How bank fraud reimbursement works in a checking account

Your bank's fraud reimbursement policy is a set of rules that determines whether the bank will return money stolen from your checking account and under what conditions. The policy is not optional—federal law requires banks to reimburse you for unauthorized transactions, but the details of what counts as unauthorized, how long you have to report it, and what you must do to get your money back vary by bank and by the type of fraud.

The core principle is this: if someone else moved money from your account without your permission, the bank is responsible for returning it. But "without your permission" has a specific meaning in banking law, and the bank's policy document will define exactly what that means for your account. The difference between a policy that covers you well and one that leaves you exposed often comes down to the details in that document—details most people never read until after fraud happens.

Key Takeaways

  • Your bank's fraud policy is a contract that specifies the dollar limit of reimbursement, the window for reporting, and what counts as your responsibility versus the bank's.
  • Federal law (Regulation E) requires reimbursement for unauthorized electronic transfers, but the bank's policy may be more restrictive than the law allows.
  • The difference between reporting fraud in two days versus 30 days can determine whether you get your full balance back or lose part of it.
  • Your bank's policy document is usually available online or by request, and reading it before fraud happens means you know exactly what to do if it does.

Where to find your bank's actual fraud reimbursement policy

Your bank publishes its fraud reimbursement policy in a document called the Regulation E Disclosure or Electronic Funds Transfer Agreement. This is a legal document the bank must give you when you open the account, and it must be available on the bank's website or by request. Do not confuse this with the general terms and conditions—the fraud policy is usually a separate document that focuses specifically on unauthorized transfers.

To find it, go to your bank's website and look for "disclosures," "legal documents," or "account agreements." If you cannot find it online, call the customer service number on the back of your debit card and ask for the Regulation E Disclosure for your checking account. Write down the date you request it and who you spoke with. The bank must provide it within a few business days. If you opened the account in person, you may have received a printed copy—check the paperwork that came with your debit card.

Once you have the document, look for sections titled "Your Liability," "Unauthorized Transfers," "Error Resolution," or "Fraud." These sections will tell you the specific rules for your account. Different banks have different policies, and even different account types at the same bank may have different rules.

The reporting window: why the first two days matter

Federal law divides fraud reporting into two time periods, and your bank's policy will specify which applies to you. The first period is two business days from the day you discover the fraud. If you report within this window, your liability is capped at $50, meaning the bank covers everything above that. If you report after two business days but within 60 calendar days, your liability jumps to $500—you lose the first $500 and the bank covers the rest. If you wait longer than 60 days, you may lose everything.

This is why the exact wording in your bank's policy matters. Some banks define "discovery" as the moment you see the transaction on your statement. Others define it as the moment you should have seen it—which could be earlier if you have online access. A policy that says "discovery means the date the transaction posted" is clearer and more favorable to you than one that says "discovery means when you reasonably should have known." Read this section carefully and note the exact language.

The two-day window applies only to electronic transfers—ACH transfers, wire transfers, debit card transactions, and online bill payments. Check fraud and cash withdrawals have different rules and longer windows. Your policy document should spell out which types of fraud fall into which category.

What counts as unauthorized versus what is your responsibility

This is where bank policies diverge most sharply. Federal law says a transaction is unauthorized if you did not initiate it and did not knowingly allow someone else to initiate it. But your bank's policy may narrow this definition or add conditions that shift responsibility to you.

For example: if someone uses your debit card number to make a purchase online, that is clearly unauthorized and the bank must reimburse you. But if you gave your card number to a merchant and that merchant charged you twice—once intentionally, once by error—the bank may argue the second charge was authorized because you gave permission to charge your card. Your policy document should clarify whether the bank covers duplicate charges, charges from merchants you did not recognize, or charges in amounts you did not approve.

Similarly, if someone with access to your online banking password transfers money out of your account, the bank may argue you were responsible for protecting your password and therefore the transfer was authorized. Some banks' policies explicitly state this; others do not. A good policy will say the bank covers unauthorized transfers even if someone had your password, as long as you reported it within the time window. A weak policy may say you are liable if your password was compromised due to your negligence.

Check your policy for language about shared accounts, authorized users, and family members. If your spouse or adult child has access to your account, the bank may not cover transfers they make, even if you did not authorize that specific transfer. This is a common source of disputes.

