An unauthorized electronic fund transfer is any transfer from a consumer's bank account that is initiated by a person other than the consumer without the consumer's authorization and from which the consumer receives no benefit. Under the Electronic Fund Transfer Act (EFTA), 15 U.S.C. § 1693 et seq., and its implementing regulation, Regulation E (12 C.F.R. Part 1005), banks and financial institutions are required to investigate reported unauthorized transactions within strict timelines and may be liable for damages when they fail to do so.
The EFTA was enacted in 1978 to establish the rights, liabilities, and responsibilities of participants in electronic fund transfer systems. As electronic banking has expanded to encompass debit cards, ATM transactions, ACH transfers, direct deposits, and online bill payments, the EFTA's consumer protections have become increasingly important. When your bank fails to properly investigate an unauthorized debit or refuses to restore your funds, federal law provides remedies.
What the EFTA Covers
The EFTA applies to electronic fund transfers, which the statute defines broadly at 15 U.S.C. § 1693a(7) as any transfer of funds initiated through an electronic terminal, telephone, computer, or magnetic tape for the purpose of ordering, instructing, or authorizing a financial institution to debit or credit a consumer's account. This includes:
- Debit card transactions: Point-of-sale purchases, online purchases, and recurring charges made with a debit card.
- ATM transactions: Cash withdrawals, deposits, and transfers made at automated teller machines.
- ACH transfers: Automated Clearing House transfers, including electronic debits initiated by merchants, service providers, or other third parties from your bank account.
- Direct deposits: Payroll, government benefits, tax refunds, and other electronic deposits to your account.
- Online and mobile banking transfers: Transfers initiated through your bank's website or mobile application.
- Recurring automatic payments: Recurring electronic debits authorized by the consumer, such as subscription services, insurance premiums, and loan payments.
- Peer-to-peer transfers: The EFTA may apply to certain transfers through services such as Zelle, Venmo, and Cash App to the extent they involve electronic fund transfers from a consumer's bank account, although the scope of coverage for peer-to-peer platforms remains an evolving area of law.
The EFTA does not cover wire transfers governed by the Uniform Commercial Code Article 4A, checks, credit card transactions (which are governed by the Truth in Lending Act and the Fair Credit Billing Act), or transfers initiated by securities brokers or dealers.
Error Resolution Procedures
The EFTA and Regulation E establish a detailed error resolution process that banks must follow when a consumer reports an unauthorized transaction or other account error. Understanding these procedures is critical to protecting your rights:
Step 1: Report the Error
To initiate the error resolution process, notify your bank that you believe an error has occurred. Under Regulation E, 12 C.F.R. § 1005.11(b), you may notify the bank orally or in writing. Your notice must include your name and account number, a description of the suspected error, and the dollar amount involved. While an initial oral notice is sufficient to trigger the bank's obligations, the bank may require you to follow up with a written confirmation within 10 business days of the oral notice.
Step 2: Bank Investigation (10 Business Days)
Once the bank receives your error notice, it must investigate and determine whether an error occurred within 10 business days under 15 U.S.C. § 1693f(a) and Regulation E, 12 C.F.R. § 1005.11(c)(1). If the bank determines that an error occurred, it must correct the error within one business day of making that determination.
Step 3: Extended Investigation (Up to 45 Days with Provisional Credit)
If the bank cannot complete its investigation within 10 business days, it may extend the investigation period to 45 calendar days, but only if it provisionally credits your account within 10 business days for the amount of the alleged error, including interest where applicable. The bank must notify you of the provisional credit within two business days of providing it.
Extended timeframes apply in certain situations:
- New accounts (open less than 30 days): The bank has 20 business days (instead of 10) before it must provide provisional credit, and up to 90 calendar days to complete its investigation.
- Point-of-sale debit card transactions: The bank may take up to 90 calendar days to investigate, with provisional credit still due within 10 business days.
- International transactions: The bank may take up to 90 calendar days, with provisional credit due within 10 business days.
