My Phone Was Stolen and My Bank Account Was Drained: Your Rights

This guide provides general legal information and is not legal advice. Consult an attorney for advice about your specific situation.

How Phone-Theft Account Takeovers Work

A smartphone often holds your email, saved passwords, and banking app, so a thief who gets past its lock, by whatever means, can quickly turn a stolen phone into a drained account.

In 2023, the Wall Street Journal reported on thieves who watched iPhone users enter their passcodes, stole the phones, and then locked the owners out of their accounts. TidBITS, summarizing the Wall Street Journal's reporting, wrote that once a thief had changed the Apple ID password, "they may transfer money from bank accounts, apply for an Apple Card, and more, all while the user is completely locked out of their account."

Money can leave by app transfer, person-to-person payment, debit card, or wire, and different laws can apply to each.

A protective setting. Apple's Stolen Device Protection, in Apple's words, helps "prevent someone who has stolen your iPhone and knows your passcode from making critical changes to your account or device." Away from familiar locations, some actions need Face ID or Touch ID "with no passcode alternative or fallback," and changing your Apple Account password requires you "to wait an hour and then perform an additional Face ID or Touch ID authentication." Apple says the feature "must be turned on before the device is lost or stolen" and only that it "might be turned on by default," so check: "Go to Settings, then tap Face ID & Passcode. Enter your device passcode. Tap Stolen Device Protection, then turn Stolen Device Protection on or off." It adds a layer of security; it does not make theft impossible. Whether or not it was turned on, Regulation E provides that a consumer’s negligence cannot be used to impose greater liability than the rule allows.

The First 24 Hours: What to Do

1. Call your bank right away. Use the number on your debit card or the bank's official website, not a number from a text or a call you received. Say your phone was stolen and identify each transfer you did not make. Under Regulation E, you "may notify the institution in person, by telephone, or in writing." Log the date, time, who you spoke with, and any claim number.
2. Follow up in writing. A bank "may require the consumer to give written confirmation of an error within 10 business days of an oral notice," and if it does, it must tell you and give you the address when you call. A bank that has told you about that requirement and does not receive written confirmation within 10 business days does not have to provisionally credit your account, though it still must investigate. Write promptly and keep a copy.
3. The bank must begin promptly. It "must begin its investigation promptly upon receipt of an oral notice."
4. Secure your accounts. From a device the thief never had, change your Apple Account, email, and banking passwords.
5. Report the crime. File reports with your local police, the FTC at IdentityTheft.gov, and the FBI at ic3.gov. Under CFPB guidance, these generally should not be a condition of the bank's investigation: the CFPB's published Regulation E FAQs (last updated January 2025) state that a bank "may not delay initiating or completing an investigation pending receipt of information from the consumer."
6. Keep everything. Save every letter, email, and screenshot.

Is the Transfer Covered? EFTA and Regulation E Basics

The main federal protection is the Electronic Fund Transfer Act (EFTA) and Regulation E. The EFTA defines an "electronic fund transfer" (15 U.S.C. § 1693a(7)) as "any transfer of funds, other than a transaction originated by check, draft, or similar paper instrument, which is initiated through an electronic terminal, telephonic instrument, or computer or magnetic tape so as to order, instruct, or authorize a financial institution to debit or credit an account."

Many app and online transfers may fall within that language. The CFPB's published FAQs, which are compliance aids rather than regulations, state that "A credit-push P2P transfer is considered an EFT even if the payment was initiated by a third party that fraudulently obtained access to consumer's account."

Wire transfers are contested. Regulation E excludes "Any transfer of funds through Fedwire or through a similar wire transfer system that is used primarily for transfers between financial institutions or between businesses" (12 CFR 1005.3(c)(3)), and the statute has a related exclusion. Federal courts are divided on whether these exclusions reach the debit to a consumer's account when a wire is ordered through online or mobile banking. In January 2025, a federal court in Manhattan held, at the motion-to-dismiss stage, that the wire exclusion did not bar EFTA claims based on a fraudulent online payment order that debited a consumer account; that ruling is on appeal. In March 2026, a federal court in California held "that the EFTA does not apply to consumer wire transfers," citing decisions from two federal appeals courts. A case raising the question was argued before the U.S. Court of Appeals for the Second Circuit on April 6, 2026; as of October 14, 2026, we were not aware of a decision.

New York's UCC Article 4-A as a possible alternative. Article 4-A "does not apply to a funds transfer any part of which is governed by the Electronic Fund Transfer Act" (UCC § 4-A-108(1)), with an exception for certain remittance transfers, so if the EFTA does not govern a wire, Article 4-A may. Under it:

• A bank can treat an unauthorized payment order as the customer's only if the parties agreed to a security procedure that "is a commercially reasonable method of providing security against unauthorized payment orders" and the bank "proves that it accepted the payment order in good faith and in compliance with" its obligations (§ 4-A-202(2)). Commercial reasonableness "is a question of law" (§ 4-A-202(3)).
• Otherwise, "the bank shall refund any payment of the payment order received from the customer to the extent the bank is not entitled to enforce payment" with interest. A customer who does not notify the bank "within a reasonable time not exceeding ninety days" can lose the interest, not the refund (§ 4-A-204(1)).
• Under § 4-A-505, if the customer "received notification reasonably identifying the order, the customer is precluded from asserting that the bank is not entitled to retain the payment unless the customer notifies the bank of the customer's objection to the payment within one year after the notification was received by the customer."

Object in writing to any unauthorized wire as soon as you learn of it, and keep proof.

