Regulation E protects you when you use electronic banking
Regulation E is a federal rule that limits how much money you can lose if someone steals your debit card, hacks your online banking, or makes an unauthorized transfer from your account. It does not prevent fraud from happening — it sets the rules for who pays when it does.
The rule comes from the Electronic Funds Transfer Act, a 1978 law that Congress passed because electronic banking was new and people worried about losing everything if their card was stolen. Regulation E is the Federal Reserve's way of spelling out exactly how that protection works in practice.
The core idea is straightforward: your bank has to investigate unauthorized transfers and either return your money or prove the transfer was actually yours. You do not have to fight the bank alone to get your money back.
Key Takeaways
- If you report an unauthorized transfer within two business days, your maximum loss is $50, even if the thief drains your entire account.
- If you wait more than two business days but report it within 60 days, your maximum loss is $500.
- Your bank must investigate and respond to your claim within 10 business days, and return your money while they investigate if the claim is reasonable.
- Regulation E covers debit cards, ATM cards, online banking transfers, and automatic bill payments, but not credit cards or checks.
- You must report the fraud to your bank in writing — a phone call starts the clock, but the bank can ask you to confirm it in writing within 10 days.
The two-day and 60-day windows that determine your loss limit
The speed at which you report fraud directly affects how much of your own money you might have to cover. This is the part of Regulation E that matters most in practice.
If you notice an unauthorized transfer and report it to your bank within two business days of discovering it, your maximum loss is $50. The thief could have emptied your account, but you are only responsible for the first $50. Your bank covers the rest.
If you wait longer than two business days but report it within 60 days of the unauthorized transfer appearing on your statement, your maximum loss jumps to $500. Again, your bank covers anything above that.
If you wait more than 60 days, Regulation E stops protecting you entirely. At that point, you have no legal limit on your loss — you would have to prove the transfer was unauthorized through other means, which is much harder. This is why banks send statements regularly and why you should check your account at least monthly.
What counts as an unauthorized transfer under Regulation E
Regulation E protects you against transfers you did not make and did not authorize anyone else to make. This includes a stolen debit card used at a store, a hacker accessing your online banking, someone using your account number to set up an automatic payment, or a fraudulent wire transfer.
It does not cover transfers you authorized but later regret. If you gave your card to a friend and they spent more than you expected, or you signed up for a subscription and changed your mind, Regulation E does not explore — that was your authorization, even if you did not read the fine print.
It also does not cover losses from a check you wrote, even if someone forged your signature. Checks are covered under a different set of rules called the Uniform Commercial Code, not Regulation E. Credit card fraud is covered under a different federal rule called Regulation Z, which actually gives you stronger protection — your maximum loss is $0 if you report it.
How your bank investigates and what happens to your money while they do
When you report an unauthorized transfer, your bank must start an investigation within one business day. They have 10 business days to finish investigating and tell you what they found. In some cases they can take up to 45 days, but only if they give you a written explanation of why they need more time and return a provisional credit to your account in the meantime.
A provisional credit is temporary money your bank puts back into your account while they investigate. It is not the final decision — it is the bank saying "we believe you, so here is your money back while we figure out what happened." If the bank later determines the transfer was actually authorized, they can take the provisional credit back, but they have to tell you in writing first.
During the investigation, the bank will contact the other bank involved (if the transfer went to another institution), review the transaction details, and ask you for any information you have — like whether you recognize the receiving account or whether your card was lost around that time. You should respond quickly to any requests for information, because delays on your end can slow the investigation.
Regulation E covers electronic transfers, not all payment methods
Regulation E applies to electronic funds transfers — money moved by electronic means. This includes debit card transactions at stores and ATMs, online banking transfers you initiate, automatic bill payments you set up, wire transfers, and transfers through mobile payment apps.
It does not cover paper checks, even if someone forges your signature. It does not cover credit card transactions — those are protected under Regulation Z instead. It does not cover cash you withdraw and lose or give away. It does not cover transfers you make through a service like PayPal or Venmo, though those services have their own fraud policies.
The reason for this distinction is historical: Regulation E was written for electronic banking specifically, because electronic transfers were new and people worried about losing money when ready without a paper trail. Checks had been around for centuries and already had established legal rules.
How to report fraud and protect yourself going forward
Report unauthorized transfers to your bank as soon as you notice them. You can start by calling the customer service number on the back of your debit card or logging into your online banking. A phone call begins the investigation and starts the clock on your protection, but your bank can ask you to confirm the report in writing within 10 days.
When you report, have ready: the date of the unauthorized transfer, the amount, the receiving account or merchant name if you know it, and any details about how the fraud might have happened (lost card, compromised online login, etc.). Write these details down in an email or letter to your bank if they ask you to confirm in writing.
To protect yourself going forward, check your account at least monthly, set up account alerts for large transactions, use a strong password for online banking, do not share your PIN or card number, and report a lost or stolen card when ready. Regulation E protects you, but prevention is faster and less stressful than investigation.
Frequently Asked Questions
What if my bank says the transfer was authorized and I disagree?
You have the right to dispute their decision. Ask your bank for a written explanation of why they concluded the transfer was authorized. If you still disagree, you can file a complaint with the Consumer Financial Protection Bureau or your state banking regulator. Keep copies of all correspondence with your bank.
Does Regulation E protect me if I gave my PIN to someone and they used it?
It depends on whether you authorized that person to use your PIN. If you gave it to them intentionally, the transfer is considered authorized and Regulation E does not protect you. If someone obtained your PIN without your knowledge and used it, that is unauthorized and you are protected.
Can my bank charge me a fee to investigate fraud?
No. Regulation E prohibits banks from charging you a fee to investigate an unauthorized transfer or to issue a provisional credit. If your bank charges you for this, that is a violation of the rule.
What if I report fraud after 60 days but before my bank discovers it on their own?
Regulation E protection ends at 60 days, so you would not have the automatic $500 limit. However, your bank may still investigate and may still return your money — they are just not required to by federal law. It is worth reporting anyway, but do not count on the same level of protection.
Does Regulation E cover transfers I made by mistake to the wrong account?
No. If you entered the wrong account number or sent money to the wrong person intentionally, that is an authorized transfer even though you regret it. Regulation E only covers transfers you did not authorize. You would have to contact the receiving bank and ask them to return the money, which they are not required to do.