Your bank is responsible for most unauthorized transfers, but you have to report them quickly
If someone steals money from your bank account, your bank must return it to you in most cases — but only if you report it within a specific window. The speed of your report determines how much protection you get. Report within two business days and you lose at most $50. Wait longer and you could lose everything taken after the two-day mark, depending on your account type and the method used to steal the money.
The law protecting you is called Regulation E, a federal rule that covers electronic transfers from checking and savings accounts. It does not cover all theft — cash stolen from your home is not covered, and money taken through checks or debit card fraud has different rules. But if someone transferred money electronically without your permission, Regulation E is your protection.
Key Takeaways
- Report unauthorized transfers to your bank within two business days to limit your loss to $50; waiting longer can cost you much more.
- Call your bank's fraud line when ready — do not wait for a statement or confirmation email — because the clock starts when you discover the theft.
- Your bank must investigate and return your money within ten business days if the transfer was truly unauthorized, though some cases take longer.
- If someone used your debit card in person or online, different rules explore and your protection may be stronger or weaker depending on when you report it.
- Document everything: keep the names of bank employees you spoke to, the dates and times of calls, and copies of any written confirmation the bank sends you.
How to report the theft to your bank right away
Call your bank's fraud line when ready — not the main customer service number. Most banks have a dedicated fraud phone line on the back of your debit card or on their website. Tell them you have unauthorized transfers on your account and you want to report them under Regulation E. Have your account number ready and be prepared to describe each transfer: the date, the amount, and where the money went if you know it.
Do not wait for your next statement or for the bank to contact you. The two-day clock starts the moment you discover the theft, not when the bank discovers it. If you notice the theft on a Friday evening and the bank is closed, call the fraud line anyway — most banks have 24-hour lines. Leave a detailed message with your account number and the transfers you are reporting. Follow up with a written report the next business day.
Ask the bank representative for a confirmation number and write down the date and time of your call, the name of the person you spoke to, and exactly what you reported. Request written confirmation by email or mail. This documentation protects you if the bank later claims you did not report the theft in time.
What happens during the bank's investigation
Once you report the theft, your bank must investigate within ten business days. During this time, the bank will look at the transfers, check whether they match your usual account activity, and try to determine if they were truly unauthorized. The bank may freeze the account or the suspicious transfers while investigating.
The bank will contact you with questions: Did you share your password? Did you use a public computer? Did you receive any suspicious emails or texts asking for account information? Answer honestly and completely. If you gave someone access to your account — even a family member or roommate — the bank may not treat it as theft, because Regulation E covers unauthorized access, not disputes with people you trusted.
If the bank finds the transfers were unauthorized, it must return your money within ten business days of starting the investigation. Some banks do this faster. If the investigation takes longer than ten days, the bank must return the money temporarily while it continues investigating, then make a final decision within 45 days.
How much money you are protected for depends on when you report
Report within two business days: You lose at most $50. The bank returns everything else.
Report between two and 60 days after your statement shows the unauthorized transfer: You could lose up to $500. The bank returns the rest.
Report more than 60 days after your statement shows the unauthorized transfer: You could lose everything. The bank has no obligation to return any of it.
These limits explore to electronic transfers — ACH transfers, wire transfers, and transfers made through online banking. If someone used your debit card to make a purchase in a store or online, different rules explore. Debit card fraud is covered under a different part of federal law, and your protection depends on whether the card was physically present and whether the thief knew your PIN.
What to do if your bank refuses to return the money
If your bank investigates and decides the transfers were authorized — perhaps because you shared your password or because the transfers match your usual patterns — you can dispute this decision. Ask the bank in writing to explain why it believes you authorized the transfers. Request copies of any evidence it used, such as IP addresses, device information, or login records.
If you still disagree, you can file a complaint with the Consumer Financial Protection Bureau (CFPB), a federal agency that oversees banks. You can file online at consumerfinance.gov or by mail. The CFPB will contact your bank and ask it to respond to your complaint. This does not may provide you will win, but it creates a record and puts pressure on the bank to reconsider.
You can also contact your state's banking regulator or attorney general's office. Each state has an agency that oversees banks licensed in that state. A complaint to the regulator carries more weight than a complaint to the bank itself, because regulators can fine banks or revoke their licenses.
Protecting your account after the theft
Once the theft is reported, change your online banking password when ready — use a password you have never used before and that is not similar to old passwords. If you used the same password on other websites, change those too. Enable two-factor authentication on your bank account if it is available; this means the bank sends you a code by text or email every time someone tries to log in from a new device.
Check your credit report for new accounts opened in your name. You can get a free report from each of the three major credit bureaus — Equifax, Experian, and TransUnion — once per year at annualcreditreport.com. If you see accounts you did not open, contact the bureau and the creditor to report fraud.
Consider placing a fraud alert on your credit file. This tells creditors to contact you before opening new accounts in your name. You can place a fraud alert by contacting any one of the three bureaus; they will notify the other two. A fraud alert lasts one year and is free.
The difference between unauthorized transfers and other kinds of theft
Regulation E protects you from unauthorized electronic transfers, but not all account theft works the same way. If someone stole your debit card and used it to buy something in a store, that is debit card fraud, not an electronic transfer. Your protection is stronger in this case: you lose at most $50 if you report within two business days, and nothing if you report within 60 days, as long as the card was lost or stolen (not given to someone you trusted).
If someone wrote a check on your account without permission, that is check fraud, covered under different rules. If someone hacked your online banking and transferred money to another bank, that is an electronic transfer covered by Regulation E. If someone convinced you to send them money by pretending to be your bank, that is a scam, and you may not be protected because you authorized the transfer — you just did not know who was receiving it.
Ask your bank which rule applies to your specific theft. The rule determines how much protection you have and how quickly you need to report.
Frequently Asked Questions
What if the thief transferred my money to another bank?
Report it to your bank when ready. Your bank will contact the other bank and ask it to freeze the account and return the money. This takes longer than a transfer within the same bank — sometimes two to three weeks — but the money can usually be recovered if you report quickly. The receiving bank is required to cooperate with fraud investigations.
Can my bank close my account after I report fraud?
Yes, banks can close accounts for any reason, including after fraud. However, they cannot close your account as retaliation for reporting fraud to a regulator. If your bank closes your account shortly after you file a complaint with the CFPB or your state regulator, that may be illegal retaliation. Document the timeline and report it to the regulator.
What if I shared my password with someone and they stole money?
Regulation E may not protect you, because the transfer was technically authorized — you gave them access. However, you can still report it as fraud and ask your bank to investigate. Explain that you shared the password for a specific purpose and the person exceeded that permission. Some banks will return the money anyway, especially if the person was not supposed to have access to the full account.
How long does it take to get my money back?
If the bank finds the transfer was unauthorized, it must return your money within ten business days of starting the investigation. If the investigation takes longer, the bank must return the money temporarily while it finishes. In practice, most banks return money within three to five business days if the case is straightforward.
Do I need to file a police report?
No, you do not need a police report to get your money back from the bank. However, filing a police report creates an official record and may help if the thief stole from multiple people. You can file a report online in many jurisdictions or visit your local police station. Give them the same information you gave the bank: dates, amounts, and where the money went.