Credit union fraud claims · FloridaYour Florida credit union denied your fraud claim. Credit unions answer to the same federal rules as banks.

Last reviewed October 8, 2026 by Jackson McMillan, Florida attorney

Short answer: A Florida credit union that denied your fraud claim must follow Regulation E just as a bank would: investigate within 10 business days or provisionally credit your account, prove the transfers were authorized, explain its findings in writing, and give you the documents it relied on. Its charter decides who regulates it; its agreement decides court or arbitration.

What happened, and why did the credit union deny the claim?

A denial usually says the transactions were made with your card and PIN, your login and a security code, or a device tied to your account, or that the member affidavit was incomplete or the report late. Those statements describe how the money left. They do not decide whether you authorized it, which is the only question the law asks.

Credit union members run into the same frauds as bank customers: skimmed debit cards, stolen phones with the mobile app installed, impostor texts that harvest a one-time code, and ACH debits by companies holding a leaked account number. The credit union's systems record a valid card, a correct PIN, or a successful login, and the denial letter treats that record as consent.

Two features of credit union claims deserve attention at the start. Many credit unions ask members to complete a fraud affidavit, sometimes notarized or signed at a branch; filling it out is reasonable, but the federal rule does not let a credit union refuse to investigate without one. And if a caller persuaded you to send a payment yourself, federal law generally does not treat it as unauthorized, while a transfer the caller made with your code or login is. Sorting the transfers by who pressed send comes first.

Who regulates Florida credit unions, and how do I find out which one regulates mine?

A Florida state-chartered credit union is chartered under Chapter 657, Florida Statutes, and regulated by the Florida Office of Financial Regulation, with the National Credit Union Administration (NCUA) insuring members' deposits. A federal credit union is chartered, supervised, and insured by the NCUA. The NCUA's "Research a Credit Union" tool lists each credit union's charter type.

Credit unions with more than $10 billion in assets also come under the Consumer Financial Protection Bureau's supervisory authority. None of this changes the substance of your rights; it tells you which agency examines the institution and which one to name if you complain to a regulator.

Here is what I verified about the three Florida credit unions people ask about most, as of October 2026. Each is named conditionally; nothing here suggests any of them mishandles claims.

If your credit union is Suncoast

Suncoast Credit Union is a Florida state-chartered credit union headquartered in Tampa, regulated by the Florida Office of Financial Regulation and insured by the NCUA. As of 2026 it reported about $20.8 billion in assets, about 1.4 million members, and 80 branches, which makes it Florida's largest credit union and large enough for CFPB supervision. Members can dispute an unauthorized transaction through SunNet online banking, the SunMobile app, a branch, or by phone, and its EFT agreement follows the Regulation E timeline: a decision within 10 business days, or a provisional credit while it investigates for up to 45 days (90 in some cases), with a written explanation if it finds no error. Its current Account Agreement contains a binding arbitration clause and a class action waiver that either side can invoke, with no opt-out, so a member may be required to arbitrate individually except in individual small claims cases; the clause does not apply while the member is an active duty servicemember or a Military Lending Act covered borrower. I found no CFPB or NCUA public enforcement action against Suncoast as of October 8, 2026.

If your credit union is VyStar

VyStar Credit Union is a Florida state-chartered credit union headquartered in Jacksonville, regulated by the Florida Office of Financial Regulation and insured by the NCUA, with about $14.3 billion in assets and just over one million members as of mid-2026, also large enough for CFPB supervision. Its fraud reporting page says a debit card fraud claim will be settled or provisionally credited within 10 business days with the outcome confirmed by mail, and that forgery claims, which get no provisional credit, typically take 10 to 45 business days. VyStar's Membership Booklet effective July 1, 2025 contains a binding arbitration clause and a class action waiver that either side can invoke for claims filed after July 1, 2021, with an exception for individual small claims cases and no opt-out in the current booklet. In October 2024 the CFPB issued a consent order finding that VyStar's May 2022 online and mobile banking conversion involved unfair practices, requiring redress and a $1.5 million penalty; VyStar consented without admitting or denying the findings, and the CFPB terminated the order on July 21, 2025. That order concerned a banking platform conversion, not fraud claims.