Step 4: Results of Investigation
Under Regulation E, 12 C.F.R. § 1005.11(d), the bank must report the results of its investigation within three business days after completing it. If the bank determines that no error occurred, or that the error was different from what you reported, it must:
- Provide a written explanation of its findings
- Inform you that it will reverse any provisional credit within the timeframes specified in Regulation E
- Provide you with copies of the documents it relied upon in making its determination, upon request
Provisional Credit Requirements
Provisional credit is one of the most important consumer protections under the EFTA. When a bank extends its investigation beyond 10 business days, it must provide provisional credit to ensure that the consumer is not left without access to funds during the investigation period. Key rules regarding provisional credit include:
- The provisional credit must equal the amount of the alleged error, including any interest the consumer would have earned on those funds
- The bank must notify the consumer within two business days of providing provisional credit
- If the bank ultimately determines no error occurred, it must notify the consumer at least three business days before reversing the provisional credit (at least five business days under Regulation E for most situations)
- The consumer must be given access to the documents relied upon by the bank in its investigation
Liability Limits Based on Reporting Timeline
One of the most consequential aspects of the EFTA is the consumer liability framework for unauthorized electronic fund transfers, established at 15 U.S.C. § 1693g. Your potential liability depends on how quickly you report the unauthorized activity:
| Reporting Timeline | Maximum Consumer Liability |
|---|---|
| Within 2 business days of learning of the loss or theft of your debit card or access device | $50 |
| After 2 business days but within 60 calendar days of the statement being sent showing the unauthorized transfer | $500 |
| More than 60 calendar days after the statement is sent | Unlimited liability for unauthorized transfers occurring after the 60-day period |
It is important to note that these liability limits apply specifically to unauthorized transfers involving a lost or stolen access device (such as a debit card). For unauthorized ACH debits where no access device is involved, the consumer's liability may be further limited, and the bank may bear greater responsibility for unauthorized transfers under Regulation E and applicable NACHA rules.
Common Violations
Banks and financial institutions frequently fail to comply with the EFTA's error resolution requirements. Common violations include:
- Failure to investigate within 10 business days: Banks that do not begin or complete their investigation within the required 10-business-day period after receiving the consumer's error notice.
- Failure to provide provisional credit: When a bank extends its investigation beyond 10 business days without provisionally crediting the consumer's account for the amount of the alleged error.
- Denying a claim without a proper investigation: Banks that deny error claims summarily, without conducting an actual investigation of the reported unauthorized transfer.
- Failure to provide written results: Not providing the consumer with a written explanation of the investigation results within three business days of completing the investigation.
- Failure to provide supporting documents: Refusing to provide the consumer with copies of the documents relied upon in the bank's determination, when requested.
- Improper reversal of provisional credit: Reversing provisional credit without providing required advance notice to the consumer.
- Requiring excessive documentation: Demanding that consumers provide documentation beyond what is required to trigger the bank's investigation obligation, such as requiring a police report before beginning an investigation.
- Failing to honor oral notice: Refusing to begin an investigation based on an oral error report, which is sufficient to trigger the bank's obligations under Regulation E.
Your Rights Under the EFTA
- Right to report errors. You may report unauthorized transactions orally or in writing, and your bank must begin its investigation upon receiving your notice (15 U.S.C. § 1693f).
- Right to a timely investigation. Your bank must investigate and resolve your error claim within 10 business days, or provisionally credit your account and complete the investigation within 45 to 90 calendar days depending on the type of transaction (12 C.F.R. § 1005.11).
- Right to provisional credit. If the bank extends its investigation beyond 10 business days, it must provisionally credit your account for the amount of the alleged error (15 U.S.C. § 1693f(c)).
- Right to written results. The bank must report the results of its investigation in writing within three business days of completing it (12 C.F.R. § 1005.11(d)).
- Right to documentation. You may request copies of the documents the bank relied upon in making its determination (12 C.F.R. § 1005.11(d)(2)).
- Right to limited liability. Your liability for unauthorized transfers is capped at $50 if reported within two business days, or $500 if reported within 60 days (15 U.S.C. § 1693g).
