McMillan Law's office is in Tampa. I represent people in Sarasota and everywhere else in Florida, and the free case review happens by phone or online, so you don't have to drive anywhere to get started.
Last reviewed October 8, 2026 by Jackson McMillan, Florida attorney
What an account takeover looks like from a distance
A takeover can start somewhere other than the bank: a hacked email account, a password reused from a site that leaked, or a phone number quietly moved to someone else's SIM card. Once inside, a thief may swap the email, phone number, and password on your bank profile so alerts stop reaching you, then move money out through transfers, bill payments, Zelle, or your debit card number. When you're away from Sarasota and glancing at your accounts less often, days can pass before you notice.
By then, you're dealing with a bank that may be hundreds of miles from where you're staying, a claim form that asks for paperwork you don't have, and a balance that keeps shrinking while you wait.
Why takeover transfers are unauthorized
The Electronic Fund Transfer Act is a federal statute governing electronic transfers out of consumer accounts, and Regulation E is the rule that puts it into practice. Regulation E calls a transfer unauthorized if another person initiates it without actual authority from you and you receive no benefit. Your login counts as a way to access the account, just like a card or PIN, so a stranger who got into your online banking and sent money out made unauthorized transfers. That holds even if the thief tricked a password or security code out of you, and even if you reused a password you shouldn't have, because carelessness doesn't increase your liability.
Bank records may show the transfers came from "your" login. That shows which credentials were used, not who used them. It's the bank's job to prove you authorized a transfer, not your job to disprove it, and changed contact details and unfamiliar devices can be strong evidence that someone else was in control.
Two honest limits. If someone persuaded you to send the money yourself, say a caller posing as your bank or a fake contractor, that payment is generally not unauthorized under federal rules, even though you were deceived. And a true wire transfer runs under different rules, though not everything a bank labels a wire actually is one. Takeovers and persuasion scams can overlap, so the exact sequence of events decides which protections apply.
Police reports, affidavits, and branch visits
A bank's fraud packet may ask for a police report, a notarized affidavit, a branch visit, or proof that you called the merchant. Filing a police report can still be a good record to have. But federal regulators have said a bank can't make any of those things a condition of investigating an unauthorized electronic transfer.
Here is what a bank can ask for. If you report by phone, it can require written confirmation within 10 business days, as long as it tells you so and gives you the address. Send it, because a bank that doesn't get timely confirmation can hold back the provisional credit. Even then, the bank can't delay the investigation itself while it waits for your letter.
From there the clock belongs to the bank: 10 business days to decide, or as long as 45 days if it puts the disputed money back in your account provisionally within the first 10 business days. If the account is new, meaning the transfers came within 30 days after your first deposit, the limits stretch to 20 business days and 90 days. If the bank denies the claim, it owes you a written explanation and, on request, the documents it relied on. My Regulation E dispute guide includes a letter you can send from anywhere.
Whether you're on Siesta Key or a thousand miles north, you can upload the bank's letters and your statements from your phone and get my honest read on whether the bank is following the rules.
Seasonal residents in Sarasota County and the Suncoast
Sarasota County is home to many seasonal residents and retirees, from Siesta Key and Lido Key to downtown Sarasota and Venice. Time away creates its own problems. Statements may go to a mailbox no one is checking, alerts may go to an old phone number, and a takeover can run for weeks before anyone sees it.
The rules account for some of this. When extenuating circumstances such as extended travel delay your report, the bank must extend the reporting time limits to a reasonable period. Notice to the bank can be given by phone from anywhere, so don't wait until you're back in town to make the call. If you've been managing Hurricane Milton repairs from out of town since it made landfall near Siesta Key in October 2024, and paying contractors online, an unfamiliar transfer can blend in with the real ones.
I take cases from across Sarasota County, including Sarasota and Venice, and from nearby Bradenton, and the work happens by phone, video, and online uploads, so you can work with me from wherever you're spending the season. Sarasota, Manatee, and DeSoto counties make up the Twelfth Judicial Circuit. If the thief also opened credit in your name, see my guide to fixing credit report errors in Sarasota. Seasonal renters on the Suncoast may also want to read how to get a Sarasota security deposit back.
What's at stake for the bank
Breaking the Electronic Fund Transfer Act exposes a bank to three kinds of recovery: your actual damages, statutory damages, which a court can set anywhere from $100 to $1,000, and the reasonable attorney's fees and costs of bringing the case. A bank that sits on a claim while waiting for paperwork it isn't allowed to require can miss its 10-business-day deadline. If, on top of that, the investigation wasn't done in good faith or the bank had nothing reasonable to base a no-error finding on, your actual damages can be tripled. Knowingly and willfully denying a claim the evidence couldn't reasonably support opens the same door.
Because a bank that loses one of these cases can be ordered to pay the consumer's reasonable attorney's fees and costs, a takeover claim doesn't have to be huge to be worth pursuing. You don't pay me unless you win. I take these cases on contingency: no attorney's fees and no case costs owed to me unless you recover money. If a case is lost, a court can sometimes order the losing side to pay the other side's court costs, and some Florida laws, including the security deposit and deceptive practices statutes, also let the winner recover attorney's fees from the loser. I explain that risk before anything is filed, and every term is in a written agreement before you sign. For more on challenging a refusal, see my page on bank fraud claims that get denied.
The clocks that are running
- Right away: when a card, phone, or login is lost or stolen, reporting within 2 business days of finding out caps your share at $50, and waiting longer can raise it to as much as $500.
- 60 days after the bank sends the statement showing the transfers: report within this window so the bank's investigation deadlines apply. Unauthorized transfers made after the window, and before you report, can shift to you, but only where the bank proves that reporting on time would have stopped them.
- 1 year: the general deadline to sue. If your complaint is about how the bank handled the claim, the year may be counted from the bank's failure instead.
What to do from wherever you are
- Call the bank's fraud line using the number on your card or statement, and report every transfer you didn't make.
- Take back control: change your email password first, then your banking password, and ask your phone carrier whether your number was moved.
- Ask the bank to confirm in writing the date you reported and your claim number.
- If the bank asks for written confirmation, send it within 10 business days and keep proof of mailing.
- If the bank says it won't investigate without a police report or affidavit, ask for that requirement in writing. It's evidence.
- Send it to me. Begin your free case review and send your statements, the bank's letters, and any alerts about changes to your account. I'll tell you where your claim stands and what I would do next.