Your bank covers most unauthorized transactions, but you have to report them

Yes, your bank is required by federal law to cover unauthorized transactions in your checking account — but only if you report them within a specific window. The Electronic Funds Transfer Act (EFTA) limits your liability to $50 if you report the fraud within two business days of discovering it. If you wait longer, your liability can jump to $500. If you wait more than 60 days after your statement arrives, you may lose coverage entirely for transactions that appear on that statement.

The catch is that "your bank covers it" means the bank reverses the fraudulent charges and returns the money to your account — it does not mean you keep the stolen funds on top of a refund. The bank investigates, determines what was unauthorized, and puts that amount back. During the investigation, which typically takes 10 business days, the money may be unavailable to you, though many banks restore it provisionally while they verify.

Not every transaction qualifies for EFTA protection. Wire transfers, checks, and ACH payments you authorized but later regret do not count as fraud. Only transactions you did not authorize at all — a hacker using your debit card number, someone logging into your account without permission, a thief withdrawing cash with a cloned card — fall under the law's protection.

Key Takeaways

  • Report unauthorized transactions to your bank within two business days to limit your liability to $50; waiting longer can raise it to $500 or eliminate coverage.
  • Your bank will investigate and return the fraudulent amount to your account, though it may take up to 10 business days and the money may be unavailable during that time.
  • EFTA protection covers only transactions you did not authorize; it does not cover payments you made yourself or wire transfers you initiated.
  • Debit card fraud, account takeovers, and unauthorized ACH transfers all may have access to for protection, but you must report them in writing or by phone, not just by email.

How to report the fraud and start the investigation

Call your bank's fraud line immediately — do not wait for business hours if the theft happened on a weekend or holiday. Most banks have a 24/7 number on the back of your debit card or on their website. Tell them which transactions were not yours and when you first noticed them. The bank will freeze your account or issue a new card on the spot.

Follow up with a written report within a few days. Some banks accept email; others require a signed letter. Ask the bank which method they need and get a confirmation number for your initial call. This written record is your proof that you reported the fraud within the legal window, and you will need it if the bank later disputes your claim or if you have to file a complaint with your state's banking regulator.

Do not assume the bank will contact you after you report it. Check your account regularly during the investigation period. If the bank denies your claim or only partially refunds you, you have the right to dispute it in writing and request that they review their decision. If they still refuse, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) or your state's attorney general.

What happens to your account while the investigation is underway

Your bank will typically place a hold on your account or freeze it entirely while they investigate. This means you cannot withdraw the disputed amount, and in some cases you cannot access your account at all until the investigation closes. The bank has up to 10 business days to complete the investigation and either restore the money or explain why they are not doing so.

Many banks will provisionally credit you — put the money back into your account — within one to three business days while they continue investigating. This is not the same as a final decision; the bank can still reverse the credit if they determine the transaction was actually authorized. If the bank does provisionally credit you, they will tell you in writing that it is temporary and subject to reversal.

If the investigation takes longer than 10 business days, the bank must notify you in writing and explain why. They can extend the investigation up to 45 days total, but only if they have a good reason — for example, if the fraud involved a third party or if the transaction occurred in another country. During an extended investigation, the bank must still provisionally credit you if you ask for it in writing.

When your bank might deny your claim

Banks can refuse to cover a fraudulent transaction if they find evidence that you authorized it or that you were negligent in protecting your account. Negligence means you did something that made the fraud easier — for example, you wrote your PIN on your debit card, you shared your login credentials with someone, or you ignored suspicious activity for weeks before reporting it.

If your bank denies your claim, they must send you a written explanation within 10 business days. The explanation must describe what they found during their investigation and why they believe the transaction was authorized or why they think you were negligent. If you disagree, you can request that they review the decision and provide additional evidence. You can also file a complaint with the CFPB or your state's banking regulator if you believe the bank made an error.

Some banks also have terms in their account agreement that limit coverage in specific situations — for example, if you did not report the fraud within the legal window or if the fraud involved a wire transfer or check. Read your account agreement or ask your bank what their specific policy is. Different banks may cover more than the law requires, so it is worth asking.

