Under the Electronic Fund Transfer Act (EFTA) and Regulation E, consumers should report unauthorized electronic transactions promptly; reporting within 60 days after the bank sends the statement showing the transfer preserves the bank's error-resolution duties and limits liability for later transfers. Banks have 10 business days to investigate, or they must provisionally credit your account if the investigation takes longer. Violations of these requirements may entitle you to actual damages, statutory damages up to $1,000, and attorney's fees.
An unauthorized electronic fund transfer is any transfer from a consumer's bank account that is initiated by a person other than the consumer without actual authority to initiate the transfer and from which the consumer receives no benefit. Under the Electronic Fund Transfer Act (EFTA), 15 U.S.C. § 1693 et seq., and its implementing regulation, Regulation E (12 C.F.R. Part 1005), banks and financial institutions are required to investigate reported unauthorized transactions within strict timelines and may be liable for damages when they fail to do so.
The EFTA was enacted in 1978 to establish the rights, liabilities, and responsibilities of participants in electronic fund transfer systems. As electronic banking has expanded to encompass debit cards, ATM transactions, ACH transfers, direct deposits, and online bill payments, the EFTA's consumer protections have become increasingly important. When your bank fails to properly investigate an unauthorized debit or refuses to restore your funds, federal law provides remedies.
What the EFTA Covers
The EFTA applies to electronic fund transfers, which the statute defines broadly at 15 U.S.C. § 1693a(7) as any transfer of funds initiated through an electronic terminal, telephone, computer, or magnetic tape for the purpose of ordering, instructing, or authorizing a financial institution to debit or credit a consumer's account. This includes:
- Debit card transactions: Point-of-sale purchases, online purchases, and recurring charges made with a debit card.
- ATM transactions: Cash withdrawals, deposits, and transfers made at automated teller machines.
- ACH transfers: Automated Clearing House transfers, including electronic debits initiated by merchants, service providers, or other third parties from your bank account.
- Direct deposits: Payroll, government benefits, tax refunds, and other electronic deposits to your account.
- Online and mobile banking transfers: Transfers initiated through your bank's website or mobile application.
- Recurring automatic payments: Recurring electronic debits authorized by the consumer, such as subscription services, insurance premiums, and loan payments.
- Peer-to-peer transfers: The EFTA may apply to certain transfers through services such as Zelle, Venmo, and Cash App to the extent they involve electronic fund transfers from a consumer's bank account, although the scope of coverage for peer-to-peer platforms remains an evolving area of law.
The treatment of wire transfers is contested. Regulation E excludes transfers through Fedwire or a similar wire transfer system “used primarily for transfers between financial institutions or between businesses” (12 C.F.R. § 1005.3(c)(3)). At least one federal court, ruling on a motion to dismiss, has held that when a wire is ordered through online or mobile banking, the debit to the consumer’s account can still be an electronic fund transfer covered by the EFTA; other courts have held that the wire exclusion reaches the entire transaction, and a federal appeals court is considering the question. Where the EFTA does not apply, Article 4A of the Uniform Commercial Code may provide separate remedies for an unauthorized wire. The EFTA does not cover checks, credit card transactions (which are governed by the Truth in Lending Act and the Fair Credit Billing Act), or transfers whose primary purpose is the purchase or sale of securities or commodities, such as through an SEC-regulated broker-dealer.
Error Resolution Procedures
The EFTA and Regulation E establish a detailed error resolution process that banks must follow when a consumer reports an unauthorized transaction or other account error. Understanding these procedures is critical to protecting your rights:
Step 1: Report the Error
To initiate the error resolution process, notify your bank that you believe an error has occurred. Under Regulation E, 12 C.F.R. § 1005.11(b), you may notify the bank orally or in writing. Your notice should enable the bank to identify your name and account number and indicate why you believe an error exists, including, to the extent possible, the type, date, and amount of the error. While an initial oral notice is sufficient to trigger the bank's obligations, the bank may require you to follow up with a written confirmation within 10 business days of the oral notice, but only if it tells you about that requirement, and gives you the address, when you give oral notice.
