Your bank is responsible for most unauthorized transfers, but the speed of your report matters

If someone steals money from your checking account, your bank must return it—but only if you report it within a specific window. Federal law (Regulation E) requires banks to refund unauthorized transfers, with one major condition: you have to notice and report the theft before the thief drains the account completely or before your bank's fraud detection catches it first.

The timeline is strict. If you report the theft within two business days of discovering it, your liability is capped at $50. If you wait longer than two business days but report within 60 calendar days of your statement, you could lose up to $500. If you wait more than 60 days after your statement shows the fraudulent transaction, the bank has no legal obligation to refund anything. In practice, many banks refund unauthorized transfers even outside this window, but you have no may provide.

The process itself is straightforward: you call your bank, report the fraud, and they freeze your account while they investigate. Most banks issue a temporary credit within one to three business days while they verify the claim. The full investigation typically takes 10 business days, though complex cases can stretch to 45 days.

Key Takeaways

  • Report unauthorized transfers to your bank within two business days to limit your liability to $50; waiting longer can cost you up to $500 or more.
  • Your bank must return the money while investigating, usually issuing a temporary credit within one to three business days.
  • The investigation itself takes 10 business days on average, though your account access may be restricted during that time.
  • Debit card fraud is handled differently than ACH transfers or checks, with different liability limits and investigation timelines.
  • Freezing your account when ready stops further unauthorized transfers but also blocks your own access until the investigation closes.

How the bank determines what was actually unauthorized

When you report fraud, the bank's fraud department pulls your transaction history and compares it to your normal spending patterns. They look for transactions that don't match your usual location, merchant type, or time of day. A $2,000 withdrawal at 3 a.m. from an ATM in another state when you normally use your card at grocery stores in your city is an obvious red flag.

The harder cases are when someone has your PIN or card number and makes purchases that look plausible. If you report a $300 gas station charge as fraudulent but you do buy gas regularly, the bank will ask you to confirm you didn't make that specific transaction. This is why your statement matters: the date, time, location, and merchant name all help prove you weren't there.

If you can't prove the transaction was unauthorized—for example, if you gave someone your card number for a legitimate purchase and they charged more than you authorized—that's a dispute, not fraud. Disputes follow a different process and take longer to resolve. The bank will still investigate, but you may be liable for part of the charge while they do.

Different rules for debit cards, ACH transfers, and checks

Debit card fraud has the strictest liability limits. If someone uses your physical card or card number without permission, you're protected under Regulation E. Report it within two days and you lose nothing. Wait longer and your liability climbs.

ACH transfers (electronic transfers between bank accounts) follow the same Regulation E rules, but the investigation is different. The bank contacts the receiving bank to try to recover the money before it's spent. If the receiving account is at the same bank, recovery is faster. If it's at another institution, the sending bank has to work through the ACH network, which adds time. Most ACH fraud is recovered within 10 business days, but if the thief moved the money multiple times, recovery can fail entirely.

Forged checks are handled under a different law (the Uniform Commercial Code) and have no federal liability cap. Your bank is responsible for catching a forged check before it clears, but if they miss it and pay the check, you have to prove the signature wasn't yours. This is why banks ask for a written statement when you report check fraud—they need documentation for their own protection.

What happens to your account while the investigation runs

Most banks freeze the compromised account when ready after you report fraud. This stops the thief from making more unauthorized transfers, but it also stops you from using that account. You can't withdraw cash, make purchases with the debit card, or set up new transfers until the investigation closes.

The bank will usually issue you a temporary debit card within one to two business days so you can access your money while the investigation runs. Some banks do this automatically; others require you to request it. Ask about this when you report the fraud—don't assume you'll be without access for 10 days.

If the fraud involved a compromised PIN, the bank will issue you a new PIN and sometimes a new card. If it involved your card number being stolen (not the physical card), they'll issue a new card but your PIN stays the same. If someone had physical access to your card, you may need to update any automatic payments or subscriptions that were charged to that card number.

How the thief got access in the first place

Understanding how the theft happened helps you prevent it again. The most common routes are: your card was skimmed at an ATM or gas pump; your card number was stolen in a data breach at a merchant; someone phished your online banking password; or you gave your card to someone who copied the number.

