Who Is Liable for Bank Account Fraud: Cards, Checks, and Wires

Liability for bank account fraud depends on what was hit and how fast you spoke up. Credit card charges are capped at $50 by federal law, and most issuers waive even that. Debit card and other electronic transfers use a sliding scale: report within two business days and you owe no more than $50; wait longer than 60 days after your statement and you can be on the hook for everything the thief took after that window closed. Forged checks have their own regime under state commercial law, with an absolute one-year deadline. Wire transfers and payments you were tricked into sending yourself sit outside consumer protections almost entirely.

Credit Card Charges: $50 Maximum, Usually Zero

Credit cards carry the strongest protection. Under the Truth in Lending Act, your maximum liability for unauthorized charges is $50, with no penalty for reporting late.¹

Even that $50 comes with strings attached to the issuer. To charge you anything, the issuer must have told you about your potential liability, given you a way to report a lost or stolen card, and provided a means to identify authorized users. Miss any of those and you owe zero. Once you notify the issuer that the card was lost, stolen, or compromised, any charges after that notice are the issuer’s problem, not yours.¹

Most major issuers go further and offer zero-liability policies as a marketing commitment. Those aren’t required by law, but they’re common enough that most cardholders never pay anything for fraud on a credit card.

While the disputed charge is being investigated, the Fair Credit Billing Act blocks the issuer from trying to collect it, closing your account over it, or reporting you as delinquent on that amount.²

Debit Cards and Electronic Transfers: Your Speed Sets Your Loss

Debit cards are different. The Electronic Fund Transfer Act and Regulation E tie your liability directly to when you notify the bank.³

Report within two business days of learning of the loss or theft, and your maximum loss is $50, or the amount taken before you called, whichever is less.
Report after two business days but within 60 days of the statement that shows the fraud, and the ceiling rises to $500. The bank can hold you responsible for transfers made after the two-day window only if it can show they wouldn’t have happened had you called sooner.
Wait more than 60 days after that statement and you face unlimited liability for anything taken after the 60-day mark and before you finally reported. The bank again has to show those later losses were preventable with earlier notice.

The clock on the 60-day tier starts when the bank sends or makes your statement available, not when you read it. That’s the tier that produces catastrophic losses: a thief drains an account over months while statements sit unopened, and the bank has no obligation to reimburse what earlier notice would have stopped.

One safety valve is written into the rule. If your delay was caused by extenuating circumstances such as hospitalization or extended travel, the bank must extend the deadlines to a reasonable period. You can push back on a denial that ignores that.

Check Fraud: A One-Year Absolute Cutoff

Forged, altered, and counterfeited checks fall under the Uniform Commercial Code, not Regulation E. UCC Section 4-406 puts a duty on you to review your statements with “reasonable promptness” and notify the bank of any unauthorized payment.⁴

The hard limit is one year. Miss that window and you lose the right to challenge a forged signature or altered check, no matter how negligent the bank was. There’s also a shorter practical deadline in the same section: if the bank shows it suffered a loss because you didn’t report within a reasonable time (often around 30 days), you can be barred from recovering for later fraud the bank could have prevented.⁴

The UCC doesn’t cap your dollar liability the way Regulation E does. It allocates losses based on which party was better positioned to catch the fraud and how quickly each acted.

Wire Transfers: The Bank’s Security Procedure Usually Wins

Wire transfers run under UCC Article 4A. The default rule holds the bank responsible for unauthorized payment orders, but banks almost always contract around that default.

If you and the bank agreed to a security procedure that a court considers “commercially reasonable,” and the bank followed it in good faith, the loss from an unauthorized wire falls on you. Reasonableness turns on the size and frequency of your typical transfers, what security options the bank offered, and what procedures similar banks and customers use.⁵

Practically, that means declining offered protections like multi-factor authentication or callback verification puts you in a much weaker position if a wire goes bad. Article 4A also generally blocks customers from bringing separate negligence or breach-of-contract claims against the bank, so recovery on a fraudulent wire is the hardest of any bank fraud category.

Zelle, Venmo, and Cash App

Peer-to-peer payment apps split along a critical line: did someone else access your account, or did you send the money yourself?

When a thief gets into your account and sends money without your knowledge, that’s an unauthorized electronic fund transfer under Regulation E. The bank or app must apply the same liability tiers and investigation rules as debit card fraud.⁶

When a scammer tricks you into sending the money yourself, banks generally treat the transaction as authorized and deny reimbursement, even if the person on the other end was posing as your bank, a government agency, or a romantic interest. Under current federal law, a consumer who voluntarily initiated the transfer usually has no legal right to a refund.

The CFPB has drawn one exception: if a scammer fraudulently obtained your login credentials or a verification code (for example, by impersonating your bank) and then used those credentials to move money, the transfers count as unauthorized. You didn’t furnish an access device in that scenario, so Regulation E’s protections apply.⁶

Zelle announced a policy in late 2023 requiring participating banks to reimburse consumers for “qualifying imposter scams,” but the criteria aren’t public and many claims are still denied on the grounds that the customer authorized the payment.

Business Accounts Sit Outside Consumer Protections

If the account is a business account, Regulation E generally doesn’t apply. Business account fraud runs under the UCC, which is less favorable to the account holder.

For unauthorized electronic payments, Article 4A’s commercially-reasonable-security-procedure test controls. If your bank offered a stronger security option and your business declined it in writing, that choice will typically be treated as reasonable and the loss stays with you.

For check fraud, the same UCC 4-406 rules apply, including the one-year absolute cutoff. Banks often impose tighter contractual reporting deadlines than the UCC default, so the operative deadline can be shorter than a year.⁴

What to Do the Moment You Spot Fraud

For debit card fraud, every day between discovery and reporting can move you into a worse liability tier. Move quickly and document everything.

Call your bank at the number on the back of your card or on its website. Note the date, time, and name of the representative, and identify the disputed transactions by date and amount.
Follow up in writing within 10 business days. If the bank asked for written confirmation and you didn’t provide it, the bank can refuse provisional credit while it investigates.⁷
Change passwords, PINs, and security questions on the affected account and anywhere else you used the same credentials.
File a police report. Some banks require one, and a report creates a paper trail that strengthens your claim.
Report identity theft to the FTC at IdentityTheft.gov if personal information was compromised. The site produces a personalized recovery plan with pre-filled letters for banks and creditors.⁸
Place a fraud alert or credit freeze. A fraud alert asks creditors to verify your identity before opening new accounts; a freeze blocks access to your credit report entirely. Contacting one of Equifax, Experian, or TransUnion for a fraud alert notifies the other two.

If the Bank Won’t Cooperate

Banks sometimes deny claims they should honor, blow past investigation deadlines, or fail to give required provisional credit. File a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov/complaint or by calling (855) 411-2372. The CFPB routes the complaint to the bank, which generally must respond within 15 days, or up to 60 days in some cases. You can then review the response and add feedback.⁹

A CFPB complaint doesn’t guarantee a refund, but the regulatory pressure often produces better outcomes than the bank’s own dispute channel. If the bank missed Regulation E’s investigation timelines or refused required provisional credit, say so directly in the complaint.

1
Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
2
Joint Base Andrews. The Fair Credit Billing Act
3
eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
4
Legal Information Institute (LII) / Cornell Law School. UCC 4-406 – Customer Duty to Discover and Report Unauthorized Signature or Alteration
5
Legal Information Institute (LII) / Cornell Law School. UCC 4A-201 – Security Procedure
6
Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
7
eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
8
Federal Trade Commission. Report Identity Theft
9
Consumer Financial Protection Bureau. Submit a Complaint