Bank fraud claims · FloridaBank of America denied your fraud claim. Federal law, not the letter, decides what you can lose.

Last reviewed October 8, 2026 by Jackson McMillan, Florida attorney

Short answer: If Bank of America denied your fraud claim, you can demand the documents behind the decision, and the bank, not you, must prove the transfers were authorized. Transfers a scammer made with a stolen login or code are unauthorized under Regulation E, and a flawed denial can support a claim for your losses, statutory damages, and attorney's fees.

What happened, and why did Bank of America say the transfers were authorized?

In the typical case, a spoofed text or call led you to a fake login page or got you to read back a one-time code, and someone used it to send Zelle payments out of your account. The bank's records show your username, password, and phone code, and the denial letter treats those facts as proof you did it.

That reasoning confuses how the fraud worked with who committed it. A login page that looks like Bank of America's, or a caller who knows your last four digits, exists to collect exactly the credentials the bank later points to. The scammer then signs in as you. From the bank's side of the screen, the session is yours. From yours, a stranger is moving your money.

Zelle makes these losses move fast. Bank of America's own Zelle pages say payments cannot be reversed and that neither the bank nor Zelle offers purchase protection, so the money is usually gone from the recipient's side within minutes. That does not end the question of who bears the loss between you and your bank. The federal rules on that question turn on one fact: whether you or someone else initiated each transfer.

If the scammer, logged in with your stolen credentials, sent the Zelle payments, those transfers are unauthorized and the protections below apply. If the caller instead talked you into opening the app and sending the money yourself to a "safe account," federal law generally does not treat that payment as unauthorized, even though you were deceived. Bank of America's pages say qualifying imposter scams may be eligible for reimbursement, but that is the bank's stated policy, not a legal duty I can enforce for you. Many real cases mix both kinds of transfers, and I sort them one by one.

Who is Bank of America, and who regulates it?

Bank of America, N.A. is a national bank headquartered in Charlotte, North Carolina. It is chartered and primarily regulated by the Office of the Comptroller of the Currency (OCC), and because it holds more than $10 billion in assets, the Consumer Financial Protection Bureau (CFPB) also supervises it. In Florida, it holds the largest share of deposits of any bank.

According to the FDIC's Summary of Deposits as of June 30, 2025, Bank of America had 425 Florida branches and about 19.9 percent of all deposits booked in the state. If you have a Florida checking or savings account there, it is governed by the bank's "Deposit Agreement and Disclosures," and the version effective May 15, 2026 matters more than earlier ones.

How to report an unauthorized transfer

The agreement describes the federal Regulation E error-resolution timeline: report within 60 days of the first statement showing the error; the bank investigates within 10 business days, or provisionally credits your account within 10 business days if it takes up to 45 days, with up to 90 days for point-of-sale or foreign transactions. Report by the channels the agreement lists, and follow a phone report with a written one, because Regulation E lets a bank ask for written confirmation within 10 business days of a call.

The arbitration clause and the opt-out

Older versions of Bank of America's consumer deposit agreement did not require arbitration. The May 15, 2026 agreement does. It contains a binding arbitration clause, a class action waiver, and a jury trial waiver for personal accounts, meaning either side can insist that a dispute be decided by an arbitrator rather than a judge or jury, and class claims are waived. Two features soften that. The agreement gives personal account holders a right to opt out of arbitration within 60 days of first delivery of the arbitration agreement, online or by phone, and it leaves small claims court available for individual claims within that court's limits.

Whether your 60-day window is still open depends on when the clause was first delivered to you. If it is, opting out costs nothing and preserves a jury. Either way, an arbitration clause does not erase your Regulation E rights; it changes the forum where they are decided.

Public enforcement history relevant to fraud claims

On July 14, 2022, the CFPB entered a consent order with Bank of America, N.A. (File No. 2022-CFPB-0004) concerning, among other things, the handling of unauthorized-transaction claims on state unemployment benefit prepaid cards the bank administered. The order required consumer redress and a $100 million civil money penalty, and the OCC imposed a companion $125 million penalty the same day. The bank consented without admitting or denying the findings. As of October 2026 the CFPB's site did not list that order as terminated. That matter involved a prepaid card program, not ordinary checking accounts, and it is history, not proof of anything about your claim.

Separately, in December 2024 the CFPB sued Bank of America, JPMorgan Chase, Wells Fargo, and Zelle's operator over Zelle fraud handling. The CFPB voluntarily dismissed that case with prejudice in March 2025, and no court made any findings.

McMillan Law PLLC is not affiliated with Bank of America and does not represent it. Bank of America is named here because people search for help with its decisions.

What does federal law require Bank of America to do with a fraud claim?

The Electronic Fund Transfer Act (EFTA) and its rule, Regulation E, require the bank to investigate, decide within 10 business days or give provisional credit and finish within 45 days, explain any denial in writing, provide the documents it relied on, and cap your loss at what the regulation allows. The bank must prove authorization; you need not prove fraud.

