How stolen-phone account takeovers work and what to do first, a split between federal courts over whether an online wire is protected by the Electronic Fund Transfer Act, what “authorized” means when a bank denies a fraud claim, and a change to New York’s consumer protection statute.
By Rausa Russo Law, PLLC
Court and case status in this edition is current as of October 14, 2026.
Federal CourtsNY AGCFPBNY LegislatureApple
This newsletter is for informational purposes only and does not constitute legal advice.
This edition covers phone-theft account takeovers and what the law says when a bank denies a fraud claim. We cover how these takeovers work and the first steps to take, an unsettled question about how federal law applies when a wire is ordered online, what the law means by “authorized,” and a new state law that expands what the New York Attorney General can pursue.
Phone Theft • Account Takeover
Stolen Phone, Drained Account: How the Scheme Works and What to Do First
In 2023, the Wall Street Journal reported on thieves who watched iPhone users enter their passcodes, stole the phones, and then locked the owners out of their own accounts. TidBITS, summarizing the Journal’s reporting, wrote that “Within minutes, the thief has used the passcode to gain access to the iPhone and change the Apple ID password,” and that “After that, they may transfer money from bank accounts, apply for an Apple Card, and more, all while the user is completely locked out of their account.”
Apple offers an iPhone setting called Stolen Device Protection. According to Apple, when your iPhone is away from familiar locations, some actions, such as using saved passwords, require Face ID or Touch ID “with no passcode alternative or fallback,” and some security actions, such as changing your Apple Account password, also require you to wait an hour and then authenticate again. Apple states that the feature “must be turned on before the device is lost or stolen” and that it “might be turned on by default,” so it is worth checking. Apple’s instructions: “Go to Settings, then tap Face ID & Passcode. Enter your device passcode. Tap Stolen Device Protection, then turn Stolen Device Protection on or off.” Apple describes the feature as adding “a layer of security”; it does not stop a phone from being stolen.
General Information
If your phone is stolen, contact your bank right away, using the phone number on its website or on your card rather than a number from a text or call you received. Under Regulation E, you may notify the bank in person, by telephone, or in writing. If you notify the bank within two business days after learning of the loss or theft of an access device, your liability for unauthorized transfers is capped at the lesser of $50 or the transfers made before notice (12 C.F.R. § 1005.6(b)(1)), and the time limits are extended to a reasonable period when a delay was due to extenuating circumstances, such as hospitalization (§ 1005.6(b)(4); Comment 6(b)(4)-1). Follow up a phone call in writing: a bank that tells you it requires written confirmation of an oral notice may not have to provisionally credit your account if it does not receive that confirmation within 10 business days. You can also report identity theft to the FTC at IdentityTheft.gov and internet fraud to the FBI at ic3.gov.
Is an Online Wire Covered by the EFTA? Federal Courts Are Divided
The Electronic Fund Transfer Act excludes certain transfers made through wire systems. Under 15 U.S.C. § 1693a(7)(B), the definition of an electronic fund transfer does not include a transfer, other than one processed by automated clearinghouse, made by a financial institution on behalf of a consumer “by means of a service that transfers funds held at either Federal Reserve banks or other depository institutions and which is not designed primarily to transfer funds on behalf of a consumer.” Whether that exclusion reaches the debit to a consumer’s account when a wire is ordered through online or mobile banking is a question federal courts have answered differently.
In January 2024, the New York Attorney General sued Citibank. According to the Attorney General’s press release, the lawsuit alleges that wire transfers Citibank makes available to consumers online and through mobile banking apps are subject to the Electronic Fund Transfer Act (EFTA). On January 21, 2025, the U.S. District Court for the Southern District of New York denied Citibank’s motion to dismiss on that ground, holding that § 1693a(7)(B) “does not preclude EFTA liability for a fraudulent Payment Order resulting in a debit from a consumer account in connection with a wire transfer.” The court said that, as far as it was aware, the issue was “a question of first impression.” That ruling came at the motion-to-dismiss stage, where a court accepts the complaint’s allegations as true; it is not a finding that Citibank violated the law. In April 2025 the court certified its ruling for an interlocutory appeal and stayed the case. The U.S. Court of Appeals for the Second Circuit heard argument on April 6, 2026 (No. 25-2105). As of October 14, 2026, the appeal had been argued and we were not aware of a decision.
On March 9, 2026, the U.S. District Court for the Northern District of California reached the opposite conclusion in Jung v. Discover Bank. The court agreed with Discover “that the EFTA does not apply to consumer wire transfers,” and stated that it “does not follow” the Citibank ruling, describing it as “an out-of-circuit decision currently on appeal.” The court said “the only two appellate courts to address the point,” the Fifth and Sixth Circuits, agreed with its view. It dismissed the EFTA claim without leave to amend and dismissed a separate claim under the Uniform Commercial Code with leave to amend. That case is ongoing.