Step 2: Bank Investigation (10 Business Days)
Once the bank receives your error notice, it must investigate and determine whether an error occurred within 10 business days under 15 U.S.C. § 1693f(a) and Regulation E, 12 C.F.R. § 1005.11(c)(1). If the bank determines that an error occurred, it must correct the error within one business day of making that determination.
Step 3: Extended Investigation (Up to 45 Days with Provisional Credit)
If the bank cannot complete its investigation within 10 business days, it may extend the investigation period to 45 calendar days, but only if it provisionally credits your account within 10 business days for the amount of the alleged error, including interest where applicable. The bank must notify you of the provisional credit within two business days of providing it.
Extended timeframes apply in certain situations:
- New accounts (transfers within 30 days after the first deposit to the account): The bank has 20 business days (instead of 10) before it must provide provisional credit, and up to 90 calendar days to complete its investigation.
- Point-of-sale debit card transactions: The bank may take up to 90 calendar days to investigate, with provisional credit still due within 10 business days.
- Transfers not initiated within a state: The bank may take up to 90 calendar days, with provisional credit due within 10 business days.
Step 4: Results of Investigation
Under Regulation E, 12 C.F.R. § 1005.11(d), the bank must report the results of its investigation within three business days after completing it. If the bank determines that no error occurred, or that the error was different from what you reported, it must:
- Provide a written explanation of its findings
- Inform you that it will reverse any provisional credit within the timeframes specified in Regulation E
- Provide you with copies of the documents it relied upon in making its determination, upon request
Provisional Credit Requirements
Provisional credit is one of the most important consumer protections under the EFTA. When a bank extends its investigation beyond 10 business days, it must provide provisional credit to ensure that the consumer is not left without access to funds during the investigation period. Key rules regarding provisional credit include:
- The provisional credit must equal the amount of the alleged error, including any interest the consumer would have earned on those funds
- The bank must notify the consumer within two business days of providing provisional credit
- If the bank ultimately determines no error occurred, it must notify the consumer of the date and amount of the debit and must honor checks, drafts, and preauthorized transfers drawn on the account for at least 5 business days after that notice (12 C.F.R. § 1005.11(d)(2))
- The consumer must be given access to the documents relied upon by the bank in its investigation
Liability Limits Based on Reporting Timeline
One of the most consequential aspects of the EFTA is the consumer liability framework for unauthorized electronic fund transfers, established at 15 U.S.C. § 1693g. Your potential liability depends on how quickly you report the unauthorized activity:
| Reporting Timeline | Maximum Consumer Liability |
|---|---|
| Within 2 business days of learning of the loss or theft of your debit card or access device | $50 or the amount of unauthorized transfers before notice, whichever is less |
| More than 2 business days after learning of the loss or theft of your debit card or access device | Generally up to $500: the lesser of $500 or the sum of up to $50 for the first 2 business days plus later transfers the bank establishes would not have occurred with timely notice |
| An unauthorized transfer on a statement not reported within 60 calendar days after the bank sends that statement | Unauthorized transfers occurring after the 60-day period and before notice, if the bank establishes they would not have occurred with timely notice (plus, if a card or other access device was involved, the amounts above), subject to extension for extenuating circumstances |
It is important to note that these liability limits apply specifically to unauthorized transfers involving a lost or stolen access device (such as a debit card, or another card, code, or other means of access to the account). For unauthorized ACH debits where no access device is involved, the consumer's liability may be further limited, and the bank may bear greater responsibility for unauthorized transfers under Regulation E and applicable NACHA rules.
Stolen Phones and Account Takeovers
Some unauthorized transfers start with a stolen phone. A thief who gets past your phone's lock, whether by watching you enter your passcode or by other means, may be able to get into your email, your text-message codes, and your banking apps, and lock you out while money moves. In 2023, the Wall Street Journal reported on thieves who watched iPhone users enter their passcodes, stole the phones, and then locked owners out of their accounts; according to coverage of that reporting, thieves could then move money out of bank accounts.
