What your bank will and won't reimburse after fraud

Banks are required by federal law to reimburse you for unauthorized transactions on a checking account, but the amount depends on how quickly you report the fraud and what type of account access was compromised. If you report within two business days of discovering the fraud, you lose a maximum of $50 of your own money. If you wait longer than two business days but report within 60 calendar days of your statement, you could lose up to $500. If you don't report within 60 days, the bank owes you nothing—you absorb the full loss.

This protection comes from the Electronic Funds Transfer Act (EFTA), which covers debit cards, ATM cards, online transfers, and ACH debits. It does not cover checks, wire transfers, or credit card fraud (credit cards have their own, more generous rules). The bank's obligation is real, but the timeline is strict, and "discovering" fraud means the moment you could reasonably have noticed it—not the moment you actually did.

Key Takeaways

  • Report fraud within two business days to limit your loss to $50; waiting longer can cost you up to $500 or the entire amount.
  • The EFTA covers debit cards, ATM withdrawals, and electronic transfers, but not checks or wire transfers sent by you.
  • Your bank's specific policy may be more generous than the law requires, so check your account agreement or call to ask.
  • Document everything: the date you discovered the fraud, the date you reported it, the transaction details, and the name of the person you spoke to at the bank.
  • If the bank denies your claim, you can file a complaint with the Consumer Financial Protection Bureau or your state's banking regulator.

The two-business-day window and why it matters

The moment you notice an unauthorized transaction, the clock starts. You have until the end of the second business day after discovery to report it to your bank and cap your liability at $50. Business days mean Monday through Friday, excluding federal holidays. If you discover fraud on a Friday afternoon, you have until the end of business on Tuesday to report it.

Most banks accept fraud reports by phone, online, or in person. Call the number on the back of your debit card or log into your online banking portal—do not use a phone number from an email or text, as that could be part of the scam. When you report, have the transaction details ready: the date, amount, and merchant name. Ask the bank to confirm the report in writing, either by email or by mailing you a letter. Keep that confirmation.

If you miss the two-business-day window, you move into the 60-day window. You still have until 60 calendar days after your statement arrives to report the fraud, but now your maximum loss jumps to $500. After 60 days, the bank has no obligation to reimburse you at all.

What counts as "discovery" and why banks interpret it strictly

Discovery does not mean the moment you personally looked at your account. It means the moment you should have reasonably looked at it. If your bank sends you a statement every month and you never check it, and fraudulent charges appear on that statement, the bank will argue you should have discovered them within 30 days of the statement date—not weeks later when you finally opened the email.

This matters because banks use the discovery date to calculate your two-business-day window, and they will push back if you report fraud months after it occurred. If you report a $2,000 unauthorized withdrawal that happened 90 days ago, the bank will likely deny the claim entirely, saying you should have discovered it sooner.

To protect yourself, check your account at least weekly—more often if you use your debit card frequently. Set up account alerts through your bank's app or website so you get notified of large transactions or withdrawals. These alerts don't prevent fraud, but they shrink the gap between when fraud happens and when you discover it.

Types of transactions covered and not covered

The EFTA covers electronic transfers only. This includes debit card purchases (online and in-store), ATM withdrawals, ACH debits (automatic bill payments), and transfers you initiated online or by phone. If someone steals your debit card number and makes purchases, you are covered. If someone sets up an unauthorized automatic payment from your account, you are covered.

Checks are not covered by the EFTA. If someone forges your signature on a check or steals a blank check from your mailbox and cashes it, that is a separate issue governed by different rules. You still have a right to dispute it, but the timeline and your liability are different. Contact your bank immediately if you discover a forged check.

Wire transfers you initiated are also not covered. If you wire money to someone and later realize it was a scam, the bank has no obligation to reverse it under the EFTA. You would need to pursue recovery through the receiving bank or law enforcement. Credit card fraud is not covered either, but credit cards have stronger protections under a different law (the Fair Credit Billing Act), which limits your liability to $50 and gives you more time to dispute.

How to read your bank's specific fraud policy

The EFTA sets the floor, but many banks offer better protection. Some banks reimburse 100% of unauthorized transactions regardless of how late you report, or they extend the reporting window beyond 60 days. Others offer zero-liability policies that cover certain types of fraud the EFTA does not. You need to know what your bank actually promises.

Find your bank's fraud policy in your account agreement or on their website under "Fraud Protection" or "Unauthorized Transactions." Look for these specific details: the maximum amount you are liable for, the reporting deadline, whether the policy covers all electronic transactions or only certain types, and whether the bank reimburses faster if you report in person versus by phone.