General Information
We are not predicting how the Second Circuit will rule. If money left your account by wire after a takeover, report it to your bank promptly, follow up in writing, and keep every notice the bank sends. Other rules may matter as well. New York’s wire-transfer statute, UCC Article 4-A, generally does not apply to a funds transfer any part of which is governed by the EFTA (§ 4-A-108), and it has its own timing rule: under § 4-A-505, a customer who received notification reasonably identifying a payment order is precluded from challenging the bank’s right to keep the payment unless the customer objects within one year after receiving that notification. Steps that come before a wire may also raise separate questions. A takeover may move money between the customer’s own accounts before anything leaves the bank, and those internal transfers may be analyzed separately.
“The Bank Says You Authorized It.” What Federal Law Means by Authorized
If your bank denies a fraud claim on the ground that you authorized the transfer, start with the statute’s definition. Under 15 U.S.C. § 1693a(12), an “unauthorized electronic fund transfer” is one “initiated by a person other than the consumer without actual authority to initiate such transfer and from which the consumer receives no benefit.” The official commentary to Regulation E adds that an unauthorized transfer “includes a transfer initiated by a person who obtained the access device from the consumer through fraud or robbery” (Comment 2(m)-3). The CFPB’s published Regulation E FAQs, a staff compliance aid last updated January 2025, state that “A consumer who is fraudulently induced into providing account information has not furnished an access device under Regulation E.”
The definition has exceptions: transfers by someone you gave access to, until you tell the bank that person’s authority has ended; transfers made with fraudulent intent by you or someone acting with you; and transfers that are the bank’s own error. Carelessness alone cannot be used to increase your liability beyond Regulation E’s limits. The commentary states that “Negligence by the consumer cannot be used as the basis for imposing greater liability than is permissible under Regulation E” (Comment 6(b)-2). And in a lawsuit involving your liability for a transfer, “the burden of proof is upon the financial institution to show that the electronic fund transfer was authorized” (15 U.S.C. § 1693g(b)).
The bank also has procedural obligations. It must investigate promptly and generally decide within 10 business days, or, if it takes up to 45 days, provisionally credit your account within 10 business days; longer periods apply in some situations (12 C.F.R. § 1005.11(c)). If it denies your claim, its report must include “a written explanation of the institution’s findings” and note your right to request the documents it relied on (§ 1005.11(d)(1)).
General Information
If you receive a denial, ask the bank in writing for copies of the documents it relied on, and keep a timeline of when you reported, whom you spoke with, and what you were told. Whether a particular transfer was unauthorized depends on the facts, and a denial letter is the bank’s position, not the final word on what the law requires.
New York’s FAIR Business Practices Act: New Authority for the Attorney General
On December 19, 2025, the Governor signed S8416, the “fostering affordability and integrity through reasonable (FAIR) business practices act,” as Chapter 708 of the Laws of 2025. The act took effect on the sixtieth day after it became law, which works out to February 17, 2026. General Business Law § 349(a) now provides: “Unfair, deceptive, or abusive acts or practices in the conduct of any business, trade or commerce or in the furnishing of any service in this state are hereby declared unlawful.”
The private right of action is narrower. Under § 349(h), a person injured “by reason of any deceptive act or deceptive practice” may sue for actual damages or $50, whichever is greater. The court may increase the award to up to three times actual damages, not exceeding $1,000, if it finds a willful or knowing violation, and may award reasonable attorney’s fees to a prevailing plaintiff. The new “unfair” and “abusive” standards are enforced by the Attorney General; individuals may sue only over deceptive acts or practices.
General Information
If a business misled you, the deceptive-practices remedy may be available to you directly. Conduct you believe was unfair or abusive, but not deceptive, can be reported to the Attorney General through the consumer complaint form at ag.ny.gov/file-complaint/consumer or by calling the AG helpline at 1-800-771-7755.
New editions periodically. No spam. Unsubscribe anytime.
We respect your privacy and do not sell your email address. Privacy Policy
Sender: Rausa Russo Law, PLLC, 75 South Broadway, 4th Floor, White Plains, NY 10601. Each issue is attorney advertising. Educational only; not legal advice. You can unsubscribe at any time using the link in any email.
Was your bank account drained after a stolen phone or an account takeover, and did your bank refuse to refund the money? Tell us what happened. Consultations are free, and fee-shifting provisions in the consumer protection statutes can make representation available at no out-of-pocket cost in many cases.