- Right to sue. You may bring a private lawsuit against a financial institution that fails to comply with the EFTA (15 U.S.C. § 1693m).
Damages Available
Under 15 U.S.C. § 1693m, a consumer who prevails in an EFTA action may recover:
| Damage Type | Amount |
|---|---|
| Actual damages | All proven financial losses resulting from the violation, including the amount of unauthorized transfers not restored, overdraft fees, bounced check fees, late payment charges, and emotional distress |
| Statutory damages | $100 to $1,000 per individual action, at the court's discretion; up to the lesser of $500,000 or 1% of the institution's net worth in a class action |
| Attorney's fees and costs | The defendant pays the prevailing plaintiff's reasonable attorney's fees and court costs |
How We Can Help
Rausa Russo Law, PLLC represents consumers throughout New York and, through our network of trusted consumer protection attorneys, across the country in EFTA claims involving unauthorized bank debits. Our approach includes:
- Free case evaluation. We review your bank statements, error dispute history, and the bank's response to assess whether the bank violated the EFTA's error resolution requirements.
- Demand letters to financial institutions. We send formal demand letters on your behalf, requiring the bank to comply with its obligations under the EFTA and Regulation E.
- Federal court litigation. When banks fail to investigate unauthorized transactions, deny legitimate claims, or refuse to provide provisional credit, we file lawsuits to hold them accountable and recover damages.
- CFPB complaints. Where appropriate, we assist consumers in filing complaints with the Consumer Financial Protection Bureau, which oversees EFTA enforcement for larger financial institutions.
- No out-of-pocket cost. Because the EFTA provides for fee-shifting under 15 U.S.C. § 1693m, we handle most unauthorized bank debit cases with no upfront cost to the client.
Frequently Asked Questions
Under 15 U.S.C. § 1693f and Regulation E, your bank generally must complete its investigation within 10 business days of receiving your error notice. If the bank needs more time, it may extend the investigation to 45 calendar days, but only if it provisionally credits your account within 10 business days. For new accounts, point-of-sale debit card transactions, and international transactions, the bank has up to 20 business days before provisional credit is required and up to 90 calendar days to complete the investigation.
Provisional credit is a temporary credit to your bank account in the amount of the disputed transaction. Under Regulation E, if your bank cannot complete its investigation within 10 business days, it must provisionally credit your account for the full amount of the alleged error, including interest where applicable. The bank must notify you within two business days of providing the provisional credit. If the bank ultimately determines no error occurred, it must notify you before reversing the credit and provide you with the documents supporting its decision.
Your potential liability increases the longer you wait. Under 15 U.S.C. § 1693g, if you report the loss or theft of your debit card within two business days, your maximum liability is $50. If you report after two business days but within 60 days of your statement, liability may increase to $500. If you fail to report within 60 days of the statement being sent, you could face unlimited liability for unauthorized transfers occurring after that 60-day window. This is why reviewing your bank statements regularly and reporting unauthorized transactions immediately is so important.
Yes. Under 15 U.S.C. § 1693m, if your bank fails to comply with the EFTA's error resolution procedures, you may bring a private lawsuit. You may be entitled to actual damages (the amount lost plus consequential damages like overdraft fees), statutory damages of $100 to $1,000, and attorney's fees and costs. The EFTA's fee-shifting provision means the bank pays your attorney's fees if you prevail, so pursuing a claim typically costs you nothing out of pocket.
The EFTA and Regulation E cover electronic fund transfers from a consumer's bank account, which may include certain transfers through peer-to-peer payment services like Zelle, Venmo, or Cash App when linked to a bank account. However, the scope of coverage depends on the specific circumstances, particularly whether the transfer was truly unauthorized versus authorized but subject to a scam. The CFPB has issued guidance suggesting that banks may have Regulation E obligations for certain unauthorized peer-to-peer transfers. This area of law continues to evolve, and we recommend consulting with an attorney to evaluate your specific situation.