"Unauthorized" and the "You Authorized It" Denial

Banks sometimes say that transfers from your phone or with your password were authorized. Regulation E's definition turns on authority, not on which device was used. An unauthorized transfer is one "initiated by a person other than the consumer without actual authority to initiate the transfer and from which the consumer receives no benefit" (12 CFR 1005.2(m)).

The official interpretation adds: "An unauthorized EFT includes a transfer initiated by a person who obtained the access device from the consumer through fraud or robbery." The CFPB's FAQs state that when account access information "is obtained from a third party through fraudulent means such as computer hacking," a transfer made with it "is an unauthorized EFT under Regulation E."

Carelessness alone does not increase your liability. "Negligence by the consumer cannot be used as the basis for imposing greater liability than is permissible under Regulation E."

The bank bears the burden of proof. In a lawsuit involving your liability, "the burden of proof is upon the financial institution to show that the electronic fund transfer was authorized" (15 U.S.C. § 1693g(b)).

The exceptions matter. Regulation E excludes transfers by someone you furnished the access device to (until you tell the bank that person's transfers are no longer authorized), transfers made "With fraudulent intent by the consumer or any person acting in concert with the consumer," and transfers by the bank or its employee. The facts decide. See My Bank Says I Authorized the Transfer. I Didn't. Now What?

Your Liability Limits

Under 12 CFR 1005.6(b), your share of the loss depends on how quickly you report:

• Within two business days after learning of the loss or theft of the access device: no more than "the lesser of $50 or the amount of unauthorized transfers that occur before notice." The day you learn of it does not count.
• Later: no more than "the lesser of $500" or a calculated sum, and the larger amount applies only to transfers the bank establishes would not have occurred had you reported in time.
• The 60-day statement rule: to avoid liability for later transfers, report an unauthorized transfer on a statement "within 60 days of the financial institution's transmittal of the statement."
• Extensions: "If the consumer's delay in notifying the financial institution was due to extenuating circumstances, the institution shall extend the times specified above to a reasonable period," such as "extended travel or hospitalization."

Regulation E defines an access device as "a card, code, or other means of access to a consumer's account, or any combination thereof, that may be used by the consumer to initiate electronic fund transfers" (12 CFR 1005.2(a)(1)), and a phone that holds your banking app and its saved credentials can fit that description. The first two tiers "do not apply to unauthorized transfers from a consumer's account made without an access device"; in that case your liability generally turns only on the 60-day statement rule. And "no agreement between the consumer and an institution may impose greater liability on the consumer for an unauthorized transfer than the limits provided in Regulation E." The EFTA's anti-waiver rule (15 U.S.C. § 1693l) separately bars agreements that waive its rights.

The Bank's Deadlines

Regulation E's error-resolution rules (12 CFR 1005.11) apply to an oral or written notice the bank receives no later than 60 days after it sends the statement first showing the error, if the notice identifies you and your account and explains the error. Then:

• 10 business days. The bank "shall investigate promptly" and decide "within 10 business days of receiving a notice of error," report results within three business days after finishing, and correct an error within one business day.
• Provisional credit and 45 days. It may take up to 45 days only if it provisionally credits your account "within 10 business days," tells you within two business days, and gives you "full use of the funds during the investigation." See Your Bank’s 10-Business-Day Deadline: How Provisional Credit Works.
• Longer periods. For transfers within 30 days after an account’s first deposit, 20 business days replace 10, and 90 days replace 45 for those transfers, point-of-sale debit card transactions, and transfers not initiated within a state.
• Explanation and documents. A denial must include "a written explanation of the institution's findings" and note your "right to request the documents that the institution relied on."
• Reversals and fees. A reversed provisional credit requires notice to you. The bank "may not impose a charge related to any aspect of the error-resolution process."

If the denial looks like a template, see My Bank Denied My Fraud Claim With the Same Form Letter. Is That an Investigation? If money was moved between your accounts first, see Thieves Moved My Savings Into Checking Before Draining It.

When a Bank's Investigation Falls Short

The CFPB's FAQs state that "The investigation must be reasonable, including a reasonable review of relevant information within the financial institution's own records." The EFTA provides remedies:

• Treble damages (15 U.S.C. § 1693f(e)) if the court finds the bank did not provisionally recredit within the ten-day period and either did not investigate in good faith or had no reasonable basis for its conclusion, or that the bank "knowingly and willfully concluded that the consumer's account was not in error when such conclusion could not reasonably have been drawn from the evidence available to the financial institution at the time of its investigation."
• Actual and statutory damages, costs, and fees (15 U.S.C. § 1693m(a)): "any actual damage sustained," plus, in an individual action, "an amount not less than $100 nor greater than $1,000," and, in a successful action, costs "together with a reasonable attorney's fee as determined by the court."
• One year to sue (15 U.S.C. § 1693m(g)): "within one year from the date of the occurrence of the violation." When that period begins in a given case depends on the facts.

Banks also have defenses, including a bona fide error defense, which requires the bank to show the violation was unintentional and resulted from a bona fide error despite procedures reasonably adapted to avoid it, and a defense for a bank that corrects its failure and pays actual damages before suit.

If You Have a Disability

If a disability makes the claim process hard to use, a trusted person may help you report. Regulation E's official interpretation states that "Notice to a financial institution by a person acting on the consumer's behalf is considered valid under this section" (Comment 6(b)(5)-2, on liability for unauthorized transfers), and the bank may require appropriate documentation from that person. Federal, New York State, and New York City disability laws may also require businesses that serve the public to make reasonable modifications for people with disabilities. The ADA's list of public accommodations expressly includes a "bank," and the State and City definitions reach establishments or providers of goods or services "of any kind." How each law applies depends on the facts.