Start with the definition that the denial letter skipped. An electronic fund transfer is unauthorized when it is initiated by a person other than you, without actual authority, and you receive no benefit from it (12 C.F.R. § 1005.2(m)). The official commentary adds that a transfer made by someone who obtained your access device through fraud or robbery is unauthorized (comment 2(m)-3). An access device is any card, code, or other means of access, and the CFPB's Electronic Fund Transfers FAQs treat a login and a one-time passcode as covered.

Banks sometimes argue that you "furnished" the credentials, invoking the rule that transfers by someone you voluntarily gave your card to are authorized until you say otherwise. The same CFPB FAQs answer that: a consumer who was fraudulently induced to share account information has not furnished an access device. Being tricked is not consent.

Your own carelessness changes nothing either. The regulation's commentary states that a consumer's negligence cannot be used to increase liability for unauthorized transfers (comment 6(b)-2). Clicking the link in the fake text does not shift the loss to you. Only the timing of your report affects what you can be made to pay.

The liability caps depend on when you reported after learning your login or card was compromised. Within 2 business days, your share is the lesser of $50 or the amount taken before you reported (12 C.F.R. § 1005.6(b)(1)). Later, the cap rises to $500, and only for transfers the bank shows a prompt report would have prevented (§ 1005.6(b)(2)). A transfer that sat on a statement more than 60 days after the bank sent it can expose you to later transfers, again only if the bank shows timely notice would have stopped them (§ 1005.6(b)(3)). A hospital stay or long travel extends each period (§ 1005.6(b)(4)).

Then the investigation rules. Your notice can be by phone or in writing, and the bank's clock starts when it receives it (§ 1005.11(b)). It may ask you to confirm a phone report in writing within 10 business days, but it may not hold up the investigation while it waits. It cannot require a police report, a notarized affidavit, a branch visit, or a call to the person who received the money as a condition of investigating, and it cannot charge you a fee for the investigation. Where the bank has an agreement with a third party involved in the transfer, such as the Zelle network built into its app, its review must reach that information (§ 1005.11(c)(4)).

"Provisional credit" is the temporary return of the disputed amount while the bank keeps investigating; it is required within 10 business days if the bank wants the longer 45-day period (§ 1005.11(c)(2)). A "no error" result must arrive within 3 business days of finishing, with a written explanation and notice of your right to the documents the bank relied on, which it must provide promptly (§ 1005.11(d)(1)). An error must be fixed within 1 business day.

Finally, the burden of proof. In any case about your liability for an unauthorized transfer, the EFTA requires the bank to prove the transfer was authorized or that the conditions for making you pay were met (15 U.S.C. § 1693g(b)). A letter that says "credentials were used" has not carried that burden.

Why do Bank of America fraud claims get denied?

Most denials rest on authentication: the transfers passed the bank's security checks, came from a recognized device, or used a code sent to your phone. Others cite a prior relationship with the recipient, a late report, or a missing written confirmation. Each describes the mechanics of the theft rather than answering the legal question of who initiated the transfer.

Each of these common denial reasons has a legal answer:

• "The transfers were authenticated with your credentials and a one-time code." That proves the person had your credentials, which is precisely what a phishing text collects. Fraud-obtained access devices produce unauthorized transfers under comment 2(m)-3.
• "The activity came from a device you have used before." Remote-access scams and session hijacking run on your device; a thief who took your unlocked phone uses it too. Who was operating the device is the question.
• "Zelle payments are final." That is a statement about recovering money from the recipient. Your rights against your own bank come from Regulation E and do not depend on whether Zelle can reverse anything.
• "You did not report within 60 days." Count the 60 days from when the statement was sent, and remember that lateness exposes only later transfers the bank can prove it would have stopped. The first transfers remain protected.
• "The claim was closed because written confirmation was not received." Missing confirmation can excuse the provisional credit, not the investigation, the written findings, or the bank's burden of proof.
• "The fraud model found no indication of compromise." A model output is a tool. Published federal enforcement orders have treated denials consisting of a fraud filter and a form letter as unreasonable investigations.

If any of these phrases is in your letter, request every document the bank relied on, in writing.

What are my rights against Bank of America as a Florida consumer?

Florida has no state law on electronic transfers, and the state's deceptive practices statute exempts banks, so the federal EFTA governs your claim. You can bring it in state or federal court, subject to the arbitration clause discussed above, and Florida federal courts have applied the statute's investigation and timing rules to financial institutions.

I practice from one office in Tampa and represent people with these claims anywhere in Florida, from Pensacola to Miami; the work is done by phone, email, and video.

Florida's Deceptive and Unfair Trade Practices Act expressly exempts banks, credit unions, and savings associations (Fla. Stat. § 501.212), which removes the usual state-law unfair practices claim. The EFTA fills that gap with fee shifting and statutory damages that do not depend on the size of your loss.

Two Florida federal decisions do the heavy lifting. Monroe v. Grow Financial Federal Credit Union (M.D. Fla. 2022) concluded that a financial institution had neither reasonably investigated a disputed debit nor met its burden of proving the transfer was authorized. Katz v. JPMorgan Chase (S.D. Fla. 2015) held that a claim over a mishandled error report accrues when the bank's deadline passed, not when the money left. Both apply the same statute that governs your Bank of America account.

