How federal law covers payment apps
The Electronic Fund Transfer Act (EFTA) and its rules, called Regulation E, limit what you can lose to an unauthorized transfer and require the financial institution to investigate when you report one. Who handles your claim depends on where the money came from.
Zelle
Zelle moves money directly out of your bank account, so your bank is responsible for investigating. File your claim with your bank, not with Zelle.
Cash App, Venmo, and PayPal balances
A balance in an app that you can use to send money to other people is a "prepaid account" under Regulation E (12 C.F.R. § 1005.2(b)(3)(i)(D)). The company running the app is a financial institution with the same basic duties: limiting your liability and investigating errors you report.
Transfers funded by a linked card or bank account
If the app pulled the money from your linked debit card or bank account, that can also be an electronic fund transfer from your bank account. Report it to the app and to your bank.
If you never completed the app's identity verification, that balance can fall outside Regulation E's liability limits and error-resolution rules (12 C.F.R. § 1005.18(e)(3)(i)). Verifying now can protect you going forward, and money pulled from your bank account or debit card may still be protected through your bank.
Which situations count as "unauthorized"?
A transfer is unauthorized when someone else started it without your actual authority and you got no benefit from it (12 C.F.R. § 1005.2(m)). Your login can count as an "access device," just like a card or PIN. Here is how common situations usually come out:
| What happened | Usually covered as unauthorized? | Why |
|---|---|---|
| Someone hacked your account or took over your login and sent your money | Yes | Someone else started the transfer without your authority. |
| A scammer tricked you into reading back a one-time code or sharing your login, then sent the money | Yes, under CFPB guidance | The Consumer Financial Protection Bureau (CFPB) says a transfer is unauthorized when you are tricked into sharing account access and the fraudster makes it. |
| Your phone was stolen and the thief used your app | Yes | Access obtained by theft or robbery doesn't make the transfer yours, and carelessness doesn't increase your liability. |
| You sent the money yourself to a fake seller, landlord, romance scammer, or impostor | Generally no | You started the transfer, so it usually isn't "unauthorized." Other remedies or voluntary bank or app policies may exist. |
| Someone you gave access to sent more than you allowed | Not until you revoke | Transfers by that person aren't unauthorized until you tell the provider they are no longer allowed to make them. |
What to do right now
- Report it in the app and to your bank. Use the app's dispute option, and notify your bank if the money came from your bank account or a linked debit card. For Zelle, go straight to your bank. Follow up in writing at the error-resolution address in the account disclosures.
- Take screenshots of the transfer, the recipient's name or handle, messages, login alerts, and every response from the app or bank. Save copies outside the app.
- Lock things down. Change passwords, turn on two-step verification, and call your phone carrier if your number stopped working.
- Don't send more money. Scammers often come back posing as the bank, the app, or a "recovery" service that promises to get your money back for a fee.
- Watch the clocks. Report within 60 days after the statement showing the transfer is sent (for app balances, the clock can start when the transfer shows up in your account history), and within 2 business days of learning your phone, card, or login was stolen to keep your liability at $50 or less. You generally have one year from the violation to sue (15 U.S.C. § 1693m(g)).
- If your claim is denied, ask for the documents. When a bank or app finds no error, it must explain why in writing and tell you that you can request copies of the documents it relied on.
My step-by-step guide on how to dispute an unauthorized transaction covers the deadlines in detail and includes a sample letter.
Bank won't refund a Zelle scam?
The first question is who actually sent the money. If a scammer got into your account or talked you into sharing a code and then made the transfer, it can be unauthorized, and a denial may be worth challenging. See what to do when your bank denies a fraud claim.
If you sent the payment yourself, no federal rule currently requires your bank or the app to refund it. Still report it right away, ask whether your bank or the app has a voluntary reimbursement policy for scams, report it at ReportFraud.ftc.gov and to local police, and get advice before you give up.
What the law allows
When a bank or payment app gets an unauthorized transfer claim wrong, the EFTA lets you sue for actual damages, statutory damages of $100 to $1,000, and reasonable attorney's fees and costs (15 U.S.C. § 1693m). Treble damages are possible in some cases, such as when the institution didn't provisionally credit your account within 10 business days and didn't investigate in good faith (§ 1693f(e)). You don't pay me unless you win. I take these cases on contingency: no attorney's fees and no case costs owed to me unless you recover money. If a case is lost, a court can sometimes order the losing side to pay the other side's court costs, and some Florida laws, including the security deposit and deceptive practices statutes, also let the winner recover attorney's fees from the loser. I explain that risk before anything is filed, and every term is in a written agreement before you sign.