If your credit union is MidFlorida

MIDFLORIDA Credit Union is a Florida state-chartered credit union headquartered in Lakeland, regulated by the Florida Office of Financial Regulation and insured by the NCUA, with about $9.8 billion in assets, roughly 500,000 members, and more than 65 branches serving 59 of Florida's 67 counties as of 2026, just under the $10 billion threshold for CFPB supervision as of mid-2026. A member reporting an unauthorized debit card transaction within 60 days of the statement can call the Help Desk or the fraud reporting line, no form is required, and the Regulation E timeline of 10 business days, or 45 (90 in some cases) with provisional credit, applies. Its Terms and Conditions dated March 2026 contain a mandatory arbitration clause and class action waiver that either side can invoke, but new members have 30 days after opening their first account to opt out in writing, the clause requires a 60-day written-demand and negotiation period before any arbitration is filed, and disputes about loans are carved out and governed by the loan agreement. I found no CFPB or NCUA public enforcement action against MidFlorida as of October 8, 2026.

McMillan Law PLLC is not affiliated with Suncoast Credit Union, VyStar Credit Union, or MidFlorida Credit Union and does not represent it. Suncoast Credit Union, VyStar Credit Union, or MidFlorida Credit Union is named here because people search for help with its decisions.

If your credit union is not one of these three, the same three questions apply: federal or Florida charter, arbitration clause or not, and which dispute channels it offers.

Does the Electronic Fund Transfer Act apply to credit unions?

Yes. The Electronic Fund Transfer Act (EFTA) and Regulation E cover consumer accounts at any "financial institution," a term that includes credit unions, and a Florida federal court applied both to a credit union in Monroe v. Grow Financial Federal Credit Union (M.D. Fla. 2022). The liability caps, investigation deadlines, and burden of proof match a bank's.

The statute covers debit card purchases, ATM withdrawals, ACH debits, and online, app, and person-to-person transfers out of a consumer's checking, share draft, or savings account, but not credit cards, paper checks, or bank wires. The regulation defines an unauthorized transfer as one initiated by a person other than you, without actual authority, from which you receive no benefit (12 C.F.R. § 1005.2(m)).

The commentary makes the impostor cases clear: a transfer by someone who obtained your card, code, or login through fraud or robbery is unauthorized (comment 2(m)-3), and the CFPB's Electronic Fund Transfers FAQs, still posted as of October 2026, say a consumer who was tricked into sharing account information has not "furnished" an access device. Your own carelessness cannot be used to increase your liability (comment 6(b)-2).

How much the credit union can leave with you depends on what was stolen and when you reported. If a card, PIN, or login was lost or stolen and you reported within 2 business days after learning of it, your share is the lesser of $50 or the amount taken before notice (12 C.F.R. § 1005.6(b)(1)); later than that, up to $500, but only for transfers the credit union proves a timely report would have prevented (§ 1005.6(b)(2)). An unauthorized transfer left unreported more than 60 days after its statement was sent can expose you to later transfers a timely report would have stopped (§ 1005.6(b)(3)). Where no access device was involved, as with an ACH debit by account number, only the 60-day rule applies.

Extenuating circumstances such as extended travel or a hospital stay extend each of those periods (§ 1005.6(b)(4)), the account agreement cannot increase your liability beyond what the regulation allows (§ 1005.6(b)(6)), and there is no reporting deadline for the first unauthorized transfers apart from the one-year limit to sue. In any dispute about your liability, the credit union carries the burden of proving the transfer was authorized or that the conditions for consumer liability were met (15 U.S.C. § 1693g(b)).

What must a credit union do when I report an unauthorized transaction?

Once you report within 60 days after the statement was sent, the credit union must decide within 10 business days, or provisionally credit your account and finish within 45 days (90 in some cases). It may ask for written confirmation but may not stall, cannot require a notarized affidavit or police report, and must explain any denial in writing.

Your notice can be by phone, in person, or in writing, and it needs to identify you and your account and say why you believe there is an error, with dates and amounts as far as you know them (12 C.F.R. § 1005.11(b)(1)). A North Florida federal court has held the notice must identify the transactions, so list each one. The credit union may require you to confirm a phone report in writing within 10 business days and may withhold provisional credit if you do not, but the regulation's commentary bars it from delaying the investigation while it waits.

That is where the affidavit forms come in. A credit union can hand you its fraud affidavit and treat it as your written confirmation. What it cannot do, under the CFPB's FAQs and federal examiner guidance, is make a notarized affidavit, a police report, a branch visit, or a call to the merchant a condition of starting the investigation; the deadlines run from the day it received your notice. It also cannot charge a fee for investigating.

