Who Is Liable for Bank Account Fraud? Consumer Rights and Reporting Rules
When money disappears from a bank account, liability often depends on how the fraud happened, how quickly the account holder reports it, and whether the account is personal or business. Federal law limits consumer losses from many unauthorized electronic transfers, but it does not cover every scam or protect every type of account in the same way. Understanding the difference between an unauthorized transaction and a payment a customer was tricked into approving can help account holders act quickly and protect their rights.
Who Is Liable for Bank Account Fraud?
There is no single rule that assigns responsibility for every case of bank account fraud. For a personal checking or savings account, federal protections generally apply when someone makes an electronic fund transfer without the account holder’s actual authority. The Electronic Fund Transfer Act (EFTA) and its implementing regulation, Regulation E, set rules for reporting errors and limiting consumer liability.
In many cases, the bank must investigate a report of an unauthorized electronic transfer and, if required, provide provisional credit while the investigation is underway. However, the result depends on the facts, the transaction type, and whether the customer followed applicable notice requirements. Banks may also have obligations under account agreements and other laws.
Key distinction: A transaction made by a criminal without permission is generally different from a transaction the customer personally authorized after being deceived. A scammer’s involvement alone does not automatically make a payment an “unauthorized” transfer under federal law.
How Federal Law Limits Consumer Liability
Regulation E generally covers electronic transfers involving consumer accounts established primarily for personal, family, or household purposes. Covered transfers may include ATM withdrawals, debit card purchases, online bill payments, and certain electronic transfers initiated through a bank or payment service. The protections do not apply identically to every payment method, and special rules may apply to certain transactions.
For many unauthorized electronic transfers, the consumer’s potential liability depends on when the bank is notified. The regulation’s basic framework is:
- Before an access device is used: A consumer generally is not liable for transfers made without authority before receiving the device, such as a debit card or access code.
- Within two business days after learning of a lost or stolen access device: Liability is generally limited to the lesser of $50 or the amount of unauthorized transfers made before notice.
- More than two business days after learning of the loss: Liability can rise, generally to as much as $500, if the bank establishes that timely notice would have prevented additional transfers.
- More than 60 days after the bank sends a statement showing an unauthorized transfer: The consumer may be responsible for certain later losses if the bank establishes that earlier notice would have prevented them.
These are statutory limits, not a guarantee that every claim will be decided in the consumer’s favor. For example, a bank may examine whether a transfer was actually unauthorized, when the consumer learned about the problem, and whether the consumer promptly reported it. Some banks voluntarily offer broader protections, such as zero-liability policies, but their terms can differ from federal law.
For an unauthorized transfer that does not involve a lost or stolen access device, consumers should report it as soon as they discover it. The 60-day statement deadline can be especially important because waiting may expose the consumer to losses from later transfers.
Unauthorized Transfers Versus Scams the Customer Approves
Many bank fraud complaints involve social engineering: a criminal impersonates a bank employee, government official, relative, or business and pressures the victim to send money. The customer may enter a transfer, approve a payment, or give a scammer a one-time passcode. That does not necessarily mean the customer gave the criminal permission to access the account. But if the customer personally initiates and approves a payment to the scammer, the bank may treat it differently from a transfer initiated by a criminal.
For instance, if a criminal steals login credentials and transfers funds without the account holder’s knowledge, the transaction may qualify as an unauthorized electronic fund transfer. If the account holder is deceived into sending a wire transfer or making a payment they intended to authorize, recovery can be more difficult. The particular payment rail, bank policies, and facts matter.
Consumers should still report an induced payment immediately. A prompt report may allow the bank to attempt a recall or freeze funds, and the bank must assess the complaint under applicable law and its own procedures. A customer should describe exactly what happened rather than assume that a transaction is either covered or excluded.
Who Is Responsible for Different Types of Bank Fraud?
| Fraud or payment type | Possible protections and considerations |
|---|---|
| Stolen debit card or unauthorized ATM withdrawal | Regulation E may limit consumer liability, with reporting deadlines tied to discovery and account statements. |
| Unauthorized online transfer | May be covered by Regulation E if it is an unauthorized electronic transfer from a qualifying consumer account. |
| Debit card purchase the customer did not make | Often handled under Regulation E and the card issuer’s procedures; prompt reporting is important. |
| Credit card charge | The Fair Credit Billing Act and related rules may provide dispute rights for billing errors and unauthorized use. Different procedures and deadlines apply. |
| Customer-authorized wire transfer to a scammer | Recovery may depend on the circumstances, applicable wire-transfer rules, and whether the bank can stop or recall the payment. |
| Business account fraud | Consumer protections may not apply. The account agreement, state law, and commercial rules can be decisive. |
| Forged or altered check | State commercial law and the bank’s deposit agreement may govern. Reporting delays and negligence issues can affect responsibility. |
The table is a general guide, not a determination of liability in a particular case. Payment systems have different legal frameworks, and a bank may need to review transaction records before deciding a claim.
