Your bank is responsible for most fraudulent transactions, but only if you report them quickly

When someone uses your account without permission, your bank absorbs the loss in most cases—not you. Federal law (the Electronic Funds Transfer Act) limits your liability to $50 if you report the fraud within two business days of discovering it. If you wait longer, your liability can climb to $500. If you don't report it at all within 60 days, you may lose everything taken after that 60-day window.

The catch is timing. Your bank's obligation to refund you depends on how quickly you notice the fraud and how quickly you tell them. A transaction that sits unnoticed for three months is much harder to recover than one you catch within a week.

The responsibility also shifts depending on what kind of fraud happened. A hacker who drained your account through your online login is different from a thief who cloned your debit card. A scammer who tricked you into sending money is different from someone who stole your account number. Each scenario has different rules about who pays and how much.

Key Takeaways

  • Report fraud to your bank within two business days to limit your liability to $50; waiting longer can cost you up to $500 or more.
  • Your bank must refund unauthorized transactions if you report them within 60 days, though they may take up to 10 business days to investigate.
  • Liability depends on the type of fraud: unauthorized card use, account takeover, and wire fraud scams each have different rules and timelines.
  • If you authorized a payment but were tricked into sending it (like a romance scam), the money is usually gone and your bank is not responsible.
  • Debit card fraud is covered under federal law, but credit card fraud has stronger protections and limits your liability to $50 automatically.

How the Electronic Funds Transfer Act protects debit card users

The Electronic Funds Transfer Act (EFTA) is the federal rule that sets liability limits for unauthorized transactions on checking accounts, savings accounts, and debit cards. It says your bank must refund money taken without your permission, but your share of the loss depends on when you report it.

If you report the fraud within two business days of discovering it, you are liable for no more than $50. If you report it between two and 60 days, you can be liable for up to $500. If you wait longer than 60 days, you may be liable for the entire amount taken after that 60-day mark. A business day is a day the bank is open; weekends and holidays do not count.

The bank's job is to investigate your claim and either refund the money or explain why they will not. They have up to 10 business days to do the investigation, though many banks move faster. During that time, the bank may provisionally credit your account while they look into it, so you are not left without access to your money.

Unauthorized transactions versus authorized payments you regret

Your bank is responsible for money taken without your permission. Your bank is not responsible for money you authorized someone to take, even if you were tricked into doing it.

An unauthorized transaction is one where you did not give permission at all: a thief used your card number, a hacker logged into your account, or someone forged your signature on a check. These are covered by the EFTA, and your bank must refund them (subject to the timing rules above).

An authorized payment is one where you gave permission, even if you were deceived. If a scammer convinced you to wire money to their account, you authorized that wire. If you sent a gift card code to someone claiming to be from your bank, you authorized that. If you gave your login credentials to someone posing as tech support, you authorized the transactions they made. In these cases, the money is usually gone, and your bank has no obligation to return it. Some banks will reverse the transaction as a courtesy, but they are not required to.

The line between the two can be blurry. If a scammer tricked you into clicking a link that logged them into your account, that is unauthorized access—your bank should refund it. If a scammer tricked you into typing your password into a fake website they created, that is authorized access—your bank usually will not refund it.

What happens when your debit card is cloned or stolen

If someone clones your debit card or steals the physical card and uses it, your bank is responsible for the fraudulent charges. You report it to your bank, and they cancel the card and issue a new one. The fraudulent transactions are refunded under the EFTA, subject to the liability limits above.

The bank's fraud department will investigate by checking whether the transactions match your normal spending patterns, whether the merchant is legitimate, and whether the card was physically present at the point of sale. Most card-present fraud (where the physical card was used) is caught quickly because the transactions stand out.

Card-not-present fraud (online or phone purchases using your card number) is also covered, but the investigation may take longer because the merchant may claim they verified the cardholder's identity. If you report it within two business days, your liability is still capped at $50.

Account takeover and online banking fraud

If a hacker gains access to your online banking account and transfers money out, your bank is responsible for refunding it—but again, only if you report it within the EFTA timelines. The hacker may have obtained your password through a data breach, phishing email, or malware on your computer.