"Provisional credit" is the temporary return of the disputed money, with interest where the account earns it, due within 10 business days if the credit union wants the longer period (§ 1005.11(c)(2)). New accounts get 20 business days and 90 days; point-of-sale debit purchases and transfers started outside the United States get 90 days (§ 1005.11(c)(3)). Where the credit union has an agreement with a third party involved in the transfer, such as a card network or a payment service in its app, the investigation must reach that information (§ 1005.11(c)(4)).

The credit union has 3 business days after finishing to report the result. If it finds an error, it has 1 business day to correct it, fees and interest included (§ 1005.11(c)(1)). A "no error" result requires a written explanation of findings and notice of your right to request the documents the credit union relied on, which it must provide promptly in a form you can understand (§ 1005.11(d)(1)). If it reverses a provisional credit, it must give notice of the date and amount and honor your checks and preauthorized payments without overdraft fees for 5 business days (§ 1005.11(d)(2)).

Why do credit union fraud claims get denied?

The reasons tend to be a correct PIN or code, a recognized device, a late or incomplete affidavit, a report the credit union counts as late, a prior relationship with the payee, or an automated fraud score. Each is a starting point for an investigation, not a conclusion, and none shifts the burden of proof onto the member.

• "The PIN or security code was entered correctly." Skimmers capture PINs and impostor texts harvest codes. The code proves what the thief had, not who the thief was.
• "Your affidavit was not returned or was not notarized." A missing written confirmation can excuse the provisional credit. It cannot excuse the investigation, the written explanation, or the document request, and notarization is not a legal requirement.
• "The transaction originated from your registered device." A stolen phone and a remote-access scam both run on your device. Who was holding it is the question.
• "You reported outside the 60-day period." The 60 days run from when the statement was sent, lateness exposes only later transfers the credit union proves it could have stopped, and extenuating circumstances extend the period.
• "You have transacted with this payee before." Past dealings do not authorize a new transaction, and federal supervisory reports have criticized denials that rest on them.
• "Fraud detection did not flag the activity." A fraud score is a tool, and published federal enforcement orders have treated a score plus a form letter as an unreasonable investigation.

What are my rights as a Florida credit union member?

The federal EFTA is the law for a denied credit union fraud claim in Florida. Florida's deceptive practices statute does not reach credit unions, and the state has no electronic transfer law. The EFTA allows suit in state or federal court, but many Florida credit unions' agreements now require individual arbitration, so the account agreement decides the forum.

I practice from one office in Tampa and represent credit union members with these claims across Florida, from Pensacola to the Keys; the case review and nearly all of the work happen by phone, email, and video.

The exemption in Florida's Deceptive and Unfair Trade Practices Act for banks, credit unions, and savings associations (Fla. Stat. § 501.212) takes the usual state-law unfair practices claim off the table. The EFTA's statutory damages and fee shifting fill that gap, and they apply in arbitration as well as in court.

Two Florida decisions matter most. Monroe v. Grow Financial Federal Credit Union (M.D. Fla. 2022) found that a credit union had neither reasonably investigated a disputed debit nor met its burden of proving it was authorized. Katz v. JPMorgan Chase (S.D. Fla. 2015) held that an error-resolution claim accrues when the institution missed its deadline, not when the money left.

On the forum question, the three credit unions above show the range: Suncoast and VyStar allow either side to require individual arbitration with no opt-out, MidFlorida allows a 30-day written opt-out and requires a 60-day demand period, and each keeps an exception for individual small claims cases. A clause changes where your claim is decided, not what the credit union must prove.

A court or arbitrator will also require a concrete injury, and losing the use of money taken from your account, even temporarily, generally qualifies.

What is a denied credit union fraud claim worth?

When a credit union violates the EFTA, the member may recover actual damages, statutory damages between $100 and $1,000, and reasonable attorney's fees and costs. Actual damages start with the unauthorized transactions and include the overdraft and returned-item fees they caused. In two defined situations the award can be up to three times your actual damages.

Statutory damages do not depend on proving a dollar loss; the court or arbitrator sets the figure by weighing the frequency, persistence, and nature of the violations and whether they were intentional (15 U.S.C. § 1693m(a), (b)). Fee shifting is what makes a claim over a few hundred dollars worth pursuing.