Courts also require a concrete injury before you can sue. Losing the use of money taken from your account, even for a time, generally meets that requirement.

What is a denied Bank of America fraud claim worth?

If the bank violated the EFTA, you can seek your actual damages, meaning the unauthorized transfers and the losses they caused, plus statutory damages of $100 to $1,000, plus reasonable attorney's fees and costs. In two specific situations the court can award up to three times your actual damages.

Statutory damages do not require proof of a dollar loss; the court sets the figure within the range by weighing the frequency, persistence, and nature of the bank's noncompliance and whether it was intentional (15 U.S.C. § 1693m(a), (b)). Actual damages begin with the stolen funds and can include overdraft fees, returned-payment charges, and related harm the denial caused.

Treble damages have two triggers. First, the bank did not provisionally recredit your account within the 10-business-day period and either did not investigate in good faith or had no reasonable basis to believe there was no error. Second, the bank knowingly and willfully concluded there was no error when that conclusion could not reasonably be drawn from the evidence before it (§ 1693f(e)). The multiplier applies to actual damages, the money you lost, not to the statutory range, so the honest phrasing is "up to three times your losses."

The bank has defenses too: a bona fide error despite reasonable procedures, and fees against a consumer who sues in bad faith or to harass. Those are reasons I review the file before recommending anything. You don't pay me unless you win. I take these cases on contingency: no attorney's fees and no case costs owed to me unless you recover money. If a case is lost, a court can sometimes order the losing side to pay the other side's court costs, and some Florida laws, including the security deposit and deceptive practices statutes, also let the winner recover attorney's fees from the loser. I explain that risk before anything is filed, and every term is in a written agreement before you sign.

How long do I have to act after a Bank of America denial?

The EFTA gives you one year from the violation to file suit. When the violation is the bank's handling of your claim, the year runs from the bank's failure, such as the day its decision deadline passed, rather than from the scam. Treat the transfer date as your safe deadline anyway.

The one-year rule comes from the statute (15 U.S.C. § 1693m(g)), and Katz is the Florida decision that starts it at the bank's misstep in error-resolution cases. Courts have occasionally extended the period for fairness reasons; nobody should plan around that.

Two shorter clocks also matter. Any transfer not yet reported should be reported now, in writing, within 60 days after the statement showing it was sent. And if you want to opt out of arbitration, the agreement allows it only within 60 days of first delivery of the clause, so check your mail and account messages for when that arrived.

What to do today

• Report any unreported transfer by phone, then in writing to the error-resolution address in your Deposit Agreement and Disclosures, listing each transfer by date and amount and stating that you did not make it and got nothing from it.
• Request the investigation file in writing. Ask for every document the bank relied on in finding no error, cite Regulation E, and keep proof of when you sent the request.
• Secure the account: new password, new email password, two-step verification, and a review of the Zelle recipients and devices tied to your profile.
• Decide on arbitration. If your 60-day opt-out window may still be open, consider opting out now; it costs nothing and preserves a jury.
• Gather these documents: the denial letter; your statements from the month before the first transfer through today; the spoofed text or the call log showing the incoming number and time; the real one-time passcode texts with timestamps; any login or new-recipient alerts from the bank; Zelle recipient names or details; your claim number and a log of every call; and the written confirmation you sent, if any.
• Do not pay anyone who offers to recover the money for a fee. That is usually the next stage of the same scam.
• Send it to me. Request a free case review and attach the denial and statements. I'll check each transfer against the federal rules and tell you whether the bank's denial can stand.

Sources: 15 U.S.C. §§ 1693a(12), 1693f(e), 1693g(b), 1693m(a), (b), (c), (f), (g); 12 C.F.R. §§ 1005.2(m), 1005.6(b), 1005.11(b), (c), (d); Official Interpretations to Regulation E, comments 2(m)-3, 6(b)-2, 11(b)(1)-2, 11(c)-2, 11(c)-3, 11(c)(4)-5; CFPB, Electronic Fund Transfers FAQs (page last modified January 16, 2025); Bank of America, Deposit Agreement and Disclosures, effective May 15, 2026; FDIC Summary of Deposits, June 30, 2025; CFPB Consent Order, In re Bank of America, N.A., File No. 2022-CFPB-0004 (July 14, 2022) and OCC News Release 2022-84 (July 14, 2022); CFPB v. Early Warning Services, LLC, et al., No. 2:24-cv-03652 (D. Ariz., filed Dec. 20, 2024, dismissed with prejudice Mar. 5, 2025); Katz v. JPMorgan Chase, 2015 WL 11251764 (S.D. Fla. Feb. 10, 2015); Monroe v. Grow Financial Federal Credit Union, M.D. Fla., Dec. 5, 2022, 2022 WL 17417034; Fla. Stat. § 501.212. Last reviewed October 8, 2026.