Money leaves your account and you did not send it. The first question is simple: who pays? Federal rules answer it. Regulation E, which implements the Electronic Fund Transfer Act, sets the framework for unauthorized electronic transfers. Your liability depends heavily on how fast you speak up.
What Counts as an Unauthorized Transfer
Under Regulation E, an unauthorized transfer is one started by someone other than you, who had no actual authority to start it. The rules cover debit card, ACH, prepaid account, and mobile or person-to-person payments that meet the definition of an electronic fund transfer. A payment you make yourself generally does not count, even if you regret the purchase later.
Scams complicate this. According to the CFPB's Electronic Fund Transfers FAQs, a transfer can still be treated as unauthorized when a third party tricks you into handing over account information. A caller posing as a bank representative is the example the guidance gives. Treat any unexpected call asking for account details as a red flag.
The Reporting Windows and What They Cost
Liability is limited by the timing of your notice. If you tell the bank within two business days after learning your access device was lost or stolen, you owe no more than the lesser of $50 or the unauthorized transfers made before you gave notice.
Miss that window and the cap rises to the lesser of $500 or a sum of two parts. The first part is $50, or the amount taken in those first two days if that is less. The second part is unauthorized transfers after the two days and before notice, but only if the bank establishes they would not have happened had you reported on time.
Here is a worked example. Say a thief takes $40 on day one, and you report on day two. You owe $40, since that is less than $50. Now say $300 is taken in the first two days, and a further $400 is taken on day five. You report on day six. The first part is $50. The second part is $400, if the bank shows that report on time would have stopped it. The sum is $450, which is under $500, so you could owe $450. If the later losses were $600, the cap would hold you at $500.
Statements add a second clock. If an unauthorized transfer shows up on a periodic statement, you must report it within 60 days of the bank sending that statement. If you do not, you can be held liable for later unauthorized transfers that the bank shows would have been prevented by timely notice. The $50 and $500 tiers, as described in the regulation, are framed around loss or theft of an access device, so check the rule text for how your situation fits.
What the Bank Must Show First
A bank cannot simply declare you responsible. Consumer liability applies only after the institution investigates your notice and confirms the transfer was unauthorized. It also must have given you certain disclosures beforehand:
- A summary of your liability under Regulation E.
- A telephone number and address for reporting an unauthorized transfer.
- The bank's business days.
Without those disclosures, the bank cannot hold you liable for the transfer.
If a card, code, or other access device was involved, the device must be an accepted access device. That means you requested and received it, signed it, or used it to get money, property, or services. It can also mean you received a renewal or substitute from the issuer. The bank must also have provided a way to identify you as the person the device was issued to. If the bank cannot show an accepted device, it cannot hold you liable at all for that transfer.
One more point from the CFPB FAQs: a bank cannot rely on your negligence to impose more liability than Regulation E allows. Careless handling of a card does not lift the caps.
What to Gather Before You Call
The sources do not explain how to file a notice or what to include, so check your account agreement and the number printed on your statement. Still, a few practical steps can help you give a clear report:
- Write down the date and time you first learned of the loss, theft, or odd charge.
- List each transaction you do not recognize, with date, amount, and merchant.
- Note the date of the most recent statement that shows any of them.
- Record how someone might have gotten your details, such as a suspicious call.
- Keep the name of the person you speak with and the date you gave notice.
After you report, the bank must investigate. A confirmed error can lead to provisional or final credit. The sources do not give timelines for the investigation or the credit, so ask the bank directly and review your account agreement.
This article does not cover credit card rules, which differ, or state laws that may add protections. For your own situation, consult a qualified financial or legal professional.
