I Found an Unauthorized Charge on My Bank Account. What Are My Rights?

If you found an unauthorized charge on your bank account, you have legal rights that most consumers do not know about. The Electronic Fund Transfer Act (EFTA), codified at 15 U.S.C. § 1693, is a federal law that protects consumers from unauthorized electronic transactions and requires banks to follow a specific error resolution process when you report a problem. The law sets strict timelines for your bank to investigate, caps your liability depending on how quickly you act, and gives you the right to sue if the bank does not follow the rules.

What the EFTA Covers

The EFTA applies to electronic fund transfers, which include debit card transactions, ATM withdrawals, direct deposits, automatic bill payments (ACH debits), and person-to-person electronic transfers. If money moved in or out of your bank account electronically without your authorization, the EFTA likely applies.

The EFTA does not cover credit card transactions. Unauthorized credit card charges are governed by the Truth in Lending Act (TILA) and the Fair Credit Billing Act (FCBA), which have their own liability rules and dispute process. If the unauthorized charge is on a credit card rather than a debit card or bank account, see our page on credit card billing errors.

Your Liability Depends on How Quickly You Report

The EFTA ties your maximum liability for unauthorized transfers to how quickly you notify your bank after discovering the problem. The timelines matter, and they are strict:

• Within 2 business days: If you notify your bank within two business days after learning of the loss or theft of your debit card or other access device, your liability is capped at $50 or the amount of unauthorized transfers before notice, whichever is less.
• After 2 business days: If you report the loss or theft of your card or other access device more than two business days after learning of it, your liability is generally capped at $500. More precisely, it cannot exceed the lesser of $500 or $50 plus any unauthorized transfers after those two business days that the bank shows would not have occurred if you had reported within them.
• After 60 days: If you do not report an unauthorized transfer within 60 days after the bank sent the statement showing it, you could be liable for unauthorized transfers that occur after the 60-day period and before you report, if the bank shows they would not have occurred had you reported in time. This rule applies whether or not a card or other access device was involved, and it is the reason it is so important to review your bank statements promptly.

These liability caps are set out in 15 U.S.C. § 1693g and Regulation E, 12 C.F.R. § 1005.6. For the two-business-day tier, the clock runs from when you learned of the loss or theft of your card or other access device; the 60-day rule runs from when the bank sent the statement showing the transfer.

How to Report an Unauthorized Charge

Notify your bank as soon as you discover the unauthorized charge. You can report by phone, in person, or in writing. We recommend following up any verbal report with a written notice so you have a documented record of when and how you reported the problem.

Your written notice should include:

• Your name and account number
• A description of the unauthorized transaction(s), including dates and amounts
• A clear statement that you did not authorize the transaction(s)
• The date you discovered the unauthorized activity

Send the notice to the bank's error resolution department. Keep a copy for your records. If you send it by mail, use certified mail with return receipt requested.

What the Bank Must Do After You Report

Once your bank receives your notice of error, the EFTA requires it to follow a specific investigation process under 15 U.S.C. § 1693f:

• Investigate within 10 business days. The bank must complete its investigation and determine whether an error occurred within 10 business days of receiving your notice (20 business days if the transfer occurred within 30 days after the first deposit to the account was made).
• Provide provisional credit within 10 business days. If the bank cannot complete its investigation within 10 business days, it may extend the investigation to 45 calendar days, but only if it provisionally credits your account for the disputed amount. The extended period is 90 calendar days for transfers not initiated within a state, point-of-sale debit card transactions, and transfers within 30 days after the first deposit to a new account. This means you get your money back (provisionally) while the investigation continues.
• Correct the error within 1 business day. If the bank determines an error occurred, it must correct it within one business day of reaching that conclusion.
• Explain a denial within 3 business days. If the bank concludes that no error occurred, it must deliver or mail a written explanation of its findings within three business days after concluding its investigation, and must make the documents it relied on available to you upon request.

Common Bank Violations

Banks do not always follow the EFTA's requirements. Common violations include:

• Failing to investigate within the statutory timeframe. The bank takes longer than 10 business days to investigate without providing provisional credit, or takes longer than 45 days (90 days for point-of-sale debit card transactions, transfers not initiated within a state, and new-account transfers) even with provisional credit.
• Failing to provide provisional credit. The bank extends its investigation past 10 business days but does not credit the disputed amount to your account in the interim.
• Providing no written explanation. The bank denies the claim but does not send a written explanation of its findings or refuses to share its supporting documentation.
• Reversing provisional credit without proper notice. The bank removes the provisional credit from your account without first notifying you and providing a written explanation.
• Treating the dispute as closed without investigation. The bank tells you the claim was denied without evidence that it conducted a meaningful investigation.

Each of these failures may be an independent EFTA violation. You can learn more about common violation patterns on our unauthorized bank debits practice page.

What Damages May Be Available

If your bank violates the EFTA's error resolution procedures, you may have a private right of action under 15 U.S.C. § 1693m. Available damages include:

• Actual damages for financial harm caused by the bank's failure to follow the law, including the amount of the unauthorized transfer, overdraft fees, bounced payments, and other consequential losses.
• Statutory damages of $100 to $1,000 per consumer per action, even without proof of specific financial harm.
• Attorney's fees and costs. The EFTA's fee-shifting provision means the defendant pays your attorney's fees if you prevail. This is why most consumer protection attorneys handle EFTA cases at no out-of-pocket cost to the client.

For class actions, the EFTA provides for statutory damages up to the lesser of $500,000 or 1% of the financial institution's net worth.

Debit Card vs. Credit Card: Why the Distinction Matters

When an unauthorized charge hits your credit card, you are not out any money while the dispute is pending because you have not yet paid the bill. The charge sits on your statement and the credit card issuer investigates. Your liability for unauthorized credit card charges is capped at $50 under the Truth in Lending Act, regardless of when you report.

When an unauthorized charge hits your bank account, the money is already gone. Your checking account balance drops, and you may face overdraft fees, bounced payments, and cascading financial consequences. The EFTA's provisional credit requirement exists for exactly this reason: to put the money back in your account while the bank investigates. When a bank fails to provide provisional credit, the consumer bears the financial burden of a problem they did not cause.

What to Do Right Now

• Review your bank statements. Check your recent statements for any transactions you do not recognize. The 60-day reporting window runs from the date the statement was sent, not the date you opened it.
• Report immediately. Call your bank and follow up in writing. The sooner you report, the lower your potential liability.
• Document everything. Save copies of your statements showing the unauthorized charges, your written notice to the bank, any responses you receive, and any financial harm you suffer as a result (overdraft fees, late payments, denied transactions).
• Track the bank's response. Note the date the bank received your report. The bank generally must decide within 10 business days or provisionally credit your account while it investigates (20 business days for new accounts, and a bank that told you when you called that it requires written confirmation, and did not receive it in time, need not provisionally credit). If neither has happened by then, ask the bank about it in writing and consider talking with an attorney about whether the bank met its obligations.
• Consult an attorney if the bank does not act. If your bank misses the investigation deadline, denies your claim without explanation, or fails to provide provisional credit, you may have a claim under the EFTA.

At Rausa Russo Law, we represent consumers whose banks failed to follow the EFTA's error resolution rules. The consultation is free, and for most consumer protection cases there is no out-of-pocket cost to you. Prior results do not guarantee a similar outcome.