Reimbursement limits and what happens to your account balance

Your bank's policy will state a maximum dollar amount the bank will reimburse for fraud in a single incident or over a set period. Federal law does not set a cap—the bank can reimburse you for the full amount—but individual banks may set their own limits. Read this section carefully. Some banks reimburse up to the full balance; others cap reimbursement at $10,000 or $25,000 per incident.

Also check what happens to your account during the investigation. When you report fraud, the bank will investigate, which typically takes 10 business days. During this time, your account balance may show the fraudulent transaction still deducted. Some banks will provisionally credit your account while they investigate; others will not. Your policy should state whether you have access to the disputed funds during the investigation period. If the bank does not provisionally credit you and you have bills due, you could face overdraft fees or missed payments while waiting for the investigation to close.

Ask your bank specifically: if I report fraud on a Monday, will the money be back in my account by Friday, or will I have to wait for the full investigation? The policy document may not answer this directly, so you may need to ask customer service. Write down the answer and keep it with your policy document.

What you must do to get reimbursed

Your bank's policy will list specific steps you must take to be reimbursed. Typically, you must: (1) report the fraud to the bank in writing or by phone within the time window, (2) provide a written statement describing the fraud, (3) sign an affidavit swearing the transaction was unauthorized, and (4) cooperate with the bank's investigation. Some banks require you to file a police report as well.

The policy will specify which method of reporting starts the clock. If the policy says "reporting by phone does not start the investigation period," you must follow up with written notice. If it says "written notice only," calling customer service does not count. This distinction can cost you days. Read this section and note exactly what counts as valid notice.

Keep records of every communication with the bank about the fraud. Write down the date, time, name of the person you spoke with, and what was discussed. If you report by phone, follow up with an email or letter restating what you reported. This creates a paper trail that protects you if the bank later claims you did not report the fraud in time.

Comparing policies across banks before you need one

If you are choosing a bank or considering switching, compare the fraud policies of the banks you are considering. Look for these specific features: a short reporting window with clear language about what counts as discovery, no cap on reimbursement or a high cap, provisional credit during the investigation period, and clear language that shifts liability to the bank rather than to you for most types of fraud.

A bank that offers provisional credit within one business day is better than one that makes you wait 10 days. A bank that reimburses you for the full amount is better than one with a $10,000 cap. A bank that covers unauthorized transfers even if someone had your password is better than one that does not. These differences matter most when fraud actually happens.

You can also ask your bank whether it participates in Zelle, Venmo, or other peer-to-peer payment networks, and what the fraud policy is for those transfers. Transfers through these networks sometimes have different rules than standard ACH transfers, and the reimbursement policy may be more restrictive.

Frequently Asked Questions

What if my bank's policy is less protective than federal law?

Federal law sets a floor, not a ceiling. Your bank cannot offer less protection than the law requires, but it can offer more. If your bank's policy is weaker than Regulation E, the law overrides it. However, you will have to argue this with the bank, and it is easier if you choose a bank with a strong policy from the start.

Does my bank have to reimburse me if I shared my password with someone?

It depends on your bank's policy. Federal law says you are liable only if you were negligent in protecting your password. Sharing your password with a family member or trusted person is not necessarily negligence. But your bank's policy may define it differently. Read your policy's section on password responsibility before you share access with anyone.

What if the fraudster is someone I know?

The bank's obligation to reimburse you does not change based on who committed the fraud. However, the bank may ask you to pursue civil action against the person first, or to file a police report. Your policy should state whether the bank will reimburse you while you pursue other remedies. If a family member committed the fraud, the bank may be slower to reimburse because the transaction may be harder to prove was unauthorized.

How long does it actually take to get my money back?

Federal law requires the bank to complete its investigation within 10 business days and reimburse you if the fraud is confirmed. In practice, many banks reimburse within 3 to 5 business days if the case is straightforward. Complex cases can take longer. Your bank's policy should state the timeline; if it does not, ask customer service for a written estimate.

What if my bank denies my fraud claim?

You have the right to dispute the bank's decision. Your policy should include instructions for filing a complaint with the bank's dispute resolution department. If the bank still denies your claim, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) or your state's banking regulator. Keep all documentation of your dispute and the bank's responses.