You open your banking app and see a withdrawal you never made. Your stomach drops. The next few days matter more than most people realize. Federal rules give you real protection, but they run on a clock, and the clock starts sooner than you might expect.
Start by checking whether the rules apply
The main federal protection is the Electronic Fund Transfer Act, which the Consumer Financial Protection Bureau implements through Regulation E. It covers electronic transfers from consumer checking, savings, and certain prepaid accounts. That includes debit card purchases, ATM withdrawals, ACH payments, some online bill payments, and automatic deductions, according to the CFPB's electronic fund transfer FAQs.
So the first question is simple. Was the disputed item an electronic fund transfer from a consumer account? If yes, these rules likely apply. Credit card disputes can follow different procedures, so check which type of card was involved. Business accounts may follow different requirements too, so confirm which rules cover your account type.
Report fast, because timing sets your liability
How much you could owe depends mainly on two things: whether an access device was involved, and how quickly you tell the bank. An access device can be a debit card, an ATM card, a code, or even a phone used to reach the account. The CFPB's guidance on getting your money back lays out the tiers for a lost or stolen card.
- Report within two business days of discovering the loss: your liability is capped at the lesser of the unauthorized amount or $50.
- Report after two business days but within 60 days of the statement showing the transfer: liability can reach $500.
- Wait longer than 60 days: you may owe the $500 plus unauthorized transfers made after the 60-day period.
Some transfers involve no access device at all, such as an ACH debit or a counterfeit card. One credit union training source says you generally owe nothing if you report within 60 days of the first statement showing the transfer. After that, later transfers may be your responsibility. That source is an industry blog, so treat the details as general background. Regulation E is only a baseline. Some banks offer extra protection, such as zero liability, so read your deposit account agreement.
How to file the dispute
Call or contact your bank or credit union right away. Give your name, the account type, and details of each transaction you did not authorize. Then follow up in writing and keep a copy. The helpwithmybank.gov guidance notes the bank may ask you to sign an affidavit of unauthorized use.
If a card is missing, the FTC's advice on lost or stolen cards is a good checklist. Write down when you noticed the card was gone and when you first reported it. Keep reviewing statements after you report, and flag any new charges quickly. It also helps to check whether your homeowner's or renter's insurance covers card theft.
One detail to hold onto: for personal accounts, the 60-day period generally runs from the date the bank sent the statement, not the date you got around to reading it.
What the bank must do next
Once you report an error, the bank generally has 10 business days to investigate. If it needs more time, it can take up to 45 days. In that case it must provisionally credit the disputed amount within 10 business days and tell you within two business days after the credit. A Federal Reserve compliance summary adds that the bank is not required to credit your account during those first 10 business days. That summary is aimed at examiners, not consumers, so your bank's own process may look different.
If the bank finds an error, it must correct it within one business day. It then reports its findings to you within three business days. A few questions are worth asking up front:
- Is this item covered under Regulation E?
- Which statement date starts my 60-day clock?
- Will you issue a provisional credit while you investigate, and if not, why?
- Do you need an affidavit, and what else do you need from me?
- When will I receive written findings?
Where the guidance runs out
Delay is the biggest risk. The helpwithmybank.gov guidance warns that repeated charges from a merchant that began months earlier, and were only noticed later, can complicate recovery. The bank may refuse to reverse them.
The sources reviewed here leave real gaps. They do not explain what to do if the bank denies your claim, or how to escalate or file a complaint with the CFPB or another regulator. They do not cover state law protections, which may differ from federal rules. They say nothing about how a dispute affects your credit report or score. They do not give detailed steps for credit card disputes. And they do not address scams where you were tricked into authorizing a payment, which are often treated differently from unauthorized transfers. If your situation falls into one of those areas, ask your bank directly and check the CFPB and FTC websites for current guidance. No outcome is guaranteed, but acting quickly gives you the strongest footing.
Please seek a professional. This article is general information, not financial, tax or insurance advice. Please seek a licensed financial, tax or insurance professional about your own situation.
