up to $50 if it has reason to believe an unauthorized transfer occurred and has met its disclosure obligations. The bank has to tell you the amount and date of the credit within two business days of posting it, and you get full use of those funds while the investigation continues.8eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
Here’s the catch that trips people up. If you reported the error by phone, many banks require written confirmation within 10 business days. If the bank asked for that and you didn’t send it, the bank isn’t required to issue a provisional credit at all.8eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors Always follow up a phone report in writing, even if the representative doesn’t explicitly ask.
If the bank confirms the fraud, the provisional credit becomes permanent. If the bank concludes no error occurred, it can reverse the credit after giving you a written explanation and copies of the documents it relied on.
The standard 10-day and 45-day windows stretch in a few situations. If the disputed transfer involved a new account (within 30 days of the first deposit), the bank gets 20 business days for the initial investigation and up to 90 calendar days for the extended one. The same 90-day extension applies to point-of-sale debit card transactions and transfers that cross international borders.8eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
If the Bank Won’t Reimburse You
Prompt reporting usually means the bank makes you whole. Sometimes it doesn’t. The claim gets denied, the loss exceeds your protected amount, or you reported too late. Two options remain.
You can sue the person who took your money in civil court, separate from any criminal case against them. A civil suit aims to recover the stolen funds directly, plus potentially court costs and attorney fees. For smaller amounts, small claims court keeps filing fees and procedures manageable. For larger losses, you’d file in a higher court, where costs rise sharply. The limitation is obvious: winning a judgment is only useful if the perpetrator has assets you can actually collect against.
Taxes won’t help either. Personal theft losses have not been deductible on federal income taxes since 2018, when the Tax Cuts and Jobs Act suspended that deduction for losses not connected to a federally declared disaster. Later legislation made the restriction permanent, so a drained bank account does not generate a tax deduction regardless of the amount lost.
Why This Is Worse With a Debit Card Than a Credit Card
Debit card and credit card fraud are governed by completely different federal laws, and the gap in protection is significant. Under the Truth in Lending Act, your liability for unauthorized credit card charges is capped at $50, period.9Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card No sliding scale based on how fast you report. Most major card issuers waive even that $50 as a matter of policy.
With a debit card, your liability can climb to $500 or unlimited if you delay reporting.4eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers Worse, the money is gone from your account immediately, which means bills bounce and cash for essentials disappears while the bank investigates. With a credit card, the disputed charges sit on your statement while the issuer sorts things out, and your checking balance is untouched. Once you’ve resolved this fraud, that’s a reason to think about which card you reach for on everyday purchases.