A bank's answer that your device, password, or one-time code was used is not the end of the analysis. Under the EFTA, a transfer is “unauthorized” when someone other than you initiates it “without actual authority” and you receive no benefit (15 U.S.C. § 1693a(12)), and the official commentary says this includes a transfer by “a person who obtained the access device from the consumer through fraud or robbery” (comment 2(m)-3). In a lawsuit involving your liability, the burden of proof is on the bank to show the transfer was authorized (15 U.S.C. § 1693g(b)), and an account agreement cannot waive your EFTA rights (15 U.S.C. § 1693l). Exceptions exist, such as when you gave someone access and had not told the bank to stop, so the facts matter.
Report every transfer you did not make, not only the final withdrawal. Thieves may first move money between your own accounts, for example from savings into checking, before sending it out. List those internal moves in your report too, with dates and amounts.
- Call the bank right away using the number on its website or your card. Notice may be given in person, by telephone, or in writing (12 C.F.R. § 1005.6(b)(5)(ii)).
- Follow up in writing. A bank may require written confirmation within 10 business days of a phone report, but it must tell you so, and give you the mailing address, when you call; a bank that does so and does not receive the confirmation need not provisionally credit your account (12 C.F.R. § 1005.11(b)(2), (c)(2)).
- Read our guide: My Phone Was Stolen and My Bank Account Was Drained: Your Rights.
- If the bank says you authorized it: My Bank Says I Authorized the Transfer. I Didn’t. Now What?
Start a Bank Account Takeover Review
Common Violations
Banks and financial institutions frequently fail to comply with the EFTA's error resolution requirements. Common violations include:
- Failure to investigate within 10 business days: Banks that do not begin or complete their investigation within the required 10-business-day period after receiving the consumer's error notice.
- Failure to provide provisional credit: When a bank extends its investigation beyond 10 business days without provisionally crediting the consumer's account for the amount of the alleged error.
- Denying a claim without a proper investigation: Banks that deny error claims summarily, without conducting an actual investigation of the reported unauthorized transfer.
- Failure to provide written results: Not providing the consumer with a written explanation of the investigation results within three business days of completing the investigation.
- Failure to provide supporting documents: Refusing to provide the consumer with copies of the documents relied upon in the bank's determination, when requested.
- Improper reversal of provisional credit: Reversing provisional credit without providing required advance notice to the consumer.
- Requiring excessive documentation: Demanding that consumers provide documentation beyond what is required to trigger the bank's investigation obligation, such as requiring a police report before beginning an investigation.
- Failing to honor oral notice: Refusing to begin an investigation based on an oral error report, which is sufficient to trigger the bank's obligations under Regulation E.
Your Rights Under the EFTA
- Right to report errors. You may report unauthorized transactions orally or in writing, and your bank must begin its investigation upon receiving your notice (15 U.S.C. § 1693f).
- Right to a timely investigation. Your bank must investigate and resolve your error claim within 10 business days, or provisionally credit your account and complete the investigation within 45 to 90 calendar days depending on the type of transaction (12 C.F.R. § 1005.11).
- Right to provisional credit. If the bank extends its investigation beyond 10 business days, it must provisionally credit your account for the amount of the alleged error (15 U.S.C. § 1693f(c)).
- Right to written results. The bank must report the results of its investigation in writing within three business days of completing it (12 C.F.R. § 1005.11(d)).
- Right to documentation. You may request copies of the documents the bank relied upon in making its determination (12 C.F.R. § 1005.11(d)(1)).
- Right to limited liability. Your liability for unauthorized transfers is generally capped at $50 if you report within two business days after learning of the loss or theft of a card or other access device, and at $500 after that, subject to the 60-day statement rule (15 U.S.C. § 1693g).
- Right to sue. You may bring a private lawsuit against a financial institution that fails to comply with the EFTA (15 U.S.C. § 1693m).
