Unauthorized Bank Transfer Dispute: Deadlines, Liability Limits and Your Letter

What should you do first after an unauthorized transfer?

Tell your bank right away, then confirm in writing. Under Regulation E, notice counts when you take reasonable steps to give the bank the information, whether in person, by phone or in writing (12 CFR 1005.6(b)(5)). A letter you mail counts as notice on the day you mail it.

1. Call the number on the back of your card or the bank's fraud line. Write down the date, time, the person's name and any claim number.
2. Ask the bank to lock the card or account and to cancel any pending transfers.
3. Change passwords and security codes for online banking, email and any payment app linked to the account.
4. Send a written notice within 10 business days if the bank asks for written confirmation of your call (12 CFR 1005.11(b)(2)). Do it even if no one asks, so the dates are on paper.
5. Save the evidence: statements, alerts, screenshots of texts or calls from anyone posing as the bank, and your device's login history.
6. Watch for the provisional credit and for a letter with the bank's findings.

A police report can help your records, but the CFPB's Regulation E FAQs say a bank may not delay starting or finishing its investigation while it waits for one.

How much of an unauthorized transfer can you lose?

Your share depends on when you report. Regulation E sets three tiers in 12 CFR 1005.6(b):

If extenuating circumstances delayed your notice, the bank must extend these time limits to a reasonable period (1005.6(b)(4)). If your account agreement or state law sets a lower limit, the lower one applies.

How long does a bank have to investigate an unauthorized transfer dispute?

A bank has 10 business days to investigate and decide. If it needs longer, it may take up to 45 days, but only if it provisionally credits the disputed amount within those 10 business days, tells you within 2 business days, and gives you full use of the money (12 CFR 1005.11(c)).

• Results are due within 3 business days after the investigation ends, and a confirmed error must be corrected within 1 business day.
• Longer periods apply to transfers made within 30 days after an account's first deposit (20 business days, and up to 90 days), and to point-of-sale debit card and foreign-initiated transfers (up to 90 days).
• If the bank finds no error, it must explain its findings in writing and tell you that you can ask for the documents it relied on. It must send copies promptly when you ask.
• If it reverses a provisional credit, it must tell you the date and amount and keep honoring checks and payments to third parties for 5 business days without overdraft fees, for items it would have paid anyway.
• The bank may not require you to contact the merchant first, according to the CFPB's FAQs.

Are Zelle and scam payments covered?

A person-to-person payment is covered by the Electronic Fund Transfer Act and Regulation E when it meets the definition of an electronic fund transfer, according to the CFPB's FAQs. The harder question is whether it was unauthorized.

Regulation E defines an unauthorized transfer as one started by someone other than you, without actual authority, that does not benefit you (12 CFR 1005.2(m)). The CFPB's FAQs address a common scam directly: if a caller posing as your bank tricks you into sharing your login or a one-time code and then sends the money, that transfer is unauthorized. Being tricked into revealing access information is not the same as furnishing an access device.

If you entered and sent the payment yourself, perhaps to a fake seller or a romance scammer, the bank may treat it as authorized, since you started it. That does not end every option. Your bank's or payment app's own policies may offer more, and the facts of how the payment was started matter, so describe them precisely in your letter.

What to put in an unauthorized transfer dispute letter

The notice must let the bank identify your name and account and say why you believe there is an error, including the type, date and amount where you can (12 CFR 1005.11(b)(1)). Add anything that shows you did not start the transfer.

Mark the letter as a notice of error under Regulation E, keep a copy and send it in a way you can track.

Example: how the $50 and $500 tiers play out

Example (hypothetical): a debit card is stolen on a Saturday and the owner notices that afternoon. Thieves make transfers of $300 on Sunday, $500 on Tuesday and $700 on Thursday.

The tiers turn on when the loss or theft became known, so note that date in your letter. Whether a cap applies in a particular case depends on the facts the bank can prove.

What if the bank denies your claim?

Ask in writing for the documents the bank relied on, which Regulation E entitles you to. Then consider a complaint with the Consumer Financial Protection Bureau, which accepts complaints about bank accounts and money transfers; its complaint page says companies generally respond within 15 days.

The federal statute adds a pointed remedy. A court can award treble damages if the bank failed to provisionally recredit within the 10-day period and either did not investigate in good faith or had no reasonable basis to find no error, or if it knowingly and willfully concluded there was no error when the evidence did not support that (15 U.S.C. section 1693f(e)).

For a disputed card purchase instead of a transfer, see chargebacks versus demand letters. If the fraud also hit your credit file, our guide to disputing a credit report error covers identity theft blocks. If the amount fits the small claims limit, see how a demand letter works before small claims.

When an attorney-written bank dispute letter makes sense

A first Regulation E notice to your bank can be a short letter you send yourself. Bringing in a lawyer to write the next letter is reasonable when the bank has denied the claim, when it reversed a provisional credit, when it is calling a fraudster's transfer authorized, or when the loss is large.

Through Talk to My Lawyer, a licensed California attorney writes your letter from your statements, alerts and the bank's findings and sends it on your behalf, marked as a Regulation E notice of error. Any lawsuit under the Electronic Fund Transfer Act is a step to plan with a lawyer.