Last reviewed September 22, 2026 by Jackson McMillan, Florida attorney
The Electronic Fund Transfer Act (EFTA) and its rules, called Regulation E, cover debit card and ATM transactions, ACH (automatic) debits, online and person-to-person transfers from bank accounts, and prepaid and payroll cards. They don't cover wire transfers or paper checks, and credit cards follow different rules (see below). A transfer is "unauthorized" when someone else started it without your actual authority and you got no benefit, including when a thief got your card, PIN, or login through fraud or robbery (12 C.F.R. § 1005.2(m) and comment 2(m)-3).
Step 1: Report it fast
How much you can lose depends on when you tell the bank (12 C.F.R. § 1005.6(b)). A card, PIN, or login counts as an "access device."
| When you report | The most you can owe |
|---|---|
| Within 2 business days after you learn your card, PIN, or login was lost or stolen | $50, or the amount taken before you reported, if less |
| Later than that, but within 60 days after the bank sent the statement showing the first unauthorized transfer | Up to $500 |
| More than 60 days after that statement was sent | The amounts above, plus transfers made after the 60 days and before you reported, if the bank shows they would not have happened had you reported on time |
| No card, PIN, or login was involved (for example, an unauthorized ACH debit) | Nothing, if you report within 60 days after the statement was sent. After that, only later transfers the bank shows on-time notice would have prevented. |
Carelessness, like writing your PIN on your card, does not raise these limits. If something like a long trip or a hospital stay kept you from reporting, the bank must extend these time periods to a reasonable time (§ 1005.6(b)(4)). Your account agreement may also promise more.
Step 2: Lock down your accounts
- Lock or cancel the card, change your banking and email passwords, and turn on two-step verification.
- Check for new payees, linked accounts, or a changed phone number or email.
- If your phone suddenly lost service, call your carrier. Someone may have moved your number.
- Keep texts, emails, and call logs from the thief. They are evidence.
Step 3: Call the bank, then put it in writing
Call the fraud number on your card or in your app, and write down the date, time, who you spoke with, and the claim number.
Then send written notice to the error-resolution address in your account agreement or disclosures, usually in a section titled something like "In case of errors or questions about your electronic transfers." A call counts as notice, but the bank may require written confirmation within 10 business days, and if it asks and you don't send it, the bank may not have to provisionally credit your account (12 C.F.R. § 1005.11). Use certified mail, return receipt requested, and keep a copy.
What to include in your notice
- Your name and account number
- The date, amount, and description of each transfer you dispute
- A clear statement that you didn't make or authorize them and got no benefit
- When you learned about them, when your card or phone was lost or stolen (if it was), and your phone report's date and claim number
- A request for the documents the bank relies on if it finds no error
Step 4: Know the bank's deadlines
- Within 60 days after the statement is sent
You tell the bank about the error, by phone or in writing.
- Within 10 business days after your call
You send written confirmation, if the bank asked for it.
- Within 10 business days
The bank must finish investigating, or provisionally credit your account so you can use the money while it keeps going. For a new account (generally, a transfer within 30 days after the first deposit), this is 20 business days.
- Within 45 days
A bank that gave provisional credit must finish investigating. This is 90 days for point-of-sale debit card purchases, transfers started outside the United States, and new accounts.
- Within 3 business days after it finishes
The bank must tell you the results. If it finds no error, it must explain why in writing and tell you that you can ask for the documents it relied on.
Provisional credit is temporary. If the bank concludes there was no error, it can reverse the credit, but it must notify you when it does.
Step 5: If the bank denies your claim
Ask in writing for copies of the documents the bank relied on. They often show what the bank actually looked at. A denial saying "your PIN was used" or "it came from your device" doesn't settle the question: a transfer is still unauthorized if the person who made it got your card, PIN, or login through fraud or robbery.
When a bank breaks these rules, the EFTA lets you sue for actual damages, statutory damages of $100 to $1,000, and reasonable attorney's fees and costs (15 U.S.C. § 1693m). Treble damages are possible in some cases, such as when a bank didn't provisionally credit your account within 10 business days and didn't investigate in good faith (§ 1693f(e)). You generally have one year from the violation to sue (§ 1693m(g)). Read more about what to do when your bank denies a fraud claim.
Report identity theft and consider a complaint
If the thief used your personal information, for example to open accounts, report it at IdentityTheft.gov, the Federal Trade Commission (FTC) site that creates an identity theft report and recovery plan. Security freezes at the credit bureaus are free. See identity theft on your credit report.
You can also file a free complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov/complaint. It creates a record, but it doesn't replace your written notice to the bank or stop the one-year clock.
Sample Regulation E dispute letter
Copy this notice of error, fill in the highlighted placeholders, and delete what doesn't apply.
[Your full name]
[Street address]
[City, State ZIP]
[Phone number and email]
[Date]
[Bank name]
[Error-resolution address from your account agreement or disclosures]
Sent by certified mail, return receipt requested
Re: Notice of error under Regulation E
Account number: [Account number]
Claim number: [Claim number, if you already called]
To whom it may concern:
I am writing to notify you of an error on my account under the Electronic Fund Transfer Act and Regulation E (12 C.F.R. § 1005.11). The following electronic fund transfers were unauthorized:
[Date], [Amount], [Description as shown on your statement]
[Date], [Amount], [Description as shown on your statement]
I did not make these transfers, I did not give anyone permission to make them, and I received no benefit from them. I first learned of them on [Date]. [If it applies, explain how it happened. For example: My card was stolen on June 3, 2026. Or: A caller pretending to be your fraud department tricked me into reading them a one-time passcode on June 3, 2026.]
[If you called first:] I reported these transfers by phone on [Date]. This letter confirms that notice in writing.
Please investigate, correct this error, and credit my account for [Total amount]. If you need more than 10 business days to investigate, Regulation E requires you to provisionally credit my account within 10 business days. Please send me the results in writing. If you conclude that no error occurred, please send me copies of the documents you relied on.
Enclosures: [Copy of your statement with the transfers marked; police report or FTC identity theft report, if any]
Sincerely,
[Signature]
[Printed name]
What if it was a credit card?
Credit cards are covered by the Truth in Lending Act, not Regulation E. Your liability for unauthorized credit card use is capped at $50 (15 U.S.C. § 1643). To use the Fair Credit Billing Act dispute process, send written notice to the billing-error address on your statement within 60 days after the card issuer sent the first statement showing the charge (15 U.S.C. § 1666). A phone call alone does not start that process.
What if you sent the money yourself because of a scam?
I want to be straight about this one. If you made the payment yourself, for example to a fake seller, a romance scammer, or someone posing as your bank who told you to "move your money to safety," it is generally not "unauthorized" under Regulation E. No federal rule currently requires banks to refund payments you sent yourself after being tricked.
That is different from a scammer who tricks you into sharing a one-time code or your login and then makes the transfer. CFPB guidance treats that transfer as unauthorized. Either way:
- Report it to the bank right away. A fast report sometimes lets the bank stop a payment or contact the receiving bank.
- Ask whether the bank has a voluntary reimbursement policy for scams.
- Report it at ReportFraud.ftc.gov and to local police.
- Get advice about your facts before you give up. See Zelle, Cash App, and Venmo fraud.
If your claim was denied
If you reported unauthorized transfers and the bank still won't return your money, send me the denial letter, your statements, and your notes. I'll review them and tell you whether the EFTA gives you a claim. No attorney's fees or costs owed to me unless you recover.