Business Bank Accounts Have Different Rules
Regulation E generally applies to consumer accounts, not accounts established primarily for business purposes. A company that discovers fraudulent electronic payments may therefore have fewer federal consumer protections than an individual with a personal checking account. Business accounts are commonly governed by the deposit agreement, applicable state law, and commercial rules such as Article 4A of the Uniform Commercial Code for certain funds transfers.
Business account agreements may require customers to review statements, report unauthorized transactions promptly, use security procedures, and keep credentials confidential. A business that misses a contractual deadline may face a difficult dispute, even when it believes a transaction was fraudulent. The precise result depends on the transaction and the relevant state law.
Businesses can reduce risk by using dual approval for large payments, limiting employee access, enabling transaction alerts, reconciling accounts frequently, and verifying changes to vendor payment instructions through a known phone number. These steps do not guarantee reimbursement, but they can help detect fraud before additional transfers occur.
What to Do After Discovering Bank Account Fraud
- Contact the bank immediately. Use the phone number on the bank’s official website, app, or card. Report each suspicious transaction and ask the bank to block compromised cards, credentials, or access devices.
- Ask how to submit a formal error notice. Keep a record of the date, time, representative, reference number, and instructions. Follow up in writing or through the bank’s secure messaging system.
- Secure the account and related devices. Change the bank password from a trusted device, update reused passwords on other sites, enable multifactor authentication, and review recovery email addresses and phone numbers.
- Request a new card or account number if appropriate. Ask the bank whether the account, debit card, checks, or digital wallet credentials should be replaced.
- Preserve evidence. Save statements, alerts, emails, text messages, receipts, call logs, and screenshots. Do not delete messages that may help document the scam.
- Report identity theft when relevant. The Federal Trade Commission’s IdentityTheft.gov provides a recovery plan. A police report may also be useful, though the bank’s process may not require one.
- Monitor accounts and credit reports. Review other financial accounts for suspicious activity and consider a credit freeze if personal information was exposed.
For a report involving an electronic transfer, a bank generally has a limited period to investigate under Regulation E. It typically must determine whether an error occurred within 10 business days. If it needs more time, it can generally take up to 45 days, subject to exceptions and requirements that often include giving provisional credit within the initial period. Different timelines can apply to new accounts, point-of-sale transactions, foreign transactions, and certain other cases.
A bank may ask the customer to provide written confirmation after an initial oral report. Consumers should follow the bank’s instructions and keep copies. If the bank denies the claim, the customer can request the reasons for the decision and copies of documents relied on, as permitted by the regulation.
What Happens When a Bank Denies a Fraud Claim?
A denial is not necessarily the last step. The customer can ask the bank to explain its findings, identify the transactions it reviewed, and reconsider the claim if new information is available. A clear timeline and supporting documents can help: when the account was accessed, when the customer noticed the transfer, when the bank was notified, and whether a card or device was missing.
If the issue remains unresolved, consumers can submit a complaint to the Consumer Financial Protection Bureau (CFPB). The CFPB forwards complaints to companies for response and uses complaint information to help monitor financial markets. Consumers may also contact the bank’s regulator. The appropriate agency depends on the institution; the FDIC’s BankFind tool can help identify a bank and its primary federal regulator.
For a large loss, a disputed business transfer, or a claim involving complex facts, an attorney familiar with banking or consumer-finance law may be able to explain available options. Deadlines can be short, so advice should be sought promptly rather than after the bank’s review period has ended.
Does FDIC Insurance Cover Money Stolen Through Fraud?
FDIC deposit insurance protects deposits if an FDIC-insured bank fails, subject to coverage limits and ownership rules. It generally does not reimburse customers for money stolen through account takeover, phishing, forged transactions, or scams while the bank remains open. Fraud disputes must instead be addressed through the bank’s investigation, applicable consumer or commercial law, and any relevant recovery process.
Consumers can verify whether a bank is FDIC-insured through the FDIC’s BankFind Suite. Insurance coverage and fraud liability are separate questions: a deposit can be insured against bank failure without being automatically protected against every fraudulent payment.
How to Reduce the Risk of Bank Account Fraud
- Use unique, strong passwords and multifactor authentication where available.
- Turn on alerts for withdrawals, transfers, debit card purchases, and changes to account details.
- Never share a one-time passcode, password, or PIN with someone who contacts you unexpectedly. A legitimate bank should not ask for a code to “reverse” a transfer.
- Verify urgent payment requests through a separate, trusted channel, especially requests involving gift cards, cryptocurrency, wire transfers, or new vendor bank details.
- Review account activity and statements regularly instead of relying only on monthly checks.
- Use secure networks and keep phones, computers, browsers, and banking apps updated.
Prevention cannot eliminate every risk, and consumers should not be blamed for being targeted by sophisticated fraud. Still, quick reporting, careful recordkeeping, and strong account controls can improve the chances of stopping additional losses and resolving a dispute.
Reliable Sources for Bank Fraud Questions
Rules can change, and the facts of a claim matter. The CFPB’s Regulation E text explains federal electronic-transfer requirements. The CFPB complaint portal accepts complaints about financial products and services. The FTC’s IdentityTheft.gov offers steps for responding to identity theft, while the FDIC BankFind Suite helps consumers look up banks and insurance status.