Damages Available
Under 15 U.S.C. § 1693m, a consumer who prevails in an EFTA action may recover:
| Damage Type | Amount |
|---|---|
| Actual damages | All proven financial losses resulting from the violation, including the amount of unauthorized transfers not restored, overdraft fees, bounced check fees, late payment charges, and other consequential losses (some courts have also allowed emotional-distress damages) |
| Statutory damages | $100 to $1,000 per individual action, at the court's discretion; up to the lesser of $500,000 or 1% of the institution's net worth in a class action |
| Attorney's fees and costs | The defendant pays the prevailing plaintiff's reasonable attorney's fees and court costs |
How We May Be Able to Help
Rausa Russo Law, PLLC represents consumers throughout New York and, through our network of trusted consumer protection attorneys, across the country in EFTA claims involving unauthorized bank debits. Our approach includes:
- Free case evaluation. We review your bank statements, error dispute history, and the bank's response to assess whether the bank violated the EFTA's error resolution requirements.
- Demand letters to financial institutions. We send formal demand letters on your behalf, requiring the bank to comply with its obligations under the EFTA and Regulation E.
- Federal court litigation. When banks fail to investigate unauthorized transactions, deny legitimate claims, or refuse to provide provisional credit, we file lawsuits to hold them accountable and recover damages.
- CFPB complaints. Where appropriate, we assist consumers in filing complaints with the Consumer Financial Protection Bureau, which oversees EFTA enforcement for larger financial institutions.
- No out-of-pocket cost. Because the EFTA provides for fee-shifting under 15 U.S.C. § 1693m, we handle most unauthorized bank debit cases with no upfront cost to the client.
Frequently Asked Questions
Under 15 U.S.C. § 1693f and Regulation E, your bank generally must complete its investigation within 10 business days of receiving your error notice. If the bank needs more time, it may extend the investigation to 45 calendar days, but only if it provisionally credits your account within 10 business days. For new accounts, the bank has up to 20 business days before provisional credit is required; for new accounts, point-of-sale debit card transactions, and transfers not initiated within a state, it may take up to 90 calendar days to complete the investigation.
Provisional credit is a temporary credit to your bank account in the amount of the disputed transaction. Under Regulation E, if your bank cannot complete its investigation within 10 business days, it must provisionally credit your account for the full amount of the alleged error, including interest where applicable. The bank must notify you within two business days of providing the provisional credit. If the bank ultimately determines no error occurred, it must notify you of the date and amount of the debit, honor items drawn on your account for 5 business days after that notice, and provide the documents supporting its decision.
Your potential liability increases the longer you wait. Under 15 U.S.C. § 1693g, if you report the loss or theft of your debit card or other access device within two business days after learning of it, your maximum liability is $50 or the amount of unauthorized transfers before notice, whichever is less. If you report later, your liability is generally capped at $500: more precisely, the lesser of $500 or the sum of up to $50 for transfers in the first two business days plus any later unauthorized transfers that the bank establishes would not have occurred had you reported within those two business days. Separately, if you do not report an unauthorized transfer within 60 days after the bank sends the statement showing it, you could be liable for unauthorized transfers that occur after that 60-day period and before you report, if the bank establishes they would not have occurred had you reported in time. These time periods may be extended when extenuating circumstances, such as extended travel or hospitalization, prevented timely notice. This is why reviewing your bank statements regularly and reporting unauthorized transactions immediately is so important.
In many cases, yes. Under 15 U.S.C. § 1693m, if your bank fails to comply with the EFTA's error resolution procedures, you may bring a private lawsuit. You may be entitled to actual damages (the amount lost plus consequential damages like overdraft fees), statutory damages of $100 to $1,000, and attorney's fees and costs. The EFTA's fee-shifting provision means the bank pays your attorney's fees if you prevail, so pursuing a claim typically costs you nothing out of pocket.
The EFTA and Regulation E cover electronic fund transfers from a consumer's bank account, which may include certain transfers through peer-to-peer payment services like Zelle, Venmo, or Cash App when linked to a bank account. However, the scope of coverage depends on the specific circumstances, particularly whether the transfer was truly unauthorized versus authorized but subject to a scam. The CFPB has issued guidance suggesting that banks may have Regulation E obligations for certain unauthorized peer-to-peer transfers. This area of law continues to evolve, and we recommend consulting with an attorney to evaluate your specific situation.