If you cannot find the policy online, call your bank's customer service line and ask them to email or mail you a copy. Write down the date you called, the name of the representative, and what they told you. If the bank later denies a fraud claim and cites a policy that contradicts what the representative said, you have documentation to dispute it.

Steps to take immediately after discovering fraud

Step 1: Report to your bank within two business days. Call the number on the back of your card or log into your online account. Do not email or use social media—use a phone call or the official banking app. Tell them the specific transactions that are unauthorized, the dates, and the amounts. Ask them to freeze or cancel the card immediately.

Step 2: Request written confirmation. After you report by phone, ask the bank to send you a written confirmation of the report. This should include the date and time you called, the transactions you reported, and the bank's reference number. Save this email or letter.

Step 3: Monitor your account daily. Check your account every day for the next 30 days to make sure no new unauthorized transactions appear. If they do, report them immediately and update your written record.

Step 4: File a police report if the amount is large. If more than a few hundred dollars was stolen, file a report with your local police or the FBI's Internet Crime Complaint Center (IC3). You do not need the police to investigate—you just need the report number. Some banks require this before they will reimburse large amounts.

Step 5: Follow up in writing if the bank denies your claim. If the bank says it will not reimburse you, send a letter to the bank's fraud department restating your claim, the date you reported it, and the confirmation number. Keep a copy for your records.

What to do if the bank refuses to reimburse you

Banks sometimes deny fraud claims by arguing you were negligent—for example, you wrote your PIN on your card, or you shared your password with someone. Under the EFTA, the bank can only hold you liable for negligence if they can prove it. Suspicion is not enough. If the bank denies your claim, ask them in writing to explain exactly what negligence they are claiming and what evidence they have.

If the bank's explanation does not hold up, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB will forward your complaint to the bank, and the bank has 15 days to respond. You can also file a complaint with your state's banking regulator—search "[your state] banking regulator" to find the right office.

If the amount is large enough to justify the cost, you can also consult a consumer law attorney. Some attorneys work on contingency for EFTA violations, meaning they take a percentage of what they recover rather than charging you upfront. The EFTA allows the court to award you damages plus attorney fees if you win, so the bank's incentive to settle is real.

How to prevent fraud in the first place

No fraud policy is better than having to use one. Use your debit card only for trusted merchants and ATMs. Never give your card number, PIN, or online banking password to anyone, even if they claim to be from your bank. Do not click links in emails or texts claiming to be from your bank—go directly to the bank's website or call the number on your card.

Enable two-factor authentication on your online banking account. This means the bank sends you a code via text or email every time someone tries to log in from a new device. It is not perfect, but it stops most account takeovers. Set up transaction alerts so you are notified immediately of large purchases or withdrawals. Check your credit report once a year at annualcreditreport.com to catch identity theft early.

If you receive a notice that your bank account or card has been compromised in a data breach, change your online banking password immediately and consider requesting a new card even if you have not seen fraudulent charges yet. Criminals often wait weeks or months before using stolen card numbers, so early action can prevent losses.

Frequently Asked Questions

What if I discover fraud more than 60 days after my statement?

The bank owes you nothing under the EFTA. You absorb the full loss. This is why checking your account weekly is critical—the 60-day window is strict and does not extend for any reason. If you discover very old fraud, contact your bank anyway; some banks reimburse as a courtesy, but they are not required to.

Does my bank have to reimburse me while they investigate?

No. The bank can take up to 45 days to investigate before they decide whether to reimburse you. During that time, the money stays frozen or removed from your account. Some banks credit the amount back temporarily while they investigate, but this is optional. Ask your bank what their timeline is.

If someone used my debit card in person, am I still protected?

Yes. The EFTA covers in-person debit card fraud the same way it covers online fraud. Report it within two business days and you lose a maximum of $50. The merchant's security camera footage does not matter for your liability—the bank's obligation is the same.

What if the fraud was my fault because I shared my password?

The bank can hold you liable for negligence, but they have to prove it. Sharing a password is not automatically negligence under the EFTA—the bank has to show you were unreasonably careless. If you shared your password with a family member or trusted person and they misused it, that is a civil matter between you and them, not a bank fraud issue. Contact the police if the person stole from you.

Can I dispute a transaction that was authorized but I want to cancel?

No. The EFTA only covers unauthorized transactions. If you authorized a purchase and now regret it, that is a customer service issue, not a fraud issue. Contact the merchant to request a refund. If the merchant refuses and the transaction was made online or by phone, you may be able to dispute it through your credit card company, but not through your bank's fraud process.