My Bank Says I Authorized the Transfer. I Didn't. Now What?

Your phone was stolen, or someone got into your banking app, and money left your account. You reported it. Then the bank's letter arrived: the transfer was made with your password, from a device the bank recognized, or after a one-time code was entered correctly, so the bank considers it authorized and will not refund it. This article explains why that reasoning can blur two different questions, what federal law actually says about unauthorized transfers, where the real exceptions are, and what you can do next.

Authentication Is Not Authorization

When a bank says your credentials or your device were used, it is describing authentication: its systems recognized the password, the code, or the phone. Whether you authorized the transfer is a different, legal question.

The Electronic Fund Transfer Act (EFTA) defines an unauthorized electronic fund transfer at 15 U.S.C. § 1693a(12) as "an electronic fund transfer from a consumer's account initiated by a person other than the consumer without actual authority to initiate such transfer and from which the consumer receives no benefit." Regulation E, the federal rule that implements the EFTA, uses the same core language at 12 C.F.R. § 1005.2(m). The definition asks who initiated the transfer and whether that person had actual authority. It does not ask whether the right password was typed.

Regulation E defines an "access device" at 12 C.F.R. § 1005.2(a)(1) as "a card, code, or other means of access to a consumer's account, or any combination thereof, that may be used by the consumer to initiate electronic fund transfers." The official commentary then addresses what happens when someone else gets one: "An unauthorized EFT includes a transfer initiated by a person who obtained the access device from the consumer through fraud or robbery." (Comment 2(m)-3.)

The Consumer Financial Protection Bureau's published Regulation E FAQs (last updated January 2025) take the same view. They are CFPB compliance aids, not binding regulations, but they are direct: "When a consumer's account access information is obtained from a third party through fraudulent means such as computer hacking, and a hacker uses that information to make an EFT from the consumer's account, the transfer is an unauthorized EFT under Regulation E." Among the CFPB's examples is a fraudster who "hacks into the consumer's phone and uses the mobile wallet to initiate a debit card transfer," and a thief who "steals a consumer's physical wallet and initiates a payment using the consumer's stolen debit card."

Carelessness Alone Does Not Increase Your Liability

Some denials suggest, directly or not, that you should have protected your passcode better. Regulation E's commentary addresses this: "Negligence by the consumer cannot be used as the basis for imposing greater liability than is permissible under Regulation E." Its example is writing a PIN on a debit card or on a paper kept with the card. (Comment 6(b)-2.) The CFPB's FAQs repeat the point.

What does affect your share of the loss is how quickly you report. Under 12 C.F.R. § 1005.6(b), reporting within two business days after learning of the loss or theft of an access device generally caps your liability at $50; later reporting can raise the cap to $500, and the rules for transfers that appear on a statement and go unreported for 60 days are stricter. Those time limits must be extended to a reasonable period when a delay was due to extenuating circumstances, such as extended travel or hospitalization. Our guide to stolen-phone account takeovers walks through the tiers in detail.

In Court, the Bank Carries the Burden of Proof

A denial letter is the bank's position, not a court's finding. If the dispute goes to court, 15 U.S.C. § 1693g(b) provides that in any action involving a consumer's liability for an unauthorized transfer, "the burden of proof is upon the financial institution to show that the electronic fund transfer was authorized." If the transfer was unauthorized, the bank must also establish that the conditions for holding the consumer liable were met.

Your Account Agreement Cannot Waive These Rights

Denials sometimes point to a clause saying you are responsible for every transaction made with your login. Under 15 U.S.C. § 1693l, "No writing or other agreement between a consumer and any other person may contain any provision which constitutes a waiver of any right conferred or cause of action created by this subchapter." The Regulation E commentary adds that "no agreement between the consumer and an institution may impose greater liability on the consumer for an unauthorized transfer than the limits provided in Regulation E." (Comment 6(b)-3.) The CFPB's FAQs put it plainly: "an agreement cannot restrict a consumer's rights beyond what is provided in the law."

The Exceptions, Honestly

Not every transfer made after a phone theft is unauthorized, and it would not help you to pretend otherwise. The definition has exceptions:

• Access you gave someone. A transfer is not unauthorized if it was initiated by a person you furnished with the access device, unless you had told the bank that person's transfers were no longer authorized. The commentary's examples are a family member or co-worker who exceeds the authority given. (Comment 2(m)-2.)
• Fraud by the consumer. A transfer initiated with fraudulent intent by the consumer, or by anyone acting in concert with the consumer, is excluded.
• Being tricked into sending money yourself. The definition covers transfers "initiated by a person other than the consumer." If a scammer persuaded you to send a payment yourself, rather than getting into your account and sending it, other rules may come into play, and the result depends on the facts.

According to the CFPB, being tricked into handing over a code is not the same as handing over authority. The CFPB's FAQs state: "A consumer who is fraudulently induced into providing account information has not furnished an access device under Regulation E," and a transfer made by a third party with information obtained that way "is an unauthorized EFT under Regulation E."

A note on wires. Regulation E excludes transfers through Fedwire or similar systems used primarily between financial institutions or businesses, and federal courts are currently divided on whether the EFTA reaches the debit to a consumer's account when a wire is ordered through online or mobile banking. If a wire is involved, report it promptly and in writing; New York's wire-transfer statute has its own rules, including a one-year objection deadline in N.Y. U.C.C. § 4-A-505.

What to Do After the Denial

1. Ask for the documents the bank relied on. Under 12 C.F.R. § 1005.11(d)(1), the bank's report must include "a written explanation of the institution's findings" and must note your right to request the documents it relied on. "Upon request, the institution shall promptly provide copies of the documents." Make the request in writing. If an error occurred, the commentary bars charges related to any aspect of the error-resolution process, including documentation or investigation.
2. Respond in writing. Explain that you did not make or authorize the transfer, who had your phone and how, when you learned of it, and when you reported it. Be aware that a bank that has fully complied with the error-resolution rules has no further obligation under 12 C.F.R. § 1005.11(e) if you reassert the same error, so a written response is most useful when it points out what the investigation did not address. According to the CFPB's FAQs, "The investigation must be reasonable, including a reasonable review of relevant information within the financial institution's own records."
3. File a complaint. You can submit a complaint to the CFPB at consumerfinance.gov/complaint or by phone at (855) 411-2372. The New York Department of Financial Services and the New York Attorney General also accept consumer complaints.
4. Keep a timeline. Write down when the phone was taken, when you discovered the transfers, and every call, chat, and letter with the bank, including dates, times, and names. Our companion article on the bank's 10-business-day deadline explains how to keep a date-stamped log.
5. Watch the calendar. An EFTA lawsuit must be brought "within one year from the date of the occurrence of the violation" under 15 U.S.C. § 1693m(g). Do not wait to get advice.

If a bank violates the EFTA, 15 U.S.C. § 1693m(a) allows recovery of actual damages, statutory damages of $100 to $1,000 in an individual case, and, in a successful action, costs and a reasonable attorney's fee. The statute also gives banks defenses, so the facts of each situation matter.

If your denial letter looks like everyone else's, see whether a form-letter denial is an investigation. If the thief moved money between your accounts first, read what happens when thieves move savings into checking. For card and debit basics, see our article on unauthorized charges on a bank account, and for the full picture, our stolen-phone guide and unauthorized bank debits practice page.