Account takeover is often more serious than card fraud because the hacker can change your contact information, set up new payment methods, or lock you out of your own account. Report it when ready by calling your bank's fraud line (not the number on your card, which may be compromised—use a number from your statement or the bank's website). Do not use email or online chat for this; use the phone.

Your bank will freeze the account, investigate the unauthorized transactions, and issue you a new account number if necessary. They may also require you to change your password and set up additional security measures like two-factor authentication. The investigation typically takes 10 business days, but the bank may provisionally credit your account while they work.

Wire fraud and ACH transfer scams

Wire transfers and ACH transfers (automated clearing house transfers, used for bill pay and direct deposit) are treated differently from debit card fraud. Once a wire or ACH transfer leaves your account, it is much harder to recover, and your bank's responsibility is less clear.

If you authorized the wire or ACH transfer but were tricked into doing it (a scammer pretended to be your landlord asking for rent, or your boss asking for a wire), the money is usually gone. Your bank is not responsible because you authorized it. Some banks will attempt to recall the transfer, but they cannot force the receiving bank to return it.

If someone accessed your account without permission and initiated a wire or ACH transfer, your bank should refund it under the EFTA—but the timeline is tighter. You must report it within one business day of discovering it to limit your liability to $50. After that, liability increases. Wire fraud investigations can take weeks because the money may have already left the receiving bank.

Credit card fraud has stronger protections than debit cards

If the fraud is on a credit card rather than a debit card, you have even stronger protections. The Fair Credit Billing Act limits your liability to $50 for unauthorized credit card charges, period—there is no higher liability tier for late reporting. You do not have to report it within two business days; you have up to 60 days from when you receive your statement.

Credit card fraud is also investigated differently. The credit card company (or the bank that issued the card) is more motivated to refund you quickly because they want to keep you as a customer. Most credit card companies will issue a provisional credit within a few days and complete the investigation within 30 days.

Debit card fraud, by contrast, is your bank's problem directly—they lose the money from your account. This is why credit card fraud is generally safer: the credit card company is a middleman between you and the merchant, so they have more leverage to recover the money.

What you need to do to protect your refund

Report fraud to your bank when ready. Call the fraud line on the back of your card or on your statement—do not use a number from an email or text, as those may be fake. Have your account number and a list of the fraudulent transactions ready.

Follow up in writing. Send a letter to your bank's fraud department (the address is usually on your statement) describing the fraud, the dates, and the amounts. Keep a copy. This creates a paper trail and resets the clock on the 60-day reporting window if needed.

Monitor your account for the next 30 to 90 days. Fraudsters sometimes make small test charges before making larger ones, and they may try again after the first fraud is caught. Check your statements weekly and set up account alerts if your bank offers them.

Do not ignore suspicious activity hoping it will go away. The 60-day window is firm. After that, your bank is not required to refund anything, even if the fraud was not your fault.

Frequently Asked Questions

Can my bank refuse to refund me if I was careless with my password?

Not under federal law. The EFTA does not require you to have been careful; it only requires you to report within the timeline. However, if your bank can prove you were grossly negligent—like writing your password on a sticky note on your monitor—they may reduce your refund. This is rare and usually only happens if the bank can show you ignored obvious red flags.

What if the fraud happened at a store and the merchant is refusing to help?

The merchant is not responsible; your bank is. Report the fraud to your bank, not the store. Your bank will investigate whether the transaction was authorized and refund you if it was not. The store's refusal to help does not change your bank's obligation.

How long does it take to get my money back?

Your bank has up to 10 business days to investigate and refund you, though many refund within 3 to 5 days. During the investigation, they may provisionally credit your account so you have access to the money when ready. Wire fraud investigations can take longer—sometimes 20 to 30 days—because the money may have already moved to another bank.

Am I responsible if someone in my household committed the fraud?

If a family member or roommate used your account without permission, it is still fraud, and your bank should refund it. However, if you gave them access (like sharing your login for bill pay), the bank may argue you authorized it. Be clear with your bank about whether you gave permission.

What if my bank says the fraud was my fault and refuses to refund me?

You have the right to dispute the bank's decision. File a complaint with the Consumer Financial Protection Bureau (CFPB) or your state's banking regulator. Include copies of your fraud report, the bank's response, and any evidence that the transaction was unauthorized. The regulator can force the bank to reconsider.