When money vanishes from a checking account through a fraudulent debit, an unauthorized ACH pull, or a stolen card number, federal law puts the burden on the bank, not the customer, to make it right, provided the theft is reported in time. The Electronic Fund Transfer Act and its Regulation E give consumers a hard 60-day window, measured from the statement that first shows the transfer, to flag charges they never authorized. Miss that window and the protection erodes quickly; use it, and in most cases the stolen dollars are legally recoverable rather than a loss the accountholder simply has to absorb.
The 60-day clock and what it protects
The window is tied to the statement, not to the moment the fraud occurred. A consumer has 60 days from the date the bank sends the periodic statement showing an unauthorized transfer to report it, and reporting inside that window preserves the strongest protections the law offers. The rule exists precisely because thieves count on charges going unnoticed for months, so the clock rewards accountholders who read their statements.
The dollar exposure depends on how fast the loss is flagged. Under the liability limits in Regulation E’s consumer-liability rule, someone who reports a lost or stolen card or access device within two business days of learning of it can be held responsible for no more than $50; wait longer and that ceiling rises to as much as $500. Let the 60 days lapse entirely and the protection thins further, leaving the customer potentially liable for additional transfers that a timely report would have stopped.
For a different, common scenario, the account number is stolen but the physical card is not, the math is often better still. Because no access device was lost, an accountholder who spots the unauthorized transfer on a statement and reports it within 60 days generally faces no liability at all. The full framework for these transactions sits in the federal rule implementing the Electronic Fund Transfer Act, which covers debit cards, ATM withdrawals, ACH debits, and online transfers alike.
The protection reaches a wide range of everyday transactions. A card skimmed at a gas pump, an account number lifted in a data breach, a recurring subscription a scammer sets up, or a withdrawal made with a cloned ATM card all fall under the same rule, because each is an electronic transfer the accountholder never approved. The label on the charge matters far less than the two facts the law cares about: the customer did not authorize it, and the customer received nothing of value in return.
Free retirement updates: Enrollment and claim windows come and go, and missing one can cost real money. The free Retirement Shield newsletter keeps readers ahead of the deadlines that matter. Sign up free.
How the dispute and refund process works
Once a customer notifies the bank, the institution cannot simply stall. The error-resolution steps in Regulation E’s investigation rule generally give the bank ten business days to look into a reported error and either resolve it or take a specific alternative. Notice can be given orally, though banks may ask for written confirmation, and the reported error triggers the timeline whether or not the customer has all the details.
If the investigation needs longer, the money does not have to sit frozen. The rule lets a bank extend its review to as many as 45 days, but only if it issues provisional credit for the disputed amount within the initial period, putting the funds back in the account while the matter is examined. That provisional-credit mechanism is what turns the 60-day right from a paper promise into cash a household can use during the dispute.
What counts as unauthorized is narrower than it sounds. The protection covers transfers a consumer did not authorize and received no benefit from, the classic case of a thief using stolen credentials. It does not cover a transfer the accountholder was tricked into approving personally, a distinction that becomes the sticking point in many of today’s scams.
Reporting promptly also shields transfers that have not happened yet. Flagging a lost card or a compromised account quickly caps the damage from any charges the thief tries next, because the bank can freeze the card and issue a new number before more money moves. A delay does the opposite, widening the window in which additional unauthorized transfers can accumulate, and it is exactly those later transfers for which a slow-to-report customer can end up on the hook.
Where the protection is thin, and how to keep the window open
The gap that catches the most people involves payments the victim technically authorized. When a scammer talks someone into sending money through a service like Zelle, banks frequently deny the claim on the ground that the customer initiated the transfer, even though it was obtained by deception. The 60-day refund right is powerful against outright theft of account access and far weaker against fraud that persuades the accountholder to hit send.
Keeping the protection intact comes down to habit. Reviewing each statement promptly, reporting anything unfamiliar the same day, and following up in writing all preserve the strongest position, and the bureau’s explainer on what to do about a checking-account error walks through the exact steps. Waiting for a paper statement to arrive can burn precious days that a quick online check would save.
The 60-day clock is one of the most valuable rights in consumer banking and among the least invoked, because many accountholders assume a stolen debit is simply their bad luck. It is not: for genuine unauthorized transfers, the law treats the loss as the bank’s to reverse, and the only real prerequisite is catching it before the window closes.
This article was produced with AI assistance and reviewed against primary sources by The Money Overview editorial team.
More Financial Reading