ATM skimming is harder to spot because the machine looks normal. The thief installs a hidden card reader that captures your card data while you enter your PIN. Gas pump skimming works the same way. If you discover fraud shortly after using an ATM or pump, that's likely the source.

Data breaches happen when a retailer or service provider's system is hacked. Your card number is stolen along with thousands of others. You'll usually find out about this through a notification from the merchant or your bank, not from fraud itself. By the time you know about the breach, the thief may have already tried to use your number.

Phishing is when someone tricks you into entering your online banking credentials on a fake website or through a fake email. Once they have your username and password, they can transfer money out of your account directly. This is why banks ask if you recognize the transactions—if you don't, the thief likely had your login information.

Steps to take when ready after discovering the theft

Call your bank's fraud line right away. Don't use the number on the back of your card if you're calling from that card's phone—use the number from your statement or the bank's website. This prevents you from accidentally calling a fake number if your card was compromised through a phishing attack.

Have your statement ready when you call. Tell the bank the specific transactions you didn't make, including the date, amount, and merchant. The more detail you provide, the faster the investigation moves. The bank will ask you to confirm your recent legitimate transactions too, so they know what's normal for your account.

Ask the bank to place a fraud alert on your credit file. This tells credit bureaus and lenders to verify your identity before opening new accounts in your name. It's free and lasts 90 days. If you're concerned about identity theft (not just card fraud), you can also request a credit freeze, which blocks new accounts entirely until you lift it.

Request a new debit card and new PIN. Even if the fraud was limited to your card number, getting a new card stops the thief from trying again. Update any automatic payments that were charged to the old card number—subscriptions, insurance, utilities, loan payments.

What happens if the bank refuses to refund you

If your bank denies your fraud claim, you have the right to dispute that decision. Send a written statement to the bank explaining why you believe the transactions were unauthorized. Include copies of your statement, any correspondence with the bank, and any evidence that you weren't in the location where the transaction occurred (receipts from elsewhere, cell phone location data, travel records).

The bank has to respond to your written dispute within 30 days. If they still refuse, you can file a complaint with your bank's federal regulator. For national banks, that's the Office of the Comptroller of the Currency (OCC). For state banks, it's the Federal Reserve or your state banking regulator. For credit unions, it's the National Credit Union Administration (NCUA). These agencies investigate complaints and can force banks to refund unauthorized transfers.

In practice, banks rarely refuse legitimate fraud claims because the liability is clear under federal law. Most denials happen when the bank believes you authorized the transaction or when you waited too long to report it. If you reported within 60 days and the transaction truly wasn't yours, you have a strong case.

Frequently Asked Questions

How long does it take to get my money back?

Your bank must issue a temporary credit within one to three business days while they investigate. The full investigation takes 10 business days on average, though complex cases can stretch to 45 days. Once the investigation closes and fraud is confirmed, the temporary credit becomes permanent.

Can the thief be prosecuted?

Yes, unauthorized account access and theft are federal crimes. However, prosecution depends on law enforcement identifying and catching the thief. Most small-scale fraud cases don't result in prosecution because the thief is difficult to locate. Your bank's fraud department will document the case, and you can file a police report, but criminal charges are rare unless the theft is large or part of a pattern.

What if the thief used my account to send money to someone else?

If the thief transferred your money to another bank account (ACH transfer), your bank will contact the receiving bank and ask them to freeze that account while they investigate. If the money hasn't been withdrawn yet, it can usually be recovered. If it has been spent, recovery is unlikely. The receiving bank is only required to hold the money if they're notified before the account holder withdraws it.

Do I have to pay overdraft fees if the thief emptied my account?

No. Once you report fraud, the bank must reverse the unauthorized transactions, which means overdraft fees tied to those transactions are also reversed. However, if you made legitimate purchases that overdrafted your account before the fraud occurred, you're still responsible for those fees.

Should I close my checking account after fraud?

You don't have to, but many people do for peace of mind. If you keep the account open, make sure you get a new debit card and PIN. If you close it, open a new account at the same bank or a different one. Closing the account doesn't affect your credit score, but opening a new account triggers a hard inquiry that may lower your score slightly.