Treble damages apply when the credit union did not provisionally recredit the account within 10 business days and either did not investigate in good faith or had no reasonable basis to believe there was no error, or when it knowingly and willfully concluded there was no error on evidence that could not reasonably support that conclusion (§ 1693f(e)). The tripling applies to your actual damages, not to the statutory range.

The credit union can defend by showing a bona fide error despite reasonable procedures, and the statute allows fees against a member who sues in bad faith or to harass, so I evaluate the file before recommending a claim. You don't pay me unless you win. I take these cases on contingency: no attorney's fees and no case costs owed to me unless you recover money. If a case is lost, a court can sometimes order the losing side to pay the other side's court costs, and some Florida laws, including the security deposit and deceptive practices statutes, also let the winner recover attorney's fees from the loser. I explain that risk before anything is filed, and every term is in a written agreement before you sign.

How long do I have after a credit union denial?

One year from the violation to bring an EFTA claim, and for a mishandled dispute a Florida federal court has counted that year from the credit union's missed deadline rather than the transaction. If your agreement requires a pre-arbitration demand period, as MidFlorida's does, build that time into your plan rather than waiting until the last month.

The one-year period is in the statute (15 U.S.C. § 1693m(g)), and Katz is the Florida decision starting it at the institution's failure. Measure from the first disputed transaction to be safe. Some courts have paused the clock for fairness reasons; do not plan on it.

Two shorter windows also apply: report any unreported transaction within 60 days after the statement showing it was sent, and if you just learned a card or login was compromised, report within 2 business days to keep your share at $50 or less. If the credit union has denied the claim, ask for the documents now so you can act on them with time to spare.

What to do today

• Report any unreported transaction by phone, then in writing to the address your account agreement gives for electronic transfer errors, listing each by date, amount, and description.
• Return the affidavit if you were given one, keep a copy, and note the date you first reported; the deadlines run from that date, not from the affidavit.
• Request the investigation documents in writing, citing Regulation E and asking for everything the credit union relied on to find no error.
• Find your charter and your clause: look up your credit union in the NCUA's Research a Credit Union tool, and read the arbitration section of your account or membership agreement, including any opt-out window or active-duty carve-out.
• Gather these documents: the denial letter; statements from before the first transaction through today; the affidavit or statement you submitted; impostor texts, the call log, or evidence of where the card was skimmed; the claim number and a log of each call; your written confirmation and delivery proof; and fee or returned-item notices caused by the transactions or by a reversed credit.
• Secure the account: new card, new passwords, two-step verification, and a review of devices and payees linked to your profile.
• Send it to me. Request a free case review and attach the denial, statements, and agreement. I'll tell you what the credit union had to prove, whether it met its deadlines, and where your claim would be heard.

Sources: 15 U.S.C. §§ 1693a(12), 1693f(e), 1693g(b), 1693m(a), (b), (c), (f), (g); 12 C.F.R. §§ 1005.2(b), 1005.2(m), 1005.6(b), 1005.11(b), (c), (d); Official Interpretations to Regulation E, comments 2(m)-3, 6(b)-2, 11(b)(1)-2, 11(c)-2, 11(c)-3, 11(c)(4)-5; CFPB, Electronic Fund Transfers FAQs (page last modified January 16, 2025); Fla. Stat. ch. 657 and Florida Office of Financial Regulation credit union pages; NCUA Research a Credit Union profiles for charters 68645 (Suncoast), 68490 (VyStar), and 68600 (MIDFLORIDA); Suncoast Credit Union Account Agreement and Disclosures (EFT sections rev. 08/01/2026) and Transaction Dispute page; VyStar Credit Union Membership Agreement and Disclosures effective July 1, 2025 and Reporting Fraud page; MIDFLORIDA Credit Union Terms and Conditions (March 2026) and card disputes page; CFPB Consent Order, In re VyStar Credit Union, File No. 2024-CFPB-0013 (Oct. 31, 2024), terminated July 21, 2025; Monroe v. Grow Financial Federal Credit Union (Dec. 5, 2022), 2022 WL 17417034 (M.D. Fla.); Katz v. JPMorgan Chase, 2015 WL 11251764 (S.D. Fla. Feb. 10, 2015); Rallis v. First Gulf Bank, 2008 WL 4724745 (N.D. Fla. Oct. 24, 2008); Fla. Stat. § 501.212. Last reviewed October 8, 2026.