Your bank is responsible for most unauthorized transactions, but the speed of your report matters
When someone fraudulently accesses your bank account and moves money out, your bank must reimburse you for those losses—with one major condition: you have to report the fraud within a specific window. Federal law (Regulation E) requires banks to cover unauthorized electronic transfers if you report them within 60 days of receiving your statement. Report after 60 days and you lose protection entirely. Report within two business days of discovering the fraud and your liability caps at $50. Wait longer and your personal liability can climb to $500 or more, depending on how long you waited.
The bank's responsibility does not mean the money comes back instantly. Most banks take 10 business days to investigate a claim and another 5 to 10 days to return funds once they confirm the fraud. During that time, your account may be overdrawn, checks may bounce, and you may face overdraft fees—which the bank may or may not refund depending on their policy and whether they find the fraud was their security failure.
Key Takeaways
- Report unauthorized transactions to your bank within 60 days of your statement date or you forfeit federal fraud protection entirely.
- Your personal liability is capped at $50 if you report within two business days, but can reach $500 if you wait longer.
- Banks must investigate and respond within 10 business days, though refunds typically take another 5 to 10 days to post.
- If the bank's own security failure enabled the fraud—such as failing to implement chip readers or ignoring known vulnerabilities—you may have grounds to dispute their liability information.
- Credit card fraud is handled differently than debit card or bank account fraud, with stricter liability limits for cardholders.
How the 60-day reporting window works
The clock starts the moment your bank sends you a statement showing the unauthorized transaction. That statement arrives by mail or email depending on your account setup. If you receive statements monthly, you have 60 days from that statement date to contact your bank and report the fraud. If you discover the fraud before the statement arrives—because you check your account online and see a strange withdrawal—you still have until 60 days after the statement date to report it, not 60 days from the day you discovered it.
This distinction matters because many people discover fraud weeks before their official statement arrives. If you spot a $300 unauthorized transfer on a Tuesday and your statement does not arrive until the following Monday, your 60-day window does not start until that Monday. However, if you wait to report until day 65 of that window, the bank can deny your claim entirely. The safest approach is to report any suspicious transaction the same day you notice it, in writing (email or through your online banking portal), so you have a timestamped record.
Your liability depends on how fast you report
Federal law creates three liability tiers based on when you report the fraud. If you report within two business days of discovering the unauthorized transaction, your maximum personal liability is $50. This is the best-case scenario and applies whether the fraud was a single large transfer or multiple smaller ones.
If you report between three and 60 days after your statement date, your liability jumps to $500. This means if $2,000 was stolen, you absorb the first $500 and the bank covers the remaining $1,500. If you report after 60 days, you may be liable for the entire amount, though some banks have internal policies that cap liability even beyond the federal requirement. Check your account agreement or call your bank's fraud line to learn their specific policy.
The two-business-day clock is strict. Weekends and bank holidays do not count. If you discover fraud on a Friday evening, you have until close of business on Monday to report it and lock in the $50 liability cap. Many banks offer 24/7 fraud reporting by phone or through their mobile app specifically to help customers meet this deadline.
What happens during the bank's investigation
Once you report fraud, the bank must acknowledge your claim in writing within one business day. They then have 10 business days to investigate and determine whether the transaction was truly unauthorized. During this period, the bank may freeze your account, restrict access to funds, or require you to provide additional documentation such as a police report or proof that you did not authorize the transaction.
The bank's investigation typically involves reviewing the transaction details—the IP address or device used, the location, the time of day, and whether the transaction matches your normal spending patterns. If the transaction was made using your debit card at an ATM or point of sale, the bank may request video footage from the location. If it was an online transfer, they examine login records and whether the transfer went to an account in your name or a third party's account.
If the bank concludes the transaction was unauthorized, they must return the funds to your account within one business day of that information. If they conclude you authorized it or cannot determine either way, they must notify you in writing with an explanation. You then have the right to dispute their decision, though the burden shifts to you to prove the transaction was not yours.
When the bank itself is liable for the fraud
Banks are not always blameless in fraud cases. If the bank's security failure directly enabled the fraud, you may have grounds to challenge their liability information or pursue a claim beyond Regulation E protections. Common examples include a bank that failed to implement chip technology on debit cards (making them easier to clone), ignored a known security vulnerability in their online banking system, or failed to flag a transfer to a new payee despite your account history showing no such transfers.
If you believe the bank's negligence contributed to the fraud, document everything: the date you reported it, the bank's response, and any evidence of the security failure. Contact your state's banking regulator (usually the state Department of Financial Services or equivalent) and file a complaint. You can also consult an attorney about whether the bank violated the Gramm-Leach-Bliley Act or other regulations that impose security standards on financial institutions.
