What the EFTA covers
The Electronic Fund Transfer Act and its rule, Regulation E, protect money moving electronically into or out of a consumer account. That includes:
- Debit card purchases and ATM withdrawals, in person or online.
- ACH transfers: direct debits, bill payments, and electronic pulls from your checking or savings account.
- Online and mobile banking transfers made from your account.
- Person-to-person payments through Zelle and similar services, and balances in apps like Cash App, Venmo, and PayPal that are used to send money to other people. See Zelle, Cash App, and Venmo fraud.
- Prepaid and payroll cards.
Some things fall under different laws. Credit card charges are covered by the Fair Credit Billing Act, which caps your liability for unauthorized use at $50 and requires a written dispute within 60 days. Wire transfers and paper checks are governed mostly by other rules. If you aren't sure which bucket your loss falls into, that's one of the first things I sort out.
Unauthorized, or "you authorized it"?
Most denials turn on one word. Under Regulation E, a transfer is unauthorized when someone other than you starts it without actual authority and you get no benefit from it (12 C.F.R. § 1005.2(m)). That includes a transfer made by someone who got your card, PIN, or login from you through fraud or robbery.
| What happened | Generally treated as |
|---|---|
| A thief used your stolen card, or took over your online banking or app login | Unauthorized. Regulation E protections apply. |
| A caller posing as your bank tricked you into reading back a one-time code or sharing your login, then moved the money | Unauthorized under the CFPB's published guidance, because the access information was obtained by fraud. |
| Someone you let use your card spent more than you allowed | Not unauthorized until you tell the bank that person no longer has permission. |
| You were tricked into sending the payment yourself (fake seller, fake landlord, impostor, romance scam) | Generally not unauthorized under current federal rules. Other claims or the bank's own reimbursement policies may still help. |
Banks sometimes deny claims because the customer wrote down a PIN or clicked a bad link. Under Regulation E, your negligence cannot be used to increase your liability for an unauthorized transfer. What matters is who made the transfer and when you reported it.
How much of the loss can the bank put on you?
For an unauthorized transfer, your share of the loss depends mostly on how fast you report it (12 C.F.R. § 1005.6):
| When you tell the bank | The most you can be charged |
|---|---|
| Within 2 business days of learning your card or login was lost or stolen | $50 |
| After 2 business days | Up to $500 |
| More than 60 days after the statement showing the transfer was sent | Also liable for later transfers, made after those 60 days and before you reported, that the bank shows it could have stopped if you had reported on time |
| No card or login was lost or stolen (for example, an unauthorized ACH debit), reported within 60 days of the statement | $0 |
Those time limits must be extended for extenuating circumstances like extended travel or a hospital stay. Many banks also advertise "zero liability" policies for debit card fraud that are more generous than the law. Ask for yours in writing.
The rules the bank must follow when you report it
- Within 60 days of the statement
You notify the bank of the error, by phone or in writing. The bank can require written confirmation within 10 business days of a phone report.
- Within 10 business days
The bank must finish its investigation, or give you provisional credit for the disputed amount so it can take longer.
- Up to 45 days
The outside limit for an investigation with provisional credit. It can be 90 days for new accounts, point-of-sale debit transactions, and foreign transactions, and new accounts get 20 business days instead of 10 to decide on provisional credit.
- Within 3 business days of finishing
The bank must report the result. If it finds no error, it must explain why in writing and tell you that you can request the documents it relied on.
If your claim was denied, send a written request for copies of every document the bank relied on. The answer often shows whether anyone actually investigated, and it is evidence if the case goes further. My dispute guide includes a sample letter.
What you can recover
When a bank violates the EFTA, a consumer can sue for actual damages (the money you lost and related harm), statutory damages of $100 to $1,000, and reasonable attorney's fees and costs (15 U.S.C. § 1693m).
Damages can be tripled when the bank didn't provisionally credit your account within the 10-day window and either didn't investigate in good faith or had no reasonable basis to think there was no error, or when it knowingly and willfully concluded there was no error when the evidence didn't support that conclusion (§ 1693f(e)).
What to do right now
- Report it to the bank immediately, lock or cancel the card, and change your banking and e-mail passwords.
- Put it in writing to the address the bank lists for error disputes, even if you already called. Keep a copy and proof of delivery.
- Keep a log of every call: date, time, the representative's name, and the claim number.
- Report identity theft at IdentityTheft.gov if your identity or accounts were compromised, and file a police report if you can.
- If the claim is denied, request the documents the bank relied on, and save the denial letter.
- Watch the clock. A lawsuit under the EFTA generally must be filed within one year of the violation.
How fees work
The EFTA lets a consumer who wins recover reasonable attorney's fees and costs from the bank or payment company (15 U.S.C. § 1693m), which is what makes it practical to pursue losses of a few hundred or a few thousand dollars. You don't pay me unless you win. I take these cases on contingency: no attorney's fees and no case costs owed to me unless you recover money. If a case is lost, a court can sometimes order the losing side to pay the other side's court costs, and some Florida laws, including the security deposit and deceptive practices statutes, also let the winner recover attorney's fees from the loser. I explain that risk before anything is filed, and every term is in a written agreement before you sign.
The statute also allows fees against someone who brings a claim in bad faith or to harass, so I review the facts carefully before recommending a lawsuit.