Debit card fraud versus account takeover: different timelines, same protection

If a hacker stole your debit card number and made purchases without accessing your account, that is debit card fraud. You report it to your bank, they cancel the card, and they investigate the charges. You are protected under EFTA, and your liability is limited to $50 if you report within two business days.

If a hacker logged into your online banking account using your username and password, that is an account takeover. They may have changed your password, transferred money out, or set up bill payments to themselves. You are still protected under EFTA, but the investigation may take longer because the bank has to determine whether you authorized the login. If you can show that your password was strong and you did not share it, the bank will usually cover the fraud.

In both cases, the bank will issue you a new debit card and may close your account if the fraud was severe. You will need to update any automatic payments or direct deposits that were tied to the old account number. The bank will provide you with the new account number, and you should contact your employer, creditors, and service providers to make the switch.

What to do if your bank refuses to restore the money

If your bank denies your fraud claim and you believe they made a mistake, you have several options. First, ask the bank to review the decision in writing. Provide any additional evidence you have — screenshots of unauthorized transactions, proof that you reported the fraud on time, documentation that your password was strong, or anything else that supports your claim. Give the bank 10 business days to respond.

If the bank still refuses, file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov. The CFPB will forward your complaint to the bank, and the bank has 15 days to respond. The CFPB does not make the final decision, but they track complaints and can take action against banks that have a pattern of denying valid fraud claims.

You can also file a complaint with your state's attorney general or banking regulator. Contact information is available through your state's government website. Some states have their own consumer protection laws that may offer more protection than EFTA, so it is worth asking what your state requires.

How to reduce the risk of fraud in the first place

Use a strong, unique password for your online banking account — at least 12 characters, with uppercase and lowercase letters, numbers, and symbols. Do not use the same password for multiple accounts. Enable two-factor authentication if your bank offers it; this requires a second form of verification (usually a code sent to your phone) every time you log in from a new device.

Monitor your account regularly. Check your transactions at least once a week, and set up account alerts if your bank offers them. Many banks allow you to receive a text or email whenever a transaction over a certain amount occurs. If you see something suspicious, report it immediately — do not wait for your monthly statement.

Keep your debit card secure. Do not write your PIN anywhere, do not share it with anyone, and do not use it at ATMs or gas pumps that look damaged or unfamiliar. Consider using a credit card instead of a debit card for online purchases; credit cards offer stronger fraud protection under a different law, and fraudulent charges do not come directly out of your bank account.

Frequently Asked Questions

What if I reported the fraud by email but my bank says they did not receive it?

Email is not always reliable proof of notification. Call your bank's fraud line and report it verbally first, then follow up with a written letter or use your bank's online secure message system if they have one. Ask for a confirmation number for your verbal report. If your bank requires a signed letter, send it by certified mail so you have proof of delivery.

Can my bank charge me a fee while they investigate the fraud?

No. Your bank cannot charge you overdraft fees, insufficient funds fees, or any other penalty for transactions that are later determined to be fraudulent. If they do, ask them to reverse the fees and file a complaint with the CFPB if they refuse.

What if the hacker transferred money to another bank account?

The bank that received the money (the receiving bank) may be able to recover it if you report the fraud quickly. Your bank will contact the receiving bank as part of their investigation. If the receiving bank can freeze the account before the money is withdrawn, they may be able to return it. This process can take several weeks, but you are still protected under EFTA — your bank must restore the money to your account while they pursue recovery.

Do I have to pay for a new debit card if mine was compromised?

No. Your bank must issue a replacement card at no cost. Some banks will expedite it for free if the fraud was severe; others may charge for overnight shipping. Ask your bank what options are available.

What if I discover fraud more than 60 days after my statement arrived?

You may lose EFTA protection for those transactions. However, some banks cover fraud beyond the 60-day window as a matter of policy, and some state laws offer longer windows. Contact your bank immediately and explain the situation. If they refuse, file a complaint with the CFPB or your state's banking regulator — you may still have options depending on your state's laws.