Banks are also responsible for fraud committed by their own employees. If a bank teller or customer service representative used your account information to transfer funds, the bank is liable regardless of the reporting timeline, because the fraud was committed by someone with authorized access to your account.
Debit card fraud versus credit card fraud
Debit card fraud and credit card fraud have different liability rules, and the difference matters. With a debit card, your own money is at risk, and liability depends on how fast you report (as described above). With a credit card, the card issuer's money is at risk, and your liability is capped at $50 regardless of when you report, as long as you report before the fraudulent charge is paid.
This means if someone uses your credit card number to make a $5,000 purchase, you are liable for only $50 and the credit card company absorbs the rest. If someone drains your debit card account for $5,000 and you report it on day 61, you may be liable for the entire amount. This is why many security experts recommend using credit cards for online purchases and keeping debit cards for ATM withdrawals only.
Credit card companies also tend to investigate fraud faster than banks do, often resolving claims within 30 days rather than the full 10 business days allowed by law. However, during the investigation period, the charge remains on your statement and may affect your credit utilization ratio if you carry a balance.
What to do if the bank denies your fraud claim
If the bank investigates and concludes the transaction was authorized—or if they simply do not respond within the required timeframe—you have options. First, request a detailed written explanation of their decision. Banks must provide specific reasons, not a generic denial. If their reasoning is weak or contradicts the facts (for example, they claim you authorized a transfer to an account you have never heard of), you can dispute their information in writing.
Send a formal dispute letter to the bank's fraud department, citing Regulation E and explaining why their conclusion is incorrect. Include copies of any supporting evidence: statements showing you were out of state when the transaction occurred, proof that you did not receive a confirmation email, or documentation that the receiving account is not yours. Keep a copy for your records and send the letter via certified mail so you have proof of delivery.
If the bank still refuses to refund you, file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB investigates complaints against banks and can compel them to respond. You can also contact your state's banking regulator or attorney general's office. These agencies have authority to fine banks for violating Regulation E and can sometimes force refunds in cases where the bank's investigation was inadequate.
Protecting yourself from future fraud
While the bank covers most fraud losses, prevention is far simpler than recovery. Enable transaction alerts on your debit and credit accounts so you receive a notification (via text or email) the moment a charge posts. Review your statements weekly rather than monthly, so you catch fraud within days rather than weeks. Use strong, unique passwords for your online banking account and enable multi-factor authentication if your bank offers it.
For online purchases, use a credit card rather than a debit card. For bill payments, use your bank's bill pay feature or pay directly through the biller's website rather than mailing checks or providing your account number to third parties. If you receive a suspicious email or text claiming to be from your bank, do not click any links—instead, call the number on the back of your card or log into your account directly through the bank's website.
Monitor your credit reports for signs of identity theft (such as accounts you did not open). You can request a free credit report from each of the three major bureaus (Equifax, Experian, and TransUnion) once per year at annualcreditreport.com. If you spot fraud on your credit report, place a fraud alert with the bureaus and consider a credit freeze, which prevents new accounts from being opened in your name without your explicit permission.
Frequently Asked Questions
How long does it take to get my money back after I report fraud?
The bank must investigate within 10 business days and return funds within one business day of confirming the fraud. In practice, refunds typically appear in your account within 5 to 10 business days after you report it. Some banks process faster, especially for large or obvious fraud cases. During the investigation period, the funds remain unavailable.
What if I reported the fraud but the bank says I authorized it?
Request a detailed written explanation of their decision. If you believe they are wrong, send a formal dispute letter citing Regulation E and include any evidence (such as proof you were out of state, or that the receiving account is not yours). If the bank still refuses, file a complaint with the Consumer Financial Protection Bureau or your state's banking regulator.
Am I responsible for fraud if someone got my PIN?
If someone used your PIN to withdraw cash or make a debit card purchase, the liability rules are the same as any other unauthorized transaction: $50 if you report within two business days, up to $500 if you report later. However, if the bank failed to implement reasonable security measures (such as requiring a signature or chip verification), you may have grounds to challenge their liability information.
Does fraud protection cover wire transfers and ACH payments?
Yes, Regulation E covers unauthorized electronic transfers, including wire transfers and ACH payments initiated from your account. However, if you authorized the transfer but the recipient was fraudulent (for example, you sent money to a scammer posing as your landlord), the bank is not liable. The protection covers unauthorized access to your account, not unauthorized decisions about where to send money.
What if my bank is taking too long to investigate?
Banks have 10 business days to investigate and respond. If they miss this deadline, they must refund the disputed amount while they continue investigating. Document the date you reported the fraud and follow up in writing if you have not heard back by day 10. If the bank continues to delay, file a complaint with the CFPB or your state's banking regulator.