What Regulation E Protects

Regulation E is a federal rule that limits how much money you can lose if someone uses your debit card, bank account, or electronic transfer without permission. It sets the timeline your bank must follow to investigate fraud, and it caps your liability — meaning the maximum amount you have to pay out of pocket.

The rule covers debit cards, ATM cards, online banking transfers, wire transfers, and automatic bill payments. It does not cover credit cards (those have different protections under a different regulation) or checks written on paper. If someone steals your card number or hacks your account, Regulation E is what forces your bank to act and limits your personal loss.

The protection applies whether the fraud happens in person, online, over the phone, or through a compromised ATM. It also covers errors your bank makes — like posting a transaction twice or crediting the wrong account — because the bank's mistake is treated the same way as fraud for purposes of investigation and refund.

Key Takeaways

  • Your maximum liability for unauthorized debit card or account use is $50 if you report it within two business days, and $500 if you wait longer than two business days but report within 60 days.
  • Your bank must investigate any disputed transaction and return your money within one to ten business days while the investigation is open, depending on the type of transaction.
  • You must report fraud or errors to your bank in writing or by phone, and the bank must acknowledge your report within one business day.
  • Regulation E covers debit cards, ATM cards, online transfers, and automatic payments, but not credit cards or paper checks.
  • If your bank fails to investigate properly or return your money on time, you can file a complaint with the Consumer Financial Protection Bureau or your state banking regulator.

How Much You Can Lose Under Regulation E

Your liability depends on how fast you report the fraud. If you call or write your bank within two business days of noticing an unauthorized transaction, you are liable for no more than $50 of the loss. That $50 is your maximum out-of-pocket cost — your bank covers the rest.

If you wait longer than two business days but report within 60 days of your statement, your liability jumps to $500. If you wait more than 60 days after your statement shows the fraud, you could lose everything in the account up to the point the bank learns of the problem. This is why speed matters: the two-day window is the difference between a $50 cap and a $500 cap.

Some banks offer zero-liability policies that go beyond Regulation E — meaning they cover 100 percent of fraud even if you wait to report it. Check your bank's specific fraud policy, because it may be more generous than the federal minimum.

What Your Bank Must Do When You Report Fraud

When you report an unauthorized transaction, your bank must send you written confirmation within one business day. This confirmation should include your name, the date you reported it, a description of the transaction you disputed, and the dollar amount. Keep this confirmation — you will need it if the bank drags its feet or denies your claim.

Your bank then has between one and ten business days to put the money back into your account while it investigates, depending on the type of transaction. For most debit card fraud, the timeline is shorter — usually three to five business days. For electronic transfers and ACH payments, it can take up to ten days. The bank does not have to wait until the investigation is finished to return your money; it returns it first and investigates after.

The bank must complete its investigation and tell you the results within 45 days of your report. If the investigation takes longer, the bank must return your money anyway and can only take it back if it finds clear evidence that the transaction was actually authorized. If the bank cannot prove you authorized it, the money stays with you.

How to Report Fraud or Errors Under Regulation E

Contact your bank by phone or in writing as soon as you spot the problem. Calling is fastest — it starts the clock on the two-business-day window for the $50 liability cap. Write down the name of the person you spoke to, the time you called, and what you reported.

Follow up with a written notice within 10 days. Send it to the address your bank lists for disputes — usually on the back of your statement or on their website. Include your account number, the date and amount of the disputed transaction, and a brief explanation of why you believe it is unauthorized or wrong. Send it certified mail with return receipt so you have proof the bank received it.

Do not assume the bank will act on a phone call alone. Some banks do, but others will not start the formal investigation clock until they receive written notice. Sending the letter protects you if the bank later claims it never heard from you.

Transactions Regulation E Does Not Cover

Regulation E does not protect credit card transactions — those fall under a different federal rule that gives you even stronger protections (you can dispute charges and owe nothing while the bank investigates). It also does not cover paper checks, even if someone forges your signature, because check fraud is handled under state law and the Uniform Commercial Code instead.

Securities and investment accounts are not covered, nor are safe deposit boxes or wire transfers you authorized but later regret. If you sent money to a scammer on purpose — even if you were tricked into doing it — Regulation E does not help you recover it. The rule only covers transactions you did not authorize at all, or errors the bank made.

Transactions at merchants who are not banks also fall outside Regulation E's direct reach. If a store's payment system is hacked and your card is compromised, Regulation E still protects you against your bank, but the store itself is not regulated by this rule.

What Happens If Your Bank Ignores Regulation E

If your bank refuses to investigate, misses the deadline to return your money, or fails to send you written confirmation of your report, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB will forward your complaint to the bank and track whether it responds.

You can also file a complaint with your state's banking regulator — usually the state attorney general's office or the state banking commissioner. These agencies can fine banks that violate Regulation E repeatedly or take action against their license.

In some cases, you may have the right to sue your bank in small claims court or file a class action lawsuit if the bank's violation caused you financial harm. You would need to show that the bank broke the rule and that you lost money as a result. Many banks settle these cases rather than go to trial.

Frequently Asked Questions

Does Regulation E cover my credit card?

No. Credit cards are protected under the Fair Credit Billing Act, which is actually stronger — you owe nothing while the card company investigates fraud. Regulation E covers debit cards, ATM cards, and electronic transfers from your bank account.

What if I report fraud after 60 days?

You lose the liability cap. Your bank is no longer required to return your money under Regulation E, though many banks will still investigate as a courtesy. Report fraud as soon as you spot it to stay within the 60-day window.

Can my bank take the money back after it refunds me?

Only if it finds clear evidence that you authorized the transaction. If the bank cannot prove authorization, the refund is permanent. The bank bears the burden of proof, not you.

Does Regulation E cover money I sent to a scammer?

No. If you authorized the transfer — even if someone tricked you into doing it — Regulation E does not apply. The rule only covers transactions you did not authorize or errors the bank made.

How long does a Regulation E investigation usually take?

Most investigations finish within 10 to 15 business days. Your bank has up to 45 days by law, but most resolve faster. Your money goes back into your account within three to ten business days while the investigation is open, regardless of how long the investigation takes.